COVER:
A heat-sensitive DOE photograph of Three Mile Island taken on the eighth day of the accident. Yellow areas
are at a higher temperature.

Available fromGPO Sales Program
Division of Technical Information and Document Control
U.S. Nuclear Regulatory Commission
Washington, D.C. 20555
andNational Technical Information Service
Springfield, Virginia 22161

II
three
mile
islandVOLUMEPart 2

A REPORT TO THE
COMMISSIONERSAND TO THE
PUBLICMITCHELL ROGOVIN
director

GEORGE T. FRAMPTON, JR.
deputy director
NUCLEAR REGULATORY COMMISSION

SPECIAL INQUIRY GROUPAVAILABILITY OF
REFERENCES
The documents cited in this volume are primarilyof four types:

The NRC documents cited in this volume that areavailable in the PDR consist of the following:

1. NRC-originated material or material presented toor developed for the NRC
2. Material developed by or for other Federal andState bodies
3. Open literature publications consisting of copyrighted books, magazine articles, newspaper clippings, national and society standards, and othersociety publications (transactions, conference
proceedings, reports, etc.)
4. Publications of the United Nations

1.

2.
3.
4.
5.
6.

The NRC-originated material and that presented
to or developed for the NRC has been placed in the
NRC Public Document Room (PDR) at 1717 H Street,
N.W., Washington, DC. It is available for inspection
and for copying for a fee. Orders may be placed inperson, by mail or by telephone. Both paper copy
and microfiche can be purchased. Paper copy is 8
cents per page for standard size paper (8 X 11 /2
inches) and 11 cents per page for larger size paper(drawings and foldouts). Microfiche copies are 25
cents per diazo duplicate. A minimum charge of$2.00 plus postage is made for mail orders. Whenordering by telephone or mail, acknowledge a willingness to assume charges for all orders but do notsend payment. Orders will be processed andmailed with a bill from the PDR contractor for thisservice. The telephone is (202) 634-3274 and theaddress is
NRC Public Document Room

7.
8.

9.
10.

11.
12.
13.
14.

1717 H Street, N.W.
Washington, DC 20555

III

Dispositions (both those taken by the
President's Commission and those taken by
the Special Inquiry Group. These are indicated by name and page number.)
Memorandums and letters (internal, external
and those received by NRC and others)
Interviews (These are indicated by name andpage number.)
Regulatory Guides
Standard Review Plan (NUREG-75/087)
Technical Specifications (generic or docket
specific)
SECY papers (NRC staff papers for Commission consideration)
Commission Issuances (labeled, for example,
4 AEC 768, 6 NRC 1218, where "4" is thevolume number, "AEC" indicates pre 1975
issuances, "NRC" is post 1975, and "768" isthe page number. These issuances present
Commission opinions and decisions.)
ACRS transcripts and reports (Advisory Committee on Reactor Safety)
Docket material (for example, Docket 50-320
i s Three Mile Island 2. A Docket 50 file contains all materials pertinent to a specificpowerplant.)
Branch technical positions (from Office of
Nuclear Reactor Regulation)
NRC contracts (for example, NRC-05-77-044)
NRC Inspection and Enforcement Manual
Commissioner speeches

15.
16.
17.
18.
19.
20.
21.
22.
23.
24.
25.
26.
27.
28.

Public Announcements
Board Notifications (to ASLB and participantsin proceedings)
Transcripts of Operating License Hearings (inDocket Files)
Operating licenses and amendments (inDocket files)
NRC Management Directives (that is, Manual
Chapters)
Transcripts of NRC Commission meetings
Proceedings of Atomic Safety and Licensing
BoardsI E Circulars and Preliminary Notifications (PN)
Vendor and licensee topical reports (for example, B&W, Met Ed, and GPU reports)
NRC Inspection Reports
Meeting summaries
Plant logs, charts, data
Reference foreign documents
NUREG and NUREG/CR series reports

Congressional hearings
General Accounting Office (GAO) reports
Senate reports (S. Rep.)
Congressional Reports (Cong. Rep.)
House reports (H. Rep.)
ERDA reports
DOE reports
Federal Energy Regulatory Commission (FERC)
Dockets
I nternal Revenue Service Ruling and Bulletins(corn. Bul and Rev. Rul.)
Military Specifications (Mil.' Spec.)
HEW reports
National Academy of Science reports
National Council on Radiation Protection( NCRP) reports
National Laboratory Reports (Savannah River
Laboratory, Lawrence Livermore Laboratory)
EPA Manual of Protective Action Guides
Federal Response Plan for Peacetime
Nuclear Emergencies
Federal Aviation Administration
U.S. Department of LaborWASH reports (WASH-1400 and others)

Some formal NRC reports, which are listed as
NUREG-XXXX or NUREG/CR-XXXX, may be purchased over the counter at the PDR. Reports notavailable at the PDR and NRC Regulatory Guides
are best obtained by those who have deposit
accounts with the Superintendent of Documents,
U.S. Government Printing Office, by calling (301)492-7333 or writing:
Attn:

State
D.C. Circuit Court (D.C. Cir.)
Pennsylvania Consolidated Statutes(Penn. Consol. Stat.)
Pennsylvania Supreme Court (Pa. Super. Ct.)
Pennsylvania Public Utilities Commission(PaPUC) hearings and proceedings
New Jersey Board of Public Utility
Commissioners
Pennsylvania-New Jersey-Maryland (PJM)
I nterconnection Agreement
Ohio Public Utilities Commission(Ohio PUC) hearings
Ohio Statutes (Ohio St.)
Pennsylvania Emergency Management Agency

Publications Sales Manager
Division of Technical Information andDocument Control
U.S. Nuclear Regulatory Commission
Washington, DC 20555

These documents may also be purchased fromthe National Technical Information Service (NTIS).
Either write to NTIS or call the Sales Desk at (703)557-4650. The address is
National Technical Information Service
Springfield, Va. 22161
The material developed by or for other Federal orState bodies is available from the organization citedor, in the case of reports prepared by other Federal
agencies, the documents are available for purchasefrom the U.S. Government Printing Office, theNational Technical Information Service, or the PublicDocument Room of the particular agency. The
documents cited in this volume that fall in thiscategory are the following:

The open literature publications cited may beavailable in public libraries and are, of course, available from the publisher. Documents of this type arealways copyrighted. Those cited in this volume include newspapers, books, journals, national and industry standards, and association and society transactions and reports.
The publications of the United Nations are available from that organization.

FederalActs of Congress (Public Laws)
Federal Registeriv

CONTENTS
Availability of References
Outline of Volume 11, Parts, 1, 2, and 3

ix

The Accident and Its Analysis

307

11.

A. Sequence of Physical Events

309

EL Radiological Releases and Their Effects341

1. I ntroduction and Background341

2. Release Pathways and Mechanisms

344

a. Principal Findings and Recommendations
b. Technical Backgrounda. Preaccident Backgroundb. Radwaste System Status at the Time of the Accident
c. Liquid Release Pathways
d. Transport of Radioactive Materials out of Containment
e. Gaseous Release Pathways
f . Source Terms for Releases of Radioactive Materials
g. Mitigation of Releases of Radioactive Materials
h. Recovery Operations
i . Summary of Findings and Recommendations for Section I I.B.2

3. Environmental Monitoring

341
342

344

348
350
351
352
355
360
364
366
368

369
a. Offsite Radiological Environment Monitoring Program (Preaccident)
b. Augmented Radiological Monitoring Program (Postaccident, March 28 to369
April 15, 1979)
c. Summary of Results of Portable Survey Instrument and Aircraft
383
Monitoring389
d. Summary of Radiological Environmental Sampling Results
390
e. Summary of TLD Data
395
f . Findings and Recommendationsv

4. Estimates of Doses and Potential Health Consequences of Releases ofRadioactive Materials395

5. Radiation Protection Program

408

a. Population Dose Assessmentb. Maximum Individual Offsite Dosec. Internal Dose Assessmentd. Skin Dose Assessmente. Occupational Exposure
f . Health Effects of Low Level Ionizing Radiationg. Radiation Doses Due to Natural Background and Medical Practiceh. Cancer Incidence and Mortality in the United Statesi . Summary of Health Effects

a. The Regulatory Frameworkb. Implementation and Weaknesses of the Radiation Protection Programc. The Responsibility of the Utility and NRC

395
399
400
400
401
401
405
406
407
408
409
432

Plant Behavior and Core Damage447

1. Deficiencies in the Plant and Their Influence on the Accident

447

2. Core Damage and Recovery

487

447
a. Introduction and Summaryb. Possible Deficiencies Related to the Primary System
448
461
c. Possible Deficiencies Related to the Engineered Safety Features
d. Possible Deficiencies Related to the Secondary Coolant System467
e. Environmental Qualifications and Use of Instrumentation and Plant Data 472
a. Data Analysis for the First 16 Hours
b. Interpretations of Accident Sequencec. Core Damage Estimates from Fission Product Released. Hydrogen Production, Removal, and Hazard
e. How Close to a Meltdown?

487
506
524
527
535

Alternative Accident Sequences551

1. Amelioration of Fuel Damage551

2. Analysis of Alternative Accident Sequencesa. Introduction and Summaryb. Alternative Accident Sequence 1 : High-Pressure Injection System
Allowed to Operate at Full Flow Ratesc. Alternative Accident Sequence 2: HPI System Operated at Full Flow

553
553
558

561
Rates and Emergency Feedwater Delivered at 1 Hour
561
d. Alternative Accident Sequence 3: EFW Delivered at 40 Seconds
e. Alternative Accident Sequence 4: EFW Delivered at 1 Hour, HPI System561
i n Degraded Modef . Alternative Accident Sequence 5: PORV Block Valve Closure at 25
562
Minutesg. Alternative Accident Sequence 6: PORV Block Valve Closure at 3.3
563
Hours
h. Alternative Accident Sequence 7: One Reactor Coolant Pump Per Loop
564
Tripped at 73 Minutes
i . Alternative Accident Sequence 8: All Reactor Coolant Pumps Tripped
565
Concurrent with Reactor Tripvi

j . Alternative Accident Sequence 9: PORV Block Valve Remains Closed
After 2.3 Hours, No Reactor Coolant Pump Restart at 2.9 Hours, No

567
High Pressure Injection Actuation at 3.3 Hours
k. Alternative Accident Sequence 10: No Reactor Coolant Pump Restart at
567
2.9 Hours, No HPI Actuation at 3.3 Hours
1 . Alternative Accident Sequence 11: No Reactor Coolant Pump Restart at567
16 Hours
m. Alternative Accident Sequence 12: Loss of Offsite Power at 1/2 to 5'/z
568
Hours
n. Alternative Accident Sequence 13: Loss of Offsite Power During March
30 to April 1
o. Alternative Accident Sequence 14: Recriticality
p. Alternative Accident Sequence 15: Effect of Containment Design

E.

568
569

Human Factors

573

1. Introduction573

2. Human Factors and the TM 1-2 Accident

573

3. Control Room Design581

4. Emergency Procedures

596

581
583
593

a. Requirements and Criteria
b. The TM 1-2 Control Roomc. Control Rooms at Other Plants

597

5. Operating Selection and Training

606

6. Human Factors Precursors

612

7. Recommendations

F.

568

Environmental And Socioeconomic Impacts

619

1. Introduction619

3. Information Flow During the Emergency620

2. Background620

4. Public Responses

622

a.
b.
c.
d.

Evacuation
Credibility of Information
Levels of Public Concern During Emergency Period
Continuing Effects

624
630
630
:... 632

5. Economic Effects633

6. Effects on Local Government and Institutions

640

a. Backgroundb. Emergency Periodc. Postemergency Perioda. Backgroundb. Emergency Periodc. Postemergency Period

vii

633
633
639

640
640
642

7. Effects on Aquatic Biota and Fisheries

643

8. Longer Term Social and Economic Effects644

a. Backgroundb. Thermal and Chemical Dischargesc. Consequences

9. Findings and Recommendations

643
643
643
644

Appendices11.1

I ntroduction to Sequence of Events

647

11.2 Carbon Performance with Time

1 1.3 Radiological Environmental Monitoring Program for Three Mile Island
Station
11.4 Offsite Radiological Monitoring Activities of DOE Organization

11.5 Atmospheric Release Advisory Capability (ARAC) Utilization During the
TMI Accident
11.6 Radiological Chronology of Events
1 1.7 Calculation of Leaching from Reactor Fuel

705
711

715
721
725

11.8 TMIBOIL Calculations of Core Damage at 3 Hours

737
741

11.10 Analysis and Calculations by and for Sandia Laboratories

763

11.9 Hydrogen Calculations

viii

757

OUTLINE OF VOLUME II
PARTS 1,2,AND3

Part 1
Foreword
I. Preaccident Licensing and Regulation Background
A. Licensing and Regulation of Nuclear Powerplants
B. Licensing and Operating Histories
C. Precursor Events
D. Pressurizer Design andCase Study.
E. Incentives to Declare Commercial Operation
Part 2
M. The Accident and Its Analysis
A. Accident Chronology (Narrative Sequence of Events)
B. Radiological Releases
C. Plant Behavior and Core Damage
D. Alternative Accident Sequences
E. Human Factors
F. Environmental and Socioeconomic Impacts
Part 3
HI. Response to the Accident
A. Utility Response
B. NRC Response
C. Response of State and Federal Agencies (Except NRC)
D. News Media Interface at Three Mile Island

ix

IV.

Safety Management Factors Germane to the Accident
1.

I ntroduction

3.

NRC Safety Policy

2.
4.

5.
6.
7.
8.

9.

Statutory Considerations
Safety Planning

Requirements and Enforcement
Safety Tasks

Organization for Safety

Conclusions and Recommendations
Epilogue

V.

List of Depositions Taken

VI.

Comparison of the Special Inquiry Group Recommendations Contained inVolume I with Those of the President's Commission and the NRR-NRC
Lessons Learned Task Force
I ntroduction

I dentification of Recommendations by Subject Area
Recommendations
Findings and Recommendations in Volume II
Index

x

II. THE ACCIDENT
AND ITS ANALYSIS

A SEQUENCE OF
PHYSICAL EVENTSThe following narrative of the sequence of physical events in the accident at Three Mile Island isbased on information from several sources: plantcomputer output, automatically recorded data, log
entries, and operators' statements. For a moredetailed description of this sequence of events,
along with references to the original data sources,
the reader should consult Appendix 11.1.
In addition to factual material, the text contains
many explanatory and interpretive statements.
Inferences, interpretations, explanations, and opinions have been set off by brackets [ ]. In manycases, the physical data could support alternativeinterpretations. Wherever more than one interpretation of the data is possible, the choice of interpretations that is presented has been based on plausibility, normal practice, or consensus of experts. It
should be understood, however, that this interpretation is not the only possible one. In many cases, it
may never be possible to establish exactly what
happened.
No references are provided in this section. All
events described here have been referenced in the
more detailed description of the sequence of eventsin Appendix 11.1. In the text that follows, references
are made to other sections of the report. Moredetailed explanations can be found in those sections.
Some events described in this section are also
covered in Section II.E. The decision as to whether

an event should be covered in both was made on
the basis of the event's probable or possible effecton subsequent actions of the control room operators.
March 28,1979-4:00 a.m.
At 4:00 a.m. on March 28, 1979, TMI-2 wasoperating at between 97% and 98% full power. The
shift foreman and two auxiliary operators had beenworking in the auxiliary building on the No. 7 condensate polisher. Two licensed control room operators were on duty in the control room. The shift superintendent was in his office adjacent to the control room.
The condensate polishers use ion exchange
resins for purification of the feedwater (Figure II-1).
During operation, flow through the resin bed tends
to compact the material into a rather solid mass. To
transfer the resin beads to the resin regeneration
system, it is necessary to break up this mass by
blowing compressed air through it. [Apparently,
during the process of air-fluffing, water entered an
instrument air line through a check valve that had
frozen in the open position.]
It has been postulated that the water in the air
piping caused the polisher inlet or outlet valves, orboth, to close.' [Problems with the valves in the309

FIGURE II-1. The Condensate and Feedwater System
Under normal conditions, exhaust steam from the turbine is condensed in the condenser.
Condensate (water) is pumped by the condensate pumps through the condensate polisher,where it is purified. The pressure is raised by the condensate booster pumps, and thetemperature is increased in the low pressure feedwater heaters. The water is then pumpedby the feedwater pumps through the high pressure feedwater heaters to the steam
generators. The polisher bypass valve can be opened so that water flows directly from thecondensate pumps to the condensate booster pumps. When the hotwell level is high,water flows through the reject valve to the condensate storage tank; this allows morewater to leave the hotwell than is entering from the condenser. When the hotwell level islow, the makeup valve is opened and water is returned from the condensate water storagetank to the hotwell. The condenser and hotwell are always under vacuum. At the
beginning of the accident, the inlet and outlet valves of the condensate polisher
accidentally closed. The bypass valve would not open because of a control fault; thisprobably caused the condensate booster pumps to trip, followed by trip of one
condensate pump and both steam generator feed pumps. A severe "water hammer"
damaged the controls of valve CO-V57 and the reject valve so that condenser hotwell level
could not be controlled.
There is no radioactivity associated with the condensate and feedwater systems nor are
they unique to nuclear powerplants. The condensate and feedwater systems offossil-fueled plants are very similar to those at TMI.

310

polisher system are discussed in Section II.C.1.d.]
Closure of either the inlet or outlet valves would interrupt the flow of feedwater and cause the condensate pumps and condensate booster pumps to trip,that is, to be automatically shut down. Tripping ofthese pumps causes tripping of the main feedwater
pumps, which in turn, causes tripping of the main
turbine and electrical generator.
I n the accident at TMI-2, it has not been definitelydetermined what caused the condensate pump to
trip, although it is a reasonable inference that theoperations on the polisher were somehow involved.
It has been established that condensate pump 1Atripped and that both main feedwater pumps thentripped almost simultaneously. Approximately 1
second later, the turbine and generator tripped.
The three emergency feedwater pumps (twoelectric-driven and one steam-driven) started automatically within 1 second after the main feedwater
pumps tripped. The purpose of the emergency
feedwater pumps is to ensure a continuing supply ofwater to the steam generators (OTSG) when themain feedwater pumps are not working. Water fromthe emergency feedwater pumps is not normallydelivered to the steam generators immediately after
the main pumps cease to operate. The automatic
valves (EF-V11A and EF-V11B, Figure 11-2) will notopen until two conditions have been met: (a) the
emergency pumps are delivering their normal
discharge pressure (at least 875 psig) and (b) thewater level in the steam generators has sunk to 30
i nches or less.
In addition to the automatic valves, there areblock valves 2 (EF-V12A and EF-V12B) in the lines tothe steam generators. These valves are required to
be open while the plant is operating. At the time of
the accident, however, the block valves wereclosed. The closed indication of these valves, which
was shown on an indicator light in the control room,
was not noticed by the operators.
The reactor is not automatically shut down whenturbine trip occurs. [The desirability of an automatic
shutdown feature is discussed in Section II.C.1.b.]
3
The integrated control system (ICS) decreases, butdoes not shut off, the reactor power. On loss offeedwater followed by turbine trip, the energy removed from the steam generators was less than theenergy added by the reactor, and the pressure in
the reactor coolant system (RCS) increased. The
pressure increase began immediately.
To protect the RCS from excessive pressure, apilot-operated relief valve (PORV) and two safetyvalves are provided. Three seconds after turbine
trip, the pressure in the RCS had increased to thepoint (2255 psig) at which the PORV opened. The
reactor was still delivering power, and pressure

continued to rise, although not as rapidly. Eightseconds after the turbine trip, the pressure hadreached the point (2355 psig) at which the reactor
is automatically shut down.
During the time that these automatic functions
were taking place, the operators took the following
actions:

1. Checked the turbine throttle and governor valves
for closure. (The operators found that one throttle
valve meter did not show closure. Closure of thegovernor valves, which shuts off steam to theturbine, however, was shown.)
2. Switched the pressurizer from manual to automatic control. (The pressurizer had previously
been manually controlled to equalize boron concentrations between the pressurizer and thereactor.)
3. Verified opening of the turbine bypass valves.
4. Set the generator circuit breakers in the lockedout position.
5. Manually tripped the turbine to make sure all trip
functions operated.

Immediately after the reactor trip, the operators
confirmed insertion of all control and safety rods. It
was definitely known that the reactor was now shut
down. Nuclear fission quickly stops when the control rods are inserted. The products of the fission
reaction, however, are themselves radioactive andcontinue to decay after the reactor is shut down.
The power produced in this radioactive decay iscalled decay heat. Immediately after shutdown, thedecay heat is about 160 MW. Dropping very rapidly
at first, the decay heat is approximately 33 MW
about 1 hour after the reactor is shut down. Tenhours after shutdown, it is about 15 MW. After that,the decay heat decreases more slowly.
The reactor coolant expands when heated andcontracts when cooled. The excess energy
delivered by the reactor causes the coolant to expand until the reactor trips. After the reactor trips,
the excess energy removed by the steam generators causes cooldown and contraction of thecoolant. Volume changes in the coolant are reflected in changes of pressurizer level.
When the system is operating, water is continuously removed from the RCS via a drain called theletdown system, is purified, has boric acid added or
removed, and is returned to the RCS through the
makeup pumps (Figure 11-3). In normal operation,
makeup slightly exceeds letdown so that small
losses from the system through the normal leakage
are replaced. Before the accident, leakage washigher than usual, because a code safety valve, or
possibly the PORV, was leaking. [Additional discus-

311

FIGURE 11-2. The Emergency Feedwater System
Three emergency feedwater pumps (two electric, one steam driven) are started
automatically on loss of the main feedwater pumps (Figure II-1). The emergency
feedwater pumps take suction from the condensate storage tank; in an emergency, they
can also take suction directly from river water. The automatic control valves will open (a)when the discharge pressure of the emergency feedwater pumps is high enough and (b)when the water level in the steam generators falls to 30 inches or less. Until bothconditions are satisfied, the control valves remain closed. The block valves should havebeen open at all times; however, at the time of the accident these valves were closed.
When the conditions were met, the control valves slowly opened, but no water was
admitted to the steam generators because the block valves were still closed. About 8
minutes after the start of the accident, the operator discovered that the block valves wereclosed, and opened them. This admitted water to the steam generators.
The block valves can be operated by switches in the control room, by switches in theauxiliary building, and manually at the valves. It is not known from which point nor
when the valves were closed.

312

FIGURE 11-3. The Makeup and Letdown System

During normal operation, water is removed from the reactor coolant system (RCS) near
the suction of the reactor coolant pump (RCP-1A). The water removed is purified andcooled and can be sent either to the reactor coolant bleed tanks or to the makeup tank.
At least one makeup pump is always operating; this supplies water to the reactor coolant
pump seals. A small amount of the seal water leaks out and is returned to the makeup
tank through the seal return system; the remainder enters the RCS. Any additional waterrequired to maintain the correct inventory in the RCS is regulated by valve MU-V17 andenters the discharge line of RCP-1A. In the high pressure injection mode (when theengineered safeguards are actuated), two makeup pumps (normally IA and 1C) takewater directly from the borated water storage tank, and pump through valves MU-V16A,
16B, and 16D-which are wide open-to all four RCS cold legs. Letdown is stopped
during engineered safeguards operation.
When the pressurizer is in the "automatic" mode, valve MU-V17 is controlled bypressurizer level.

313

sion of plant operation with leaking valves can befound in Section II.C.1.b.] Leakage from the PORV
went to the reactor coolant drain tank (RCDT)
where it was condensed and was then pumped to
the reactor coolant bleed tanks. The buildup of water in the bleed tanks was then being transferredperiodically to the makeup tank.
If not compensated for, the expected shrinkageof reactor coolant on cooldown could cause an excessive change of volume. To reduce the rate ofvolume change, therefore, letdown is stopped andmakeup is increased. Thirteen seconds after theturbine trip, the operator stopped letdown. He also
attempted unsuccessfully to start a second makeup
pump. This operator has testified that the pump did
not start because the switch was not held in position long enough. The pump was started later, however, by another operator. (The operation of the
makeup pump is discussed further in Section
II. C.1.c, in which it is concluded that only momentary
switch contact is required to start the makeup
pumps.)
Thirteen seconds after turbine trip, pressure had
lowered to the point (2205 psig) at which the PORV
is designed to close. An indicator light in the control
room shows when the valve has been ordered toclose-that is, when power to the valve opening
solenoid is cut off-but does not show when thevalve actually closes. It is now known that the valve
did not, in fact, close as it was designed to do. The
operators, however, had no direct means of knowing this.
Fifteen seconds after turbine trip, the pressurizer
l evel reached a maximum of 255 inches (from an
operating level of about 220 inches). Contraction of
the coolant then caused a rapid drop in pressure, as
was expected. [The operators expected to reduce
the amount of contraction by adjusting makeup andl etdown flows.] [By 28 seconds after turbine trip,
the two conditions for admission of emergency
feedwater to the steam generators had been met,
and the automatic valves should have begun to
open. Because the block valves were closed, ofcourse, no water could be admitted to the steam
generators even with the automatic valves open. It
appeared to the operator that the automatic valves
were opening at an unusually slow rate, and theslow opening of these valves was initially attributed
to the delay in feeding the steam generators.]
Thirty seconds after turbine trip, an alarm of high
PORV outlet temperature was received on the alarm
printer in the control room. This alarm was notprinted out until several minutes later, because thealarm printer, which was receiving over 100 alarms
per minute at the time, was overloaded. Such an
314

alarm does appear on an annunciator; however, theannunciator is not readily visible from the normal
operating location. [The high temperature alarm did
not show that the valve was still open; the momentary opening known to have occurred previously,plus the known leakage, would have accounted forthis alarm.]
By 30 seconds after turbine trip, the contractionof the reactor coolant had reduced the pressure in
the RCS to the point (1940 psig) at which the reactor would have been tripped if it had not previously
been tripped on high pressure.
By 40 seconds after reactor trip, both steam
generators had boiled down to the low level alarm
point. [This fact would not unduly concern theoperators, given the apparently slow opening rate of
the automatic emergency feedwater valves.] 4
A second operator now noticed that the second
makeup pump had not started, and successfully
started pump MU-P1B. He also opened the makeup
throttling valve (MU-V16B, Figure 11-3) to increase
the amount of makeup flow. [This increased flow,
along with reduced letdown, apparently overcame
the coolant contraction.] Forty-eight seconds after
turbine trip, the pressurizer level reached its
minimum-158 inches-and then began to increase.
Meanwhile, the condenser hotwell (Figure Ii-1)
was undergoing some expected level fluctuations,first dropping to 21.7 inches, then rising to normal.
At 1 minute 13 seconds, the condensate level had
reached the high level alarm point at 37.8 inches.
[These initial fluctuations were not unexpected.]
Unknown to the operators, however, an air line tothe hotwell level controller was broken, apparently
by a "water hammer" during the initial transient. 5
The operators were unable to regain control ofhotwell level.
Very shortly thereafter, the temperature of thewater in the RCDT had significantly increased. Unfortunately, the meter showing this temperature is inback of the main control panels and cannot be seenfrom the normal operating position. [Even if it had
been noticed, this information might not have beeninterpreted as meaning that the PORV was still
open. The RCDT liquid was already warm becauseof leakage and would have become hotter yet when
the PORV opened in the initial transient.]
Two minutes after turbine trip, the RCS pressure
had dropped to 1600 psig. At this pressure, the engineered safeguards (ES) automatically actuate.
The ES system is designed so that when the RCS
pressure drops to this level, makeup pumps MU-P1A
and 1C will start (if not already operating), makeup
pump MU-P1B will trip (if running), and the makeup
valves will open to admit the full output of thepumps6 i nto the RCS. At TMI-2, the ES system
functioned smoothly. Makeup pump MU-P1A wasrunning. When the RCS pressure dropped, makeup
pump MU-PlC came on, makeup pump MU-P1B wastripped, and the throttling valves were opened wide.
[If the PORV had not been opened, it could now
be expected that increased flow of makeup wateri nto the system would accelerate the rate of rise of
the pressurizer level (Figure 11-4) and cause the RCS
pressure to begin to climb again. Uncontrolled fillingof the pressurizer might cause it to fill completely(pressurizer "solid"). Control of RCS pressure islost with a solid pressurizer. and a very smal! temperature increase in the totally filled system could
cause the pressure to rise to the point where thesafety valves would open. If this were to happen, it
is possible that the plant would have to be shut
down. The safety valves might have to be repaired,because it is not unusual for safety valves to leakafter being lifted. Operators are trained to avoid thissituation. Operating procedures require them toswitch to manual control and reduce makeup as
soon as the pressurizer regains a normal level.
(This practice is necessitated by a preexisting
design deficiency discussed in Section II.C.1.c.)]
The operator bypassed the ES system and reduced the makeup flow, but the pressurizer level
continued to increase rapidly. Pressure did not riseand even began to move slightly downward. The
reason for the anomaly of rising pressurizer leveland decreasing pressure was not recognized by theoperators. Trained to avoid a solid pressurizer, they
stopped makeup pump MU-PlC and increased letdown flow to its high limit, thereby temporarily
arresting the rate of pressurizer level increase.
March 28,1979-4:06 a.m.

[ Loss of coolant through the PORV and excessof letdown over makeup accelerated the decline of
RCS pressure. At the same time, very little heat
was being removed by the steam generators.
About 6 minutes after the turbine trip, the pressure
had decreased to the point where some bulk boilingof the reactor coolant could have taken place. At
about this same time, the pressurizer level cameback on scale.][If the pressure dropped low enough for boiling tooccur, control of the pressurizer level would havebecome more difficult. The open PORV would
reduce the pressure in the pressurizer steam space.
Steam forming elsewhere in the system would force
more water through the surge line, raising the pressurizer level. If the RCS pressure rose so that thewater was no longer saturated, the steam bubbles inother parts of the system would be condensed, andthe pressurizer level would fall. In other words, thepressurizer level would be controlled by steam formation, as well as by the makeup and letdown system. At the same time, it would have been difficult
to regain a bubble by using the heaters. The rate ofenergy loss through the PORV at the system pressure was many times greater than the energy addedby the heaters.]
About 6 minutes after the turbine trip, unsuccessful attempts were made to restart the condensate pump CO-PIA and a condensate booster
pump. The steam generators were completely dry
and steam pressure was dropping rapidly. [Very little energy was being removed through the steam
generators. Some energy was being removed by
hot fluid flowing out the PORV, but this was not sufficient to prevent an increase in RCS temperature
after the makeup flow was reduced.]
The relief valve on the RCDT was opening intermittently after approximately 3 1/2 minutes. Operation of this valve allowed the tank to overflow into
the reactor building sump. Operation of the relief
valve was not noticed by the operators. RCDT
parameters are displayed on panel 19a, which is located out of the operator's view. The level in thereactor building sump eventually got high enough tocause a sump pump to be automatically turned on.
[The flow of mixed water and steam out of therelief valve was filling the RCDT at a rate that may
have been as high as 20 pounds per second.][The reactor building sump is normally pumped tothe miscellaneous waste holdup tank. It appears
that at the time of the accident, however, the reactor building sump pump was actually lined up to
pump into the auxiliary building sump tank-which
was already nearly full and had a broken rupture
disk. Overflow of the auxiliary building sump tankwould cause overflow to go to the auxiliary building
sump.]March 28,1979-4:08 a.m.

At 8 minutes after turbine trip, the operator
discovered that the emergency feedwater block
valves were closed and opened them. Opening
these valves caused a rapid increase in steam pressure, which had previously dropped when the steam
generators boiled dry, and a drop in RCS temperature. Steam generator level, however, did not recover noticeably for another 14 minutes. [The reason for the lag in recovery of the steam generator
level is that emergency feedwater is sprayed directly onto the hot tubes and evaporates immediately(Figure 11-5). Evaporation raises steam pressure, but
315

FIGURE 11-4. The Pressurizer

The pressurizer controls the reactor coolant system pressure and water level. The
pressurizer is connected to the hot leg through the pressurizer surge line. This line has a"V" bend (a "loop seal") so that any steam bubbles in the hot leg would not enter thepressurizer. The pressurizer is partly filled with water. The upper part contains steam. If
the pressure drops, the pressurizer heaters are turned on. This raises the watertemperature, which causes more steam to form and raises the pressure. If the pressure
rises, the spray valve is opened and water from the cold leg (1A) is sprayed into thesteam. This condenses some of the steam and reduces the pressure. The pressurizer spraydepends on the operation of pump RC-PIA for its operation. The heaters and spray areusually operated automatically. However, they both can also be manually operated fromthe control room.

The water level in the pressurizer is measured by the level sensing systems. There are three
independent level sensors. If the level drops, valve MU-V17 is opened to admit moremakeup water. If the level rises, valve MU-V17 is closed. Valve MU-V17 can be operated
either automatically, or manually from the control room.

The safety and relief valves and the vent valve are at the top of the pressurizer. One ofthese is the pilot-operated relief valve, which stuck open in the accident at TMI-2. The
purpose of the safety and relief valves is to allow escape of steam if the pressure gets toohigh. The vent valve is used to bleed off air and other gases when the plant is being started
up.
316

FIGURE II-5. The Once-Through Steam Generator
The water that has been heated in the reactor coolant system circulates
through the tubes of the once-through steam generators (OTSGs). In
normal operation, the feedwater is sprayed out of the feedwater nozzles
into the downcomer. There is steam in the downcomer which raises thetemperature of the already hot feedwater almost to the boiling point. Thevery hot feedwater collects around the tubes near the bottom of the OTSG.
The reactor coolant system is maintained at a temperature above the boilingpoint of water at secondary pressures. Some of the heat is transferred to
the feedwater, causing it to boil. The reactor coolant enters at the top,
the hottest region. As the steam rises past the very hot tubes near the
top, it becomes superheated.
Emergency feedwater is sprayed in through the emergency feedwater nozzles.
This water, which is cold compared to normal feedwater, is sprayed directly
onto the upper part of the tubes. This action cools the reactor coolant at
the top of the tubes and causes it to contract, thereby increasing its
density. Because of the increased density the coolant flows down throughthe tubes, even if the reactor coolant pumps are not operating. This iscalled natural circulation.
Even if the reactor coolant system is not full, some circulation can takeplace if the secondary side has a high water level. Steam filling the hotlegs can condense in the steam generator as fast as it is being produced in
the reactor. This is called reflux flow.

317

no water collects in the bottom until the tubes arecooled down.] About 7 or 8 minutes after the block
valves were opened, sufficient heat had been removed from the system that the reactor coolant became cool enough so that little or no bulk boiling
was taking place. [The voids (steam bubbles) in thesystem should have collapsed; their collapse would
make the pressurizer level drop. That the pressuri zer level dropped only about 30 inches when the
RCS became subcooled shows that the steam bubble voids did not yet constitute a large fraction of
the coolant volume.]
The opening of the RCDT relief valve was insufficient to keep the tank pressure from increasing.
Fifteen minutes after turbine trip, the rupture disk on
the RCDT broke as designed. The tank was now
opened directly to the reactor building. [The pressure instrument on the tank actually measures thedifference in pressure between the tank and thereactor building. An indication of the high rate offlow through the PORV is that the pressure measuri ng device indicates some pressure even after the
rupture disk broke; i.e., the fluid was rushing in as
fast as it could be discharged through the rupture
disk opening. This high discharge to the reactor
building suggests that a mixture of water and steam
was coming out the PORV.] The alarm printer8shows that a second sump pump started.
At 19 minutes after turbine trip, the first of many
radiation alarms was received from the reactor
building air exhaust duct. [It is unlikely that any fuelhad failed at this time. What probably happened
was that violent boiling and temperature excursions
had dislodged a lump of slightly radioactive material(crud) from the exterior of a fuel rod. It is also possible, although improbable, that the combination of
reduced coolant pressure and higher than normal
coolant temperatures could have allowed someminor cracks to appear in the fuel rod cladding. At
any rate, there was some radioactivity in the coolantthat came out of the PORV.]

combinations of parameters can be preprogrammed
to be printed out in groups of data on request.
At the beginning of the accident, the computer
alarm printout was synchronized with real time. The
alarm printer can only type one line every 4
seconds, however, and during the accident, several
alarms per second were occurring. Within a few
minutes, the computer was far behind real time, andthe alarms being printed were for events that had
occurred several minutes earlier. The operators canbring the computer up to date, but only at the costof clearing all alarms awaiting printout from memory.
The computer was brought up to date during thecourse of the accident, and as a result, nearly 1'/2
hours of historical data have been lost. Also, when
the computer alarm printer was brought up to date,real time information was available for only a few
minutes, then the computer began to lag again.
[ Computer alarm data, therefore, was of very little
value to the operators, although it has been useful inreconstructing the accident sequence.][ Data of value to the operators were presented bymeters, strip charts, multipoint recorders, statusli ghts, and alarm annunciators. So many annunciators were lighted, however, that their value to theoperators was probably diminished.] The annunciators for RCDT alarms, like the RCDT gauges, cannot
be seen from the normal operating position.
March 28,1979-4:25 a.m.

About 25 minutes after turbine trip, the operators
received a computer printout of the PORV outlet
temperatures. [The high temperature-285°F-was
not perceived by the operators as evidence that the
PORV was still open. When the PORV opened in
the initial transient, the outlet pipe temperature
would have increased even if the PORV had closed
as designed. The operators supposed that the abnormally slow cooling of the outlet pipe was causedby the known leak in the relief or safety valves. Actually, sufficient evidence of the failure of the PORV
to reclose was now available: the rapid rise in
RCDT pressure and temperature, the fact that therupture disk had blown, the rise in reactor building
sump level (with operation of the sump pumps), andthe continuing high PORV outlet temperature. The
PORV outlet temperature was read again at 27
minutes after turbine trip. The evidence of an open
valve, however, was not interpreted as such by theoperators. Many of the instruments were behindthe control panels, out of the immediate sight of theoperators. It appears that at 30 to 40 minutes, theoperators deliberately went behind the control
panels to read the instruments, but then failed torecognize the significance of the readings.]

The plant computer measures each parameter,
temperature, pressure, level, etc., and then compares the reading for each to a preset alarm value.
If the reading is found to exceed acceptable limits, anotation to that effect is typed out on the alarm
printer. When the parameter is restored to acceptable limits, another notation is typed. The alarm
printer records starting, stopping, or tripping of major equipment.
Operators can communicate directly with thecomputer through the utility typer. The utility typer
can give an operator immediate information about
selected parameters; e.g., whether the readings forthese parameters are within normal limits. Certain

318

March 28,1979-4:30 a.m.

At approximately 30 minutes, an auxiliary operator noticed that the suction line to condensate
booster pump CO-P2B was leaking. [He believed
the leak to have been caused by the "water hammer" at the time of the accident.] The pump wasi solated by closing the suction valve.
Another auxiliary operator noticed that the reactor building sump pumps were on and that the metershowing the depth of water in the reactor building
sump was at its high limit (6 feet). The backgroundradiation in the auxiliary building had increased.
( Although it was believed that the reactor building
sump pumps were discharging to the miscellaneous
waste holdup tank, the level in the holdup tank had
not changed. On the orders of the control room
operator, with the shift supervisor's concurrence,
the operator shut off the sump pumps.)
The auxiliary operators, after considerable difficulty, manually opened the condensate polisher
bypass valve. An air line to the condensate rejectvalve was found to be broken. [This broken air line
was apparently the cause of operators' inability tocontrol hotwell level.]
Operators were still encountering problems withthe condensate system. They were also beginningto have problems with the reactor coolant pumps.
[The operators now could have realized that what
was occurring was not a normal turbine and reactor
trip. They continued to be puzzled by the highpressurizer level and decreasing pressure, however,and no one took the time to investigate the RCDT
gauges.][The reasons for the problems with the reactor
coolant pumps were that steam bubble voids had
formed throughout the system when the pressure
was below the saturation pressure. The systempressure at the coolant pump inlets is required to besignificantly above the saturation pressure. This requirement is called the net positive suction head
( NPSH) requirement. If the NPSH requirement is notmet, vapor bubbles will form in the lowest pressure
regions on the suction side of the pumps. The formation of vapor bubbles, called cavitation, could
cause severe pump vibration, which in turn could
damage the seals and might even damage the attached piping. Operators ignored the NPSH requirement and left the reactor coolant pumps
operating as long as possible. Had they not done
this, more severe core damage could have occurred. As long as the pumps provided circulation,even of froth, the core was being cooled. As soonas all the pumps were stopped, circulation of
coolant decreased drastically, because natural circulation was blocked by steam.] [Some circulation319

can be maintained by refluxing. In this type of flow,
the water boils in the reactor vessel, and the steam
flows through the hot legs, is condensed in thesteam generators, and flows (as liquid water) backto the reactor vessel. For refluxing to occur, aspray of emergency feedwater must be hitting thetubes, or the water level on the secondary side of
the steam generators must be higher than the waterlevel on the primary side and the temperature significantly cooler. The level in steam generator A was
low (about 30 inches). The steam pressure, hence
the temperature, on the secondary side was notmuch lower than that on the primary side. Reflux
circulation, therefore, would probably not have beeneffective.][ Effective cooling might have been maintained if
the steam generators had been filled to a high level
and if the steam pressure had been kept significantl y lower than the RCS pressure.][The voids in the system also caused the neutron
detectors outside the core to read higher than expected. Normally, water in the downcomer annulus(Figure 11-6), outside the core but inside the reactor
vessel, shields the detectors. Because this water
was now frothy, however, it was not shielding thedetectors as well as usual. Not realizing that theapparent increase in neutrons reaching the detectors was caused by these voids, operators feared
the possibility of a reactor restart. Although it can
now be seen that their fears were unfounded, at thetime they were one more source of distraction.]
The emergency diesel generators had been running unloaded ever since ES actuation. These
diesels cannot be run unloaded for long without
damage. They cannot be shut down from the control room, but must be locally tripped. Once thediesels are stopped, the fuel racks must be reset so
the diesels can be automatically restarted. At 30
minutes after the turbine trip, the operator sent a
man to the diesels to shut them down. The fuelracks, however, were not reset. Failure to reset
these racks could have had serious consequences
if offsite power had been subsequently lost, because radioactivity restricted access to the diesels.
[This is discussed further in Section II.C.1.c.][Voiding throughout the system and thedeteriorating performance of the reactor coolant
pumps decreased the efficiency of the heat transfer
through the steam generators. The rate of boiling
was lower than usual, and operators found it difficult
to keep the water level from creeping up. At 26
minutes, the steam driven emergency feedwater
pump had stopped, and at 36 minutes, one of theelectric pumps had stopped thereby throttling theflow of feedwater. At 50 minutes, operators wereFIGURE 11-6. The Reactor and Reactor Pressure Vessel
The reactor is contained in the reactor pressure vessel. Water is pumped in through thefour cold legs (inlets), and flows down through the downcomer annulus. At the bottomof the vessel, the flow is reversed and the water flows upward through the core. The
temperature of the water is raised as it flows past the hotter fuel rods.
Thermocouples-temperature measuring devices-are installed just above the fuel rods.
These devices are not in contact with the rods and, therefore, measure the temperature of
the fluid that has just left the core area. Water then flows out through the two hot legs
(outlets) to the steam generators. Neutron detectors are located inside the core. In
addition, there are two sets of detectors outside the reactor pressure vessel. The source
range detectors read relatively low neutron levels. Before the upper limit of the source
range is reached, the intermediate range detectors pick up and continue recording higher
levels than the source range can read. No instruments are provided for reading the level ofwater in the reactor vessel.

320was stopped, and pump RC-P1B was stopped a few
seconds later. [The reason for stopping pumps in
the B loop is that power for the pressurizer spray
comes from the A loop. The operators were hopefulof regaining control of pressurizer level and wanted
to keep the pressurizer spray operable as long as
possible.]
Shutting down two pumps reduced the flow of
coolant through the reactor core. [Apparently, there
was still enough mass flow in the steam/water mixture to provide cooling, but not as much cooling asthat provided when a large volume of void-free water was circulating. There is no firm evidence ofoverheating at this time. The open valve was
reducing the inventory of water in the RCS, though,and the pressure was getting lower. Water continued to boil to remove decay heat; this boiling increased the amount of steam in the system andfurther impeded circulation.]
A few minutes later, analysis of a sample of reactor coolant indicated a low boron concentration.
[This finding, coupled with that of apparently increasing neutron levels, increased operators' fears
of a reactor restart. As explained earlier, the supposed increase in neutron levels was spurious, appearing on the detector only because bubbles in thedowncomer were allowing more neutrons to reachit. It is believed that the apparently low boron level
was also spurious, that condensed steam diluted
the sample. Neither explanation appears to havebeen considered at the time. The operators did apparently distrust the low boron concentration, andtook steps to get a second sample.]still having trouble stabilizing the steam generator
level, as well. While steam generator B was still filli ng, the level in A was decreasing.][The condition of the condensate system continued to deteriorate. Normally, the heat removed fromthe primary system via the steam generators isejected to the atmosphere via the main condenser
and cooling towers. The condensers must be maintained at a vacuum to operate efficiently, however,and condenser vacuum was gradually being lost. If
condenser vacuum were to drop below acceptablelevels, the condensate system would be automatically tripped and an uncontrolled dump of secondary steam to the atmosphere would occur (Figure11-7). To prevent loss of vacuum, operators deliberately shut down the condensate system 1 hour
after the turbine trip and sought to maintain control
over steam pressure by controlling the atmosphericsteam dump.
March 28,1979-5:00 a.m.

[ At the end of the first hour, the situation withwhich the operators were confronted had severely
deteriorated: pressurizer level was high and was
only barely being held down, the reactor coolant
pumps were still operating but with decreasing efficiency, the condensate system was no longer operable, the reactor building pressure and temperature
were slowly increasing, the alarm computer lagged
so badly that it was virtually useless, and radiation
alarms were beginning to come on.]At 1 hour 2 minutes, the alarm printer failed, andalarms were shifted to the utility printer for the next
11 minutes. Alarms from 1 hour 13 minutes to 2
hours 37 minutes are irretrievably lost.
At 1 hour 11 minutes, operators initiated reactor
building cooling. Their action soon halted, andeventually reversed, the rise in reactor building temperature and pressure. [That this step was considered necessary by the operators suggests thatthey were aware of increasing temperature andpressure.][The increasing temperature and pressure shouldhave been a good indication that a small-break
LOCA was in progress. In fact, if the air cooling had
not been initiated, the reactor building would probably have been isolated (sealed off) shortly after thisti me.]March 28,1979-5:20 a.m.

At 1 hour 20 minutes, an operator had the computer print out the PORV and pressurizer safetyvalve outlet temperatures. The temperature of the
PORV outlet was 283°F. The temperatures on thetwo safety valve outlets were 211°F and 219°F. [Thatthere had been essentially no change in temperature in 55 minutes should have alerted the operatorsthat the PORV valve had not closed; operators
could have confirmed this by checking the RCDTand reactor building parameters or by closing theblock valve to see if the outlet temperatureschanged.]Also at 1 hour 20 minutes, the letdown line radiation monitor began to increase. It increased steadily
to the full-scale reading. [The increase in radioactivity cannot definitely be attributed to fuel failure.
Certainly, it was not attributed to this at the time.
The letdown monitor was notoriously sensitive, sothat even minor changes in radioactivity would
cause great variations in the reading.]

March 28,1979-5:13 a.m.

[The operation of the reactor coolant pumps wasseriously impaired. High vibration, low flow, lowamperage, and inability to meet NPSH requirements
l ed the operators to start shutting down pumps.] At
1 hour 13 minutes, reactor coolant pump RC-P1A
321

FIGURE 11-7. Main Steam Lines and Dump Valves
Steam is delivered to the turbine in normal operation. When the turbine is tripped, thesteam is preferably passed to the condenser via the bypass valves. If the condenser is notoperating, steam can be released to the atmosphere through the atmospheric dump valves.
Either the bypass valves or the dump valves can be automatically controlled to maintainsteam pressure at a preset valve.

[The low steam pressure in steam generator B
and the increase in reactor building pressure were
believed to be caused by a leak from the steam
generator.] At 1 hour 27 minutes, steam generator
B was isolated (taken out of service). [With hindsight, it can be seen that the low pressure was simply caused by steam bubbles and a reduction ofheat transfer in the B loop following stoppage of thepumps. A small change in building pressure wasnoted when the steam generator was isolated. The
occurrence of this change at this time was probably
coincidental.]cause of increasing vibration and erratic flow. [Theonly heat transfer through the steam generators
was now achieved by reflux flow (Figure 11-5). Thiswas inadequate for core cooling. It is now believedthat the core was drying out. The operators were
hoping to establish natural circulation in the primarysystem. Natural circulation was blocked by steam,and refluxing would be ineffective because thesecondary temperature was nearly as high as theprimary temperature.][The pressurizer is at a higher level than thereactor. It was assumed that the presence of water
i n the pressurizer meant that the core must becovered. Actually, because the PORV was open,pressure in the upper part of the pressurizer was
reduced. The strong boiling that was occurring in
the core, however, caused more steam to go into
the upper part of the reactor vessel, and the pressure there was increased. The difference of pressure forced the water level higher in the pressurizer
than in the reactor vessel.][Previous reports have alluded to a "loop seal,"thus giving the false impression that the piping configuration alone somehow created this difference ofl evel. Even with the loop configuration, to maintain ahigher level in the pressurizer when the water in thepressurizer is saturated, a higher pressure is required in the reactor than in the pressurizer. If thepressures are equalized with the hot leg voided, thesaturated pressurizer water level would drop to thel evel of the connection of the pressurizer surge line
i nto the hot leg. Subcooled water could be maintained at a higher level. During most of the accident, the water in the pressurizer was slightly subcooled or saturated. During the time that the surge
li ne was uncovered, the water in the pressurizer
was subcooled. It was the combination of loop seal
and temperature that kept the level high, rather thanthe loop seal alone.]

March 28,1979-5:30 a.m.

At 1 hour 30 minutes, the apparent neutron leveli ncreased again. An RCS sample showed evenl ower boron concentration and increased radioactivity. [The activity was probably due to crud.]
The temperature of the RCS coolant in all primarysystem piping had been slowly increasing. Eventually, the primary side of steam generator A got hot
enough so that more steam was produced on thesecondary side, and the steam pressure began torise. The increased steam production had two side
effects: (1) the water level on the secondary side
dropped and the steam generator boiled dry for thesecond time, and (2) the increased heat removal
brought the RCS temperature down again.
[The efficiency of the reactor coolant pumps was
still decreasing, and at 1 hour 37 minutes, the frothy
mixture became too light to circulate. Separation of
the froth would have sent the steam to the highparts of the system, while water collected in the low
parts. An analogy is a kitchen blender with the bowl
half full of water. With the blender at high speed,enough air bubbles are whipped into the water sothat the bowl is full. If the speed drops, the air bubbles are lost and the lower half of the bowl is solidly
filled with liquid water. This was reflected in the
behavior of the neutron instrumentation. Apparently
the downcomer, which had been previously filledwith froth, now filled with water. The increased
shielding stopped neutrons from reaching the detector and the apparent neutron level dropped by afactor of 30.]
Operators recognized that steam generator A
was dry, and in an attempt to regain water level,
they increased feedwater flow.

March 28,1979-5:42 a.m.

At 1 hour 42 minutes, the decreasing level in thereactor vessel again reduced the shielding of theneutron instrumentation, and the apparent neutron
count increased by about a factor of 100. Emergency boration was commenced to avert a restart.
[ Actually, a restart was impossible because of thepartial emptying of the core, but no one recognized
this. A further discussion of this topic is given in
Section II.C.2.b.]
The hot-leg temperature now became decidedly
higher than the cold-leg temperature. Superheatedsteam was present in the hot leg. [The superheati ng of the hot leg showed that a fair amount of the

March 28,1979-5:41 a.m.

At 1 hour 41 minutes, both remaining reactor
coolant pumps (RC-P1A and 2A) were stopped be323

core was uncovered. It is impossible to superheat
the hot leg without uncovering the core.]
Although none of the instrumentation directly indicates to the operators that the saturation temperature has been reached or exceeded, a copy oftables that show saturation temperatures as a function of pressure (the "steam tables") was available
to them. [Apparently, however, operators did not
draw the inference from the superheated hot leg
concerning the core.][ Up to this time, it might have been possible tosalvage the situation without extensive core damage. If the PORV had been closed and full makeup
flow had been instituted, it might have been possible
to fill the system enough so that a reactor coolant
pump could be restarted. As the uncovering of thecore became more extensive, the opportunity to reverse the tide dwindled.][ The upper part of the core was now uncovered.
The steam rising past the fuel rods gave some cooling, but not nearly as much as when they werecovered with water. The decay heat-about 26
MW-was higher than the heat removed, so the fueltemperature increased.][The fuel rods are clad with Zircaloy, an alloy ofzirconium. Zirconium reacts with water to form zirconium dioxide and hydrogen. At operating temperatures, this reaction is extremely slow and does
not represent a problem. At higher temperatures,
however, the reaction goes faster. It is believed thatthe temperature of the fuel rods reached a point at
which the reaction occurred rapidly, producing significant amounts of hydrogen. Furthermore, thereaction itself releases heat. Heat released from thereaction would have caused the cladding to becomehotter, driving the reaction faster.][As long as the upper part of the system contained only steam, the bubble could be condensed(collapsed) by increasing the pressure or decreasi ng the temperature. However, with large amountsof hydrogen in the system, these measures would
reduce the size of the bubble but could never coll apse it. The accident could not now have been reversed by simply closing the PORV and increasing
makeup.]When this happened, the hot-leg temperature read
constantly at the upper limit (620°F), and the coldleg temperature read constantly at the lower limit( 520°F).

The wide range temperature measurements werestill available, although the narrow range temperatures can be read more accurately and the operators are in the habit of using them exclusively. One
meter shows average temperature, which is actuallyan average of the narrow range indications. Average temperature shown at this time was 570°F, theaverage of the constant readings of 520°F and 620°F.
[ This steady average temperature evidently convinced the operators that the situation was static.
The restricted range of these indicators and their influence on the accident are considered further in
Section II.C.1.e.][ The operators now knew that there was a probl em. Natural circulation had not been established,
and they had been forced to turn off the last RCP.
Apparently, however, no one knew just what waswrong.]
At 2 hours 15 minutes, the reactor building air
sample particulate radiation monitor went off scale.
[This was the first of many radiation alarms that
could definitely be attributed to gross fuel damage.]
At some time before this incident occurred, thecore flood tanks had been valved off. If the pressure had dropped to the nominal nitrogen pressurein the core flood tanks (about 600 psig) with valves
open, the tanks would have discharged water into
the RCS. [The high pressurizer levels had convinced the operators that there was an adequate
amount of water in the RCS, and it was thought tobe completely unnecessary to allow the core floodtanks to operate. Sometime later, the core floodtank valves were reopened.]
March 28,1979-6:18 a.m.

At 2 hours 18 minutes, the PORV valve outlet
temperatures were again reviewed. A shift supervisor who had just come into the control room isolated the PORV valve by closing a block valve (RC-V2)
i n the same line. [Apparently, he did this to see
whether it would have an effect on the anomaly ofhigh pressurizer level and low system pressure.]
The reactor building temperature and pressure immediately began to decrease and the pressure of
the RCS increased. The shift supervisor who had
closed the block valve immediately recognized thata leak had been stemmed. Others in the control
room, however, were apparently slow in recognizingthat the PORV had been leaking consistently forover 2' hours and that leakage of this valve had
resulted in a small-break LOCA.

March 28,1979-6:00 a.m.

At 2 hours into the accident, the pressure in loop
A was 735 psig. At this pressure, the saturation
temperature (the boiling point) is about 511°F. Thel oop A hot-leg temperature was actually 558°Fdefinitely superheated. Shortly after 2 hours, thenarrow range hot-leg temperatures went offscalehigh, and cold-leg temperatures went offscale low.
324

[Leakage through the PORV had now been
stopped, but there was still no way to get rid of the
decay heat, because there was virtually no circulation through the steam generators. The oncethrough steam generator (OTSG A) had 50% cold
water, which would have been adequate if there had
been circulation. The situation was in some ways
worse than it was before the valve was closed.
While the PORV was open, a considerable amountof energy, as well as mass, was being dumped into
the reactor building.]

During this period of probable core damage,there was virtually no information on conditions in
the core.
I ncore thermocouples (temperature
measuring devices), which measure reactor coolant
temperature at the exit from the core, could measure only up to 700°F. This limit is imposed by thesignal conditioning and data logging equipment, notby the instruments themselves. When a temperature reading is off scale, the computer prints out
question marks: "?????". The operators, however,cannot tell whether such an indication on the computer means that the readings are outside the scaleli mits, or whether there has been some other malfunction and the readings are simply not being taken
correctly.
Many radiation monitors began to go offscale
high. [This is an indication of severe core damage.
The zirconium dioxide resulting from the same reaction that gives rise to the hydrogen is much morefrangible than Zircaloy. The intense boiling could
have caused shattering of much of this material; andthe loss of cladding integrity, coupled with the hightemperatures, could have allowed the more volatile
radioactive substances in the fuel to escape into thereactor coolant.]
March 28,1979-6:46 a.m.
At 2 hours 46 minutes, an unsuccessful attempt
was made to start reactor coolant pump RC-P1A,
and 2 minutes later, an equally unsuccessful attempt
was made to start pump RC-P2A. At 2 hours 54
minutes, pump RC-P213 was started after operators
bypassed some interlocks. This pump ran normallyfor a few seconds, then the flow dropped to zeroand the pump ran at very high vibration levels; 19
minutes later it was stopped again.
At 2 hours 47 minutes, the computer-printed
alarms were brought up to date. As previously explained, bringing the alarms up to date erases all
alarms waiting for printout. The alarm summary wasat this time 1 hour 34 minutes behind, so that alarms
from 1 hour 13 minutes to 2 hours 47 minutes were325

irretrievably lost. The advantage gained was that
operators were provided with current alarm data.
Within a very short time, however, the computer
was again hopelessly behind.
The problems with the condenser hotwell level
control were finally solved at 2 hours 50 minutes.
The broken air line to the reject valve was repaired,the valve now operated properly, and the condensate hotwell was pumped down to its normal level.
March 28,1979-6:54 a.m.

At 2 hours 54 minutes, the pressurizer heaters
tripped. Throughout the remainder of March 28,
operators were plagued by difficulties in attempting
to keep the pressurizer heaters in operation. The
heaters are necessary for maintaining control of thepressurizer pressure, and the intermittent loss of theheaters was keenly felt. [It was believed at the timethat the heaters were tripping because of the hot,humid atmosphere in the reactor building. The shift
foreman went to the pressurizer heater control cabinet to check the circuit breakers. The circuit
breakers were actually closed, but vent fans in thearea had tripped because of high temperatures.
The fans were restarted.
[The attempted starts of the reactor coolant
pumps had not established circulation in the reactor
coolant system. It appears, however, that a slug ofwater was forced into the downcomer by the momentary running of pump 2B. Flow meters indicatedthat about 1000 to 1100 cubic feet of water weremoved in the 9 seconds of flow. This could havecovered the core or could have flowed into the other RC pump cold legs that were nearly empty.][The flow of water resulted in a sudden drop in
the indicated neutron levels, but rapid boiling soon
reduced the water level and the levels rose again.
The boiling also caused a rapid pressure rise andprobably did considerable damage to the brittle oxidized cladding.]
Several high radiation alarms within the plant had
now been received. At 2 hours 56 minutes, the shift
supervisor declared a site emergency and began
to notify local authorities. By now the control room
was full of people, including Metropolitan Edison
management and technical people. One estimate isthat there were as many as 50 to 60 people
present. Another report, however, says 18 to 20
people were in the control room. [Many of the actions taken were at the direction of the Metropolitan
Edison emergency director. For simplicity, the term
"operator" is used in this report to indicate actions
taken from the control room, even though theoperators themselves may not have been taking
some actions on their own initiative.]

The letdown sample lines had now been reported
to have an extremely high radiation level (600 r/h),
and the auxiliary building was evacuated. An attempt was being made to secure another reactor
coolant sample.

RCDT, an increase in reactor building pressure, andan increase in the valve outlet temperature.
Reactor coolant pump RC-2B had been operating
essentially without flow since being started at 2hours 54 minutes. Because of low current, zero
flow, and a high vibration level, the pump was shut
down at 3 hours 13 minutes.
At 3 hours 20 minutes, the ES were manually initiated by the operator. This was quickly followed bya drop in pressurizer level. [The reason for actuation of the ES was the rapidly dropping RCS pressure.] (The ES would have actuated automaticallyat about the same time.) Makeup pump MU-P1C
started and the makeup valves opened fully. RCS
temperature dropped rapidly as the cold water
flooded in. [It is believed that the sudden admissionof cold water to the extremely hot core probably
caused additional major damage to the core because of thermal shock. The external neutron indicators dropped suddenly, indicating a rapid changeof level in the downcomer. The water added shouldhave ensured that the coolant level was above thecore height.]
Almost immediately, many radiation monitors registered alarms. The control building, except for thecontrol room itself, was evacuated. [These radiation
alarms are a good indication that severe core damage occurred. Apparently, the brittle oxidized cladding was shattered by the sudden admission of cold
water, so that the fuel pellets were no longer held in
their original position. This sudden rearrangementof the core may have permitted the volatile fission
products to enter the coolant; these could later havestreamed out of the open PORV into the reactor
building.]

March 28,1979-7:00 a.m.

[ By 3 hours after the turbine trip, the situation
appears in hindsight to have become quite grave. It
should have been obvious that there was no circulation of reactor coolant. The abortive attempts tostart reactor coolant pumps and the attempts tosecure natural circulation by a high water level inthe steam generator indicate that this was suspected at the time. Most incore thermocouples werereading off scale. The hot-leg temperatures were
nearly 800°F. This superheating of the hot leg indicates both that the hot leg had virtually no liquidwater in it and that at least the upper part of thecore was dry. The many high radiation alarms indicate that extensive fuel damage had occurred.]
RCS pressure had been moving generally downward. There had been a slight recovery in pressure
just before the last pumps were shut down. Afterthe pumps were stopped, though, the pressure
dropped rapidly from about 1140 psig to about 600
psig. Just before closure of the block valve, thepressure began to rise and when RC-P2B was
turned on, the pressure rose rapidly from 1200 to
2200 psig.
At the same time, the pressurizer went off scale(above 400 inches). At this time, the loop B hot-leg
temperature exceeded the scale limit of the wide
range instrumentation (800°F).
At 3 hours, the condenser vacuum pump exhaustradiation monitor was showing increased radiation
l evels. A leak in steam generator B had been previously suspected, and the increased level of radiation
seemed to confirm this. At 3 hours 4 minutes, theturbine bypass valves from steam generator B andthe auxiliary feedwater valves to this generator wereclosed. This completely isolated the steam generator from the condensate system.
The external neutron instrumentation was showi ng an increase in apparent neutron levels. [Thiswas an indication of the dropping water level in thereactor vessel.]

March 28,1979-7:24 a.m.

At 3 hours 24 minutes, a general emergency was
declared on the basis of the many radiation alarms.
The borated water storage tank (BWST) low level
alarm was received at 3 hours 30 minutes. There
were still 53 feet of water in the BWST. [That thel evel was falling, however, caused concern. Additional ES actuations could cause all the water in the
BWST to be used up, and the highly radioactive water in the reactor building sump would have to be
used for high pressure injection. The HPI pumping
system would become radioactive, which could
cause grave problems if repairs became necessary.
There was thus an inclination to use ES as little aspossible (high pressure injection water is taken fromthe BWST).] ES was reset and makeup pump MUP1C was stopped.
At the same time, the PORV block valve wasMarch 28,1979-7:12 a.m.

At 3 hours 12 minutes, the PORV block valve was
opened in an attempt to control RCS pressure. The
opening of the valve caused a pressure spike in the326

shut. Closing this valve, with pump MU-P1A still running, caused a rapid increase in pressurizer level.
March 28,1979-7:35 a.m.

At 3 hours 35 minutes, it was noted that the auxili ary building basement was flooded. It will be recalled that the rupture disk on the auxiliary building
sump tank had previously broken, so that much of
the water pumped from the reactor building had
wound up in the auxiliary building basement. Highradiation readings were found in many areas of theauxiliary building.
The PORV block valve was reopened at 3 hours
41 minutes. Thirty seconds earlier, there was a sudden jump in the source range neutron detectors.
[The jump may have been due either to water in thedowncomer flashing into steam or to a disturbanceof the core geometry. The change in the source
range is believed to be due to an event internal tothe core representing a change of geometryunrelated to external events.]
At 3 hours 56 minutes, there was an ES actuation because of high reactor building pressure (thesetpoint for actuation is 4 psig). When the ES actuated, the reactor building was automatically isolated. Isolation means that valves in alI systems not
absolutely essential for cooling the core are closed
and the systems are shut down. Makeup pump
MU-PlC started, and the intermediate closed coolingpumps were tripped automatically. The intermediateclosed cooling pumps are needed for letdown andseal cooling, so the building isolation and ES were
defeated 4 minutes after actuation and the pumps
were restarted. [The delay in building isolation is
discussed in Section II.C.1.c.]

number of which were above 2000°F-and enteredthese readings in a computer book which was later
placed on a control room console. The technicians
then left the area when nonessential personnel were
evacuated. [We have not developed evidence that
their superiors were conscious of these additional
readings on March 28.]
An attempt was made to start reactor coolant
pump RC-P1A at 4 hours 18 minutes. Current andflow were monitored to see if the pump could be
operated. The starting current was normal, butcurrent quickly dropped to a low value and flow
dropped to zero. This indicates that a slug of water
may have been forced through, but the pump was
not working continuously. It was stopped a minutel ater.
March 28,1979-8:18 a.m.

Both makeup pumps (MU-P1A and 1C) were
stopped at 4 hours 18 minutes. Two unsuccessfulattempts were made to restart pump 1A. The control switch was then put in the "pull-to-lock" position. This completely defeated automatic starts ofthe pump. [The reasons for doing this were apparently the difficulties experienced in attempting torestart the pump, and a desire to avoid the possibility of having the pump come on if ES actuated. The
pressurizer indicated full, and the operators wereconcerned about full high pressure injection flow
coming on with an apparently "solid" system.][ Actually, a very large part of the RCS was filledwith steam and gas, and the system was far frombeing solid. This condition could have been recognized from the fact that the RCS hot legs were superheated. There was no danger of overpressurizing the RCS by high makeup flow.]
There was, in fact, another ES actuation at 4hours 19 minutes. Decay heat pump DH-P1A started, and the intermediate closed cooling pump
tripped, but makeup pump MU-P1A did not start.
The ES actuation was immediately defeated and thei ntermediate closed cooling pump was restarted.
Only one channel had been actuated, but the factthat one channel was defeated satisfied the "twoout of three" logic which is required for ES actuation.
Makeup pump MU-P1B was started by the operator at 4 hours 22 minutes, and MU-PlC at 4 hours
27 minutes.
Problems in the condensate system were continuing. The condensers had been steadily losing
vacuum. It was also necessary to maintain steam tothe main turbine seals in order to operate the condenser at a vacuum. When main steam is not avail-March 28,1979-8:00 a.m.

About 4 to 4 1/2 hours into the accident. incore
thermocouple temperature readings were taken off
the computer; many registered question marks.
Shortly after, at the request of the station superintendent, an instrumentation control engineer had
several foremen and instrument technicians go to aroom below the control room and take readings witha millivoltmeter on the wires from the thermocouples. The first few readings ranged from about
200'F to 2300°F. These were the only readings reported by the instrumentation control engineer tothe station superintendent. Both have testified thatthey discounted or did not believe the accuracy ofthe high readings because they firmly believed thel ow readings to be inaccurate. In the meantime, thetechnicians read the rest of the thermocouples-a327

It was possible to reset the fuel racks at once,
however, and then to leave the controls in position
so that the diesels would not automatically start on
ES actuation. In the event of a blackout, the diesels
could have been immediately started from the control room, as soon as the operators realized thatpower was lost. Resetting the fuel racks was carried out at 5 hours 29 minutes.

able, seal steam is provided by the oil-fired auxiliary
boiler, which is shared by both TMI units. The auxiliary boiler broke down, so that seal steam could not
be maintained, and it was necessary to shut down
the condensate system completely.
March 28,1979-8:31 a.m.

At 4 hours 31 minutes, the vacuum pumps were
stopped and the condenser vacuum was broken.
As a result, steam was now being dumped to the atmosphere. The letdown temperature alarmed highbecause of the frequent stoppages of the intermediate closed cooling pump. The high temperature
alarm cleared at 4 hours 36 minutes.
[Only a small amount of heat could be removedby the steam generator because the upper part of
the RCS was filled by a steam-gas mixture. Thisdrastically cut flow on the primary side. The waterlevel on the secondary side was rising because
more water was coming in as feedwater than was
leaving as steam. At 4 hours 42 minutes, emergency feedwater pump EF-P2A was stopped.]

March 28,1979-9:43 a.m.

By 5 hours 43 minutes, the RCS was fully
repressurized.
The pressure was maintained
between 2000 and 2200 psig by operation of the
PORV block valve. When pressure got up to 2200
psig, the valve was opened and the pressure
dropped. When the pressure got down to 2000
psig, the valve was closed and pressure increased.
This control of the pressure was maintained for the1
next 1 /2 hours.
[It was supposed that the higher pressure might
be able to collapse the bubble and allow natural circulation. In order to encourage natural circulation,
operators raised the water level of steam generator
A to 90% by using the condensate pump for feedi ng.]

March 28,1979-9:00 a.m.

At 5 hours after turbine trip, the RCS pressure
was reading 1266 to 1296 psig, the cold legs were
subcooled, and the hot legs were superheated.
Many radiation monitors were off scale. The containment dome monitor showed a very high readingof 6000 r/h. As it was apparent that conditions
were far from satisfactory, the decision was madeto repressurize. At 5 hours 18 minutes, the PORV
block valve was closed.
At 5 hours 24 minutes, there was yet another ES
actuation on high reactor building pressure. Thiswas immediately defeated. Decay heat pump DHP1A had already been stopped and put in the "pullto-lock" position. The intermediate closed coolingpump tripped again, but was immediately restarted.
The diesel engines that operate the emergency
generators had been stopped at 30 minutes after
the turbine trip. These diesels provide an emergency electrical supply for the ES in the event of failureof the regular supply. During the past 5 hours, thediesels had been incapable of being rapidly started.
If there had been an interruption in the power,
someone would have had to go to the diesel generator area to start them. On the other hand, if thefuel racks were reset, the diesels would have restarted on every ES actuation. As previously explained, they cannot be run for long periods when
unloaded, and someone would have had to go to thediesel generator area each time to reset them. Either way, someone would have had to pass througha high radiation area.

March 28,1979-10:17 a.m.

At 6 hours 17 minutes, control room personnel
had to don respirators because of high radiation
l evels. These respirators made communications
more difficult.
Auxiliary building fans were stopped at 6 hours
because of the high radiation and so as not to
spread radioactivity. The fans were restarted again
at 6 hours 14 minutes.
A leak in steam generator B was suspected; thiswas the reason for isolating it previously. There
was also some concern about the steam generator
A. Steam from A was being released to the atmosphere, and any leak would have led to a release ofradiation. An operator was dispatched to the roof
with a meter that was held near the steam plume.
This measurement confirmed that the steam being
released was not contaminated.

328

An emergency feedwater pump (EF-P2A) was
restarted at 7 hours 9 minutes to complete the fillingof OTSG A. Filling was completed at 7 hours 30
minutes.
I t became clear that even with a full steam generator and high pressure, natural circulation was not
being established. The next plan was to depressurize sufficiently to inject water from the core floodtanks.

Each of the two core flood tanks holds 7900 gall ons of borated water. The tanks are pressurizedwith nitrogen gas to 600 psig. During operation, thetanks are open to the reactor vessel, but backflow
of water is prevented by check valves. If the RCS
pressure drops below the pressure of the nitrogengas, borated water will be injected directly into thereactor vessel.
When water is injected from the core flood tanks,
expansion of the nitrogen gas causes its pressure
to drop until it balances the RCS pressure. If the
RCS pressure drops slightly below 600 psig, only asmall amount of water will be injected. An amountof water approaching the full volume of the tanks
will be injected into the reactor vessel only when the
RCS pressure is much lower than 600 psig. The
operators did not realize this and incorrectly believed that the small amount of water injected wasi ndicating that the core was covered.
[Other reports have mentioned the existence of aloop seal between the core flood tanks and thereactor vessel. These reports give the unfortunatei mpression that the loop seal might somehow
prevent water from flooding the core even if the
RCS pressure is lower than the nitrogen gas pressure. Actually, this can only be true if the differential
pressure is less than 5 to 10 psi. High pressure in
the RCS in combination with the loop seal will always prevent large amounts of water from being injected.]

31 minutes, operators started decay heat pumps
DH-P1A and 1B in anticipation of getting pressure
down to the level for which the decay heat removal
system is designed (about 300 psig).
Up to this time, the atmospheric steam dump
valve was open. Sometime between 8 hours 30
minutes and 9 hours 15 minutes, the atmospheric
dump valve was closed on orders to the control
room from Metropolitan Edison management, because of concern that this might be the source ofsmall radioactivity levels being measured outside theplant.
The steaming rate was very low at this time, andclosing the atmospheric dump valve did not makeany noticeable change in steam pressure. On thebasis of physical evidence alone, therefore, it is notpossible to pin down the time of closure. A small increase in pressure and operating level that occurredat about 9 hours 45 minutes cannot be definitely attributed to closure of the atmospheric dump.
The condenser had already been shut down.
The atmospheric dump was an alternate method of
removing some heat from the steam generator.
[The rate of heat removal was very low because
there was virtually no circulation on the primaryside. With closure of the dump valve, however,even this inadequate heat sink was lost. Energy removal via the open pressurizer relief valve and thel etdown line kept the system from immediately heati ng up.]
The BWST level was still decreasing and there
was increasing concern that the tank would run out.
At 9 hours 8 minutes, suction from the BWST was
stopped.

March 28,1979-11:30 a.m.

At 7 hours 30 minutes, the PORV block valve andthe pressurizer spray valve were opened, and thepressure began to drop. The operator defeated ES
actuation at 7 hours 42 minutes, just before automatic actuation would have occurred.
At 8 hours 12 minutes, a core flood tank high level alarm was received, indicating a level of 13.32
feet. [This alarm indicates that the core flood tanks
were taking water from the reactor coolant system,
which means that the check valve must have beenleaking slightly.] At 8 hours 40 minutes, the RCS
pressure was down to the nominal pressure of thenitrogen gas (600 psig), and flow from the coreflood tanks to the reactor vessel should have started. At 8 hours 55 minutes, the core flood tank level
was down to 13.13 feet, indicating that a small
amount of water went into the reactor vessel.

March 28,1979-1:50 p.m.

March 28,1979-12:31 p.m.
[Evidently, operators intended to use the decay
heat removal system if at all possible.] At 8 hours

329[It became obvious that the RCS pressure could
not be reduced to get the decay heat removal system in operation. Only a small amount of water wasi njected from the core flood tanks.] The PORV
block valve was closed at 9 hours 15 minutes, andwas thereafter reopened at intervals for shortperiods. At 9 hours 50 minutes, coincident with
opening of the PORV, there was a very sudden
spike of pressure and temperature in the reactor
building. The building was isolated, and the ES actuated and building sprays came on. The setpoint
for the building sprays to come on is 28 psig, so thepressure spike must have been at least that high.
The strip chart shows a peak pressure of 28 psig.
It is now known that the pressure spike was due
to hydrogen combustion in the reactor building. Evidence for this is the high pressure in the building(seen on three pressure-measuring instruments),

the high temperature in the building (seen not onlyby the building temperature measuring device but
also by the reactor coolant pump air intake alarm),and the depletion of the oxygen level in the building.
[The lack of adequate equipment to control hydrogen concentration is discussed in Section II.C.1.c]
The building sprays quickly brought the pressure
and temperatures down. At 6 minutes after actuation, the sprays were shut off from the control room
because there appeared to be no need for them.
I nitially, the spike was dismissed as some type ofi nstrument malfunction. Shortly afterward, however,at least some supervisors concluded that for several
i ndependent instruments to have been affected in
the same way, there must have been a pressure
pulse. It was not until late Thursday night, however,that control room personnel became generally
aware of the pressure spike's meaning. Its meaning
became common knowledge among the management early Friday morning. [See Section II.C.2.a fora more detailed discussion of this issue.]At about the same time, two 480-volt ac motor
control centers (MCC-2-32A and 42A) tripped. The
motor control centers (MCC) are in the auxiliarybuilding; it is not certain that tripping was connectedwith the explosion. Two leakage closed coolingpumps (DC-P2A and DC-P213) tripped at the sametime; these pumps are the largest loads on the
MCCs. The loss of these MCCs caused considerable inconvenience for later operation. Even though
there was standby dc equipment available for someof the motors, the loss of the MCCs made directcontrol from the control room more difficult.
[Although it was impossible to get the pressure
low enough for the decay heat system, it was supposed that there would still be some advantage inkeeping the core flood tanks open to the reactor
vessel.] Operators maintained the RCS pressure
below 600 psi (down to a minimum of 410 psi) byperiodically opening the PORV block valve.
The pressurizer at this time showed a full (greaterthan 400 inches) indication. [It is possible that thetrue level in the pressurizer could have been lower.
An indication of 400 inches means that thetemperature-compensatedlevel
i nsidethepressurizer-measuring leg equals the level in thereference leg. There is a possibility that the reference leg could have been less than full, although noi nformation to substantiate or refute this hypothesis
i s available.]minimum of 460°F, and then climbed back up,reaching 590°F at about 11 hours 40 minutes. Duri ng this period, there were a number of short dipsand rises superimposed on the general trend. [It is
possible that the pressurizer at this time backed up
i nto the hot leg.][An alternate hypothesis, which also ties in withother phenomena, is that steam reflux increased at
this time. Steam flow across the top of the hot leg
would have been blocked by hydrogen. Continued
venting of the pressurizer may have removed
enough hydrogen to allow steam to flow across the
top of the hot leg and be condensed in the steam
generator. This is shown by a simultaneous drop insteam generator level (water was boiled away), a
jump in steam pressure, and a drop in RCS pressure.][The operators believed that they now had natural circulation established in the A loop. It wasthought that the bubble in the A loop had disappeared. Actually, even well-developed refluxing
would not give the heat sink needed to cool thesystem much further.] The RCS pressure hit aminimum of 420 psig and then began to increaseagain. [As the pressure dropped, boiling in thereactor vessel would have increased to the point at
which the steam production exceeded condensation
plus loss through the relief valve, resulting in another rise in pressure.]
At 10 hours 32 minutes, makeup pump MU-P1C
was started. Makeup pump 1C was stopped again
at 10 hours 36 minutes.
March 28,1979-2:38 p.m.

At 10 hours 38 minutes, the hot-leg temperatures
went off scale again. They came back on scale almost immediately, however, and thereafter continued to drop. Steam generator parameters indicatethat there was a momentary drop in heat transfer,but that the steam generator quickly recovered andbegan to remove heat again. Note, however, that if
the atmospheric dump valve is closed, as soon assome of the water in the steam generator secondary side has boiled and the rest of the water has
heated up, the steam generator can no longer remove any more heat.
At 11 hours 6 minutes, the temperature of loop A
suddenly increased. [This increase in temperature
is an indication that the secondary side of the steam
generator had become "heat soaked" and would nolonger remove a significant amount of heat from theRCS.]
At 11 hours 10 minutes, personnel in the control
room removed their respirators.

March 28,1979-2:28 p.m.

At about 9 hours 50 minutes, the loop A hot-leg
temperatures came back on scale, went to a330however, did stop the radioactive coolant from getting out to the reactor building.][It was now believed that it might be possible tostart a reactor coolant pump. There was some concern, however, as to whether a pump would
operate. If there were voids in the system, sustained running would possibly damage the pump or
blow out the seals. Therefore, the control room
personnel decided to "bump" one of the pumps (runit for only a few seconds) and to observe current
and flow while the pump was running.]
The loss of two MCCs meant that the ac oil lift
pumps were out of service. It is not possible tostart a reactor coolant pump unless the oil lift pump
can be started. There is a standby dc oil lift pump,
but it was necessary to send people to the auxiliarybuilding to start it. This was done at 15 hours 15
minutes.

March 28,1979-3:10 p.m.

At 11 hours 10 minutes, the pressurizer level indication dropped rapidly to 180 inches over an 18minute period. The drop in pressurizer indication
was more or less coincident with the increase in
hot-leg temperature and in the A loop cold-leg temperatures. [There is a possibility (unsubstantiated)that pressurizer heaters had been turned on previously.] The pressurizer level stayed low for about
20 minutes, and then began to climb, eventually goi ng off scale again. The operator had turned on
makeup pump MU-P1C, and 20000 gallons of water
had been added from the BWST and makeup tank.
There was very little change in conditions until 13hours after turbine trip. During the intervening time,
the PORV block valve and makeup pump MU-P1C
were operated several times in an effort to hold a
The hot-leg temperature
constant pressure.
dropped again at about 12 hours 40 minutes, coincident with an increase in RCS pressure. [Thepressure increase would cause some steam in the
hot leg to condense; the condensation transfers
heat to the secondary side and gives a modest increase in steam pressure.]

March 28,1979-7:33 p.m.

At 15 hours 33 minutes, operators started reactor
coolant pump RC-P1A by manually bypassing someof the inhibiting circuitry. The pump was run for 10
seconds, with normal amperage and flow. Dramatic
results were seen immediately. RCS pressure andtemperature instantly dropped, but began to riseagain as soon as the pump was stopped. [Evidently, there was an immediate transfer of heat to thesteam generator when the coolant circulated. There
was also a rapid spike in the steam pressure and adrop in steam generator level.]

March 28,1979-5:00 p.m.

At 13 hours after the turbine trip, the auxiliary
boiler was brought back into operation. Steam forthe turbine seals was now available and it was possible to hold a vacuum on the condenser. Two condenser vacuum pumps were started. [It was now
expected that repressurization would collapse thebubble in the hot legs, and natural circulation could
be achieved through OTSG A.] Repressurization
began at about 13 hours 30 minutes. At this time,
makeup was 425 gpm, using two makeup pumps.
At 13 hours 45 minutes, following the resolution of aproblem with the outlet valve, OTSG A began
steaming to the condenser.
At 14 hours 39 minutes, valve MU-V16B began toclose; at 14 hours 41 minutes, valve MU-V16C wasthrottled until the makeup flow was down to 105
gpm; and at 14 hours 43 minutes, makeup pump
MU-P1C was stopped and valve MU-V16C was completely closed. The RCS pressure was then 2275
psig.

March 28,1979-7:50 p.m.

After analysis of the results of the short term runof the reactor coolant pump, conditions looked so
hopeful that operators decided to start the pumpand to let it run if all continued to go well. At 15
hours 50 minutes, reactor coolant pump RC-P1A
was restarted, and again all went well. Temperatures went down and stayed down, and a steadysteaming rate was established.
[ Reasonably stable conditions had now, for the
first time, been established. New problems were toarise later, but they were less serious than thosethat had been handled up to this time.][Apparently, no one at this time realized that abubble still existed in the RCS. What appears tohave happened is that the starting of the reactor
coolant pumps swept the remaining gas in the upper
part of the system around with the water as
discrete bubbles. The gas bubbles would tend tocollect in the most quiescent part of the system-

March 28,1979-7:00 p.m.

At about 15 hours, many of the radiation monitors
came back on scale. [It is not likely that the reduction in radiation levels was directly controlled by the
repressurization. Closing the PORV block valve,
331

The auxiliary building sump was full of contami nated water. The auxiliary building neutralizer tank
(WDL-T8B) had been filled before the accident. At
9:29 p.m. the operators commenced pumping thecontents of this tank to TMI-1, so that the auxiliarybuilding sump contents could later be pumped into
WDL-T8B. The transfer to TMI-1 was completed at
12:20 a.m. on March 29.
At 10:18 p.m. on March 28, it seemed that a bubble had been reestablished in the pressurizer.
About 30 minutes later, however, the bubble wasagain lost and the pressurizer returned off scale.
At 10:34 p.m., letdown flow was lost. [It is believed likely that the letdown coolers became
clogged with boric acid. Boric acid is more soluble
i n hot water than in cold water. The extensive
boration during the accident might have caused a
condition of saturation, so that when letdown water
was cooled, boric acid precipitated out in the letdown coolers and filters.]
High pressure drop alarms, along with letdown
flow alarms, began to come in shortly after midnight
and continued through the early morning hours ofMarch 29.
During these early morning hours, some radiation
alarms also continued to be received. The auxiliarybuilding and fuel handling ventilation was shut off
between 12:55 a.m. and 2:10 a.m. Shutting down
the ventilation caused radiation levels to increase in
the control room; so from 2:11 a.m. to 3:15 a.m., control room personnel were required to wear respirators.

the upper head of the reactor vessel. There is also
a possibility of a dry "hot spot" within the core.][It is now believed that the gas was largely hydrogen. Hydrogen is slightly soluble in water, andits solubility is greater at high pressure. An attempt
to depressurize the system would cause some ofthe dissolved hydrogen to effervesce out of the water, thereby increasing the amount of hydrogen in
the bubble. (An analogy is a capped bottle of carbonated soft drink. When the cap is firmly seated,
the pressure is high and the carbonated gas
remains dissolved. If the cap is removed, however,the pressure quickly drops, and gas bubbles out of
the liquid.) The effervescence of hydrogen out of
the water would interfere with attempts to depressurize. As the pressure dropped, the bubble wouldgrow in size and could interfere with circulation of
the reactor coolant.][In addition to growing in size, the bubble and thedissolved gas would make it impossible to depressurize the RCS completely. The pressure is controlled by the size of the steam bubble in the upper
part of the pressurizer. When this bubble contains
only steam, spraying colder water into the top of thepressurizer shrinks the bubble and reduces thepressure. When the bubble contains a gas like hydrogen, however, spraying does not reduce the sizeof the bubble as much, so there is less control overthe pressure.]
Another problem with reduced pressure occurredi n the letdown system. As explained, gas comesout of solution when the pressure is reduced. The
gas from the letdown water collected in the bleed
tanks and makeup tank, increasing the pressure
and making it necessary to vent the tanks often.
The gas vented off, though, was not purehydrogen-there were small amounts of radioactive
materials as well. There was a limited space available for holding the gas released from the letdown
flow. [See Figure II-8 for a schematic drawing of
the gas venting system.][These two factors would make the reduction ofpressure an extremely slow process that took
several days to accomplish.][At 9:25 p.m. on March 28 (17 hours 25 minutes
after turbine trip), it was apparent that the utility beli eved pressure could soon be reduced to a level atwhich the decay heat system could be used.]
Valve DH-V187 from the decay heat pump to the
1A cold leg was opened at that time. [The reason
for opening this valve must have been the utility's
i ntention to use the decay heat system shortly.]
Unfortunately, there was still no bubble in thepressurizer; the pressurizer was reading off scale.

March 29,1979-4:35 a.m.

At this time, the first of many ventings of the
makeup tank MU-T1 was carried out. The waste
gas decay tank vent header, to which the tank was
being vented, was leaking into the auxiliary building.
At 4:43 a.m., the seal water temperature on reactor coolant pump RC-P2A alarmed high. The operator then got a printout of the seal water temperatures of all reactor coolant pumps. High temperatures were found on pumps RC-P1B, RC-P2A, and
RC-P2B (all nonoperating).
Between 8:00 p.m. March 28, and 6:15 a.m.
March 29, the pressure slowly decreased from 1300
to 945 psig. A pressurizer bubble had been definitely established at 4:00 a.m.; and by 6:15 a.m., thepressurizer level was down to 341 inches. During
this period, the cold-leg temperature hovered
between 230°F and 280'F.
At 6:30 a.m. March 29, the pressurizer was
sprayed down. The results were an additional 40-

332

FIGURE 11-8. Gas Venting System
Gases vented from the makeup tank are piped to the waste gas vent header in addition togases from several other vents. Gas is pumped from the header to the waste gas decay
tanks by the waste gas compressors. The gas is held in the decay tanks to allow decay ofpart of the radioactivity and is finally discharged to the atmosphere through the station
vent (a full chimney) after being filtered in the waste gas filters.

psi drop in pressure and a 22-inch climb in thepressurizer level.
Letdown flow was reestablished at 6:31 a.m. Intermediate cooling temperature was increased, andapparently this increase raised the temperature at
the coolers sufficiently to clear up the problem ofboric acid fouling.

the floor by washing it down underneath the plastic
sheeting.
The industrial waste treatment system was restarted at 4:10 p.m. and was secured at 6:15 p.m.,and had discharged a total of 25 000 gallons oftreated waste.
March 29,1979-8:20 p.m.

March 29,1979-7:15 a.m.

Degassing of the makeup tank MU-T1 continued
to be a problem. One solution, which was tried at
8:20 p.m., was to degas the tank through the unit
sample system, and back to the TMI-2 waste gas
vent header. The attempt to do this was given up
after 10 minutes of venting.
The next effort involved opening vent valve MUV13 for 5 seconds to admit a small quantity of gas
to the header. The purpose of admitting only asmall amount of gas was to keep the header pressure down; it had already been noted that highpressure in the header made radiation levels rise in
the auxiliary building. At the same time, the waste
gas compressor was pumping out the vent.
Another attempted solution involved isolating all
nitrogen venting to the vent header. The idea wasto block all other discharges to the header to keep
the header pressure down.
During the rest of the day, the makeup tank wascautiously vented again between 8:45 p.m. and 9:05
p.m., and again at 11:30 p.m., when the vent valve
was bumped open at about 2-second intervals.
A significant increase in the fuel handling building
exhaust gas monitor, from 300 mr/h to 1 r/h, wasseen at 5:40 p.m. [It is assumed that this was connected with the venting, although it should be
remembered that there were several other sourcesof contamination in the plant.]
One of the pressurizer level indicators failed at
9:14 p.m., but returned to service at 10:30 p.m. [Thiswas not catastrophic, because there are three completely separate level sensors. Level indication issuch a vital piece of information, though, that theloss of an indicator would be expected to cause
concern.][The previous indications of a leak in steam generator B were now perceived to be false.] The
steam pressure in OTSG B was holding steady at
25 psig, and the level was constant at 380 inches.
Analysis of samples provided contradictory information concerning whether there had at some time
been a leak.

At 7:14 a.m., the auxiliary building sump tank was
pumped to the auxiliary building neutralizer tank
WDL-TSB. The intention was to pump the auxiliarybuilding sump to the auxiliary building sump tank.
At 7:16 a.m., the letdown flow was shifted toreactor coolant bleed tank (RCBT) B. It had been
observed that when the makeup tank was vented,
the radiation levels in the auxiliary building increased. [Apparently, this was because of the leaki n the waste gas vent header.]The contents of a second neutralizer tank
( WDL-T8A) were pumped to TMI-1, beginning at
8:45 a.m. In addition to these contents, this tankcontained preaccident water. It was destined tocontain contaminated water from the auxiliary buildi ng sump.
March 29,1979-12:40 p.m.

At 12:40 p.m., the sump pumps in the turbine
building, control building, and control and service
building were shut off. These pumps discharge tothe industrial waste gas treatment system sump.
The sump was completely filled and had overflowed
to a settling pond. There was a leak from the pond
(known as the "east dike drainage area") to theSusquehanna River.
March 29,1979-1:15 p.m.

The industrial waste gas treatment system wasstarted up at 1:15 p.m. in order to bring down thelevel of the overflowing sump and to eventually decrease the release of untreated water from thepond. The treated water from this system also
discharges to the river. The treatment system wasshut down again at 2:10 p.m. because of apparently
high xenon levels in the discharge stream. It waslater determined that the xenon reading was erroneous. Letdown was shifted from RCBT B to RCBT C
at 2:58 p.m.
At 4:00 p.m., the auxiliary building sump tank was
pumped to neutralizer tank WDL-T8A, and later theauxiliary building sump was pumped to the auxiliarybuilding sump tank. After pumping out the sump,operators made an attempt at 7:00 p.m. to clean up

March 29,1979-12:00 p.m.

At the end of the day on March 29, the RCS
pressure had risen slightly to 1105 psig, the tem334

from the makeup tank was shut, and the flow of water to the reactor coolant pump seals dropped tozero.
[It was realized that the high pressure in the
makeup tank was leading to uncontrolled releases
through the vent header. When the makeup tankdumped to the bleed holdup tanks, the relief valve
on the latter would have lifted. Relief valvesdischarge directly to the stack, without treatment or
holdup, so there was an uncontrolled puff release ofradiation. Possibly, some water could also have entered the waste gas vent header.]I n order to obviate any later problems with the
makeup tank, it was completely vented down via thewaste gas vent header. [Some leakage in the ventheader caused this venting to add to the contami nated gas being released.]
An attempt was made to pump from the reactor
coolant bleed holdup tanks to the makeup tank; thisattempt was unsuccessful because of the high pressure in the makeup tank (about 80 to 84 psig).
It was absolutely necessary to regain makeup
flow in order to get seal water to the reactor coolant
pumps. There was considerable concern about the
low level in the BWST; therefore, the makeup pumpsuction had to be switched to the BWST.
The makeup tank was again vented to the waste
gas vent header at 7:10 a.m. At 7:50 a.m., water
was pumped from the reactor coolant bleed holdup
tank to the makeup tank. Operators achieved somesaving in makeup by stopping the flow of seal water
to the nonoperating reactor coolant pumps RC-P2A,
1B, and 2B. At 8:15 a.m., they again aligned the
makeup pump suction to the makeup tank.

perature in the loop A cold leg was 325°F, and thepressurizer level was 325 inches. [It was now beli eved that there was a steam bubble in the reactor
vessel. The presence of a bubble would also havecaused difficulty in depressurizing. The presence ofhydrogen could have been inferred at the time, however, from the difficulty caused by the outgassing of
the makeup tank. This difficulty implied dissolved
gas in the letdown stream.]
Difficulties with increasing gas pressure in the
makeup tank took up much of the attention of theoperators on March 30. It was noted early that thetank pressure was increasing even while the tankl evel was decreasing.
March 30,1979-1:30 a.m.

At this time, the RCS temperature had dropped.
The turbine bypass valves were closed slightly toraise the temperature by 8°F.
The makeup tank was vented to the waste gas
decay tank (WGD-T18) from 1:50 a.m. to 2:15 a.m.
At 2:15 a.m. all sump pumps from the turbine
building and control building area were shut off.
One hour later, at 3:15 a.m., a temporary pump wasused to pump the turbine building sump to the control building sump.
March 30,1979-3:30 a.m.

Pressure in the makeup tank continued to increase. Because of the leak in the waste gas ventheader, the venting of the tank was being controlled
i n an effort to keep the pressure in the header
down. The tank was vented again at 3:30 a.m. At
about the same time, more difficulty was being experienced in maintaining letdown flow. The valve
between the letdown coolers and letdown block orifice (MU-V376) was being periodically cycled sothat the pulsating flow might clear up the stoppagei n the letdown system.
At 4:30 a.m., a filter system in the industrial
waste treatment system was started. The waste
treatment system was discharging to the riverthrough the mechanical draft cooling tower blowdown line.

March 30,1979-9:40 a.m.

At 9:40 a.m., OTSG A was closed off for 7
minutes in order to heat the RCS to 280°F.
The pressurizer level was brought down at 10:45
am.; the intention was to eventually bring the levelto 100 inches. At the same time, letdown wasaligned to reactor coolant bleed holdup tank A.
[ Reducing the pressurizer level is usually a prelimi nary to depressurizing the RCS system.] The temperature of the A cold leg was 280°F, and the RCS
pressure was 1043 psig.

March 30,1979-4:35 am.

The liquid pressure relief valve (MU-R1) on the
makeup tank (MU-T1) opened at 4:35 a.m. becauseof the increasing gas pressure in the tank. The
opening of this valve allowed the entire contents ofthe makeup tank to be discharged to the reactor
coolant bleed holdup tanks. The level in the makeup tank dropped to zero, the outlet valve (MU-V12)

March 30,1979-12:20 p.m.

At 12:20 p.m., transfer of the contents of the miscellaneous waste holdup tank to TMI-1 was started.
The transfer was completed at midnight.
An attempt was made to reduce radioactive
gaseous discharges by venting the waste gas decay
tank back to the reactor building. At 2:05 p.m.,335

operators encountered difficulty in opening valve
WGD-V30B to accomplish venting. They successfully opened the valve at 2:42 p.m.
March 30,1979-4:00 p.m.

At 4:00 p.m., the pressurizer level was down to
215 inches. At the time the decision had been madeto reduce the level, the pressurizer was at 390
i nches.
[It was suspected at this time that a bubble still
existed in the RCS. The bubble obviously could nothave been steam, or it would long since have condensed given the low temperatures in the RCS. (Adetailed discussion and evaluation of the formationand disappearance of the bubble will be found in
Section II.C.2.)][If the mass or temperature of the reactor coolant
are increased, the pressure will increase. If the
RCS has very little steam or gas in it, there will be arather large increase in pressure. If there is a large
volume of steam or gas in the system, however, thepressure change corresponding to a change ofmass and temperature will be cushioned. If a known
change of liquid occurs, and the corresponding
change of pressure is measured, it is possible tocalculate the volume of gas in the system.][In order to calculate the gas volume precisely, it
i s necessary to know the change of liquid volume,the change of pressure, and the temperature fairly
precisely. The pressure, volume, and temperature
measuring devices of a nuclear powerplant are veryrugged and reliable, but do not have laboratory precision; nor is such precision normally needed.
Furthermore, the meters indicating the quantities are
difficult to read exactly even if they were to indicate
correctly. The difficulty in making precise measurements will make it difficult to calculate the gas
volume with any great accuracy.][Another problem is that hydrogen is more soluble in water at high pressure. If the pressure in the
RCS is increased, a hydrogen bubble would shrink;first, because it is being compressed, and second,
because more hydrogen is dissolved in the water at
the higher pressure.][To calculate the volume of the bubble at any
ti me, letdown and makeup were aligned to themakeup tank. The level in the tank, along with thepressurizer level, was measured at the beginningand end of the experiment. Then the system pressure was changed by a known amount, and fromthis the volume of gas in the RCS could be calculated.][Some organizations computing the size of the
bubble made corrections for the change in solubility
336

of hydrogen and the different water densities in the
makeup tank and the RCS, whereas others did not.
However, even if a single method is used for calcul ations, two measurements made at slightly different
ti mes might give quite different results; first, becauseof the inherent imprecision of measurement, andsecond, because the bubble was actually shrinking.][ Because the bubble was not pure hydrogen, but
was really a mixture of steam and hydrogen, theresults really ought to have been corrected by subtracting out the amount of steam. The results were
the total amount of gas-whether hydrogen or water vapor. The real interest, however, was in theamount of hydrogen. Apparently, no one made thiscorrection. Given the inexact nature of the measurements, it probably was not worthwhile. It should
also be noted that the term bubble does not necessarily mean only a bubble in the top of the vessel.
Any gas, anywhere in the RCS, would appear in themeasurements.]
At 4:34 p.m., all the pressurizer heaters wereturned off. This caused the pressurizer steam
space to shrink. From measurements of both theshrinkage in volume and the decrease in pressure
the size of the bubble could be calculated. The
bubble was calculated to be about 366 cubic feet.
Calculations had been performed for previous
times, whenever it appeared that a sufficient pressure change had taken place-the first calculation
was made by Met Ed for 1:00 p.m. on March 29but the experiment at 4:00 p.m. on March 30 seems
to have been performed specifically to calculate thebubble size.
Problems with letdown flow were continuing. At
4:50 p.m., the letdown temperature alarmed high.
Letdown flow was reestablished, and operators
cleared the alarm in 5 minutes by opening the valve
between the letdown coolers and the block orifice,
MU-V376.
Only one reactor coolant pump was operating,
RC-P1A. If this pump had failed, the plant would
have been completely without an operable RCP. At
5:04 p.m., the oil pump for RC-P2A was started.
Because there was a dc ground fault, however, thereactor coolant pump could not be started.
March 30,1979-5:30 p.m.

There was considerable concern about the lowlevel of the BWST, which was now down to 15.5
feet. At 5:30 p.m., a valve lineup was made so thatclean, borated water would be pumped from theTMI-1 spent fuel tank to the TMI-2 surge tank andthen to the TMI-2 BWST. Pumping of this water
was started at 6:50 p.m.

The reactor coolant temperatures had been
gradually and slightly decreasing. At 5:48 a.m., theturbine bypass valves for OTSG A were closed
slightly-from 47% open to 44% open-to arrest thecooldown.

Up to this time, degassing of the RCS had beenaccomplished principally by degassing the letdown
water. This disadvantage of this method was that it
was overpressurizing the makeup tank and contributing to radioactive releases via the leaky waste
gas vent header. At 9:32 p.m. on March 30, theoperators cautiously began "jogging" the pressurizer
vent valve RC-V137. To keep the pressure up, theyturned on the pressurizer heaters (three groups) at
the same time. The effluent went to the reactor
coolant drain tank and was condensed. The gasthat came out was discharged through the RCDT
rupture disk into the reactor building. The procedure was repeated at 10:17 p.m. and at 11:10 p.m.
By midnight on March 30,1979, the total releases
from the industrial waste treatment system had
amounted to 72.56 millicuries. This was within theallowable limits. (Regulations allow the releases to
be averaged over a year's time.)

March 31,1979-7:53 a.m.

Venting of the pressurizer was started again at
7:53 a.m., even though the hydrogen recombiner
was not yet operating. The RCS was vented at thefollowing times during the day:
7:53-8:03 a.m.
8:28-8:46 a.m.
9:07-9:17 am.
9:35-9:57 a.m.
1:12-1:50 p. m.
2:25-3:00 p.m.
3:37-4:19 p.m.
4:56-5:37 p.m.
6:15-6:50 p.m.
7:50-8:34 p.m.
9:10-9:39 p.m.
10:21-11:52 p.m.

March 31,1979-2:05 a.m.

At 2:05 a.m. on March 31, a contact measurementon the reactor building equipment hatch gave areading of 60 r/h. At the same time, contact readi ngs on the waste gas decay tanks WDG-T1A and1B gave 40 r/h. [These high readings do not meanthat radioactive materials were being released atthese locations. They do, however, indicate that intensely radioactive materials were contained in thereactor building and decay tanks.]
The pressurizer was vented to the reactor buildi ng from 1:45 a.m. and 3:15 a.m. Venting was thenstopped while the hydrogen recombiner was placedi n operation.
At 3:25 a.m. on March 31, the shift superintendent, shift foremen, and control room operators reviewed the emergency procedures for loss of theremaining reactor coolant pump. [This does notmean that the loss of the pump was expected; however, it was recognized that stoppage of the pumps
could worsen the situation if not promptly countered.]

Release of hydrogen was accomplished with aminimum loss of coolant by cracking the vent valve
open, while simultaneously using the pressurizer
heaters and spray.
March 31,1979-1:44 p.m.

Refilling of the BWST from TMI-1 was begun at
1:44 p.m. The method of filling was to use two sump
pumps to pump from the TMI-1 spent fuel pool to
the TMI-2 spent fuel surge tank, then to use thespent fuel cooling pump SF-PiA to pump the wateri ntermittently to the TMI-2 BWST. This transfer was
halted at 3:11 p.m. (at which time the BWST level
was up to 26.5 feet) to allow the TMI-1 spent fuelpool to be refilled.
By 5:41 p.m., the pressure in the makeup tank
MU-T1 had dropped to zero. The vent valve, MUV13, was closed, and radiation levels in the vicinityof the vent header dropped. At 6:58 p.m., the valve
was opened again to allow the makeup tank pressure to equalize, and the radiation readings increased. [The presence of radiation shows that theleak in the waste gas vent header was allowing gas
to escape even at low pressure.]
The size of the bubble was calculated every few
hours during the day by General Public Utilities(GPU) personnel, who used a simplified method of
calculation that ignored many factors. To obtain an
idea of the differences inherent in using different
methods of calculation, one can compare the GPU

March 31,1979-4:00 a.m.

At this time, exactly 72 hours after the accident
began, loop A cold-leg temperature was 282°F, RCS
pressure was 1060 psig, pressurizer level was 215
inches, and the level in the BWST was 18 feet. At
this time, the calculated decay power was 7.4 MW,
compared to 32.8 MW at 1 hour after turbine trip.
Pressures in the makeup tank MU-T1 were now
decreasing. At 5:46 a.m., the pressure was down to32 psig.
337

calculation with the results of a method derived byBabcock & Wilcox (B&W) which included corrections for many of the items ignored by GPU. Fromdata taken at 10:45 p.m., GPU calculated a bubble
size of 894 cubic feet. The same data used in the
B&W method gives a bubble size of 532 cubic feetwhen corrected to the same conditions.
[Even if one used the more exact method of calculating the bubble size, the inherent inaccuracy ofreading and transcribing the required pressure andtemperature measurements would make the estimation of bubble size subject to great uncertainty.
Much of this uncertainty could have been eliminatedif the measurements needed had always been put
on the utility printer. Some of the readings can bereconstructed from the computer printouts, butsome of the most important measurements areunaccountably missing.][In view of the inherent inaccuracy in themethods of bubble estimation, the differences in themethods used by different estimators, and the apparent casualness with which bubble data were acquired and recorded, it is understandable that there
were large differences in public statements on bubble size.]
April 1, 1979-12:29 a.m.

The pressurizer was also vented on April 1, at
about the same frequency as on March 31. Samples of the containment atmosphere were tested
several times during the day. The hydrogen content
remained about 2%, even with extensive venting.
At 12:29 a.m. on April 1, the turbine bypass
valves, which had previously been closed slightly,
were opened slightly. The purpose of opening
these valves was to bring the RCS temperature
down. Later, at 3:00 p.m. on April 1, the RCS pressure, which had exceeded 1000 psi, was reduced.
At 9:30 a.m., the contents of the miscellaneous
liquid waste holdup tank WDL-T2 were transferredto TMI-1.
Pressures in the waste gas decay WDG-1A and1B remained high. The pressure at 8:30 p.m. on
April 1 was 86 psig.
April 1, 1979-10:00 am.

At this time, the auxiliary boiler was lost for 2
minutes. Although auxiliary steam is needed forcondenser operation, the loss of the boiler for sucha short time did not represent any threat to smoothcooldown.
A calculation of bubble size by GPU at 1:15 p.m.
on April 2 showed shrinkage to 174 cubic feet. A
338

calculation by the B&W method based on identical
data showed no bubble in existence at this time.
Calculations performed in the course of this investigation indicate that the bubble was gone the night ofApril 1 (see Section II.C.2.d.).
April 2,1979-1:47 p.m.

The hydrogen recombiner was placed in service.
The recombiner removes a steady flow of air fromthe reactor building, causes any hydrogen in it torecombine with oxygen, and returns the hydrogenfree air to the reactor building.
The hydrogen recombiner had first been started
at 2:00 p.m. on March 30. Because there was ahigh radiation field in the neighborhood, however,operation of the recombiner was too hazardous for
personnel. Heavy shielding was placed around therecombiner and its connections.
April 3,1979-9:50 a.m.

The level in OTSG A was slowly raised to 97%.
[ Maintaining a high level on the secondary side of
the steam generator would make it easier to ensure
natural circulation if reactor coolant pump RC-P1A
were lost, or if this were not possible, to startanother pump.]
By midnight on April 3, the RCS temperature was
281°F, the pressure was 1050 psig, and all parties
agreed that the bubble appeared to be gone. [Itwould still not be possible to depressurize completely. Hydrogen was still dissolved in the water,and reducing the pressure would have caused someto fizz out as gas, which would have reestablished
the bubble.][Furthermore, there might have been some small
discrete patches of hydrogen caught up in the internal structure of the reactor vessel. Reducing pressure could have caused these patches to expand
and coalesce. The problems associated with hydrogen in the RCS, though, were now minor.][It should also be mentioned that it is now understood that there could not have been appreciableoxygen in the bubble; hence, an explosion would
have been impossible. Even if there had been an
explosion, though, it does not appear certain thatthe reactor vessel would necessarily have beendamaged at all by it; and it appears highly unlikelythat the vessel would have been damaged to theextent that there would have been a serious releaseof radioactive material.][The confusion stemmed from the known factthat water slowly decomposes into hydrogen andRC-P1A tripped. Pump RC-P2A was successfully
started about 2 minutes later.
At 8:00 p.m. on April 7, the RCS pressure wasslowly lowered to 400 psig.
Stable conditions were established at 2:03 p.m.
on April 27, 1979, when RC-P2A was stopped andnatural circulation was established in both steam
generators. (Steam generator B was later isolated,
and adequate natural circulation was continued withsteam generator A alone.) At that time, there wereminor transients on some core thermocouples,
which subsequently settled down.
The achievement of natural circulation ended thereal emergency phase of the accident, but otherproblems have remained. The reactor building was
heavily contaminated with about 5 million gallons ofradioactive water, and the resulting waste disposal
problem has not yet been solved. (There were evena few areas in the auxiliary building showing higher
than normal radioactivity.) Perhaps most important,however, long term cooling of the badly damaged
core will be necessary.

oxygen in the presence of radiation. What was apparently ignored by, or unknown to, some analysts
is that when excess hydrogen is present, the reverse reaction (recombination) takes place at amuch faster rate. Oxygen would thus be used up
faster than it was formed, and no oxygen (otherthan minute traces) could ever appear in the bubble.][ By midnight on April 3, the decay power was
down to about 5 MW. This is a power density(spread over the entire reactor core in its original
undamaged dimensions) of 2.9 watts per cubic inch.
For comparison, a 60-watt light bulb produces
about 6 watts per cubic inch.]
April 4,1979 to April 7,1979

Degassing continued throughout April 4 and 5.
The pressurizer was being periodically vented into
the reactor building.
At 1:25 p.m. on April 6, reactor coolant pump

339

REFERENCES AND NOTESI Postaccident tests have not established that water in
the air lines would cause the valves to close. When thevalves were inspected later, however, they were found to
be closed.
2
Block valves are provided in many systems to allow
positive shutoff, especially where automatically operated
or throttling valves are used. Throttling valves adjust therate of flow of fluids and sometimes will not close absolutely tight. The block valve gives positive shutoff in caseof leakage of the control or relief valve.
3
The Integrated Control System (ICS), which controls
reactor and turbine power, senses several systemparameters and operates valves on the basis of theseparameters.
4
Many of the alarms indicate the approach of an
unusual condition, rather than anything dangerous. These

alarms are noted, but do not always call for immediate
action.
5
The failure of the condensate system did not impinge
directly on the accident. Constant problems in the condensate system did distract operator attention, however,
and may have led to additional confusion. See Section
I.C.2. and I.C.10. for further discussion.
6 Both pumps operating together will deliver between
850 and 1000 gpm, depending on system pressure.
7 There was no direct indication that the RCDT rupture
disk was broken. This could be inferred from the rapid
drop in RCDT pressure and the sudden rise in building
pressure.
8
Reactor building sump pump operation is typed out
on the alarm printer, but the printout of the alarm wasdelayed.

340

B RADIOLOGICALRELEASES AND THEIREFFECTS
Our evaluation included reviews of Met Ed's Final
1
Safety Analysis Report (FSAR) ; the NRC staff's
2
Safety Evaluation Report (SER) ; its Final Environmental Statement (FES) 3; pertinent design specifications and drawings of the Three Mile Island Station's
gaseous and liquid radioactive waste treatment systems; Met Ed's radiation protection program and radiological instrumentation; the radiological monitoring data collected by the utility, NRC, and others
who responded to the accident; and records andlogs of the operation. These reviews were supplemented with site visits to obtain increased familiarity
with the actual systems; interviews and depositionsof site radiation protection personnel and consultants; and discussions with representatives of thevarious government agencies responding to the accident.
A chronology of significant radiological and radiation protection events is contained in Appendix 11.6.

1. INTRODUCTION AND BACKGROUNDThe Three Mile Island Special Inquiry Group (SIG)
i nvestigated the radiological and health-related
aspects of the March 28, 1979 accident at TMI-2.
The principal objectives were to: (1) determine theimmediate causes of and mechanisms for release ofradioactive materials to the environment; (2) determine whether there were any direct sources of radiation outside the containment building during andsubsequent to the accident; (3) determine the magnitude, sources, and duration of the releases ofradioactive materials as well as any radiation leakage; (4) evaluate actions taken to mitigate releases
and exposures; and (5) assess the radiologicalconsequences of these releases and exposures toradiation on the health and safety of the exposed
populations (both on site and off site).
To accomplish these objectives, the SIG
evaluated the radiological and health-related conditions before, during, and after the accident. Thei nquiry examined the role of Met Ed, the role of the
NRC in licensing and inspection, and the effort of
the utility, industry, NRC, and other Federal andState agencies in response to the accident.

a. Principal Findings and Recommendations
We found numerous deficiencies in radiation protection practices and procedures, equipment,341

radwaste system, personnel training, and in the attitudes of both Met Ed and the NRC toward radiation
protection and radiological health. These deficiencies are described in detail below. The principal
findings and recommendations are as follows.

Findings• There were numerous deficiencies related to radiation protection and radiological health; however, few, if any, of the deficiencies were causal
factors in the TMI-2 accident.
• Even though the design bases of the radwaste
systems were exceeded, the systems provided
significant mitigation of the releases.
• The "defense-in-depth" concept, used in the regulatory process, was shown to be valid in mitigating the radiological consequences of the accident.
• The radiological consequences of the releases ofradioactive material from TMI-2 into the environment are minimal at worst and may be nonexi stent. Therefore, public concern regarding theeffects of releases of radioactive materials from
TMI-2 is not warranted.
• At Three Mile Island Station, a conflict existed
between operations and radiation protection due
to management's motivation toward production.
As a result, radiation protection was perceived asa "necessary evil," and considered secondary to
production.
• NRC failed to give sufficient attention to radiation
protection and radiological health matters.
• The NRC review and inspection process in thearea of radiation protection focused on conduct
of normal power operation. Radiation protectionin accident situations, such as existed at TMI,
was not considered in the licensing review or inspection program.
Recommendations• The role of radiation protection at commercial
nuclear power reactors must be given greater
emphasisbytheCommission
andlicensee/applicants.
• The NRC must give additional emphasis to radiation protection and radiological health, and mustchange its organizational structure to improve
management effectiveness to ensure that theagency's mandate "to protect the public healthand safety" is fulfilled.

• Radiation protection programs at existing reactors should be reexamined to ascertain whether
they are adequate to cope with normal and emergency conditions.
• The public must be fully informed of the mannerby which nuclear powerplants are designed,li censed, and operated, and of the actual risks
associated withradiation and radioactive
materials.

b. Technical Background
The following sections summarize the technicalaspects of production, retention, and release of radioactive materials in a nuclear powerplant. Thosematerials behave in accordance with their known
physical and chemical characteristics. The radionuclides (radioactive atoms) released from the plant
were primarily the noble gases and a small amountof radioiodine. The nonvolatile and water soluble
materials were not released in any measurable
quantities.
Radioactive Materials Produced by or in Nuclear
Power Reactors-The primary source of energy in a
nuclear reactor is the fission (breaking apart) of thenucleus of a uranium or plutonium atom. The production of radioactive materials is the natural consequence of the fission process. Additional energy(about 5%) is produced by the radiation emitted
from these radioactive materials. This energy continues to be released after termination of the chain
reaction (decay heat).
The radionuclides produced by the fission process are isotopes of elements found in nature. An
i sotope of an element has a different atomic mass
but has the same chemical properties as anotheri sotope of the same element. Therefore, the physical and chemical behavior of fission products andother radioactive materials produced in the reactor
can be predicted. From this knowledge, the potential release, transport, and biological behavior ofeach fission product can be determined.
Fission Product Behavior-In a power reactor, there
are several barriers to prevent the fission products
from entering the working areas and the general environment. The ceramic fuel matrix in which the fission products are produced provides the first suchbarrier. Those elements that are volatile or gaseousat the operating temperature of the fuel are able tomigrate through the ceramic fuel. However, the maj ority of the fission products produced is retained,342

either trapped or chemically bound. Examples of
elements that are volatile, gaseous, or chemicallyunreactive with the fuel material are iodine, xenon,
krypton, ruthenium, and cesium.
The second barrier to the release of the fission
products is the fuel cladding. The ceramic fuel pell ets are placed within thin walled tubes and sealed.
Zircaloy was used for the fuel tubes in the reactors
at Three Mile Island Station. There is a small gap
between the fuel and the cladding in which the noble gases and other volatile niiclides collect and arecontained.
The third barrier to the release of the fission product radionuclides is the reactor coolant. Many ofthe volatile fission products, the radioiodines andother radiohalogens, are soluble in the coolant ini onic (electrically charged) form. These materials
can be removed by demineralizers such as those in
the makeup and purification system of the reactor,
or remain dissolved in the coolant. The majority ofthese radionuclides is contained within the primarycoolant system. Other radionuclides such as thebariums, strontiums, and cesiums are also soluble inthe coolant. However, the solubility of these radionuclides is dependent upon the pH of thecoolant. As the pH of the primary coolant is increased (becomes more alkaline), their solubility decreases and they tend to precipitate or plate out.
The noble gas radionuclides (kryptons and xenons)
have very low solubility in the coolant, particularly athigh temperatures and in the presence of othergases such as hydrogen, and evolve into a gas orvapor phase above the coolant or wherever thecoolant is depressurized.
The fourth barrier to the release of fission products is the reactor pressure vessel and the pipingof the primary coolant system, which are made ofheavy walled steel. The fifth barrier is the containment building that houses the reactor. The containment building is designed to withstand overpressurization and external impacts and contain or delay
fission product releases during an accident.
Release of Radionuclides into the Coolant during
Normal Operations-If a defect in the fuel cladding
develops, volatile fission products can be released
i nto the coolant. NRC generally allows operation ofa reactor with up to 1% of the fuel having a defect inits cladding.
I n the absence of defective fuel elements, a small
background concentration of fission products exists
i n the primary system. This background concentration results from the fissioning of trace quantities ofuranium (termed tramp uranium) in or on the fuelcladding material.
343

In a reactor, many radioactive materials are produced in the primary system by capturing excess
neutrons available from the fission process. In thefuel, several isotopes of plutonium are ultimately
produced as the result of neutron capture by 238 .
Several "activation products" are produced
as
a
16
13
result of neutron irradiation of water; e.g., N, N,
and 18F.
Minute amounts of material due to corrosion of
the structure of the primary coolant system are carried by the water into the reactor core andactivated-the resulting radioactive
materials
are
60
58
59
calledcorrosion
products;
e.g.,
Co,
Co,
Fe,
54
and Mn.
Radioactive Materials Released As a Result of theTMI-2 Accident-The radioactive materials released
to the environment as a result of the TMI-2 accident
were those that escaped from the damaged fuel andwere transported in the coolant via the letdown line
into the auxiliary building and then into the environment. The noble gases and radioiodines, becauseof their volatile nature and large concentration, were
the primary radionuclides available for release fromthe auxiliary building.
Because the releases occurred primarily througha series of filters including charcoal filters designed
to remove radioiodines, the released materials consisted primarily of the noble gas isotopes of krypton
and xenon. Two krypton isotopes, 87 and 85, were
not released in any significant
quantities because of
87
the
short
half-lifeofKr
andthe small amount of
85
Kr in
the
reactor
core.
It
would
be anticipated
131
1351
that
1, 133 1, and somewould have beenreleased from the plant due to their abundance andhalf-life. Several onsite
and133
offsite measurements
1311
were made for bothand1, and these radionuclides were detected in some onsite samples on
March 28. 4 Since the radioiodine releases were filtered and the primary radioiodine releases did not
occur
until several days later, the concentrations of1331
thereleased to the environment were significantly reduced.
The principal release of radioactive noble gases
occurred on the first day of the accident, March 28.
The total quantity of released radioactive materials
is estimated as 2.5 million Ci. (See Section II.B.2.f.)Table II-1 shows the calculated core inventory at theti me of reactor shutdown, the estimated quantity
released and the fractional contribution of each radionuclide to the total release.
135
After the first day, the 88Kr and the
Xe concentrations were reduced by radioactive decay tol ess than detectable concentrations. All of the 133 I
contained in the primary coolant released to theTABLE II-1. Radionuclides released to the environment as a result of TMI-2 accident
Radionuclide
Kr-88
Xe-133
Xe-133m
Xe-135
Xe-135m
1 -131

Half-life

2.8 hours
5.2 days
2.2 days
9.1 hours
15.3 minutes
8.0 days

Quantity in Core atTime of Shutdown
5( Curies)
6.92 x 10 7
1.42 x 108
2.11 x 10 7
3.31 x 10 7
2.60 x 107
6.55 x 10 7

Estimated
Quantity Released( Curies)
3.75 x 10 5
1.58 x 10 6
2.25 x 10 5
3.0 x 105
2.5 x 104
15

Estimated Fractionof Total Release
0.15
0.63
0.09
0.12
0.01
"

'On an estimated fractional basis of total nuclides released, iodine-131 was very small(about 15 curies as opposed to about 2.5 million curies of noble gases). See Section II.B.2.f.
auxiliary building eventually decayed to 1 33Xe and1'
Xe, which composed the major fraction of theradionuclides released from the plant.

tems are included for the main condenser vacuum
pump discharge, the turbine gland seal condenser
discharge, the auxiliary building exhaust, the fuelhandling building exhaust, and the reactor building
purge unit. The auxiliary building and fuel handlingbuilding ventilation systems played a significant role
in reducing the release of gaseous radioactive materials resulting from the March 28 accident. The
reactor building purge system may play an important role in radioactive gaseous waste cleanup during recovery operations (Section II.B.2.h). The maincondenser vacuum pump and turbine gland sealcondenser discharges are normally released untreated but can be processed if the radioactivity inthis effluent becomes high. These two systems did
not contribute to or mitigate the March 28 releases
from Three Mile Island Station.
The process gas system collects and stores radioactive gases stripped from the primary coolant in
the letdown line, gases from the reactor building
vent header, and vent gases from equipment. The
low pressure vent header collects these gases andpipes them to one of two waste gas compressors,
40 standard cubic feet per minute (scfm), forcompression and storage in the gas decay tanks.
This storage allows radioactive decay prior torelease to the environment. Releases are directed
through a high efficiency particulate air (HEPA) filter
to remove particulate material, and a carbon adsorber to remove gaseous radioiodine species.
The exhaust ventilation systems for the various
buildings treat the exhaust air prior to release to theenvironment by particulate filters and carbon adsorbers.
The auxiliary building heating and ventilation system for TMI-2 is a once-through air flow systemwith no recirculation. Because the auxiliary building
contains the makeup and purification system andthe gaseous and liquid radwaste treatment systems,a small but measurable amount of radioactive material is expected to be present in the air in the

2. RELEASE PATHWAYS AND MECHANISMS
The mechanism by which radioactive material left
the TMI-2 core and the pathways for release to theenvironment are discussed in this section. Thissection also describes: (1) the radioactive waste
treatment systems, designed to reduce the releaseof radioactive material to the environment during
normal and accident situations; (2) additional mitigating actions taken by Met Ed subsequent to theaccident; (3) calculations of quantities of radioactive
materials released in gaseous and liquid effluents forvarious time periods after March 28; and (4) the
postaccident radioactive waste at the Three Mile Island Station and the plans for its treatment.
a. Preaccident BackgroundIn the FES 6'7 and the SER E , the NRC staff concluded that the radioactive waste (radwaste) treatment systems at Three Mile Island Station were acceptable, based on conformance with Met Ed's
designs, design criteria, and design bases to applicable NRC regulations and regulatory guides, aswell as with staff technical positions and industry
standards. The NRC staff also concluded that thesesystems satisfied the requirements of Appendix I to
10 C.F.R. 50, for maintaining releases "as low asreasonably achievable" (ALARA).
gaseousRadwaste System - The
radwaste system for TMI-2 processes gaseous
wastes based on their origin and expected radioacFigure 11-9 shows the gaseous
tivity levels.
radwaste and ventilation systems. Filtration sys-

Gaseous344

FIGURE 11-9. Ventilation and Waste Gas System Release Pathways
The process gas system collects and stores the radioactive gases stripped from the primarycoolant in the letdown line and also the gases from the reactor building vent header andvent gases from equipment. The low pressure vent header collects these gases and pipes
them to one of two waste gas compressors (40 scfm) for compression and storage in thegas decay tanks. This storage allows radioactive decay before release to the environment.
Releases are directed through a HEPA filter, to remove particulate material, and a carbon
adsorber, to remove gaseous radioiodine species.
The exhaust ventilation systems for the various buildings treat the exhaust air before
release to the environment by particulate filters and carbon adsorbers as indicated.

building because of normal component leakage.
Accordingly, there is a cleanup system for the buildi ng exhaust that maintains the release of this radioactive material to the outdoor environment at alevel that is as low as reasonably achievable(ALARA). There are two 30 000-cubic feet per
minute (cfm) air filtration systems. Each consists ofa prefilter, a high efficiency particulate air (HEPA)
filter, a 2-inch-deep carbon adsorber, a second
HEPA filter, and a fan. Each filter train is equippedwith inlet and outlet dampers for isolation whenchanging filter components. All ventilation air fromthe auxiliary building is designed to be processed bythese cleanup components at all times-there is no
bypass line. The entire ventilation system isdesigned for continual use during normal operationof the reactor. It is not designed or intended for
postaccident operation, and there are no technicalspecifications for balancing of ventilation flows or inplace testing of the exhaust air filtration components. The TMI-2 auxiliary building ventilation
system is completely independent of the TMi-1 ventilation system.
The auxiliary building ventilation system underwent satisfactory functional and leak testing prior
to startup, 9 although the bypass dampers weresealed. The sealing of the dampers routed all ventil ation air through the cleanup components of thefilter system which resulted in degradation of thefilters over time due to the normal atmospheric contaminants. (See Section 11.B.2.g for further discussion on the bypass dampers and the effects of seali ng.) The auxiliary building filters are designed fornormal ventilation purposes only and do not haveany periodic inplace testing requirement.
The fuel handling building heating and ventilating
system for TMI-2 is a once-through air flow systemwith no recirculation. There is a cleanup system on
the exhaust for two reasons: (1) spent fuel is stored
i n the spent fuel pool, which releases small but
measurable amounts of radioactive materials to thefuel handling building environment; and (2) it is possible that a fuel handling accident may release significant amounts of radioactive materials to the fuelhandling building environment. It has two 18000cfm air filtration systems, each consisting of a prefilter, a HEPA filter, a 2-inch-deep carbon adsorber,a second HEPA filter, and a fan. Although a bypass
li ne is installed around these components to prevent
their degradation and to preserve them for postaccident situations, the filter systems had been manually valved into service prior to March 28. In fact,
since the completion of acceptance testing in
February 1978, all ventilation flow has been continuously routed through all the cleanup components. 10
Thus, we find that the carbon in the fuel handlingbuilding air exhaust filter system on March 28 was
degraded.
The fuel handling building ventilation exhaust system is an engineered safety feature systemdesigned to operate in a postaccident environment.
TMI-2 technical specifications issued in February
1978 require periodic inplace testing of the exhaust
units to verify that the systems are ready to perform
after an accident. However, exemptions to pertinent
sections of these technical specifications were
granted until the first refueling outage for TMI-2,
which has not occurred. The impact of these exemptions on releases of radioactive material subsequent to the March 28 accident is discussed below.
A basis for the exemptions was the NRC staff assumption that the ventilation systems were independent. However, the ventilation systems for TMI-1
and 2 are in direct communication. Accordingly,
any gaseous radioactive material present in either
spent fuel area will be exhausted via both fuel handling building ventilation units. In fact, all the design
aspects of the radiation protection review of TMI-2
were characterized by the NRC staff as being independent of TMI-1. 11 We find that the review of theTMI-2 ventilation system did not consider interties
with TMI-1.
All of the filtration systems and their initial chargeof activated carbon were supplied by Mine Safety
Appliances Company (MSA) of Pittsburgh, Pa. The
carbon did not meet the specifications of, and its
testing did not meet the recommendations of, NRC
Regulatory Guide 1.52 (Revision 1, July 1976). The
carbon did meet GPU specifications that required a
removal efficiency of 99.95% for elemental iodine
and 85% for methyl iodide when the new (unused)carbon was tested at a relative humidity of 90% andhad a residence time of 0.25 seconds. The technical specifications for the fuel handling building exhaust filtration units require, in accordance with Regulatory Guide 1.52 (Revision 1, July 1976), a removal efficiency of 99.9% for elemental iodine and 99%
for methyl iodide. As supplied, the MSA carbon (acoconut shell based carbon impregnated with stableiodine, as KI3, to increase the efficiency for organici odide removal) did not satisfy the applicable technical specification requirement of 99% for methyl
i odide removal, but did satisfy the licensee specification of 85% (the actual test result was 96.97%).
The NRC's Office of Nuclear Reactor Regulationagreed in February 1978 to allow the installation ofthis carbon until the first refueling outage for TMI-2.
The TMI-2 operating license allowed anothertechnical specification exemption pertaining to thetesting frequency for the installed carbon. Engineered safety feature air filtration systems are re12
quired by standard technical specifications to have346

a representative sample of carbon removed every
720 hours of filter system operation and tested in alaboratory to verify that the radioiodine removal capability has not been seriously degraded. The
operating license also exempted this section. The
carbon did not meet the applicable requirements at
i nstallation in February 1978, and was not periodically tested to verify its condition. Thus, we findthat the degraded carbon contributed to greater radioiodine releases than would have occurred had
the carbon filters met all NRC requirements.
The fuel handling building exhaust system is the
only engineered safety feature air filtration system
at TMI-2 designed to prevent releases of radioiodine
to the environment after an accident and, therefore,
was the only air filtration exhaust system coveredby the TMI-2 technical specifications. Met Ed did,
however, install the same grade of carbon qualified
to the same specification in all of the TMI-2 air filtration systems.
The filters and cleanup components for the fuelhandling and auxiliary buildings were installed andtested in place in February 1978 and were not tested or inspected thereafter. Final painting and cleanup of these buildings between February and December 1978 generated significant amounts offumes and aerosols that degraded the cleanup components. The components would most likely havebeen replaced had inplace testing occurred andshown degradation of the filters. We find that thedesign and testing of these filter systems did not
permit the condition of the filters and leakage
around the filters to be identified at any time fromi nitial functional testing.
The lack of periodic inplace testing was due to (1)the technical specification exemptions on the fuelhandling building filtration system, and (2) the lack ofrequirements for periodic inplace testing of the auxili ary building filtration system, because the filtration
system is not considered to be an engineered safety feature system in the NRC licensing review process. Based upon postaccident determinations offilter carbon efficiencies, we find that radioiodine
releases were higher than those releases might
have been with NRC requirements for periodic inplace testing and carbon in the filter system. We
find, also, that these radioiodine releases werehigher by approximately a factor of 5, which is esti mated from an analysis of expected removal efficiencies with inplace testing (95%) versus measured
efficiencies (approximately 75% as shown in Table
11-4).
The reactor building air purge has a capacity of
50000 cubic feet per minute. Cleanup components
i n the system are a prefilter, a HEPA filter, a 2i nch-deep carbon adsorber, and a second HEPA
347

filter. This filter system was not used in response to
the March 28 accident, but may be of importanceduring recovery operations when, and if, the containment structure is purged (see Section II.B.2.h).
Liquid Radwaste System - The liquid radwaste
treatment system for TMI-2 consists of equipment
and instrumentation necessary to collect, process,monitor, and recycle or dispose of radioactive liquid
wastes. The system is composed of three basic
subsystems: the makeup and purification system,
the miscellaneous waste system, and the industrial
waste treatment system. Prior to treatment in thesubsystems, wastes are segregated based on their
origin, activity, and chemical composition. Treatment is on a batch basis, after which samples areanalyzed to determine whether the waste is to beretained for further processing or discharged undercontrolled conditions to the Susquehanna River via
the blowdown system of the mechanical draft cooli ng tower. There were no releases of liquidradwaste by this normal discharge path during or
subsequent to the March 28 accident.
The makeup and purification system, as shown in
Figure 11-10, is used to maintain the quality andboron concentration of the primary coolant. A
stream of the primary coolant, termed the letdown,
is taken continuously from the reactor, treated, fed
to the makeup tank, and ultimately returned to thereactor. The letdown can be held up in any of threereactor coolant bleed holdup tanks.
The liquid radwaste treatment system treats theli quid radwaste prior to discharge to the environment. The letdown stream is a designed pathway
for primary coolant to enter the cleanup components in the auxiliary building.
The makeup tank, located downstream of thecleanup components, is designed to temporarily retain the treated letdown. The makeup tank contains
a manually operated vent (MU-V-13) to allow any
hydrogen overpressure to be vented. The standard
operating procedures specify an operating pressureof between 10 and 20 pounds per square inchgauge (psig). The operator vents hydrogen if thepressure is high, or adds nitrogen if the pressure islow. Since radioactive gases may be present in thevent stream, the vent is connected to the ventheader and the waste gas decay tanks. The makeup and purification system for TMI-2 is separated
from the TMI-1 system. Liquid radwaste generated
by operation of the makeup and purification system
i nclude the letdown (when the boron concentrationi s being lowered) and demineralizer regeneration
wastes.
The miscellaneous waste treatment system treats
the liquid radwaste collected in the containment andTABLE 11-2. Liquid releases from TMI-2
Release1 -131 (Curies)

Activation & Corrosion
Products (Curies)
Tritium (Curies)

March 28-31
1979

1st Quarter
1979
Jan.1-Mar.31

2nd Quarter
1 979
April 1-June 30

Calendar
Year
1978

Tech.
Spec.
Limit (Ci/yr)

0.11 *

0.20

0.13

0.39

10

0.11

0.55*

0.11

78

0.13

ND

0.0014

38

1 0"

NA

*Reported number is for TMI - 1 and 2 combined.
**The total fission, activation, and corrosion products allowed to be released in 1 year is 10 curies.
NA = Not Applicable
ND - Not Determined or Measured
operation were calculated on a design basis of fis14
Noblesion product leakage from 1% of the fuel.
gas releases from normal operations
were
estimat133
Xe from reactor
ed to be 6700 Ci/yr, primarily
131
1. The site (i.e.,building purges, and 0.01 Ci/yr of
TMI-1 and 2 combined) is allowed by technicalspecification15 to release as many as 220000 Ci/yrof noble gases (when calculated on a 133Xe dose
equivalence basis) and 0.05 Ci/calendar quarter of
131 1.

auxiliary building drains, laboratory and samplingdrains, demineralizer resin and filter sluice water,
deborating bed regenerants, and decontaminationand other miscellaneous wastes. These streams
are collected in holdup tanks, pumped through afilter to an evaporator, to a polishing demineralizer,
and then stored in test tanks for recycling ordischarge. The miscellaneous waste evaporator isshared by both TMI-1 and 2, and is physically located in TMI-1.
The industrial waste treatment system (IWTS) is
not expected under normal conditions to containli quids with any appreciable activity. Accordingly, it
is not evaluated by the NRC staff in its13review of theliquid radwaste treatment systems.
Figure II-11
shows that the sumps from the control and service
building, the diesel generator building, the tendon
gallery, and the turbine building are pumped to theI ndustrial Waste Treatment Plant. Minimal treatment
is provided by a filtration system before the wastes
are discharged. The effluent flows through a radiation monitor; however, there is no automatic shutoff
capability in the event of detection of levels exceeding technical specifications. A manually operated
valve is installed to prevent any discharge of liquid.
The industrial waste treatment system is not expected to contain radioactive material, and is not reviewed as part of the liquid radwaste system.

Projected release rates of radioactive material inliquid effluents were approximately 0.24 Ci/yr, excluding tritium and dissolved gases. TMI-1 and 15
2
combined are allowed by technical specification
to release as many as 10 Ci/yr, excluding tritiumand dissolved gases. The tritium release was esti mated to be 550 Ci/yr.
On March 28, 1979, prior to 4:00 a.m., the TMI-2
liquid radwaste treatment system was operating
normally. TMI-1 was returning to operations after arefueling outage, which generated liquid radwastethat required processing in order to continue startup. A spill of 20000 gallons of contaminated waterfrom the fuel transfer canal into the reactor buildingof TMI-1 near the end of the outage resulted in large
volumes of low level liquid radwaste from decontamoperations. Because there is no de minimis
i nation
16
leveI below which low level liquid radwaste can bereleased untreated, this volume was being stored,
which reduced the available liquid radwaste storage
capacity at Three Mile Island Station on March 28.
I mmediately prior to the accident, approximately
60% of the station's available liquid radwaste
storage capacity (300 000 gallons per unit) was
filled. Of particular importance, the auxiliary building
sump was approximately 63% full, the auxiliarybuilding sump tank (WDL-T-5) was approximately
76% full, the two contaminated-drains tanks (WDLT-11A and 11B) were 77% and 24% full, respectively,
and the three reactor coolant bleed holdup tanks,b. Radwaste System Status at the Time of theAccident
I n its review of the radwaste systems, the NRC
staff calculated source terms for gaseous and liquid
effluents and used these source terms to calculate
the individual and population radiation doses expected to result from normal operations, including
67
anticipated operational occurrences. ' Expected
releases of radioactive material during normal
348

FIGURE II-10. Liquid Radioactive Waste Treatment System
The liquid radwaste treatment system treats the liquid radwaste before release to theenvironment. The letdown stream is a designed pathway for primary coolant to enter thecleanup components in the auxiliary building.
capacity for the site. Accordingly, we find that fornormal operations the liquid radwaste storage andtreatment system was marginal at best.
Prior to March 28, 1979, the gaseous radwaste
system and the heating and ventilating systems had
satisfactorily undergone
numerous functional and17
acceptance tests
However, a number of mainte-( WDL-T-1A, 18, and 1C) each of 83 000-gallon capacity, were 40%, 61%, and 61% full, respectively.
Although there was minimal input of liquid radwastefrom TMI-2, 60% of the Three Mile Island Station's
li quid radwaste tank capacity was not available on
March 28. We attribute this to the lack of a deminimis release level and insufficient processing
349

FIGURE II-11. Unit 2 Industrial Waste Treatment System
The industrial waste treatment system is not expected to contain radioactive material andis not reviewed as part of the liquid radwaste system.
nance work requests for the waste gas systemwere outstanding at the time of the accident. Bothwaste gas compressors (WDG-P-1A and 1B) needed
service for various conditions (described in maintenance requests as "over pressurized," "makes loudnoise," "no seal water level," "level control pump
operation")18 These compressors leaked during the
March 28 incident. In addition, makeup tank ventvalve MU-V-13 was suspected to be leaking. 19
Operation of compressor A resulted in releasesof gaseous radioactive materials to the auxiliary andfuel handling buildings with each venting of the
makeup tank to the waste gas decay tanks. The
radioactive noble gases in this leakage were notheld up in the decay tanks and were released untreated to the environment. Compressor B, which
was to be operated only in an emergency because

it was considered to be in poor condition, 20 was not
used until Thursday, March 29 and therefore, leaks
i n this compressor were not significant. We findthat the leaks, particularly in compressor A, which
led to the release of small amounts of radioactive
material during normal operation, led to releases ofradioactive material after core damage.
c. Liquid Release Pathways
The only release of radioactive materials in liquid
effluents was via the industrial waste treatment system (IWTS) shown in Figure II-11. These releases
were discharged to the Susquehanna River. Since
radioactive material is not expected in its input
streams, the IWTS is not designed to collect or pro350

and analysis, discharges from the IWTS have continued, the overwhelming majority being blowdown
from the mechanical draft cooling towers. Low activity water from TMI-1 that has been processed
through a demineralizer cleanup system has also
been discharged. However, none of the liquidradwaste in the TMI-2 auxiliary, fuel handling, andcontainment buildings has been released (see thediscussion on Recovery Operations in Section
II. B.2.h).
We find that the quantity of radioactive material inli quid effluents thus far released as a result of the
March 28 accident at TMI-2 was not significant.

cess radioactive material. The IWTS is designed tocollect sump liquid from the various buildings, provide minimal filtration, and discharge the sump water
i n the cooling tower blowdown.
Several times on March 28, Met Ed sampled theprimary coolant and secondary system water fromboth steam generators to determine plant conditions. Because the sampling room is shared byboth units and is located in TMI-1, the TMI-2 sample
li nes are several hundred feet long. This necessitates flushing and recirculation of each line for 45
minutes prior to sampling to obtain a representative
sample. These actions resulted in significant
amounts of highly radioactive liquid entering thecontaminated-drains tanks in the control and service building (total capacity approximately 5000 gallons). The two tanks (already 77% and 24% full) received greater amounts of liquid than normally expected, and overflowed to the control and service
building sumps, which were pumped to the IWTS for
discharge because minimal liquid radwaste tankcapacity was available. We find that the radwaste
liquid storage capacity at the Three Mile Island Station was inadequate to cope with the emergency
operations.
A second mechanism for release of liquid containing radioactive material was through the turbine
building sump. Leaks between the primary coolant
and secondary coolant, caused by steam generator
B tube failures, contaminated the secondary side of
TMI-2. Contaminated steam leaked from the turbine
to the turbine building sump, and was then pumped
to the IWTS.
From March 28 at 4:00 a.m. to March 30 at 12:00
midnight, approximately 265 000 gallons werereleased via the IWTS. Much of this volume consisted of preaccident water and Unit
13111 water. it contained approximately 0.073 Ci ofwhich was the
only measured radionuclide. Fromtheperiod March
181
28 through April 30, 0.23 Ci of
1, 0.24 Ci of all activation and corrosion products, and negligible
Theseamounts of tritium were released. 21
releases, although above normal, did not approachany technical specification action limits (see Table
11-2).
Discussions were held among Met Ed, the NRC,
HEW, and various State agencies regarding termination of releases of liquid via the IWTS as early as
Thursday, March 29. The purpose of the discussions was to verify that releases were within technical specification limits, and no liquid discharges
were permitted for approximately 24 hours beginning at approximately 6:00 p.m. on March 29, to all ow time to establish acceptable surveillance andmonitoring activities. With an increase in samplingd. Transport of Radioactive Materials out ofContainment
Following the turbine trip, the open pilot-operated
relief valve (PORV) on the pressurizer permitted
reactor coolant, at high temperature and pressure,to fill the reactor coolant drain tank. Fifteen minutes
after the turbine trip, the reactor coolant drain tankrupture disc, which had a setpoint of 192 psig, failed
and primary coolant flowed to the reactor building
sumps. As a result, the reactor building sump
pumps started automatically and transferred at most
8100 gallons to the auxiliary building sump tank.
These pumps were manually turned off at 4:38
a.m. 22 Since the available capacity of the auxiliarybuilding sump tank was only 700 gallons, liquid
overflowed to the auxiliary building sump, whichcaused water to back up through the floor drains inboth the auxiliary and fuel handling buildings.
This liquid did not contain large amounts of radioactive material because significant core damage
did not occur until after 6:00 am. However, theliquid proved to be a means for highly contaminatedreactor coolant to travel into areas of the auxiliary
and fuel handling buildings as the accident progressed. A second, larger source of water that was
not contaminated, but compounded the spread ofradioactive material in the two buildings, was leakage from the four river water pumps (RR-P-1A, 1B,
1C and 1D) located on the 280-foot elevation of theauxiliary building. These pumps, which provide
cooling water to plant components, leaked gallons
per minute.
After core damage occurred, radioactive material
was transported out of the reactor by the letdown
li ne of the makeup and purification system. Because the letdown is a stream of primary coolant
directly from the reactor, it contained significant
amounts of radioactivity.
351

It was necessary to maintain some letdown flow
to the makeup and purification system to ensure
safe cooldown of the reactor between March 28
and April 2, 1979. As a result, leaks in the makeup
and purification system (located in the auxiliarybuilding), which release small amounts of radioactive
material in normal operation, released large amountsof radioactive material during the accident, eventhough the letdown flow was reduced from its normal volumetric flow of 45 gallons per minute toabout 20 gallons per minute. The letdown flow was,i n fact, the major path for transferring radioactive
material out of the reactor.
We find that leakage of radwaste system components, particularly in the makeup and purification
system, which contained small amounts of radioactive material during normal operation, led to themost significant releases of radioactive material
after core damage occurred. This source of liquidradioactivity was released to the auxiliary building
and uncontaminated water spread over the floors of
the auxiliary and fuel handling buildings.
e. Gaseous Release Pathways
The TMI-2 stack was the main release point forgaseous effluents. Numerous pathways to the stackexisted for the release of radioactive gaseous effluents. The release pathways from the reactor to
the auxiliary and fuel handling buildings are shown in
Figure 11-12. Figure 11-13 shows the general arrangement of buildings at the site, and the TMI-2 stack.
The release of radioactive gases into the auxiliary
and fuel handling building occurred by direct gas
leakage and leakage of radioactive liquid from whichradioactive gases evolved. Direct leaks of radioactive gas were the major source of radioactive gaseous releases.
Leaks in the vent header system and the waste
gas decay system were the primary mechanisms forthe direct release of gaseous radioactive material.
The high pressure in the reactor coolant drain tank(up to 192 psig) prior to rupture disc failure led to asequence of events that created a significant
release pathway for gaseous radioactivity throughthe vent header.
The reactor coolant drain tank was connected to
the vent header via two paths. Pressures in thereactor coolant drain tank prior to rupture discfailure pressurized the vent header. Before the rupture of the reactor coolant drain tank relief at 4:15
a.m., the radiation monitoring system detected activity that indicated that the waste gas vent header352

was leaking. Subsequent inspection
has identified
23
six leaks in the vent header system.
The high pressure in the reactor coolant draintank (up to 192 psig) prior to rupture disc failure led
to a sequence of events that created a significant
release pathway for gaseous radioactivity.
The vent line from the reactor coolant drain tankto the vent header was open on March 28, as indicated by the open status of valves WDL-V-126 and
V-127. 24 The high pressures in the reactor coolant
drain tank forced liquid (primary coolant) through thevent line to the vent header. The vent header relief
valve (WDG-R-3) is set at 150 psig, so water underpressure caused leaks in the water drains. Thiswater also damaged some of the 10 check valveslocated between the vent header and connectedtanks (such as WDG-V-113 to the reactor coolant
bleed holdup tanks, or WDG-V-153 to the reactor
coolant evaporator). These check valves aredesigned to permit flow only from the component tothe vent header and not in the opposite direction,
but are known to operate inefficiently and fail easily.25 Therefore, a significant pathway existed fromthe vent header to a number of tanks. The relief
valves on these tanks, which were set at relatively
l ow pressures (reactor coolant bleed holdup tank at
20 psig, reactor coolant evaporator at 10 psig),
opened. Lifting of these relief valves resulted in untreated releases directly to the stack via the relief
valve vent header (shown in Figure 11-12). We findthat the gaseous radwaste system design included"relief to atmosphere," which provided a path to theenvironment for untreated gas. We find, also, thatthe high reactor coolant drain tank pressures
between 4:00 and 4:30 a.m. on March 28 damaged
portions of the vent gas system and resulted in agaseous release pathway to the vent header,through failed check valves to components with
low-pressure relief valves. Once established, thisrelease path was available whenever the ventheader was used, such as in the venting of the
makeup tank.
Problems with the waste gas system compressor
have already been discussed. A postaccident examination of compressor B found a hole approximately the size of a quarter. The operation of thecompressor at any pressure would be considered asignificant release path. 23 However, compressor B
was off line from March 28 until March 29. 26 In addition, the design of the waste gas system includes
a pressure regulator (WDG-V-59) that limits the inlet
pressure to the compressors to approximately 1
i nch of water gauge. This prevented any high pressures in the vent header from reaching theFIGURE 11-12. Release Pathways
Continued operation of the letdown transferred primary coolant from the reactor tocomponents in the auxiliary building. Pressure buildup in components due to degassing of
the hydrogen and noble gases in the letdown system caused gaseous leakage to theauxiliary building and operation of relief and vent valves to release gaseous radioactivity
to the auxiliary and fuel handling buildings and to the environment.

compressors. These two factors lessened the significance of the release pathway presented by theleaking waste gas system compressors.
Two minor gaseous leak paths existed-a failed
rupture disc on the auxiliary building sump tank, andpossible leakage of makeup tank vent valve MU-V13. The sump tank rupture disc had failed prior to
the accident, and any gaseous activity in the tank
was released to the auxiliary building environment.
This rupture disc has not been repaired. It has notbeen possible to verify whether leaks in MU-V-13

exist because of the high radiation levels in thearea.
The radioactive noble gases and a small fractionof the iodines present in the water on the auxiliarybuilding floors escaped into the building. This offgassing occurred primarily for the noble gases, be27
cause the iodines tend to remain in solution.
On
Thursday morning, March 29, Met Ed recognized
this pathway and attempted to minimize thereleases of radioactive noble gases by placing
sheets of polyethylene over the water. These pro-353

FIGURE 11-13. General Building Arrangementsures of greater than 30 psig were observed) on the
bleed holdup tanks would open. The opening of thetanks would permit an uncontrolled release of gaseous radioactive material to the environment via therelief system.
A decision was made to vent the makeup tankcontinuously in an attempt to reduce pressure. During the morning of March 30, 1979, this action was
suggested by Control Room Operator Craig Faust,
and all personnel present in the TMI-2 control room
agreed. 29 At approximately 7:00 a.m. on March 30,
MU-V-13 was opened. A caution tag was placed on
the valve on March 31 at 11:15 p.m., stating, "Do not
move this valve without Supt. or Shift permission(per J. Herbein)."
The opening of MU-V-13 at 7:10 a.m. on Friday,
March 30 resulted in a momentary reading of 1200
mR/h, 130 feet above the TMI-2 stack. This reading
was the event that apparently triggered the Friday
evacuation recommendations. Leaving the valve
open provided a continual pathway for gaseous radioactive material to enter the auxiliary building.
Leaks in the vent header permitted the gases toenter the auxiliary and fuel handling buildings and be
discharged through the stack. Since letdown flow is
still being maintained, this release pathway still exi sts. However, all short-lived radionuclides in thereactor coolant have undergone significant decay
since March 28, and releases of radioactive material
from Three Mile Island Station are now negligible.

tective efforts did not provide any substantive mitigation of releases because the sheets were not airtight.
Each time the makeup tank was vented, the radiation levels inside and outside the plant increased.
The pathway for the gaseous activity from the
makeup tank venting process and for other component vents is shown in Figure 11-12. Cleanup components in the letdown and the makeup tank have
manually operated vents that discharge to the ventheader. During normal operation, vented gases areheld up and filtered prior to release.
The makeup tank has a liquid relief to the reactor
coolant bleed holdup tanks. The tank is designed tooperate with approximately one-third of its volume
as a gas space to allow gases from the cooled anddepressurized primary coolant to evolve and be collected. Collection of noncondensible gases in the
makeup tank caused a reduction in the letdown flow
because of pressure buildup. This reduction of letdown flow became a concern in the early morningof March 29. As a result, manual ventings of the
makeup tank to reduce pressure began at 4:35 a.m.
on March 29. The venting process consisted ofshort bursts, with vent valve MU-V-13 being cycledopen for short periods of time to minimize leakageof radioactive material. According to William Zewe,
Shift Supervisor, venting of the makeup tank occurs
only once every 2 or 3 months during normal
operation to remove nonradioactive noncondensible
gases and there is no standard operating procedure28
for venting the tank.
Nonetheless, on March 29,
Met Ed wrote and approved operating procedures
20
for the periodic venting of the makeup tank.
The rate of pressure buildup in the makeup tank
became too rapid to control with the cyclic opening
of MU-V-13 during early Friday morning, March 30.
The liquid relief on the makeup tank opened, allowi ng all of the contents in the tank to flow into thereactor coolant bleed holdup tanks. The makeup
pumps (MU P-1A, 1B, and 1C) then switched suction
to the borated water storage tank. This water
bypassed the primary system and was recirculated
to the makeup tank and to the reactor coolant bleed
holdup tanks through the open liquid relief valve,thus depleting the supply of borated water.
It was crucial to reduce the pressure in the
makeup tanks at this time for two reasons. First,
the supply of borated water in the borated water
storage tanks was being depleted. This supply was
the only readily available source of borated waterfor continued boron control of the primary coolant.
Second, the increase in pressure in the reactor
coolant bleed holdup tanks through the open relief
valve on the makeup tank increased the probability
that the relief valves (20 psig setpoint, but pres-f. Source Terms for Releases of Radioactive
Materials
Radiation monitor HP-R-219, located in the TMI-2
stack, is designed to measure the amount of radioactive material in the gaseous effluents of TMI-2.
The monitor detects radioactive material in particul ate form, radioiodine, and noble gas. The channels
that detect noble gas went off scale before 8:00
a.m. on March 28, and consequently the recorded
data are of little use in estimating a noble gas
source term from the accident. Releases of radioactive material in particulate form were negligible
because of the two banks of HEPA filters installed in
the auxiliary and fuel handling building air filtration
systems.

Radioiodine Source Term- I odine releases havebeen calculated by analyses of the charcoal cartridges of HP-R-219. Beginning on March 28, thesecartridges were periodically replaced. The cartridges that were removed were analyzed for their131
1 content. Table 11-3 shows the results of the analyses through May 8. There were six time periods
355

TABLE 11-3. 1-131 releases
Time PeriodTo
From0400 3/28
1900 3/28
1900 3/30
2200 3/30
0600 4/1
0315 4/3
1905 4/3
2232 4/3
1830 4/5
1516 4/6
0600 4/7
0245 4/8
0425 4/9
0925 4/9
1 608 4/ 10
1 8404/11
19204/11
2315 4/13
1 030 4/14
1915 4/14
05224/15
0804 4/15
1 802 4/ 15
2140 4/ 152346 4/15
04084/16
0758 4/16
11564/16
1 556 4/16
1 8104/16
23564/16
04024/17
08354/17
1226 4/17
1640 4/ 17
1 958 4/ 1723574/17
04054/18
05504/18
08004/18
09504/18
1204 4/ 181650 4/ 18
1823 4/ 18
23474/18
0358 4/ 1908034/19
1 2124/19
1 355 4/ 19
1728 4/ 19
2025 4/19
0001 4/20
0351 4/20
0821 4/20
1105 4/20
1 300 4/20
1620 4/20
2023 4/20
2249 4/20
0320 4/21
0404 4/21
0819 4/21

1 900 3/28
1 900 3/30
2200 3/30
0600 4/1
0315 4/3
1 905 4/3
2232 4/3
1 830 4/5
1516 4/6
0600 4/7
0245 4/8
0425 4/9
0925 4/9
1608 4/10
1 8404/11
1920 4/11
2315 4/13
1 030 4/14
1915 4/14
0522 4/15
08044/15
1 802 4/15
2140 4/ 1523464/15
0408 4/16
0758 4/ 16
1156 4/16
1550 4/ 16
1810 4/16
2356 4/ 16
04024/17
0835 4/ 17
1 226 4/ 17
1 634 4/ 17
1946 4/ 172357 4/ 1704054/18
05504/18
08004/18
0945 4/ 18
1200 4/ 18
1647 4/ 18
1823 4/ 18
2347 4/ 18
03584/19
0800 4/ 19
12104/19
1355 4/ 19
1 725 4/ 19
2025 4/ 190001 4/20
0351 4/20
0821 4/20
1105 4/20
1 300 4/20
1 620 4/20
2019 4/20
2204 4/20
0317 4/21
0402 4/21
0819 4/21
1201 4/21

Curies 1-131
Released for Time Period
0.22
3.90
0.24 3
0.31
1.57
0.13
0.09
1.15
0.03
3
0.36
0.51
1.17
0.23 30.05
0.12
0.01 30.39
0.24 3
0.19
0.24
0.08
0.51
0.09
0.05
0.10
0.08
0.07
0.05
0.09
0.13
0.04
0.05
0.03
0.03
0.06
0.07
0.08
0.05
0.05
0.02
0.01
0.03
0.01
3
0.07
0.05
0.03
0.03
0.00
0.05
0.05
0.04
0.11
0.10
0.05
0.05
0.04
0.04
0.03
0.03
0.03
0.02
0.02
2

356

Cumulative Curies 1-131
Released
0.22
4.12
4.36
4.67
6.24
6.37
6.46
7.61
7.64
8.00
8.51
9.68
9.91
9.96
10.08
1 0.09
1 0.4810.72
1 0.91
11.15
11.23
11.74
11.83
11.88
11.98
12.06
1 2.1312.18
1 2.2712.40
12.44
1 2.4912.52
1 2.55
12.61
1 2.6812.76
1 2.8112.86
12.88
1 2.89
1 2.92
1 2.931 3.00
1 3.05
1 3.081 3.11
1 3.11
1 3.16
1 3.21
1 3.25
1 3.36
13.46
1 3.5113.56
1 3.60
13.64
13.67
13.70
1 3.73
13.75
13.77

1

TABLE 11-3. 1-131 releases-Continued
Time Period
FromTo

1204 4/21
1628 4/21
2018 4/21
0105 4/22
0447 4/22
0807 4/22
1230 4/22
1624 4/22
2036 4/22
2130 4/22
0007 4/23
0358 4/23
0801 4/23
1223 4/23
1617 4/23
2014 4/23
2159 4/23
0004 4/24
0408 4/24
0642 4/24
0815 4/24
1 217 4/24
1600 4/24
1 958 4/24
0004 4/25
0520 4/25
0701 4/25
1 200 4/25
1557 4/25
2013 4/25
0016 4/26
0400 4/26
0805 4/26
1 220 4/26
1 606 4/26
1913 4/ 26
0011 4/27
0042 4/28
0832 4/28
1645 4/28
0028 4/29
0010 4/30
0000 5/1
0000 5/2
0000 5/3
0000 5/40000 5/50000 5/60000 5/70000 5/8

1 624 4/21
2017 4/21
0103 4/22
0441 4/22
0804 4/22
1229 4/22
1 621 4/22
2024 4/22
2130 4/22
0004 4/23
0406 4/23
0758 4/23
1 201 4/23
1614 4/23
2010 4/23
2156 4/23
0015 4/24
0404 4/24
0637 4/24
0813 4/24
1 215 4/24
1600 4/24
1 955 4/24
0001 4/25
0512 4/25
0658 4/25
1200 4/25
1555 4/25
2010 4/25
0013 4/26
0357 4/26
0802 4/26
1220 4/26
1 558 4/26
1913 4/26
00064/27
0038 4/28
0830 4/28
1 625 4/28
0025 4/29
0008 4/30
0010 5/1
0000 5/2
0000 5/3
0000 5/40000 5/50000 5/60000 5/70000 5/80000 5/9

Curies Iodine-131
Released for Time Period
0.02
0.02
0.03
0.02
0.02
0.02
0.03
0.04
0.00
0.03
0.03
0.02
0.02
0.05
0.01
0.01
0.01
0.02
0.01
0.01
0.01
0.01
0.02
0.01
0.01
0.00
0.01
0.01
0.01
0.01
0.01
0.00
0.01
0.00
0.01
0.01
0.03
0.00
0.01
0.01
0.05
0.04
0.04
0.01
0.01
0.01
0.01
0.01
neg.
neg.

Cumulative Curies 1-131 1
Released
13.79
13.81
13.84
13.86
13.88
1 3.90
1 3.93
1 3.9713.97
1 4.0014.03
1 4.0514.07
1 4.12
1 4.1314.14
1 4.1514.17
1 4.1814.19
1 4.20
14.21
14.23
14.24
14.25
14.25
14.26
1 4.2714.28
1 4.29
1 4.30
1 4.30
1 4.31
1 4.31
1 4.32
1 4.33
1 4.36
1 4.36
1 4.37
1 4.38
1 4.43
1 4.47
1 4.51
1 4.52
1 4.5314.54
1 4.55
1 4.56
1 4.56
1 4.56' Source of Data: TDR-TMI-116. "Assessment of Offsite Radiation Doses from the Three MileI sland Unit 2 Accident, July 31, 1979.
2
Based on auxiliary and fuel handling building release rates.
3
I nterpolated value from higher release rate for two surrounding time periods.

for which the charcoal sample cartridges were lostor not analyzed in a timely manner. In those instances, marked by an asterisk in Table 11-3, interpolated values were obtained by assuming that thehigher release rate for the time periods immediately
preceding or following the period of interpolation exi sted for the period of interpolation. The operationof the filter systems was not disturbed during these
periods, and this method of interpolation is therefore
considered to be conservative. Releases of radioiodine after May 8 were
negligible because of ra1311
dioactive decay of the(8-day half-life) and thei nstallation of higher efficiency filtration systems on
the auxiliary and fuel handling building exhausts.
We find that the calculated 13i1 source term for theaccident is approximately 15 Ci. with the timedependent
release rates as specified in Table 11-3.
1311
The
source term of approximately 15 Ci is in30
close agreement with that calculated by Met Ed
by a environmental consultant for Met Ed 31 and in
substantial agreement with a source term of approximately 27 Ci estimated by an air cleaning consultant [Nuclear Consulting
Services, Inc. (NUCON)
32
of Columbus, Ohio1.
The technique employed by
NUCON for calculating the iodine source term was alayering of the spent carbon trays,1311
analysis for 131 1,
then integration of the amount ofover the bed
depth, done independently for the auxiliary and fuelhandling buildings. NUCON acknowledged that theestimate was high, because the fuel handling buildi ng carbon trays with the highest, rather than average, activity were analyzed. The activity in thesetrays was two to three times higher than the average. When this is considered, the source term calculated is in close agreement with those alreadydiscussed.
1311
It is also possible to confirm thesourceterms
1311
by a calculation employing the amount of
captured by the different carbon adsorbers and themeasured efficiency of the carbon at various
operating conditions. Data on the various iodine
species (elemental iodine, methyl iodide, and hypoiodous acid) are available for an auxiliary building
air sample taken on April 8, 1979. 33 The removal efficiency of the various carbon adsorbers for these
species
at 95% relative humidity has been deter32,34
mined.
The total iodine estimated to bereleased as a result of these calculations is 32 Ci(see Table 11-4). This estimate is presented as an
upper bound for iodine releases, since carbon becomes less efficient for iodine species (particularly
methyl iodide) at relative humidities above 85%. The
estimate is high by approximately a factor of 2 to 3
because the highest, not average, activity carbon
cells from the fuel handling building were analyzed

to determine filter efficiencies for the various
species.
It should be noted that the highest relative humidity estimated to exist inside the auxiliary building
during and subsequent to the accident is 80%. Thisestimate is based on measured outside-humidity
conditions in Harrisburg at the time of the accident
and assumes a depth of 3 inches of water
throughout the floor of the 280-foot elevation in the
35
auxiliary building.
This fact also suggests that the1311
estimated
release of 32 Ci is high.
Data are also available for the removal efficiencyof the carbon installed at the time of the accident at
32
an operating condition of 30% relative humidity.
This was the lowest probable relative humidity inside the auxiliary building after the accident, and will
result in carbon performing at its greatest efficiency
for the removal of iodine species. Table 11-5 contains an estimate of the lower limit for the iodine
source term of 17 Ci. Since the fuel handling building trays are considered high in curie content, by afactor of 2 or 3, this correction (using 2 to 1) yields
an actual lower bound of 10 Ci as the iodine source
term. We find that the iodine source term of 15 Ci
as presented in Table 11-3 is substantiated by anumber of other independent analyses,
and is a
1311
valid estimate of the quantity of
released to theenvironment from the accident. Further, based on
the data in Tables 11-4 and 11-5, we find that anonengineered safety feature filter system designed
for normal operation only, i.e., the auxiliary building
exhaust ventilation filtration system, greatly reduced
the quantity of radioiodine released to the environment.
Noble Gas Source Term-The quantity of radioactive noble gases released because of the accident
was first estimated by a back-calculation based on
environmental
thermoluminescentdosimeters(TLDs). These TLDs provide the best estimate of
the integrated radiation dose at a specific location,and can yield a source term when an isotopic spectrum and meteorological conditions are considered.
This calculation, when done for various time periods
and TLD locations, results in an accident source
term of approximately 13 x 10 6 Ci of noble gas as
133Xe.36

A second method of calculating a noble
gas
37,38
source term is also based on TLD values.
In
this method, a set of trial release rates for each isotope is assumed, proportional to inplant area radiation monitors and a dose equivalence factor (average gamma energy per disintegration). With therelease rates and measured onsite meteorological
data for the time of the accident, gamma doses can
358

TABLE 11-4. Calculated 1311 releases at 95% relative humidity-----------------------Curies
CarbonCuriesFilter System
Species`
Captured
Efficiency
Released--------------Auxiliary
Building

A Train

Auxiliary
Building

B TrainFuel Handling1

2

CH 3 1
HOI

99.9

25%

3.0

99.8

4.8

69.5

0
2.1
0

35%

5.1

99.8

0.01

HOI

25%

3.6

99.7

0.01

35 °%°

1 2.8

97.2

0.37

25%

9.2

99.9

0.01

CH 3 1

1

2

CH 3 1

Fuel Handling

12

Building
B Train

4.2

40%

12

Building

A Train35%

HOI

CH 3 1
HOl

40%

4.8

40%

1 4.7

35%

40%
25%

56.0

75.6

1 6.9

98.5

1 2.0

99.3

1 9.3

49.1

4.6

4.7

0.26

20

0.28

Total
112
32
--------------------------------------*Assuming no other species present. and identical distributions in bothbuildings. Ignores 7.3x10 - 8 , Ci/cc particulates. The concentrations of these
species are 6.7x10 -8 1' Ci/cc for elemental iodine, 79x10 - 8! ' Ci/cc for methyl
i odide (CH 3 1 ), and 4.8x 10 81, Ci/cc for hypoiodous acid (HOP,

TABLE 11-5. Calculated 1-131 releases at TMI at 30% relative humidity
Filter System

Curies Captured

CH 3 1 Efficiency

Curies Released

1 4.6

88.8

1.8

Fuel Handling Building
A Train

36.7

97.1

1.1

Fuel Handling Building
B Train

48.3

78.7

1 3.0

Auxiliary Building
A Train
Auxiliary Building
B Train

Total

12

91.2

1.2

17

112

359

be computed for each onsite TLD monitor site forwhich exposures are available. A comparison of
calculated and measured exposures tests the accuracy of the calculated release rates. When a best fitof calculated versus measured exposures isobtained by varying the release rates, for each time
period with available data, the release rates areadded to present a total source term of 10 x 10 6 Ci
noble gases, 133with a radionuclide 135
content as follows:
6
6
8.3
x
10
Ci
Xe;
1.5
x
10
Ci
Xe; 1.7 x 10 5 Ci
133m
135mXe5
Xe; 1.4 x 10 Ci
and 6.1 x 10 4 Ci 88Kr.
The most reliable method of determining thereleases of radioactive noble gases would be via
direct measurement of releases from the TMI-2
stack. However, the radiation monitor (HP-R-219)
i nstalled on the stack for this purpose was designed
for normal operation only, and went off scale at approximately 7:45 am. on March 28. Direct measurement of the releases thus was not possible, andattempts were made to calculate the noble gas
releases by an indirect method.
Analysis of area radiation monitors showed thatan external area gamma monitor (HP-R-3236), located on the 305-foot elevation of the auxiliarybuilding, remained on scale for the duration of theaccident. This monitor is located between the tworeactor building purge air filtration units and isshielded from the operating air filtration units for theauxiliary and fuel handling buildings. The monitor
was sensitive to changes in the radioactive release
rates because it was close to the exhaust ductwork.
A review of the readout from HP-R-3236 shows its
highest reading (which was still on scale) after theaccident to be 6.5 R/h (at 11:00 p.m. on March 28).
A correlation between the reading on HP-R-3236
and HP-R-219, when both were on scale, permits
estimation of these releases from the stack for theduration of the accident. The known flow rate in thestack allows the calculation of the integrated noble
gas source term from the area gamma monitor( HP-R-3236). This calculation results in an estimateof 2.37 x 10 6 Ci of total noble gases being released
because of the accident. This method of calculation
was employed by the Presidential
Commission on
39
the Accident at Three Mile Island.
An isotopic distribution can be obtained by calcul ating the core distribution at the time of reactor
shutdown and decaying each isotope 3 hours toaccount for transit time to the building environments.
This calculation assumes all noble gas isotopes aretransported equivalently from the core to the buildi ng environments. The calculation
yields an esti133
6
mate
of
release
of
1.51
x
10
Ci
Xe;
0.35
x 10 6 Ci
88
135
133m
6
6
Kr; 0.28 x 10135Ci
Xe; 0.21 x 10 Ci
Xe; and0.01 x 106 Ci
Xe, which is consistent with theestimate made by the President's Commission. We

find this noble gas source term to be the best estimate because it is based on an extrapolation of
measured releases in proximity to the source andnot TLD exposures at remote locations.
g. Mitigation of Releases of Radioactive
Materials
The buildings and equipment at the Three Mile Isl and Station provided substantial mitigation of therelease of radioactive material to the environment.
The primary coolant absorbed significant quantities
of radioactive material. 40 Normal activity of the primary coolant is approximately 1 µCi/cm 3 and was
41
actually 0.4 µCi/cm 3 just prior to the accident.
During the accident, the activity increased to morethan 20000 µCi/cm 3. The containment structure
prevented large quantities of radioactive material
from being released. Six months after the accident,
there
were approximately 50000 Ci of noble gases(85 Kr) and 600000 gallons of contaminated wateri nside that structure. The piping and tanks in theauxiliary building also retained quantities of radioactive material. These provided either holdup, to allow
short-lived radionuclides to decay, or containmentof the radionuclides in a form that would allow treatment after the accident.
Additionally, a number of installed plant components were actively used after the accident to mitigate the release of radioactive materials. The mostimportant of these were the ventilation systems andthe exhaust air filters installed in the auxiliary andfuel handling buildings. As discussed in Section
II. B.2.a, these systems are designed to filter all of
the exhaust ventilation separately from these twobuildings prior to release through the plant stack.
The auxiliary building filtration system is designed
for normal operation only, and would be expected toremove 99% of particulate material and 90% of radioiodines. The fuel handling building filtration system is designed for both normal operation and use
after a fuel handling accident in the fuel handlingbuilding, and would be expected to remove 99% ofparticulate material and 95% of radioiodines for bothconditions. The systems are not designed for noble
gas holdup.
Both filter systems were in operation during thei nitial stages of the emergency. Attempts weremade to reduce releases of radioactive materials by
shutting off the exhaust fans a number of times
between March 28 and 30. These stoppages, however, resulted in increased radiation levels inside theplant, including the control rooms. The ventilation
systems have been in continuous operation since
March 30, except for minor maintenance periods.
360

The cleanup components installed in the filter
systems were built and purchased according to
specifications that the NRC staff found acceptable.
The specifications for the carbon (see Section
II.B.2.a) were acceptable to the NRC staff when reviewed in 1975. Prior to the accident, these specifications were upgraded and the quality of the carbon
42
used in TMI-2 would not be acceptable in 1979.
The HEPA filters satisfied Military Specification
MIL-F-51068, "Filter, Particulate, High Efficiency,
Fire-Resistant," 43 which is the industry standard.
The same quality HEPA filters were installed in bothof the filtration systems even though only the fuelhandling building system was designated as safety
grade.
The origina! design of the filter systems included
bypass dampers to allow ventilation air to bypass
the cleanup components during periods of low radioactivity, thus prolonging the component life.
However, testing of these dampers indicated thatthey leaked at a 15% rate. The dampers weresealed . 45 After sealing, testing proved satisfactory
but resulted in all air being directed through thecleanup components whenever the ventilation system was in operation. The dampers opened andshut sporadically during the accident, and we findthat the dampers did not permit the filter system tooperate as effectively as possible during the accident. The operation of these filter banks during
the year after completion of acceptance testing,combined with their exposure to paint fumes, resulted in degraded carbon being in the filters at the timeof the accident.
The condition of the filtration systems after theaccident was determined by two methods. The first
method involved analysis of building air samples
taken upstream and downstream of the filters. The
overall decontamination factor was 1.2. 33 As aresult, a decision to changeout the carbon in thefilter system was made. The changeout was completed in mid- to late April. The spent carbon was
sent off site for laboratory analysis by an independent consulting corporation. 32 The analyses indicated that, of the two filter trains, the fuel handlingbuilding ventilation exhaust system removed moreradioiodine than the auxiliary building systeii7. The
variablity in performance between these systems
was due to (1) an imbalance of ventilation flows(ventilation system balancing was never required or
performed); (2) a faulty inlet damper that would
sporadically open and shut; 46 and (3) the location of
the vent header in the auxiliary building, which
results in the air around the header actually being
ventilated by the fuel handling building system.
Samples of the carbon taken from trains A and Bof the auxiliary building and trains A and B of the361

fuel handling building ventilation systems were tested in accordance with Regulatory Guide 1.52 (Revision 1) with a pre-equilibration of 16 hours at thestated relative humidity. Tables 11-4 and 11-5 show
the results of these tests for removal efficiency ofthe carbon in place at the time of the accident. Removal efficiencies ranged from a low of approximately 49% for methyl iodide at 95% relative humidity in fuel handling building train B, to over 99.9%
for elemental iodine at 95% relative humidity in auxili ary building train A. Table 11-4 shows that a total of
112 Ci of 131 1 (all species) was captured by the carbon in the four filter trains. The amount of radioiodine captured is compared to a release of approximately 13 Ci (see Table 11-3) to the time of filter
changeout. We find that the filter systems installedat the time of the accident provided a decontamination factor of 9.5 (equivalent to an efficiency of
89.5%) for all species of iodine.
The carbon installed at the time of the accident
was also analyzed for water content and pH as afunction of bed depth. Low pH values can be correl ated to an exhausted carbon that has low removal
efficiencies. 47 These values are tabulated in Table
11-6, along with the activities determined to be oneach layer of carbon. Values for moisture content
are listed only for train A of the auxiliary building.
The other samples were sent unsealed and absorbed moisture in transit, invalidating any determination of water content.
A comparison of the status of the carbon as
determined by the two methods discussed aboveshows discrepancies. Inplace tests indicated thecarbon was severely degraded, while after-the-factlaboratory testing showed that the carbon would still
perform satisfactorily. Both methods have inherent
weaknesses. Inplace air samples may not be
representative and give only an instantaneous readi ng. Laboratory tests suffer from procedural problems (such as whether to pre-equilibrate the carbon
to the stated relative humidity prior to test) and also
from noble gas contamination of the carbon. We
find that neither inplace testing of the filter systems
nor the laboratory testing of the carbon was adequate to characterize the condition of the carbon
after the accident.
Changeout of the carbon adsorbers in each filter
system was accompanied by concurrent changing
of all the HEPA filters in these components. These
HEPAs were visually examined before changeout
and were intact and in satisfactory condition, butwere damaged during changeout of the carbon
trays. Unfortunately, no used HEPA filters or sections of filter media were retained for analysis.
33
Twenty-seven percent of the iodine species
was in particulate form. In addition, the filter sys-TABLE 11-6. Analyses of carbon exposed during the accident
Fuel Handling Building
Train A
Train B
Activity
ActivitypHµCi/gmpHµCi/gmDepth (inches)

H2O%

Auxiliary Building
Train B
Train A
Activity
ActivityµCi/gmpHµCi/gmpH

First 0.5

2.53

4.3

10.1

3.4

15.4

4.1

34.5

ND*

76.1

Third 0.5

2.58

5.9

2.5

4.3

3.1

4.5

0.9

3.9

1 8.5

Second 0.5
Fourth 0.5

3.41

1.05

4.5

5.6

4.4
1.7

4.0

4.6

4.9
1.5

4.7

4.5

6.4
0.1

3.4
3.9

26.5
1 5.1

*ND-Not determined
iodine, as KI 3. The use of coimpregnated carbon
was desirable because it is better able to remove
methyl iodide at high humidities than is carbon impregnated with stable iodine, as KI .
Appendix 11.2 presents the available data on the
carbon used as replacement as a function of time.
Although test procedures conform to the recommendations of Regulatory Guide 1.52 (Revision 1),
the data lack consistency. Two types of impregnated carbon were obtained from two sources (MSA
and NUCON), and carbon sampling methods did notconform to industry standards. 51 The carbon samples removed for analysis were shipped in plastic
bags, with incomplete data on cells sampled, location in bank, date obtained, and type of charcoal.
There is also no means to ascertain whether the
sample was properly mixed to assure homogeneity
prior to shipment. In addition, different cells with different operating histories have been removed forsampling. This removal resulted in some of the
carbon being tested that had been used to refill atest cell at the previous sampling, and not testingother carbon that had been in service since thechangeout. These sampling problems resulted innonrepresentative samples with results that may beneither reproducible nor valid. However, based on
the remaining adsorptive capacity of the carbon
after approximately 6 months of service of 83% to99% (see Table 1 of Appendix 11.2) and the negligiblei odine releases after replacing the carbon, we findthat the coimpregnated carbon has performed satisfactorily in reducing radioiodine releases to the environment.
When Met Ed realized the severity of the accident and the potential for release of significant
quantities of radioiodine to the environment, it decided to obtain a supplementary filtration system tofurther mitigate radioiodine releases. The decisiontems contain two individual banks of HEPA filters(one upstream of the carbon and one downstream),
each of which were acceptance tested to greaterthan 99.95% leak-tightness. Thus, we find that the
HEPA filters removed essentially all of the particul ates generated.
After completion of the postaccident changeoutof all the cleanup components in both trains of theauxiliary and fuel handling building systems, inplace
l eak-testing was not performed to verify the leaktightness of these systems. A visual inspection wasconsidered sufficient because of (1) the necessity toreturn the filtration units to operation as soon as
possible, (2) the lack of manpower, and (3) the potential for increased worker exposures. Although it
i s good engineering practice to leak-test filter systems in place after changeout, the decision to deferl eak-testing of these filter systems was warranted.
Because further releases through these filter sys48
tems have been negligible, the performance of thesystems has demonstrated their integrity.
The carbon used as replacement in the four filter
systems was impregnated with either stable iodide,as KI , or a mixture of KI and triethylenediamine(TEDA . Problems in readily obtaining replacement
cells were encountered because the TMI-2 cells are
40 inches long, rather than the standard industry
l ength of 30 inches. 49 This discrepancy and possible
problems arising from the use of 40-inch trays werereported to Burns and Roe on November 20,
1973, 50 but Burns and Roe required the 40-inchtrays. Thus, a special size cell was needed for replacement and it was difficult to quickly obtain asufficient number. The cells were refilled and reinserted into the systems. All trays were refilled withcoimpregnated carbon, except for 79 trays in theauxiliary building train B filter system, which wererefilled with carbon impregnated only with stable36 2

was made prior to the large influx of NRC personnel
to the site on Friday, March 30. Met Ed decided toi nstall four separate 30 000-cfm filter units on theroof of the auxiliary building. These units consist ofheaters, prefilters, HEPA filters, a 2-inch-deep bedof KI -impregnated carbon, and a second bank of
HEPR filters. The units were obtained in the firstweek in April from MSA, which had already shipped
the units to Richland, Wash. for installation in the
Washington Public Power Supply System's( WPPSS) Nuclear Units 1 and 4. The filter systems
had not been installed in Washington, and were immediately air lifted to the Three Mile Island Station
for installation. By mid-May, the filter systems had
been installed on the roof of the auxiliary building tofilter all of the ventilation air from the auxiliary andfuel handling buildings prior to release. The filter
units are installed in series with the existing auxiliary
and fuel handling building filters, and therefore all
ventilation air has been filtered twice before releaseto the environment.
The TMI-2 stack was capped on May 20, ensuri ng that all ventilation exhaust flows were throughthe supplementary auxiliary building filtration system. An effluent monitor downstream of each filter
train measures releases of iodine, particulates, andnoble gases. Since May 20, three of the four filter
systems have been on line at all times, and releases
have been negligible.
The cleanup components installed in the supplementary auxiliary building filtration system were thecomponents marked for use at the WPPSS units.
The HEPA filters were specified to satisfy MilitarySpecification MIL-F-51068D, which is the industry
standard. An inplace leak test was also performed on each bank as an acceptance test, andthe results showed a minimum leak-tightness of
99.85%. It should be emphasized that all ventilation
exhaust air was treated by four individual banks of
HEPA filters after the installation of the supplementary auxiliary building filtration system: two banks inthe filter systems inside the building, and two banks
i n the supplementary auxiliary building filtration systems installed on the roof.
The carbon installed in the supplementary auxiliary building filtration system satisfied the specification for the WPPSS units, and was certified as
passing a laboratory test demonstrating the ability
to remove at least 95% of methyl iodide when tested at 95% relative humidity and 212 °F, and 99.9% ofelemental iodine when tested at the same conditions, for each batch of carbon. Of the nine batchesof carbon tested in March 1978 by MSA and certified as acceptable, the minimum methyl iodide removal efficiency was 96.28%, and the minimum elemental iodine removal efficiency was 99.87%. 44

Attempts to evaluate the performance of the carbon in the supplementary auxiliary building filters as
a function of time have been hampered due to thei nability to obtain a representative adsorbent sample
52
from the installed bank .
The available data are included in Appendix 11.2 (Appendix Table 11-3), andalthough the carbon shows degradation, it is still extremely effective in removing radioiodines (aminimum of 84.3% at 95% relative humidity and99.4% at 30% relative humidity for methyl iodide removal) after 5 months of service. This can be attributed to the existing auxiliary and fuel handlingbuilding filters acting as guard beds and removing
the bulk of the nonradioactive contaminants. We
find that the use of the supplementary auxiliarybuilding filtration systems has mitigated the releasesof radioactive material.
Two other filtration systems were added to exhaust streams from TMI-2 in the first few weeks
after the accident. These additional systems were
not as significant in mitigating the releases as the
supplementary auxiliary building filter systems. Both.systems were supplied by American Air Filter Company in Louisville, Ky. The first was a small (lessthan 1000 cubic feet per minute) system installed on
the exhaust of the radwaste chemical lab trailer outside of the TMI-2 turbine building wall. The cleanup
components consisted of a HEPA filter and 2 inchesof KI -impregnated carbon. The system was install A in early April, was put in operation after satisfactory leak-testing on May 2, 1979 (HEPA filterand carbon tray 99.99% leak-tight), and has notbeen retested due to its minimal impact on plant
operation or releases.
The second system was a 1000-cfm filtration
system installed on the condenser vacuum pumpexhaust. This exhaust does not normally containsignificant amounts of radioactive material and is nottreated in a pressurized water reactor. However, it
was determined following the accident that this exhaust was contaminating the auxiliary building; andthe system was installed in early April, leak-tested
on April 9, and put in operation. The system consists of a heater, an upstream bank of HEPA filters,two2-inch-deepcarbonadsorbers( KI 3i mpregnated) in series, and a downstream bank of
HEPA filters. Leak-testing proved acceptable(99.99% for both HEPA banks, and 99.98% for the
one carbon bank tested.) The carbon was certified
as removing 98.7% of methyl iodide when tested in°
the laboratory at 130 C and 95% relative humidity.
The performance of this carbon has been followed
as a function of exposure time, and the results are
i ncluded in Appendix 11.2. The same sampling andreproducibility problems exist for this system as forthe auxiliary, fuel handling, and supplementary auxi363

liary building filter systems. Removal efficiency is
still approximately 90% for methyl iodide (September 1979), and the carbon has not been changed
to date.
I n addition to the installation of supplementary filtration systems to assist in mitigating the release ofradioactive particulates and iodine, attempts weremade to reduce the impact of noncondensible gases
and noble gases that were stripped out of the primary coolant in the letdown line of the makeup andpurification system. These gases were overpressurizing the makeup tank and the vent header, andwere resulting in increasing pressures in the waste
gas decay tanks. Met Ed was aware of this situation on Wednesday, March 28, and began to installcopper tubing from each waste gas decay tank andthe makeup tank back into containment that day.
Flame arresters and sampling ports were installed in
the lines. The connection to containment was madethrough an existing hydrogen purge penetration (R57/C). Since the containment structure has a large
volume (approximately 2 million cubic feet) and isdesigned to withstand pressures of at least 50
pounds per square inch (psi), the decision to use
the containment was based on sound technicaljudgment.
On Friday morning, March 30, the pressure in thewaste gas decay tanks was approximately 80 psig,
and there was concern that the setpoint of 120 psig
on the relief valves would be achieved. If this occurred, the highly radioactive gases would be
released through the relief valve vent header andwould move directly to the stack. Attempts weremade on Friday afternoon to transfer these gases
back to containment. The first attempts showedleakage in the tubing, but after repairs further attempts were successful. The line installed from the
makeup tank back to containment was completed
on April 12, but no records have been found indicati ng that this line was ever used for transferringgases back to containment. Transferring gases
back to containment via vent lines and the use ofcontainment as a large waste gas decay tankproved to be extremely effective in allowing plant
operations to continue by maintaining letdown flow.
Based on the high activities in the various
radwaste system components after the accident,
the overflow of liquid tanks, and the overpressurization of components due to the gaseous fission products, we find that the design bases of the radwaste
systems were exceeded, and that a number ofradwaste system modifications that assisted in mitigating the releases of radioactive materials to theenvironment were made after March 28, 1979.
These included a supplementary auxiliary building
air filtration system to filter all ventilation exhaust air

from the auxiliary and fuel handling buildings, a condenser vacuum pump air filtration system, and vent .
lines from the makeup tank and waste gas decay
tanks to transfer gases back into containment.
We find that the two filtration systems operating
at the time of the accident to reduce releases of radioactive materials to the environment (auxiliary andfuel handling buildings), had identical safety gradecleanup components, and that the safety grade
versus nonsafety grade designation was meaningl ess during the accident. Finally, we find that
although the design bases of the radwaste systems
were exceeded, the systems as operating at thetime of the accident, and the additional actions taken, provided significant mitigation of the release ofradioactive materials.
h. Recovery Operations

The recovery operation for TMI-2 includes treating gaseous and liquid radioactive materials thatremain in various plant structures. Radioactive
gases are primarily within the containment structure.
85
Kr
Because of radioactive decay since March 28,
year
half-life)
is
the
only
radionuclide
with
(10.3
measurable activity. It is present in a concentration
3of approximately 0.78µCi/cm , which for the 2.1 x
6
10 cubic feet containment volume equates to approximately 48 000 Ci. No definite plans have been85
established for treating the Kr. Viable options include releasing the gas to the environment untreated during favorable meteorological conditions, holdi ng up the krypton on a large (tens of thousands ofpounds) bed of carbon that could be cooled to increase the adsorptive capacity, pressurizing the gas
into tanks for storage, or cryogenically distilling thegas to remove the krypton. Atmospheric dilution
under favorable meteorological conditions would
result in atmospheric concentrations to levels below
the maximum permissible concentrations in 10
C.F.R. Part 20 for unrestricted areas. This option iseasiest to implement, and will not result in significant
exposures to the public.
There are two types of liquid radwaste in TMI-2
components that need to be processed. The first is
600000 gallons of highly radioactive liquid contained entirely within the containment structure.
The radioactive composition of the liquid was last
determined on August 28, 1979, as listed in Table
53
Plans for treatment have not been finalized,
II-7.
but two systems under consideration are a demi neralizer system submerged in the TMI-2 fuel pooland an evaporation and solidification system which
would require a new building to be constructed tohouse all the treatment components. Designs forany system built will need to consider the additional364

TABLE 11-7. Analysis of TMI-2 containmentbuilding water
I sotope

Hydrogen-3 (Tritium)

E.c Ci/ml Activity*
1.0

Strontium (89 and 90)

45

Zirconium-95

1.8 x 10 -3

Strontium-90

2.8

Niobium-95

5.0 x 10 -3

Ruthenium-106

7.0 x 10-3

Ruthenium-103
Tin-1 13

Antimony-125

Tellurium-129

5.7 x 10-3 .
5.0 x 10-4
1.5 x 10

1.2 x 10"2
2

I odine-129

1.5 x 10-5

Cesium-134

40

Cerium-137

2.5 x 10-2

I odine-131

Cerium-134

Cesium-137

Lanthanum-140
Cerium-141

Cerium-144
Barium-140

ary building tanks, as indicated in Table II-8. The
radioactive inventory in each tank as of June 15,
1979 is tabulated in Table 11-9. For comparison purposes, normal primary coolant activity is expected
to approximate 1 µCi/ml total for all radionuclides
except tritium.
Shielded piping has been installed from tanks inthe auxiliary building to the chemical cleaning buildi ng, located on the east side of the island between
TMI-1 and 2. This building, originally intended forthe cleaning of steam generators, now houses theprocessing system for the intermediate level liquid
waste. This system, known as EPICOR-II, has been
specifically designed and constructed for the purpose of processing the TMI-2 intermediate levelliquid radwaste contained in the auxiliary building
tanks. It consists of a prefilter/demineralizer
designed to remove particulate radioactive wastes,cesium and other cationic radionuclides; a demi neralizer for further removal of cationic radionuclides; another demineralizer for removal of both cationic and anionic (iodine) radionuclides; tanks;
pumps; transfer piping; and instrumentation. After
processing, the water is collected in the clean water
receiving tank (133 000 gallon capacity) where it issampled and analyzed. The results of this analysis
will determine whether the treated water istransferred back to either TMI-1 or 2 for storage until ultimate disposal, or transferred to the offspecification water receiving/batch tank (95 000gallon capacity) for reprocessing through EPICOR-Il.
Changeout
of
the
media
in
the
prefilter/demineralizer and the demineralizers will beaccomplished remotely. Cameras located in an adjacent structure will allow observation and control ofthe spent components during transport on an overhead monorail to a truck adjacent to the building.
The components will be replaced on predetermined
contact exposure rates, ranging from 3 R/h to 100
R/h for the various components. Approximately 50
changes of prefilter/demineralizers and demineralizers are expected for the processing of intermediatelevel TMI-2 liquid waste, based on ion-exchange
capacity. This results in a total volume of 2500 cubic feet of spent resins. The casks will be temporarily stored on site, then the wastes solidified
prior to offsite disposal in an approved facility.
The NRC published an environmental assessmentof the operation of EPICOR-II on August 14, 1979,
NUREG-0591, "Environmental Assessment Use of
EPICOR-II at Three Mile Island, Unit 2." Numerous
public comments were received and answered, andon October 16, 1979, an order was issued by theCommission to begin operation of EPICOR-11. The
system began operation the week of October 22,
1979.

1.2 x 10-2
5.6 x 10-3
1.8 x 10 2

7.1 x 10 -2
1.2 x 10 -3
6.3 x 10 -3
1.3 x 10 -3*Average of three samples taken August 28, 1979.

3 million gallons of water expected to be generated
as a result of decontamination.
The second type of radwaste that needs to beprocessed
is intermediate level liquid (defined as
1311
havingand 137Cs concentrations greater than 1µCi/ml but less than 100 µCi/ml) contained in various TMI-2 auxiliary building tanks. This radwaste
resulted from (1) inventory existing prior to the accident, (2) contaminated water transferred from thereactor containment building sump to the auxiliarybuilding during the early phases of the accident, (3)l etdown from the reactor coolant system, and (4)normal continued leakage of system components.
137
The significant radionuclide present is
Cs, with ahalf-life of 30 years. Approximately 280000 gallons of intermediate level waste exists in the auxili365

TABLE II-8. Radioactive water volumes in TMI-2 auxiliarybuilding tanks
Tank

Volume (gallons)

Reactor Coolant Bleed Holdup Tank B

77250

Reactor Coolant Bleed Holdup Tank A
Reactor Coolant Bleed Holdup Tank C
Neutralizer Tank A
Neutralizer Tank B

Miscellaneous Waste Holdup Tank,
Auxiliary Building Sump and Sump
Tank, Miscellaneous Sumps

Waste Evaporator Condensate Tanks,
Contaminated Drain Tanks
TOTALI. Summary of Findings and Recommendationsfor Section II.B.2

We find that:• although the design bases of Three Mile Island

•
•
•

•

77 2508780
8780

1 35001 6 200

279000a high pressure damaged portions of the vent gas
system, which resulted in a gaseous release
pathway (Section II.B.2.e);• the gaseous radwaste system design included"relief to atmosphere," which provided a path tothe environment for untreated gas (Section
II. B.2.e);• Met Ed initiated modifications after the accident
that helped to mitigate the releases; these modifications included the supplementary auxiliarybuilding filter systems, and vent lines from thewaste gas decay tanks back to containment(Section ILB.2.g);• the quantity of radioactive material thus far
released in liquid effluents as a result of the accident is not significant (Section ILB.2.c);• the quantity of radioactive material released ingaseous effluents
due to the accident consisted1311
of 15 Ci ofand 2.4 million Ci of noble gases(Sec. II.B.2.f);s the carbon installed in the auxiliary and fuel handling building exhaust systems was in a degradedcondition on March 28, and contributed to the radioiodine releases. The design and testing of thefilters did not allow the condition of the filters orleakage around the filters to be determined. If
carbon had been in place at the time of the accident that satisfied the technical specifications,radioiodine releases would have been lower by afactor of 5 (Section II.B.2.a);P the auxiliary and fuel handling building exhaust
filter systems installed at the time of the accident
provided a decontamination factor of 9.5(equivalent to an 89.5% efficiency) for all speciesof radioiodine (Section II.B.2.g);Findings•

77 250Station's radwaste systems were exceeded, thesystems as operating at the time of the accident
provided significant mitigation of the release ofradioactive materials to the environment (Section
II. B.2.g);
for normal operations the liquid radwaste storage
and treatment systems were marginal, at best,
due to the lack of a de minimis l evel below which
liquid radwaste can be discharged without treatment, and insufficient processing capacity (Section II.B.2.b);the radwaste liquid storage capacity was inadequate to cope with the emergency operations(Section II.B.2.c);the NRC review of TMI-2 design did not consider
the impact of TMI-1 in certain areas such as ventilation systems (Section II.B.2.a);leakage of radwaste system components, particularly in the makeup and purification system,
which contained small amounts of radioactive
material during normal operation, led to the mostsignificant releases of radioactive material after
core damage occurred (Section II.B.2.d);due to lack of maintenance on the waste gas
system, leaks existed, particularly in compressor
A, which led to additional releases of radioactive
material after core damage (Section 11.B.2.b);366

TABLE 11-9. Inventories of radioactive materials in auxiliary
Reactor Coolant
Bleed Holdup
Tank

Nuclide
A

B

H-3

0.23

0.27

1 -131

1.9

2.8

Cs-134

6.5

Cs-1360.28

Cs-13728

Ba-140

0.09

7.6
0.29

35

0.3

*No analysis performed.

C

0.29
3.0
7.7
0.28
35

0.29

Neutralizer Tank
A
B

building tanks as of June 15, 1979 (, Ci/cc)

Miscellaneous Waste Holdup Tank,
Auxiliary Building Sump and Sump
Tank, Miscellaneous Sumps

Evaporator Condensate
Tanks, ContaminatedDrain Tank

1.0

0.1

2.4

0.1
0.1

0.98

0.15

0.18

0.56

0.72

0.02

0.08

2.5

3.3

1 0.1

0.02

0.01

0.3

0.8

0.1
0.1

• methods be developed for inplace testing of ven-

• HEPA filters installed in the ventilation exhaustsystems removed essentially all of the particul ates generated (Section II.B.2.g);• for the two filtration systems operating at theti me of the accident (auxiliary and fuel handlingbuildings) each had identical safety grade cleanup components, rendering the safety grade
versus nonsafety grade designations of thesesystems meaningless (Section II.B.2.g);• inplace testing and laboratory testing of carbon
samples were inadequate to analyze the effectiveness of the ventilation exhaust filters during
the first week of the accident (Section ll.B.2.g);
and• replacement carbon in the various filter systems
was impregnated with an amine (triethylenediamine), and this carbon was effective in reducing radioiodine releases (Section Il.B.2.g).

•
•
•
•

Recommendations

tilation
systems,suchascontinuous
upstream/downstream sampling or inplace radioactive tracer testing, to ascertain overall filter
system performance when needed;
procedures be developed for the evaluation of
spent carbons exposed to accident conditions
and to consider the effect of high concentrationsof noble gas and iodine;
specific filtration systems be designated anddesigned for use only after an accident; separate
filter systems be provided for normal operation;
dampers around filter systems be eliminated ori mproved to minimize leakage;to increase the radioiodine removal capabilities,
consideration be given to coimpregnating carbons with an amine such as triethylenediamine,and to use of deeper carbon beds.

3. ENVIRONMENTAL MONITORING

Unless otherwise specified herein (Section II.B),
the recommendation is applicable to the NRC andapplicant(s)/Iicensee(s).
We recommend that:

The purpose of radiological monitoring at nuclear
powerplants is to protect workers and the public byensuring that exposure of workers on site to radiation and releases of radioactive materials off site are
kept within the limitations of applicable Federal regulations and as low as reasonably achievable(ALARA).
Radiation monitoring of onsite personnel is accomplished by means of dosimeters, such as thermoluminescent dosimeters (TLDs) and self-reading
pocket ion chambers (pocket chambers). Area
monitoring is performed using fixed, mobile, andportable radiation detection instruments. Concentrations of airborne radioactive materials are monitored using fixed and portable air sampling devices.
Evaluation of internal contamination of personnel isaccomplished by means of bioassays (urinalyses)
and whole-body counting (WBC).
Onsite and offsite environmental radiation monitoring also uses TLDs. In addition, a program is inforce to sample air, water, milk, vegetation, fish, andriver sediments to assess the amount of radioactive
materials deposited off site.
At Three Mile Island Station, it was necessary toi ncrease onsite and offsite monitoring as a result of
the accident. The large number of people on site,
together with the increased chance of high radiation
exposure after the accident, required greater emphasis on radiation safety, including additional dosimetry. Onsite monitoring is discussed in Section
II. B.5. The prospect or fear of substantial offsite
releases led to increased environmental monitoring,which is discussed below.

• the design bases for radwaste and other related

systems, such as the makeup and purification
system, be reexamined to determine appropriate
design criteria for the expected levels of activity
and volumes that will be generated in both normal
operation and accident situations;• review of radwaste systems should include all related systems, such as the industrial waste treatment system, to ensure that potential releases(whether within the plant or to the environment)
are treated;• a de minimis level be established for low-levelli quid radwaste, and any liquid at a nuclear power
station containing less than this de minimis l evelof radioactive material be allowed to be released
untreated;• radwaste system components (with the potential
for containing primary coolant or waste gas products) be periodically tested for leaks and anyleaks exceeding a minimum acceptance level be
repaired;• consideration be given to locating systems suchas the makeup and purification system in an isol ating building (such as the reactor building);• consideration be given to the installation of tieli nes from components outside containment havi ng the potential to contain significant activity(e.g., makeup tank, waste gas decay tanks, reactor coolant bleed holdup tanks) back to containment for use during an accident;368

a. Offsite Radiological Environmental
Monitoring Program (Preaccident)

A Radiological Environmental Monitoring Program(REMP) for Three Mile Island Station has been conducted for Met Ed since June 1969 and is described
i n Appendix 11.3. At the time of the accident,
Teledyne Isotopes Corporation was
responsible for54
the analytical portion of the REMP.
The REMP consists of gaseous and liquid effluent
monitoring, sampling of flora and fauna, soil, vegetation, and milk in the environs of the nuclear station
to detect whether there are any plant effluents thatmight contribute to the exposure of the public. This
program also is designed to detect if any longterm
55
buildup of radioactive material is occurring.
I n addition to the REMP, environmental radiological monitoring is performed at TMI using environmental TLDs. 56 The location of the onsite TLDs is
described in Table 11-10 and shown in Figure 11-14.
Met Ed also had an onsite monitoring program using
personnel TLDs.
b. Augmented Radiological Monitoring
Program (Postaccident, March 28 to April 15,
1979)

agencies. From these sources came additional personnel, technical expertise, analytical laboratory capability, radiation survey instrumentation, environmental monitoring (including extensive offsite groundand airborne radiation surveys, and sampling of air,terrestrial, and water media), and an additional
method to predict plume behavior. For example, immediate radiological monitoring expertise was pro57
Release andvided by Porter-Gertz, Consultants.
plume predictions were provided by Pickard, Lowe,
58
Doand Garrick, Inc., meteorological consultants.
simetry expertise, management, and personnel were
provided by the Electric Boat Division of General59
by Pennsylvania Power &Dynamics Corporation,60
and by the Naval Reactors DiviLight Company,
61
Expersion of the Department of Energy (DOE).
tise in the maintenance and control of the varied
portable radiation survey instruments that were62
used was provided by Electric Boat Division,
63
and Naval
Georgia Power and Light Company,
64
Additional assistance provided by othReactors.
er sources, particularly from Government agencies,
is discussed elsewhere. 65-74

Metropolitan Edison- As an initial response to theaccident, Met Ed performed offsite surveys around
Three Mile Island. Teams were dispatched in the
downwind direction to perform surveys at points
that were inside the expected extent of the plume.
Teams consisted initially of two radiation chemistryAs part of the immediate response to the accident, radiological monitoring at and around TMI
was augmented by Met Ed, other utilities, consultants and contractors, and Federal, State, and local

TABLE 11-10. Onsite TLD locations for operational
radiological56
environmental monitoring program (REMP)
StationDesignation

Map Number(Fig.ll-14)

2S2

3Location2

0.4 mile N of site, North Weather Station

4S2

5

5S2

6

0.3 mile ENE of site on top of dike, East
Fence

9S2

8

14S1

10

16S1

11

1 S2

11 S1

9

0.7 mile NNE of site on light pole in middle of North Bridge

0.2 mile E of site on top of dike, EastFence
0.4 mile S of site at South Beach

0.1 mile SW of site west of Mechanical
Draft Tower on dike

0.4 mile WNW of site at Shelly's Island
picnic area

0.2 mile NNW of site at gate on fence onwest side
369

FIGURE 11-14. Location of Onsite TLDs

technicians and later (primarily March 29 and 30),
three individuals. Three teams were dispatched initially and up
to six teams made surveys on March
75
29 and 30.
Direct radiation measurements were performed
with portable radiation survey instruments by thel and-based and helicopter-based teams. Instruments used were generally the PIC-6A (an ion

chamber-type instrument having a range from
0-1000 R/h), the RO-2 (an ion chamber-type instrument having a range from 0-5000 mR/h) and theE-520 (a 75
GM-type instrument having a range from
0-2 R/h).
These teams also collected short term air samples (particulate and iodine) for field determination ofradioiodine concentrations (primarily on March 28).
370

COLOR PLATE I. LOCATION OF OOSIMETRY SITES WITHIN
A 5 MILE RADIUS OF TMI NUCLEAR STATION.

COLOR PLATE II. MAP OF TMI 2 AREA

0
Ed at the observation center. S I n addition to thesei nitial surveys, NRC teams performed ground monitoring surveys on the east side of the SusquehannaRiver for several weeks after March 28. NRC deployed TLDs at 37 offsite locations on March 31 andat an additional 10 locations on April 5. These TLDs
were placed and read by RMC. 81 The locations of
the NRC TLDs are listed in Table 11-12 and shown inColor Plates I and II. NRC placed portable air
samplers around the plant area and observation
center and analyzed the results. 78 NRC also placedli quid effluent monitors near or on the station
discharges. 79

These samples were later counted with a Ge(Li)75system based in a mobile laboratory at the site.
On March 29, the REMP was augmented by expanding the number of sampling locations and frequency. 76 Table II-11 describes the augmented
REMP, also termed Emergency REMP.

Commonwealth of Pennsylvania-On the advice of
the Pennsylvania Bureau of Radiation Protection( BRP), the Pennsylvania Agriculture Department
sampled farm milkings on the evening of March 28
and the morning of March 29. This sampling program continued through mid-June. 77 The BRP performed ground surveys in the offsite area and coll ected and analyzed data. 77 The Bureau of Water
Quality Management and BRP joined with the EPA
to provide
a water sampling and analysis pro78.79
gram.
BRP placed portable air samplers
around the plant area and at the observation center78
and analyzed the results.
BRP also placed liquid
effluent monitors
near
oron the station
78
discharges.

Department of Health, Education, and Welfare(HEW), Bureau of Radiological Health (BRH)- I n
response to the accident, BRH deployed TLDs
around the site starting on the evening of March 31,
1979. The TLDs deployed, type TLD 100, had aminimum sensitivity of 10 to 20 mrem. A total of 173
dosimeter sites (237 dosimeter packages) had been
set up by Monday afternoon, April 2,1979 82 and areshown in Figure 11-15.
The BRH dosimeter sites were distributed over a
20-mile radius (about 1200 square miles) centeredat TMI-2. Within the 0- to 10-mile radius, the area
was divided into 2 by 2-mile grids. The individual

Nuclear Regulatory Commission (NRC)-While intransit to Three Mile Island on March 28, the NRC
Region I teams conducted limited radiation surveys.
The results of these surveys were reported to Met
TABLE 11-11. Augmented or Emergency REMP 76

Media

Air particulates
Air iodine
Surface/drinking water
Effluent water
Precipitation (rain water)
FishesAquatic plants

Aquatic sediment
Milk
Vegetation
Soil
Misc. foodstuffs ?
TLD
1

REMP.

No. of
I ndicator
LocationsNo. ofBackground
Locations

2
46
4
4
1
15

1
1
1
1
1
5

5
5
53
1
2
1
2

3
3
2
0
2
1
1

Sampling
Frequency

Every 3 days 2
Every 3 days 2
Daily 4
Daily 4
As available 5
WeeklyWeekly (ifavailable)
WeeklyDaily
MonthlyMonthly
As available
Every 3 days 2

Analyses'

Gross beta, gamma spectraRadioiodine
Gross beta, radioiodine
Tritium, gamma spectra
Gamma spectra
Gamma spectra, strontium
Gamma spectra

Gamma spectra, strontiumRadioiodine, gamma spectraRadioiodine, gamma spectra
Gamma spectra
Gamma spectra
Dose rate

The listed analyses are performed on each sample and are in addition to those performed in the operational

2
Sampling periods were from 3/29-3/31, 3/31-4/3, and every three days thereafter until 4/24/79. As of 4/24/79,
samples are collected weekly.
3
An indicator location was added on 4/22/79.
4
Sampling was done on 3/29, 3/31, and daily thereafter.
5
Precipitation was collected on 3/31, 4/5, and 4/27.
6
Due to its use by newborn goats, milk is not always available from a goat farm.
7
l ncludes poultry, beef, eggs, pork, and game, if available.

371

TABLE II-12. NRC TLD locations 81
Station
N-1a
N-1

N-1c

N-le
N-1f
N-2

N-3
N-4

Distance( miles)

Direction(degrees)

Sector

2.6

358

N

2.4
3.0

356

0

N

School (added 4/5/79)

N

School (added 4/5/79)

3.5

349

5.1

0

N

0

N

4.0
7.4
9.3

N-5

12.6

NE-2

1.8

N

351

N

6

N
N

3

0.8

25

NNE

NE-3

3.1

17

NNE

NE-4

6.7

NE-1

NE-3a
E-1

E-5 (E-1a)
E-3

E-4
E-2

SE-4

SE-4a
SE-5
SE-1

SE-2

44

0.5

61

ENE

94

E

0.4
3.9
7.0

NE
E

90

E

94

ESE

5.0

146

SE

4.6
7.0

1.0

1 37

SE

135

SE

151

SSE

1.9

162

SSE

3.2

169

S

3.35

S-4

47

110

S-1a
S-3

NE

2.7

2.3

S-2

NNE

3.6

SE-3
S-1

19

5.3
9.0

12.0

SSE

1 60
1 73

S

1 78

S

1 81

S

1 84

S

372

Description

Middletown

School (added 4/5/79)

School (added 4/5/79)
Clifton

Hummelstown

Union Deposit-

North Gate

Geyers Church

Township School

School (added 4/5/79)-

1200' N of E-1a
Residence
Newville

Elizabethtown

Unpopulated area
Highway 441

School (added 4/5/79)
Bainbridge

Unnamed community on
Highway 441
FalmouthFalmouthYork Haven

School (added 4/5/79)
Conewago Hts
Emigsville

Woodland View

TABLE 11-12. NRC TLD locations-Continued
StationDistance( miles)

Direction(degrees)

Sector

SW-2

2.6

203

SSW

SW-1

SW-3

2.2

8.3

SW-4

10.4

W-3a

4.4

W-3

2.9

W-2
W-1

W-4

W-5

NW-1

NW-3
NW-2
NW-4

1.3
1.3

5.9

7.4
2.6

7.4
5.9
9.6

NW-5

1 3.8

N-1d

3.5

N-1b

2.75

200

225
225

SSW

Bashore Island

SW

Zions View

SW

252

WSW

263

W

247

WSW

270

W

272

W

262

W

303

WNW

310

NW

297

WNW

306

NW
NW

312

NNW

346
333

Description

NNW

Pleasant Grove
Eastmont

Goldsboro

School (added 4/5/79)
Goldsboro

Unnamed community
Lewisberry

Lewisberry

Harrisburg Airport
New Cumberland
Highspire

Harrisburg
Harrisburg

School (added 4/5/79)
School (added 4/5/79)

The specific information as to animal location, sample type, supplier, feed, herd site, and recipient dairy
is indicated in Table 11-13. The source, azimuth, anddistance from TMI for each food and milk sampling
location are listed in Table 11-14. HEW collected water samples from various points on the Susquehanna River, from taps in Harrisburg, Columbia, Harrisburg Airport, Port Deposit Water Treatment Facility,
Conestoga, Middletown, and various locations in
Maryland.

grid sectors were weighted by population, and sites
were identified in the field on the following basis:
High Population Density-4 dosimeter sites
Medium Population Density-2 dosimeter sites
Low Population Density-1 dosimeter site

When possible, two dosimeter packages wereplaced at each site, one outside and one inside abuilding. In the 10- and 20-mile ring, only externalsites were used.
The dosimeters were left in place until a small
sample (19) was collected and replaced on April 10
were
for a preliminary evaluation. All dosimeters
82
collected on April 17 and 18 and replaced.
HEW also carried out a limited bioassay program,performing urine analyses on 33 residents living
near the plant. The samples were collected over 5
days (April 4 through 8). 83
HEW collected milk, food, and water samples in
the area around Three Mile Island to a distance of
30 miles. Raw milk was sampled from 29 locations,and included samples from both cows and goats.

Environmental Protection Agency (EPA)- EPA deployed its major response efforts from its Las Vegas, Nev. laboratory. EPA personnel arrived in the
TMI area on March 31 and began an offsite environmental sampling effort. EPA also brought laboratory
analysis capability and set up an analytical facility in
Harrisburg. EPA was requested to coordinate alloffsite Federal environmental monitoring for the longterm efforts on April 13,1979.
From April 1 to April 3, EPA set up an offsite air
sampling network. Thirty-one air sampling stations
373

FIGURE 11-15. Location of HEW Monitoring Sites .

Detectable exposures are shown (mR).
Period of exposure: 3/31/79 to 4/18/79.

374

TABLE II-13. Raw milk sample program for HEW 86
Milk
Supplier

Product

Feeds

AnimalLocation

Dairy toWhich Sold

Herd
Size

Mt. Joy Farmer
Corporation
Mt. Joy, PA

200

Mt. Joy Corp.
Mt. Joy, PA

1 02

I nside &Dry Lot

I nterstate Coop.
S. Hampton, PA

42

On DryLot

Rutter Bros.
York, PA

ChristianBecker

Raw Milk

StoredI nsideRaw Milk

StoredI nsideKen
Glatfeller

Raw Milk

StoredJ. R.
AlwineRaw Milk

StoredI nside &Dry Lot

Jim
Williams

Raw Milk

StoredJeremiah
Fisher

Raw Milk

StoredClarence
Lytle

Raw Milk

StoredBeshoreFarms

Raw Milk

StoredMasonic
Homes

Raw Milk

StoredJay Swope

Raw Milk

StoredLeroy
Hertzler

Raw Milk

StoredAvalong

Bruce Zell

Raw Milk
Raw Milk

Stored

Myers
Farms

Raw Milk

StoredRaw Milk

StoredTimothy
Tyson

Raw Milk

StoredPaul Nolt

Raw Milk

Stored

Under
Roof

H. E.
HeindelRaw Milk

StoredI n & Out

Ashcombe
Farm Dairy .

Raw Milk
Raw Milk

StoredI nsideH. Risser
Meadow
Vista)

Sunnyhill
Farms

Rutter Bros.

StoredStoredI nside &Dry Lot
I nside &GrazedI nside &Dry Lot

Under
Roof

Hershey Foods
Hershey, PA

40

Rutter Bros
York, PA125

I nterstate Coop.
S. Hampton, PA

1 08

Harrisburg Dairy
Harrisburg, PA

1 02

Harrisburg Dairy
Harrisburg, PA

115

Rutter Bros.
York, PA

27

82

Under
Roof

Lehigh Valley
Allentown, PA

25

I n & OutOwn Processor

1 00

Hershey Foods
Hershey, PA

35

I nside &Dry Lot
I nsideOn
Property
I nside &Dry Lot
Under
Roof

Dry Lot

375

Hershey Foods
Hershey, PA

80

Own Processor

1 60

Mt. Joy Corp.
Mt. Joy, PA
Lehigh Valleys
Allentown, PA

54

Maryland Coop.

1 38

Own Processor

60

Mt. Joy Corp.
Mt. Joy, PA
Lehigh Valleys
Allentown, PA

Own Processor

39

200

TABLE 11-13. Raw milk sample program for HEW-Continued
Milk
Supplier

AnimalLocation

Dairy toWhich Sold

Herd
Size

Product

Feeds
Graze

OutsideOwn Processor

Raw
Goat'sMilk

StoredI nsideOwn Processor

1

Raw Milk

StoredMaryland Coop.

38

Doll L.
ZirkleRaw Milk

StoredPasture3 hrs/day

I nterstate Coop.

43

Evergreen
Valley Farm

Raw Milk

StoredPasture3 hrs/day
I nside
Dairy

Hershey Food
Hershey, PA

42

LesterHawthorne

Raw Milk

StoredI nside150

Menno
Gruber

Raw Milk

StoredI nsidePenn Dairies
Lancaster, PA

Bruce
Taylor

Raw Milk

StoredI nside50

JosephConleyRaw Milk-

Rutter Bros.
York, PA

Alton
Hower

Lloyd
SarverDale
Barshinger

Raw
Goat'sMilk-

were established, with 12 stations located at a distance of 3 miles from the plant, at 30° spacing along
the arc; 10 stations at 6 to 7 miles, located between
the 3-mile stations; and 9 stations in populated locations more than 7 miles away at Bellaire, Manchester, Carlisle, Hummelstown, Campbelltown,
88
York, Hershey, Lebanon, and Lancaster.
Each station contained an air sampler of approximately 10-cfm capacity (400 m 3/day) with a glass
fiber prefilter for particulate collection and a charcoal cartridge for radioiodine collection. Samples
were changed on a daily basis and counted using a89
Ge(Li) detector.
The location of each air samplingstation is shown in Table 11-15.
At each EPA monitoring station, calcium fluoride
TLDs consisting of three badges, each containing
two chips, were placed. In addition, 50 people at90
these locations wore badges on a voluntary basis.
Gamma exposure rate recorders were located ateach air sampling station and three additional locaThetions ( Stations 031, 032, and 033).
recorder/monitors were deployed from March 31 toApril 4 and were operated throughout the intensive
phase. They contain a pressurized gas proportional

3

Hershey Foods
Hershey, PA

60

-

30

detector with output to a strip chart recorder enclosed in an aluminum case. The91strip chart fromeach recorder was collected daily.
EPA conducted water sampling at locations on
the Susquehanna River and in Chesapeake Bay.
Drinking water from 21 surface supplies was also
sampled. The drinking and surface water sampling
effort was reduced on April 6 to include only major
public drinking water sources on the SusquehannaRiver (Lancaster, Columbia, and Wrightsville). On
April 8, the Wrightsville and Columbia stations were
dropped and another station was set up on Brunner
I sland. Composite samples (24-hour) were collect92
Daily grab samples
ed daily from these sites.
were collected on the liquid effluent discharges.
A
92
133
1 monitor was also installed.
continuous
EPA initiated milk sampling in the offsite area on
April 5. A total of nine dairy farms were included inthis effort. 94 Their locations are indicated in Table
11-16.
Three special stations were established for radioactive noble gas sampling at stations 001, 006,
and 014 (Table 11-15). Air samples of at least
2/3 m 395
were collected over a 2- to 3-day period.

376

TABLE 11-14. Source locations for HEW food and milk sampling program 87
Distance( miles)

Direction(degrees)

16

315

20

Name

Location

340

All Lebanon Bakery

Lebanon10

34

Arndt's Ice Cream

Hershey

12225

Ashcombe Dairies

Dover

1 2.5

166

Avalong Farms, Inc.

York

Red Lion

15

270

Alton Hower

Ashcombe Farm Dairy

Enola

Mechanicsburg

22

159

Bakers Homemade Bread

10

178

Bartons Bakery

Mt. Wolf

7292

Bedshore Farms

18

88

10

313

Bickel's Potato
Chip Co., Inc.

New
Cumberland

20.5

52

Brouse's Pastry
Shop

7

1 82

Bruce Taylor

Manchester

20

90

Lititz12128

Bucker, Raymond
Farm

1

1 25

5

4.5

176

4

Beecher, Katherine
Candies

Brookwood Farms

Bruce Zell

Manchester

Manheim

Harrisburg
Lebanon

Hummelstown

Byers Pastries

Marietta

Christian Becker

Elizabethtown

16

Clarence Lytle

Middletown

13

1 75

Cloverland

York

6

195

Dale Barshinger Dy.

York

20

260

14

Dol-MarAnnville

5

50

207

20.5

51

Dunkin Donuts

3
12

1 82

D. F. Stauffer
Biscuit Company

York

Dillsburg Grain &Milling

Dillsburg

Doll L. Zirkle Dy.

377

Manchester
LebanonTABLE II-14. Source locations for HEW food and milk sampling programContinued
Distance( miles)

Direction(degrees)

8

10

22

35

16

2.5

16

22

Name

Location

Dutchland Farms,
I nc.

RheemsEastern Milk

Jonestown

285

Eastern Milk

Mechanicsburg

121

Evergreen Valley
Farm

Elizabethtown

1 80

Farmer Boy

Glen Rock87

Graybill's

LititzH. B. Reese
Candy Co.

Hershey

1 35

H. Risser

Bainbridge

Harrisburg
I nt'l Airport

Middletown

Hershey Chocolate
Company

Hershey

1 03

Elmtree Acres

15

41

14

182

9

19

15

155

11

318

3.1

335

11.2

312

10

24

5

1 63

2

81

3.5

284

Jay Swope

Elizabethtown

5

1 32

11

50

Johanna

Palmyra

117

22.5

4

12

12.5

110

35

2.8

275

6

1 66

22

Gingrich's Bakery

Mt. Joy

Green's Dairy, Inc.

H. E. Heindel

Campbelltown
York

York

Harrisburg
Dairies, Inc.

Harrisburg

Harrisburg R. P.

Harrisburg

Hilshire, Claire

Elizabethtown

I. R. Musser
Poultry Farm,
I nc.

Mt. Joy

Ja-MarPalmyraJ. R. Alwine

Jeremiah Fisher

Middletown

EttersJoseph Conley

EttersKendigMillersville

Ken Glatfeller

Mt. Wolf

378

TABLE 11-14. Source locations for HEW food and milk sampling programContinued
Distance( miles)

Direction(degrees)22165

Knaubs Cakeand Deli House

1

33

Kraft, Inc.

PalmyraLocation

Name

Dallastown

1 63

Leroy Hertzler

Mt. Wolf

1 25

Lester Hawthorne

Elizabethtown

210

Lloyd Sarver

7

97

Longenecker
Hatchery, Inc.

Elizabethtown

3355

Longenecker's
Meats, Inc.

22

117

Manorview

Millersville98

Masonic Homes

1025

Mazzoli's Ice
Cream

Hershey

12

121

Mellinger's
Poultry Farm

5

129

Menno Gruber

Bainbridge

20

165

Midway Super
Thrift Market

30

335

Miller Bros.

Millersburg

18

1 68

Mrs. Smith's
Pie Co.

1187

Mt. Joy
Corporation

10

288

Myers Farms

10

178

Mt. Wolf

17281

Naylors Candies,
I nc.

11

1 07

Paul Nolt

Mt. Joy

11

180

23.5

109

Penn Dairies, Inc.

Lancaster

12.9

181

10.5

320

7.5
5
2

6

Oak Grove Poultry
FarmYork Haven

Middletown

Elizabethtown

Mt. Joy

DallastownYork
Mt. JoyNew
Cumberland

Mechanicsburg

Peerless Farm
Products

York

Penn Dairies, Inc.

York

Penna Dutch Megs.
I nc.

379

Harrisburg

TABLE II-14. Source locations for HEW food and milk sampling programContinued
Distance( miles)

Direction(degrees)

13

175

Perrydell Farm

York

21

125

Queen Dairy Foods

Conestoga

335

R Own Dairy

Halifax

11318

Reservoir

Harrisburg

5355

Rose Enterprises,
I nc.

Middletown

20

54

Royers Cake Box

LebanonRutter Bros.

York

20
22.5

12.5

90

1 84

Name

R.W. Sauder

Lititz

10

314

20

51

Lebanon

15

San Giorgio
Macaroni, Inc.

286

Schenks Pastries

Mechanicsburg

22.5

47

Sams Ice Cream,
I nc.

Location

Showerdale

6

89

11

Simon Candy
Company

50

12

214

Smith's Modern
Dairy

12
18

20
9

4.6
11.6
13.9
2.4

22

1 0.5
5.5

10

Harrisburg

LebanonElizabethtown
PalmyraSmitties Soft
Pretzel

Dover

1 05

Spanglers Flour

Mt. Joy330

Speeces Dairy

Dauphin193

Stump Acres

341

Sunnyhill Farms

157

Susquehanna River

York Haven

Susquehanna RiverMarietta

1 29
1 33

1 69
1 56

63

344
315

Susquehanna River
Susquehanna River

York

Harrisburg

Wrightsville
Falmouth

Tastysnack, Inc.

Windsor

Tom Williams

Middletown

Timothy Tyson

Town & Country
Pastry Shop
380

PalmyraHarrisburg

TABLE 11-14. Source locations for HEW food and milk sampling programContinued
Distance( miles)

Direction(degrees)

21

125

6

1 4.1

Location

100

Troutmans Dairy

Elizabethtown

125

Turkey Hill Mini
MarketColumbia

3

355

8

3

10

314

14

50

17

Name

Turkey Hill Dairy

259

Conestoga

Universal Flexible
Packaging, Inc.

Unk

Visaggios Bakery

Harrisburg

Wengerts Dairy,
I nc.

LebanonVerdelli Farms,
I nc.

Hummelstown

Wayne Feed Supply
Storage

Dillsburg

TABLE II-15. EPA air sampling and monitoring locations (intensive phase)
StationAZDistance( miles)320

5.2*Highspire, Pa.-Highspire Fire Station No. 1

3.0* Middletown, Pa.-Elwood's Sunoco Station

3.0

Royaltown, Pa.-Blandine Hershberger
residence

001

290

003

325

002
004

350

6.2

3.5

005

040

007

080

6.6

1 00

3.0

006

055

008

070

010
012

009

011

013

014
015

2.6

Location

Frogtown, Pa.-Robert Bean Gulf Station

Meade Heights, Pa.-Harrisburg Intl Airport

Royaltown,-Pa.- -endonderry Township Bldg.

Elizabethtown, Pa.-Koser's Fruit Market

8.2*Bellaire, Pa.-Robert Risser residence

095

6.3

*Elizabethtown, Pa.-Arco Service Station

1 20

6.9

Maytown, Pa.-Bassler's Church

1 30
150

1 45
1 55

2.9
3.0
5.3

6.6

93

Newville, Pa.-Brooks Farm, Earl Nissley
residence

Falmouth, Pa.-Charles Brooks residence
Falmouth, Pa. - Dick Libhart residence*Bainbridge, Pa.-Bainbridge Fire Company
Saginaw, Pa. - United Methodist Church

381

TABLE 11-1 5. EPA air sampling and monitoring locations (intensive phase)Continued
StationAZDistance( miles)

180

3.0

016

180

018

220

017

Location

7.0*Manchester, Pa. - Manchester Fire Department

2.5

Pleasant Grove, Pa. - George Ziegler residence

019

205

021

250

4.0

*Newberrytown, Pa. - Exxon Kwick Station

265

2.9

Goldsboro, Pa. - Muellar residence

020
022
023

205
275

5.0

*York Haven, Pa. - York Haven Fire Station

2.5

5.0

Strinestown, Pa. - Brenner Mobil Service Station
Woodside, Pa. - Zane Reeser residence
Yocumtown, Pa. - IML Freight Yard

024

275

26

026

025

10

028

055

20

*Lebanon, Pa. - Goodwill Fire Company

13*York, Pa. - Springetts Fire Co. No. 1

1.5

Goldsboro, Pa. - Harold Bare residence

025

027

029

030

360

040
110
1 80

031

270

033

205

032
034
035

255
305
068

7

10

025

1.5
2.2

2.7
3.5

*Carlisle, Pa. - Union Fire Company No. 1*Hummelstown, Pa. - Keffer's Exxon Service Station*Hershey, Pa. - Arco Service Station

Campbelltown, Pa. - Gulf Service Station
Lancaster, Pa. - Southern Manheim Fire Co.

*Goldsboro, Pa. - Dusty Miller residence

Pleasant Grove, Pa. - George Shaffer residence

Plainfield, Pa. - Polites residenceRoyaltown, Pa. - George Hershberger residence*Sampling located in indicated town. Other sampling stations are located neari ndicated towns.
EPA analyzed its environmental samples at its
temporary laboratory in Harrisburg and its labora95
tories in Las Vegas, Nev., and Montgomery, Ala.

Search Team (AMS/NEST) from Andrews Air Force
Base, Md., arrived by midafternoon on March 28.
The RAT assisted the Commonwealth of Pennsylvania by taking vegetation, soil, and air samples; andby making direct radiation measurements off site.
The AMS/NEST measured and characterized radiation levels in the plume created by plant discharges.
These data were immediately provided to the Commonwealth of Pennsylvania and the NRC to assist in
determining the hazard to the public. 97
A local DOE command post was established on
March 28 at the Capital City Airport in New
Cumberland, Pa. Various contractors and branchesof DOE augmented the radiological monitoring effort.

Department of Energy (DOE)-DOE and its contractors, in accordance with the Interagency Radiological Assistance Plan, conducted a substantial environmental monitoring effort in response to the accident. The Commonwealth of Pennsylvania and the
NRC asked formally96for DOE assistance on themorning of March 28.
The Radiological Assistance Team (RAT) from
Brookhaven National Laboratory (BNL), and the
Aerial Measurement System/Nuclear Emergency382

airborne discharges from the TMI plant, as wellas in the surrounding area.
• Processing, compilation, and analysis of all radiation data in response to a request from T. Gerusky, Director of the Pennsylvania Department ofEnvironmental Resources.
• Documentary and scientific photography.

TABLE 11-16. EPA milk sampling locations(intensive phase)97
1.

Milton Hershey Dairy #41, Hershey, Pa.

2.

Conewago Farms Dairy, Elizabethtown, Pa.

3.

Aungst Dairy, Rheems, Pa.

4.

A. W. Hoffer, Dairy, Middletown, Pa.

5.

Ruhl Dairy, Middletown, Pa.

6.

David Miller Dairy, Falmouth, Pa.

7.

Elmer Gruder Dairy, Falmouth, Pa.

8.

Leroy Herzler Dairy, Mount Wolf, Pa. 17347

9.

Beshore Farms Dairy, New Cumberland, Pa.

National Bureau of Standards (NBS)-NBS calibrated portable survey instruments and TLDs used dur133
Xe was the predominant
i ng the accident. Since
radionuclide released, the portable survey instrumentation and TLDs used to monitor releases were
not used to detect and measure the energies forwhich they were calibrated. Most instruments were
calibrated133with 137 Cs gamma rays (662 KeV),
althoughXe emits gamma rays of considerably
l ower energy (81 KeV). With this wide energy difference, many survey instruments and TLDs over99
responded (by factors of from 1.5 to 20).

Their contributions are briefly described in Appendix
11. 4.
DOE monitoring activities included: 98

c. Summary of Results of Portable Survey
I nstrument and Aircraft Monitoring• Aerial surveys using helicopters to locate and
•
•

•

•
•
•
•

A summary of significant survey data collectedby Met Ed and other agencies during the period ofMarch 28 to April 5, 1979, during which most of thereleases of radioactive materials occurred, ispresented in Tables 11-17 and 11-18. These data weretaken directly from copies of survey forms or from
reports and logbooks of the various agencies.
Many of the data sources lack important informationsuch as instrument type, open or closed shield, exact time, exact location, and the identification of thei ndividual making the survey. In addition, most of
the instruments
were not calibrated for the radiation
133
emitted by Xe. These data, however, were all thatwere available for decisionmaking purposes at theti me of the emergency. Data contained in Tables
11-17 and 11-18 and discussed below do not include
the many measurements that did not detect any radiation above natural background.

measure radiation, and to characterize airborne
discharges from TMI.
Meteorological forecasts and predictions ofplume trajectories needed for guidance in radiation monitoring and evacuation planning.
I nstallation of radio and telephone communications, including coordination with the AT&T Long
Lines Command Center, for special NRC, Commonwealth of Pennsylvania, and DOE telephonerequirements; staffing the command post, providi ng rapid telephone and radio communications ofdata and information between DOE field units,
DOE Headquarters, NRC, and the Commonwealthof Pennsylvania.
Collection of environmental soil, grass, surface
water, and air samples taken in the paths of thedischarge plumes as well as in the general surrounding area. The sampling procedures usedwere designed to optimize detection of any radionuclides which might be present.
Gamma spectrum analysis of environmental samples to detect and identify the radionuclides
present.
Evaluation and analysis of radiation survey data.
Coordination of shipping and arrangement for radiochemical analyses of reactor coolant and containment air samples.
In situ measurement and characterization of radiation on the ground and in the air, in the path ofMarch 28, 1979-The first onsite survey indicationof a release of radioactive materials occurred at
10:00 a.m. when a 7-mR/h exposure rate wasmeasured at the fence line at the east edge of thesite. The first positive indication of an offsite releaseof radioactive materials was made approximately
0.5 to 1 mile east-northeast of the site at 11:00 a.m.
Throughout the day, releases to the environment
occurred. Exposure rates continued to vary, generally rising as releases occurred and quickly fallingas the radioactive materials were dissipated. The
383

TABLE 11-17. Summary of significant survey data on site March 28 to April 5, 1979
Location-Distance
From Site

Elevation( Feet)

Date

Time

0328

1 0:00 a.m.

GE-4;*Fence, east

Ground0328

5:00 p.m.

GE-10; Fence
northwest

0328

3:00 p.m.

GE-2; North gate

GE-10

Exposure
Rate (mR/h)

Type of
Radiation

Met Ed

1 00

Ground

1 40

Met Ed100

Ground365

Helicopter

50

GroundMet Ed70

Highest ground readings on site

DOE

1 02

Highest airborne reading on that day

1 03

Highest ground reading on that day

Met Ed

1 03

Highest ground reading on that day/3 & yMet Ed104

Highest reading during the accident

400y

Met Ed

1 04

Highest reading during the accident

Ground30

J3 & yMet Ed105

Venting of makeup tank

Ground25/3 & yMet Ed

1 05

Venting of makeup tank

Ground8y

Met Ed

1 05

Venting of makeup tank

1 200

/3 & yMet Ed1 06

Directly in the plume

Ground90/3 & yMet Ed

1 05

Ground9y

Met Ed105

11:00 p.m.

GE-10

Ground

5:00 a.m.

GE-9; Fence, westnorthwest

Ground

1 50/3 & yGE-9; Fence, westnorthwest

Ground1 00

y

1 5 over
stack

3,000

15 overstack
Ground90329

5:00 a.m.

0329

2:10 p.m.

0329

2:10 p.m.

Above Unit 2 stack0330

8:00 a.m.

GE-7; Fence, south

0330

8:00 a.m.

GE-8; Fence, southwest

0329

0330

8:00 a.m.

0330

8:00 a.m.

0330

8:02 a.m.

0330

3:00 p.m.

0330

3:00 p.m.

Above Unit 2 stack

GE-7; Fence, south

GE-8; Fence, southwest
Above Unit 2 stack

GE-9; Fence, westnorthwest
GE-9; Fence, westnorthwest

First positive onsite reading

1 00

0328

Over north gate

1 01

Comments

Met Ed

11:00 p.m.
-6:00 p.m.

Reference

7

0328
0328

AgencyPerforming

1 30 overstack*GE numbers refer to the fixed on i sland monitoring points.

50/3 & yyy

Met EdMet EdMet Ed

1 00

1 05

Highest readings on site

Venting of makeup tank0331

3:28 a.m.

0331

11:15 a.m.

0331

GE-4; Fence, east

Ground150[3 & yMet Ed107

Between GE-3 andGE-4; Fence, eastnortheast

Ground

1 00/3 & yMet Ed

1 08

Highest ground reading on that day

3:28 a.m.

GE-4; Fence, east0331

11:15 a.m.

Ground35y

Met Ed

1 08

0331

3:51 p.m.

Between GE-3 andGE-4, Fence, eastnortheast
500 kV Substation/3 & yMet Ed

1 09

4:28 a.m.

GE-4 and GE-5,
Fence, east andsoutheast

Ground120401

500 kV Substation

GroundGround40/3 & yMet Ed110

Highest ground reading on that day

GE-4 and GE-5, Fence,east and southeast

Ground20y

Met Ed110

Highest ground reading on that day

GE-9, Fence, westnorthwest

Ground15/3 & yMet Ed111

Highest ground reading on that day

GE-9, Fence, westnorthwest

Ground7y

Met Ed111

Highest ground reading on that day

Over the Unit 2
screen house

Helicopter

90-240J3 & yMet Ed112

Ground10/3 & yMet Ed113

Different altitudes. Measurements
taken between 2:25 and 2:50 p.m.

GE-5; Fence,southeast

Ground

1.9y

Met Ed113

Highest ground reading on that day

East Side; between
north and south gates

Ground5.5(3 & yMet Ed114

Highest ground reading on that day

Fence, east
Fence, east

GroundGround3.5(3 & yMet Ed115

Highest ground reading on that day

0331

3:51 p.m.

0401

4:28 a.m.

0402

1:40 p.m.

0402

1:40 p.m.

0402

2:30 p.m.

0403

1 2:12 p.m.

0403

1 2:12 p.m.

0404

4:19 a.m.

0405

1:04 p.m.

0405

1:04 p.m.

GE-5; Fence,southeast

Ground

20

3

0.6

y

y

y

Met EdMet EdMet Ed

1 07

1 09

116

Highest ground reading on that day

Highest ground reading on that day

Highest ground reading on that dayTABLE I1-18. Summary of significant survey data off site March 28 to April 5, 1979
Date

Elevation(feet)

Exposure
Rate (mR/h)

0.5-1 eastnortheast

6:05 p.m.

7

Helicopter

6:00 a.m.

1-2 west

Time

0328

11:00 a.m.

0328

3:00 p.m.

0328

6:05 p.m.

0328

10:00 p.m.

0328
0329

0329
0330

6:00 a.m.

9:00 a.m.

0330

9:00 a.m.

0330

9:00 a.m.

0330

9:00 a.m.

0330

11:53 a.m.

0330

12.15 p.m.

0330

4:00 p.m.

0330
0330
0330

4:00 p.m.

1 0:35 a.m.
1 0:35 a.m.

0331

2:39 p.m.

0331

2:39 p.m.

Location-Distance
From Site (miles)

AgencyPerforming

GroundGround20-50

Met Ed101

1 6 north

Helicopter

0.1-0.2DOE

1 02

2-3 northwest

Ground12

Met Ed101

0.5-1.0 eastsoutheast

1

DOE

Ground30

13 & yGround10

13 & yGround20

Met EdReference

0.5-1 east-northeast

1-2 west

3

Type of
Radiationy

Met EdMet EdMet Ed1 01

I n center of plume116

Highest ground offsite reading

116
117

Ground0.4y

Met Ed

1 17

0.5-1.0 southeast

Ground8

f3 & yMet Ed

1 17

0.5-1.0 southeast

Ground

4.5

y

Met Ed117

PA 441, Red Hill Farm
Fruit Stand

Ground5-6

13 & yDOE

118

Goldsboro
1-2 west

GroundDOE

119

1-2 west

Ground5

Ground1

Med Ed117

PA 441 northeast
PA 441 northeast

Gingrich Road,
1 eastGingrich Road,
1 eastGroundGroundGroundGround

13 & y17f. & y4

yMet EdMet Ed7

13/3 & yMet Ed2y

Met EdMet EdFirst positive offsite reading

102

0.5-1.0 eastsoutheast

6

Comments

Highest ground offsite reading

117

1 08
108

1 09
1 09

Highest offsite reading that day
Highest offsite reading that day

0331

9:03 p.m.

'/4 east of
Observation Center

1800 MSL*

19y

Met Ed

1 20

0331

1 2:00 p.m.

PA 441, '/4 east

Ground7

13 & y

DOE

1 21

0331

6:55 p.m.

New Cumberland

Ground

1.5/3 & y

DOE

121

0401

4:32 a.m.

650 MSL30/3 & yMet Ed110

0401

4:35 a.m.

Over the 500 kV
Substation
Observation Center

Ground7.5

13 & yMet Ed110

Highest reading that day

0401

4:35 a.m.

Observation Center

Ground1.0y

Met Ed110

Highest reading that day

0401

6:51 a.m.

1-2 southeast

Ground2.5/3 & yMet Ed110

0401

6:51 a. m.

1-2 southeast

Ground1.5

y

Met Ed110

0401

1 2:45 p.m.

Falmouth Pike & PA.
441

Ground2.5/3 & y

DOE

1 22

0401

1 2:45 p.m.

Falmouth Pike & PA.
441

Ground

1.5

y

DOE

1 22

0402

1:44 p.m.

Goldsboro Square

Ground

1.5/3 & yMet Ed111

0402

1:44 p.m.

Goldsboro Square

Ground0.1

y

Met Ed111

0402

11:15 p.m.

Goldsboro

Ground

0.5

y

DOE

1 23

0403

1:15 p.m.

PA 441, north

Ground

3.0

DOE

1 24

0403

2:50 p.m.

0.4 east

Ground

1.0

DOE

1 25

0404

4:43 a.m.

Above Goldsboro

450 MSL

1.4/3 & yMet Ed

1 260404

6:33 a.m.

Goldsboro

Ground3/3 & yMet Ed

1 27

Highest offsite reading that day

0404

6:33 a.m.

Goldsboro

Ground0.03

y

Met Ed

1 27

Highest offsite reading that day

0405

5:41 a. m.

0.5 east

650

1.8/3 & yMet Ed

1 280405

6:30 a.m.

2-3 eastnortheast

Ground0.4/3 & yMet Ed

1 290405

6:30 a.m.

2-3 eastnortheast

Ground0.08

y

Met Ed

1 290405

1 0:46 a.m.

0.2 south

Ground

1.9

DOE

1 30

'MSL-mean sea level

Highest airborne offsite reading that day

Highest offsite reading that day

highest exposure rate seen on site this day, was
365 mR/h (/3 + y) or 50 mR/h (y). The Commonwealth of Pennsylvania, together with the DOE
and the NRC, observed levels of 1 to 10 mR/h (U3 +y) in the offsite area during the first day. (Normally,
the unit "Roentgen" (R or mR) should not be used todenote the exposure to /3-radiation. We are using
those units because most of the survey instrumentsi ndicate mR/h. The actual values of the potential /3+ y dose are highly uncertain because the instruments were not calibrated for the conditions of the
exposure and the mixed radiation fields. The actual
values are most likely less than the indicated readi ngs.)
Airborne measurements were made in the plumeby the DOE helicopter. These helicopter observations indicated that the plume could be detected out
to a distance of 16 miles (0.1 to 0.2 mR/h) with acenterline passing from the plant north to Hummelstown. The plume was bounded on the east with ali ne to Hershey and on the west with a line to Rutherford Heights.

441, northeast of the B cooling tower. The Met Ed
helicopter team observed the maximum airborne exposure rate of the day of 19 mR/h (y) at 7:03 p.m.
at an altitude of 1800 feet MSL, '/4 mile east of theobservation center. DOE Bettis teams monitoring
the offsite area observed a maximum of 7 mR/h (/3+ y) '/4 mile east of the plant on Pa 441 at 12:20
p.m.
April 1, 1979-Maximum exposure rates were lower
on April 1, 1979. The maximum onsite surface exposure rate was 40 mR/h (/3 + y) and 10 mR/h (y)measured at the fence line. The Met Ed helicopter
team reported an exposure rate of 30 mR/h (/3 +y) 650 feet MSL above the 500 kV substation at
4:32 a.m. These readings were the highest measured during the day.
April 2, 1979-Exposure rates on site and off sitewere considerably lower on April 2. The maximum
onsite ground exposure rate was 15 mR/h (/3 + y)and 7 mR/h (y). The highest offsite reading was 1.5
mR/h (/3 + y) and 0.1 mR/h (y) in Goldsboro
Square. The Met Ed helicopter team observed 90 to
240 mR/h ((3 + y) over the TMI-2 screen house.
DOE Bettis teams observed a maximum of 0.5
mR/h (y) at the Pennsylvania Fish Commission boat
access in Goldsboro.

March 29, 1979-The highest ground exposure rate
noted on this day was 150 mR/h (/3 + y) and 100
mR/h (y) on the fence line. The maximum offsite
surface exposure rate observed was 30 mR/h (/3 +y) and 10 mR/h (y). The highest airborne exposure
rate observed during the accident was 3000 mR/h(/3 + y) and 400 mR/h (y).

April 3, 1979-On April 3, the maximum onsite
ground exposure rate was 10 mR/h (/3 + y) and 1.9
mR/h (y), observed at the fence line. A DOE teamobserved the maximum offsite exposure rate of 3.0
mR/h on Pa 441, north of the plant.

March 30, 1979-Releases resulting from venting of
the makeup tank yielded onsite ground exposure
rates of 30 mR/h (/3 + y) and 9 mR/h (y) at thefence due south of the plant. Exposure rates of 20
mR/h (/3 + y) and 8 mR/h (y) were observed at thesame time at the fence line southwest of the plant.
At 8:02 a.m., a helicopter measurement was taken
directly in the plume. An air exposure rate of 1200
mR/h, the highest rate seen that day, was observedat an altitude of 600 feet mean sea level (MSL) (approximately 130 feet above the TMI-2 stack). At
9:00 a.m. offsite ground readings peaked at 10
mR/h (/3 + y) and 0.4 mR/h (y). These readings
probably represented the effects of the venting of
the makeup tank. At 3:00 p.m., the maximum onsite
surface reading of the day was observed (90 mR/h(/3 + y) and 9 mR/h (y) at the fence westnorthwest of the plant).

April 4, 1979-Exposure rates were slightly higher
on April 4. The maximum onsite ground exposure
rate observed was 5.5 mR/h (/3 + y). Maximum
offsite airborne exposure rate of 1.4 mR/h (/3 + y)
was observed above Goldsboro at 450 feet ofelevation. The maximum offsite ground exposure
rate was 3 mR/h (/3 + y) and 0.03 mR/h (y) measured in Goldsboro.
April 5, 1979-Some releases of radioactive material
continued on April 5. The maximum airborne exposure rate was 1.8 mR/h (/3 + y), at 650 feet (MSL).
The maximum offsite exposure rate observed by
Met Ed teams was 0.4 mR/h (/3 + y) and 0.08
mR/h (y) 2 to 3 miles east-northeast to northeast of
the site. The maximum onsite exposure rate was 3.5
mR/h (/3 + y) and 0.6 mR/h (y), east of TMI-2 at
the fence line. The maximum offsite ground exposure rate observed by a DOE team was 1.9 mR/h at
0.2 miles south of the plant.

March 31, 1979- At 3:28 a.m., the highest onsite
ground exposure rate of the day of 150 mR/h (/3 +y) and 20 mR/h (y) was observed at the fence line.
The maximum offsite surface exposure rate was 17
mR/h (/3 + y) and 4 mR/h (y), at 10:35 a.m. on Pa

388

1979-By April 6, offsite exposure rates had
dropped almost to natural background levels. Some
small onsite exposure rates were observed, andthese will continue as recovery operations are carried out.
April 6,

Conclusion- The exposure rates observed on siteand off site as a result of the accident were low.
The maximum airborne exposure rate reported at
any time was 3000 mR/h (J3 + y) and 400 mR/h(y). This reading was made directly in the plumeover the plant on the afternoon of March 29. The
release quickly dissipated and exposure levels on
the ground on site were orders of magnitude less.
On March 30, an airborne exposure of 1200 mR/h(,8 + y) was observed in the plume about 130 feetabove the TMI-2 stack. Again, releases of radioactive material quickly dissipated and the exposurel evels on the ground were orders of magnitude less.
During the period April 2 to April 13, the DOE Environmental Measurements Laboratory (EML) conducted offsite radiation exposure rate measurements at distances of 0.37 to 9.26 miles from theplant. The detectors deployed by the EML provided
the most precise measurements of exposure rates
off site. Of the 37 sites at which measurements
were made, only three had exposure rate levels
above background; the highest one was 1 mR/h, on
April 3, 0.37 miles from the plant.
d. Summary of Radiological Environmental
Sampling Results

In response to the accident, thousands of environmental samples were collected (and continue tobe collected) by Met Ed, the Commonwealth ofPennsylvania, and the various agencies of theFederal Government. Samples were collected during
the period of March 28 to April 16, from air, water,milk, vegetation, soil, and foodstuffs. Our review ofthese sampling results indicates that although
133
137
severalCs, 89 Sr and 9OSr,
Xe,
131 radionuclides (and1) were detected in some samples, only veryl ow levels of radioiodines and radioxenons can be
attributed to releases from the accident. The trace
quantities of radiocesium and radiostrontium detected in a few samples are attributed to and consistent
with residual global fallout from previously conducted nuclear weapons tests. This confirms that thereleases from the TMI facility were limited to the noble gas radionuclides and a small quantity of radioiodines.
Samples-Releases were detected in the offsitearea by sampling the air at ground level. For all
Air

389

samples taken from March 28 to April 12, whenchanging of the filters in TMI's
process ventilation
1311
was initiated, the levels ofdetected off site werevery low (a few picocuries per cubic meter(pCi/m)or less). The highest concentration observed during
3 131
The maximum permisthis period was 32 pCi/m . 1311
sible concentration (MPC) of3 132 i n the air in an un.
restricted area is 100 pCi/m
I ncreased levels ofradioiodines were detected after April 12, over awide area close to the plant. These releases of radioiodine were attributed
to the filter-changing
133
operations in TMI-2.
Three samples obtained by
NRC in the area immediately downwind of the plant
during the 24-hour period ending at midnight on3
April 16, indicated 131, the13111 levels of 110-120 pCi/m134
highest observed
concentration off site.
At
12:27 a.m. on April 16, 1979, a sample taken at thegate
500-kV substation contained 88
3f35thepCi/m .
EPA ground measurements of radioiodines in air
around the site during this period were below
detectable concentration levels. The maximum concentration that the EPA observed away from the sitewas 2.3 pCi/m 3, i n a sample collected from 11:58
a.m. on April 15 to 9:15 a.m. on April 16, at theCharles Brooks residence in Falmouth, Pa. Most of
the positive airborne concentrations observed by
EPA during the136April 12 to April 16 period were 1
pCi/m 3 or less.
Particulate air samples taken in the area after theaccident did not show any particulate radionuclides
attributable to the accident at TMI. Isotopes of xenon, namely 131m, 133,133m
125and 135, were the only
radioactive gases detected.

Milk Sampling Results-Afterthe accident, small
1311

concentrations ofwere detected in a few samples of the hundreds of samples of milk taken. The
milk was produced at several farms within 15 milesof the site. The highest radioiodine concentration
was 41 pCi/I in a sample of goat's milk collected by
Met Ed on March 30 1.2 miles north of the site,
along Pa Route 441. 17 The highest levels of radioactivity in cow's milk weredetected by the FDA.
1311
These were 36 pCi/I of 137Cs1( oriqinally reported to be
1 7
41 pCi/I) and 46 pCi/I of(the
Cs was attributed to fallout from previous weapons testing).
These values are well below the EPA protective ac1311
tion level137Cs.138
for milk of 12000 pCi/Iof
and 340 000
89
pCi/I ofTraces of Sr and 9O Sr were also
detected in 12 of 694 milk samples collected by the
FDA and were attributable to residual
139 fallout fromprevious
1311 atmospheric nuclear testing.
No
was detected in the milk samples collected by the EPA, although a single sample indicated aConclusion-The l ow levels of radioiodines andtraces of radioxenons collected in environmental
samples taken from the area around Three Mile Island Station confirm that releases of radioactive material from the accident were not significant. All of
the offsite analytical results were significantly below
regulatory limits.

137

trace (6.7 pCi/I) of
Cs. This trace was also attributed to residual global fallout. 140
Surface/Drinking

Water Sampling

Results-Only

three surface water samples of the many collected
postaccident indicated any positive radioiodine
results. The results of these samples, taken by Met
141
Ed, were 0.4 1pCi/I, 0.72 pCi/I, and 0.66 pCi/I.
The MPC 142
forI in water for unrestricted areas is
300 pCi/I.

e. Summary of TLD Data

Effluent Water Sampling Results-The EPA collect-ed samples of the effluent from the TMI outfalls.
Xenon-133 was detected in only four samples ofli quid effluents from TMI outfalls that were taken by
the EPA: 143

Various types of TLDs were deployed in the environs of Three Mile Island before, during, and after
the accident to determine the radiation characteristics of the radioactive materials released. The types
of TLDs used by each of the groups responding to
the accident and pertinent information regarding the
TLDs are summarized in Table 11-19.
Because all of the TLDs used were different,each had unique energy response characteristics,
and the materials included in the TLD package tomake the TLD respond uniformly over a wide range
of energies also were different. These differences,
coupled with a lack of background history for manyof the TLD locations that were used in response to
the accident, made interpretation of data from thesedevices difficult.
Table 11-20 contains the results of the Met Ed
TLDs for the period December 27, 1978, throughApril 15, 1979. These TLDs were in place since December 1978 for the quarterly dose assessment inaccordance with the REMP. These dosimeters wereretrieved on March 29, to determine the offsite population dose.
Replacement dosimeters werechanged at 3-day intervals in accordance with theaugmented REMP. The data in Table 11-20 werecorrected for background, resulting in the data
shown in Table 11-21 that are the net dose data attributable to the accident.

• 1200 pCi/I from Outfall 002 (12 inch) at 4:30 p.m.
on April 4.

• 5100 pCi/I from Outfall Marker 112 (20 inch) at
4:40 p.m. on April 4.

• 110 pCi/I at Outfall 003 at 3:00 p.m. on April 10.
• 130 pCi/I at Outfall 003 at 10:33 a.m. on April 11.

Only one positive radioiodine sample was collected from the TMI oily waste sump. The result of thissample, which was taken by the EPA at 10:45 a.m.
on April 12, was 740 pCi/I. 1
Vegetation Sampling Results-During the period
from March 28 to April 12, 1979,
only two vegetation
1311
results. The samples
samples yielded positive
were collected by the DOE on April 3, 1979 (80pCi/m2 , at 11:27 a.m., north of Red Hill Plaza) and on
2
April 4, 1979 (260 pCi/m at 5:00 p.m., at a point 3
144,145

miles north of pole No. T-761).
During the period April 13 to 16, the DOE collected many grass samples. Iodine-131 was detected ineight samples.
1311 The highest level detected was 730
pCi/m 2 ofobtained from a sample
146taken near
the plant in an area beneath the plume.

TABLE 11-19. Summary of TLD types deployed at Three Mile Island stationGroup

TLD Supplier

TLD Material

RMC

CaSO 4 : T m

Met EdTeledyne/Isotopes

NRC

RMC

Met Ed

NRC

HEW
EPA

RMC

Harshaw
Harshaw

TLD Reader Used

CaSO 4 : Dy

Teledyne Model 7300

Li 2 B 4 0 7 : Cu
+Ag/CaSO 4 : T m

LID 710

CaSO 4 : T m
LiF

CaF 2 : D Y390

RMC UD-505A

UD 710Harshaw-Atlas
Harshaw 2271

TABLE 11-20. Met Ed Teledyne and RMC quality control dosimeter results for first quarter 1978 background rate48
and total exposures including background for the period December 27, 1978 to April 15, 1979

Site
I dentification

1 C1
7F1

1 5G1
1 2B1

1 st Quarter
1978 Background
Rate (mR/month)
4.10
6.57

5.13

9G1

3.57
5.60

4A1
2S2

4.60
4.07

5A1

1 S2

1 6S1
11S1

9S2
4S2

582
4G1
8C1

7G1
1GA1

4.60
4.67

6.40
5.07

4.67
4.80
4.30

5.30
3.50
7.20
2.03

1 4S1

2.17

1 0131

1.97

7F10
1 5G 1 Q

6.15

5A1Q
1 S20

4.70

4.57
5.71

12/27/78
to
3/29/79
20.1
24.1

18.4
16.3
21.3

1 8.6
20.2
43.7

97.2
1 044.2

216.0
25.0
35.5

Total Exposures Including Natural Background (mR)

3/29/79to
3/31/79
3.2

1.1
1.9

9.4
1.4

8.3
34.3
32.5
20.0
83.7

1 07.1

25.1
124.3

3/31/79
to
4/03/79

4/03/79to
4/06/79

4/06/79to
4/09/79

4/09/79to
4/12/79

4/12/79to
4/15/79

0.5

0.9
0.5

0.8

0.4

0.5

1.4

-0.7
0.2
0.1
7.7

41.4

3.4
-0.1

7.0

45.0
4.6

1.2

0.5
1.0
1.3

0.6
3.0

0.9
1.2

0.9
0.6

1.4

2.2
1.5
21.8

1.8

0.7
0.6
1.0
8.5

1.3

0.6
0.7

0.3
0.6
2.2

0.6
0.3

0.3
0.5
0.1
0.5

0.2

0.4
0.2

0.4

0.2

0.4

0.3

0.4
0.4

0.3
0.1

0.6
1.1

1.6
6.0

-0.5

0.8
0.9

1.1
0.7

48.8

9.5

1.5

0.9

0.3

0.1

40.6.
36.6
23.3

1 4.9

0.4

1.1

0.8

0.6

0.4

0.8

1.5

0.9
0.7

1.0

1.0

0.9

95.7

15.3

0.8

0.6
0.7

1 3.0

25.8
907.7.
453.4

1 31.2.
1 48.3

17.6
1 6.1

49.3
1.2
1 0.7
1.0
45.1

1.1
5.4

26.7
0.6
1.7
1.7

0.8
5.2
1.3

0.6
1.3

2.0
0.8

0.7
1.0

0.6
1.3
0.9

0.6
2.7

0.6
0.6

7.9
1 5.5

30.5
1 7.2

28.0

0.5

0.7
0.4

0.6
1.8

0.2
0.2

0.4
0.2

0.7

TABLE 11-20. Met Ed Teledyne and RMC quality control dosimeter results for first quarter 1978 background rate andtotal exposures including background for the period December 27, 1978 to April 15, 1979-Continued

Site
I dentification

1 6S10

11S1Q

4S20
5S20

4G1Q
8C10

Total Exposures Including Natural Background (mR)

1st Quarter
1978 Background
Rate (mR/month)

12/27/78
to
3/29/79

3/29/79to
3/31/79

3/31/79
to
4/03/79

4/03/79to
4/06/79

4/06/79to
4/09/79

4/09/79to
4/12/79

4/12/79to
4/15/79

5.35

1 68.5

75.7

35.2

14.2

5.5

1.0

0.9

36.6

21.2

11.5

2.6

1.1

3.93
4.91

4.32
4.94

4.07"'

929.4
31.4
27.7

1 7.7

1 2.6

61.5
71.4

0.6
8.4

5.6

21.3

1.4

1.3

4.7
0.7

0.9
1.0

0.8
1.0

4.7

2.2

0.7

0.7

0.8

0.8

0.9
0.7
0.9
0.7

0.6

'At these three sites, two dosimeters were left in place for 6 months, thus two readings are available. This practice is followed
because the sites are inaccessible during the normal quarterly exchange time (-January 1st).
"Second Quarter, 1978: First Quarter missing.

TABLE 11-21. Net exposures, attributable to the accident, obtained from Met Ed Teledyne data 149

Site
designation
1 C1
7F1

15G 1
1281
9G1
5A1

4A1

12/27/78
to
3/29/79

3/29/79to
3/31/79

3/31/79
to
4/03/79

4/03/79to
4/06/79

4/06/79to
4/09/79

4/09/79to
4/12/79

4/12/79to
4/15/79

6.5

2.0

0.7

0.1

0.1

0.1

-0.1

0.0

0.1

-0.1

0.0

0.0

0.2

0.0

1.2

0.2

X

3.6

X

-0.1

4.6

6.1

-0.1

4.0

5.3

2.4

3.7

5.3

1.0

0.7

4.8

2.8

17.6

82.7

18.4

4G1

1.0

0.6

0.1

1 6A1
14S1

3.4

758.0
11.9

-0.1

0.2

0.0

0.0

0.8

16.5

4S2

7G1

-0.1

5.0

9.2

2.0

0.1

5.3

9S2

8C1

-0.2

14.2

32.7

7.0

0.9

17.5

10.0

0.9

0.6

0.4

-0.8

32.4

6.2

30.0

0.6

1.0

0.1
0.1

0.5
0.9

-0.1

1.2

0.5

29.7

4.2

0.3

0.0

X

-0.2

71.2

2.0

X

0.0

0.1

55.5

14.7

1.7

0.6

-0.4

861.1

5S2

0.6

0.2

13.1

16S1

168.6

-0.3

0.2

X

27.3

21.5

69.8

-0.8

X

22.7

26.4

11S1

X

0.4

2S2

1 S2

Net Exposures Attributable to the Accident (mR)

0.6

0.6

0.1

0.0
0.4

0.0

0.0

0.0

-0.2
0.1

-0.1

0.1

-0.2

0.1

-0.1

-0.1

0.3

0.0

3.7
0.4

0.3
0.5

1.5
0.0
0.1
0.1

-0.1

-0.2

-0.2

0.0

-0.1

TABLE 11-21. Net exposures, attributable to the accident, obtained from Met Ed Teledyne data-Continued
Net Exposures Attributable to the Accident (mR)
Sitedesignation

12/27/78
to
3/29/79

3/29/79to
3/31/79

3/31/79
to
4/03/79

4/03/79to
4/06/79

4/06/79to
4/09/79

4/09/79to
4/12/79

X

X

X

0.1

X

0.6

X

0.4

X

0.3

0.1

0.9

0.3

0.4

0.4

0.3

5.1

4.7

1.5

0.8

0.3

1.3

0.2

0.1

0.5

0.4

0.5

1081

27.4

7F10

4.7

0.4

15G1Q

3.4

0.8

0.3

1 S2Q

1 4.9

0.7

0.2

1 6S10

78.4

917.5

61.3

5.2

0.9

11Sia

1 52.3

75.3

4S20

16.5

71.1

34.7

4G1Q

2.8

0.3

5A1Q

5S2Q
8C10

2.3

9.8

1 4.6

36.3

0.3

8.1

20.8

0.2

1 3.7

4.2

0.1

4.9

0.1

0.5

0.6

0.5

X

0.2
0.2

0.4
0.2

20.8

11.1

4.3

0.2

0.3

0.3

0.2

2.2

0.7

0.2

0.2

0.2

0.9

1.8

4/12/79to
4/15/79

0.4

Table 11-22 contains daily data from the NRC
TLDs for the period March 31 through April 7, 1979.
These data were used by the Ad Hoc Interagency
Dose Assessment Group. With the exception of thefirst day of NRC TLD data, the data for the exposure period of April 1 through May 1, 1979 were usedby the President's Commission to determine the population dose for this period. 147 These results are
discussed in more detail in Section II.B.4.a.
The TLD data indicate that the major off site
releases of radioactive materials occurred on thefirst day. The highest readings were obtained onsite and at Kohr Island (see TLDs 16S1 and 16A1 in
Table 11-20). These readings indicate that the plumetraveled to the north-northwest. The other high
TLD readings (station 14S1) indicated that portionsof the plume may have migrated to the westnorthwest for short periods of time. With the exception of the Kohr Island dosimeter, all of the highreadings were on site. The highest net TLD reading
offsite location, about 2 miles to the southwest, was
27 mrem.
During the period of April 1 to April 3, 1979, only
the Kohr Island dosimeter and the dosimeter locatednear the observation center indicated a dose in excess of 10 mrem. Higher readings exceeding 10
mrem were noted on site. During the period March
31 to April 3, the data indicate that no significant
offsite releases occurred. Only four onsite readings
exceeded 10 mrem, the highest being approximately
30 mrem.

predicting plume behavior and location, was atool available for use in responding to the accident but was not effectively used within the
NRC (see Appendix 11.5).

We recommend that:. The NRC reevaluate its requirements for environmental radiological monitoring to ensure thatmonitoring of released radioactive materials inboth normal and accident conditions is at least as
adequate as the environmental monitoring that
occurred in response to the accident. This
reevaluation should include:-the location and number of TLDs permanently
i nstalled in the site environs;-stations to monitor airborne (particulate, gaseous, and iodine) activity;-the placement of fixed real-time instrumentation for monitoring radiation in site environs.
4. ESTIMATES OF DOSES AND POTENTIALHEALTH CONSEQUENCES OF RELEASES OF
RADIOACTIVE MATERIALS
Several independent studies using different
analytical techniques have estimated the radiation
exposure and resultant dose from the TMI-2 accident to the public. These studies have concluded,
and we agree, that the adverse health consequences attributable to the population dose areminimal at worst.
Onsite occupational exposures during the accident were also relatively low. Only three exposures in excess of the NRC quarterly exposure limi ts were recorded despite high radiation fields in theauxiliary building. The adverse health consequences attributable to these exposures will beminimal at worst. The total collective occupationaldose that will accrue as a result of this accident
cannot be determined until recovery operations arecomplete.

f. Findings and Recommendations
We find that:• Several

organizations including the Federal
Government responded to the accident and capably undertook the enormous task of environmental monitoring.
• The TLDs placed by Met Ed as part of its environmental radiation monitoring for routine
operation provided adequate data to characterize
the radiation levels in the environment attributable
to the accident.
• Data from the supplementary TLDs placed in theenvironment by the NRC, the HEW, and the EPA
following the accident were of limited use because of the different number and types of TLDs
employed and the lack of information regarding
background history and response characteristicsof the TLDs.
• The Atmospheric Release Advisory Capability( ARAC), a computer system with the capability ofa. Population Dose Assessment
Met Ed had TLDs in place on and around the site
environs at the time of the accident (see Section
II. B.3). Beginning on March 31, 1979, NRC placed
additional TLDs around the site. The Met Ed andthe NRC TLD data were used to assess populationdose resulting from the accident.
The Environmental Protection Agency (EPA) andthe Department of Health, Education, and Welfare
395

TABLE 11-22. NRC TLD data-radiation exposures for periods from March 31 to April 7, 1979 (includes background)

15o

Station3/31-4/1mR

4/1-4/2mR

4/2-4/3mR

4/3-4/4mR

4/4-4/5mR

4/5-4/6mR

4/6-4/7mR

N-1

1.0 ± 0.1

0.3

0.37 ± 0.08

0.28 ± 0.08

0.32 ± 0.04

0.43 ± 0.05

N-2

(wet)

0.3

0.45 ± 0.05

0.32 ± 0.08

1.0 ± 0.1

0.3

0.43 ± 0.05

0.48 ± 0.08

0.32 ± 0.08

0.34 ± 0.09

0.47 ± 0.05

0.50 ± 0.11N-3

1.2 ± 0.3

N-5

( wet)

N-4

0.3
0.3

0.58 ± 0.08

NE-1

7.0 ± 2.1

0.2

0.45 ± 0.08

NE-3

1.6 ± 0.50.3

0.42±0.09
0.53 ± 0.1( wet)

0.3

0.48 ± 0.09

NE-4

2.1 ± 0.5

0.3

E-1

25.0 ± 8.1

0.4

0.37 t 0.05

E-2

4.3±0.50.3

E-4

2.5 ± 0.4

NE-2

E-5(E-1a)E-3

8.4 ± 4.6
2.1 ± 0.4

SE-1

1 0.1 ± 2.0

SE-3

2.3 ± 0.6

SE-2
SE-4
SE-5
S-1

S-2
S-3

S-4

3.5 ± 0.5
3.0 ± 0.4
2.5 ± 0.7
1.6 ± 0.1

0.33 t 0.05
0.37 ± 0.5

0.3
0.3
0.3
0.3
0.4

0.4

1.2±0.2

0.3

0.4

4.4

±0.7

2.1

± 0.4

9.1

2.8

± 1.6
± 0.7

0.13 ± 0.1
2.2

± 0.4

1.5

± 0.3

1.5
1.4

0.48 ± 0.10

0.52 ± 0.08

0.46 ± 0.05

2.6 ± 0.60

0.50 ± 0.09

0.55 ± 0.10

0.38 ± 0.08

0.45±0.10,

0.35±0.08

0.35 ± 0.14

0.42 ± 0.19

0.43 ± 0.04

0.22±0.04

0.33 ± 0.08

0.38 ± 0.04

0.33 ± 0.05
1.7 ± 0.45

0.32 ± 0.04

0.40 ± 0.06

0.3

0.35 ± 0.05

0.48 ± 0.10

0.37±0.08

0.42 ± 0.1± 0.1

0.42 ± 0.02

0.38 ± 0.08

0.37 ± 0.10

0.4

0.4

0.37 ± 0.05

0.40 ± 0.05

0.38 ± 0.04

0.38 ± 0.08

0.3

0.48 ± 0.15

0.45 ± 0.05

0.73 ± 0.2

0.55 ± 0.7

0.33 ± 0.08

0.32 ± 0.04

0.3

1.0 ± 0.2
1.2 ± 0.3

0.40 ± 0.06

0.40 ± 0.09
1.2 ± 0.27

0.47 ± 0.12

0.45±0.10

0.43 ± 0.05
0.48 ± 0.08
0.32 ± 0.04

0.48 ± 0.08

0.32 ± 0.08

0.92 ± 0.19

0.40 ± 0.00

0.87 ± 0.16

0.38 ± 0.08

0.35 ± 0.05

0.55 ± 0.06

0.30 ± 0.06

0.53 ± 0.08

0.47 ± 0.08

0.43 ± 0.10
0.57 ± 0.10

0.42 ± 0.04
1.1

± 0.050.50 ± 0.06

0.47 ± 0.10

0.45 t 0.08

0.45 ± 0.05
0.37 ± 0.08

0.37 ± 0.05

± 0.2

0.52 ± 0.08

0.32 ± 0.10

± 0.2

0.33±0.05

0.45±0.10

0.47 ± 0.05

0.40 ± 0.06

0.40 ± 0.06
0.62 ± 0.31

0.35+ 0.05

0.35 ± 0.05
0.40 ± 0.06

0.55 ± 0.18

0.25±0.05

0.25 ± 0.05
0.25 ± 0.05
0.38 ± 0.13

0.40 ± 0.00
0.43 ± 0.08
0.55 ± 0.10
0.42±0.08

±0.180.37±0.08

0.37±0.10

0.78±0.1

0.65 ± 0.10

0.45±0.10

0.38 ± 0.08

0.42 ± 0.02

1.4

1.7

± 0.350.57 ± 0.10

0.48 ± 0.08

1.1

±0.15

0.42 ± 0.08

0.38 ± 0.08

0.47 ± 0.08

0.60 ± 0.13

0.40 ± 0.06

0.57 ± 0.14

0.33 ± 0.05

0.35 ± 0.05

0.38 ± 0.08

0.32 ± 0.04

0.45 ± 0.10SW-1

0.9±0.1

0.8

1.2

SW-3

1.1 ± 0.3

0.4

1.2

SW-2

0.9±0.2

1.0±'0.2

0.4

NW-1

0.9 ± 0.2

1.2±0.2

0.45 ± 0.14

0.50 ± 0.14

0.50 ± 0.09

0.62±0.04

0.72 ± 0.04

0.37±0.08

0.38 ± 0.08

0.67 ± 0.1

0.42±0.10

0.45 ± 0.14

1.3 . ± 0.25

0.30 ± 0.06

0.38 ± 0.08

0.63 ± 0.12

0.40 ± 0.25

0.38 ± 0.04

0.40 ± 0.09

0.42 ± 0.04

0.42 ± 0.21

0.32 ± 0.04

0.48 ± 0.08

0.75 ± 0.1

W-4
W-5

0.62 ± 0.10

0.5
0.5

1.1 ± 0.1

0.38 ± 0.08

0.37±0.12

0.9 ± 0.1

W-3

0.43 ± 0.08

±0.3

W-2

1

± 0.24± 0.1

0.5

0.78 ± 0.2

0.6

0.4

1.7

± 0.150.65±0.12NW-2

1.2 ± 0.5

0.4

0.62 ± 0.08

0.40 ± 0.15NW-4

5.5 ± 1.8

0.3

0.4

0.30 ± 0.06

NW-3
NW-5

1.4 ± 0.7

4.6 ± 2.00.8
0.4

0.45±0.05

0.30±0.09

1.3

0.9 ± 0.1

3.0 ± 1.9

1.1

0.5

SW-4
W-1

±0.3

± 0.061.3± 0.290.37 ± 0.08

0.45 ± 0.05
0.52 ± 120.57 ± 0.08

0.53 ± 0.04
0.42 ± 0.05
0.45 ± 0.05

S-1a

Not in Service until 4/5/79

0.35 ± 0.05

0.43 ± 0.05

W-3a

Not in Service until 4/5/79

0.65 ± 0.39

0.45 ± 0.10

N-1a

Not in Service until 4/5/79

0.50 ± 0.19

0.47 ± 0.04

N-1 c

Not in Service until 4/5/79

0.40 ± 0.09

0.45 ± 0.08

N-le

Not in Service until 4/5/79

0.40 ± 0.06

0.44 ± 0.08

Not in Service until 4/5/79

0.33 ± 0.05

Not in Service until 4/5/79

0.38 ± 0.08

Not in Service until 4/5/79

0.40 ± 0.06

N-1d

Not in Service until 4/5/79

0.35 ± 0.05

0.50 ± 0.06

N-1f

Not in Service until 4/5/79

0.47 ± 0.15

0.37 ± 0.08

SE-4a
NE-3a
N-1 b

0.25 ± 0.05

0.57 ± 0.08

0.50 ± 0.06

(HEW) also placed TLDs around the site. Because
the limit of sensitivity of these dosimeters was about
10 mR, they did not provide data useful to dosimetric calculations. If significant quantities of radioactive material had been released after April 1,
however, these dosimeters would have been of
great value in determining the dose to the offsite population. Additional radiological monitoring in theenvironment by the Department of Energy (DOE),
Met Ed, NRC, and the Commonwealth of Pennsylvania confirmed that radiation levels off site werequite low and remained so during the course of andsubsequent to the accident (see Section II.B.3).
Ad Hoc Interagency Dose Assessment Group
Study- The Ad Hoc Group 151 analyzed the TLD
data available through April 7. The group determined that the most likely collective population doseas a result of the accident was 3300 person-rem
for the period March 28 through April 7. The Ad
Hoc Group estimated that the possible doses
ranged from 1600 person-rem to 5300 person-rem.
In developing these estimates, several simplifying
assumptions were made. As a result, several factors known to reduce estimates of exposure were
not taken into account, including: (1) shelter factor(the protection afforded to people remaining indoors), (2) population redistribution, (3) actual organ
doses which are smaller than the air dose calculated from the net TLD exposure, and (4) overresponse of the dosimeters supplied by Teledyne
Isotopes, Inc. In addition, a conservatively
small
151
value for background was subtracted.
152
The highest value (5300 person-rem)
resultedfrom inclusion of data from NRC TLDs for the firstday of their deployment, which yielded dose values
higher than could be substantiated by other TLDs or
by field or aerial measurements. The Ad Hoc Group
believed that insufficient background subtraction
could have been the cause.
Two other methods used to estimate the population dose were presented in the Ad Hoc Group's report. One method used standard meteorologicaldispersion calculations and an estimated source
term to calculate the population dose. By thismethod, the populationdose was estimated to be153
2600 person-rem.
The other population dose
estimate was based on radiation measurements
made from DOE helicopters. This method resulted
in a population dose estimate of 2000 person54
rem )A subsequent recalibration of the DOE instruments indicated that they were overresponding
to the radiation emitted by 133Xe, indicating that theinitial DOE population dose estimate may be high.

398

Task Group on Health Physics and Dosimetry of the
President's Commission - This Task Group estimated the offsite population dose by several
methods. The primary estimate was based on thesame TLD data analyzed by the Ad Hoc Group, plus
certain additional data available after April 7. This
Task Group concluded that the most155
probable population dose was 2800 person-rem,without accounting for the shelter factor. With a shelter factor,
the estimate of the population dose was 2000
person-rem. 156
I n arriving at its population dose estimates, theTask Group evaluated the energy-response characteristics of the TLDs, and the accuracy and precision of the measurements made. These factors
were used to establish the bounds of populationdose values from 600 person-rem to 6500 personrem.
The Task Group determined that the first batchof TLDs deployed by NRC, which had been used by
the Ad Hoc Group to derive its maximum estimate of
population dose, was irradiated during storage andtransit prior to deployment. 157 Because the contribution from this irradiation to the total dose could
not be ascertained, these data were not included in
the Task Group's dose assessment. Apparently,
the use of a shielded shipping container and a control dosimeter was not considered either for the deployment or retrieval of the dosimeters. This situation should not have occurred and is not in accord
with acceptable practice.
The Task Group used three computer models
with different meteorological modeling and dispersion calculations, and a source term, to make additional population dose estimates.l 58 The estimates
are shown in Table 11-23.
The Task Group concluded that the "most likely
collective (population) dose," as determined bythese methods was 500 person-rem. They also
stated that even if the results were in error by asmuch as a factor of 10, the "highest likely collective
dose" was 5000 person-rem; and the "lowest 159
likelycollective dose" was less than 50 person-rem.
TABLE 11-23. Population dose estimates using
computer models
Computer ModelADPIC
AIRDOS-EPA
TMIDOS

Population Dose (person-rem)
276
390
970

Commission. Correcting for occupancy factors,
shielding, and reductions in the population due tovoluntary evacuation, the population dose is believed to be somewhere in the lower end of those
ranges, or about 2000 person-rem.
There are no data or methodologies available bywhich to establish the collective dose with any
greater accuracy. Among the factors that contribute to the inability to improve the collective dose
estimates are the uncertainties associated with individual TLD determinations at the level of doses
measured, the sparcity of the data, and the influence of the many factors that contribute to additional exposures of the TLD for which correction factors
cannot now be ascertained. However, the placement of the TLDs and the prevailing wind directions
at the time of the accident indicate that the close-in
TLDs properly measured the radiation emanatingfrom the plume. Furthermore, because the healtheffects implications do not change in this range of
population doses, it is not necessary to attempt toestimate the range of the population dose more accurately. We find that despite the uncertainties in
the TLD data, the data were adequate to characterize the magnitude of the collective dose to the population.

Other Collective Dose Estimate-Using an independent computer model for atmospheric dispersion
and dosimetry, and an estimated source term considerably larger than that used by the Task Group1of the President's Commission, Woodard 60 calculated the population dose to be about 3500
person-rem for the period from March 28 to April
30, although releases were effectively terminated byMarch 31. No corrections were made for occupancy or shielding. The uncertainties in this calculation
were estimated to be within a factor of 2 depending
upon whether the plume was elevated or not. The
range is from a low value of 2098
161 person-rem to ahigh value of 6836 person-rem.

TM/ Special Inquiry Group-We analyzed the offsite
population dose estimates of the studies discussed
above. The estimates are summarized in Table II24. The studies were independently performed withdifferent methodologies, yet arrived at similar popul ation dose estimates. Each of the dose estimates
was comprehensive in its analyses of the potential
pathways of the plume and the potential error
sources in the data. The maximum population dose
estimates indicate that the population dose could
not have exceeded 5000 person-rem.
Based on our review of the population dose studies, we deemed it unnecessary to perform an additional independent analysis of the raw data. We findthat the collective dose as determined by the TLDs
i s within the ranges estimated by the Ad Hoc Interagency Dose Group and the Task Group on
Health Physics and Dosimetry of the President's

Additional Offsite
Dosimetry- The HEW Public
164
Health Service
attempted to determine offsite exposure from photographic film present in stores in
the TMI area during the first 3 days after the accident. The Public Health Service concluded thateven if the fogging noted on the purchased films
was attributed to radiation exposure, the total dosewould be less than 5 mrad. Some of these films
were from the Middletown, Pa. area, adding further
evidence that the offsite population exposures were
low, in agreement with the TLD readings. 162
Met Ed deployed several of its personnel TLD
badges around the site as an additional means ofdetermining onsite doses. The data from thesebadges were compared to the data from the environmental dosimeters. These data were very erratic and the results ranged from a factor of 6
higher to a factor of 10 lower than the environmental
monitoring TLD data. No correlation or explanation
for these wide variations could be established, so
the results could not be used in the population dose
assessment.

TABLE II-24. Population dose estimates
SourceAd Hoc Interagency Population
Dose Assessment Group

Population Dose( person-rem)
3300

President's Commission, Task
Group on Health Physics andDosimetry

2800
2000'

ADPIC

300

TMIDOS

1 000

Woodard (Pickard, Lowe, &Garrick)

3500

AIRDOS-EPA

400

b. Maximum Individual Offsite DoseThe maximum individual offsite dose would be received by a person near the plant in the path of the'Includes shelter factor.
399

plume. Based on the TLD data, the maximum dosewould be received by an individual located on theeast bank of the Susquehanna River. The Ad Hoc
I nteragency Dose Assessment Group estimatedthis dose to
be 83 mrem (expressed as less than163
100 mrem)
The Health Physics and Dosimetry
Task Group of the President's Commission estimat11 4
ed the dose to be between 20 and 70 mrem.
Itsestimate included correction factors for occupancy
and dosimeter overresponse and is in close agreement with the Ad Hoc Group estimate. Our reviewof the available data and analytical methodologies
employed by both groups verified these estimates.
The highest actual individual offsite dose identified was received by an individual who was on Hill
Island for short periods of time during the accident.
The Ad Hoc Group calculated a most probable doseof 37 mrem185 to this individual. The President's
Commission estimate was about 50 mrem. 1 64 Our
review of the available data and analytical methodologies used by both groups verified these estimates.
We find that the maximum offsite individual dose
was less than 100 mrem.

Radioiodines behave physiologically in the samemanner as stable iodine. The thyroid gland concentrates and uses iodine. Radioiodine entering the
body is taken into the blood; a fraction (about 25%)
is taken up by the thyroid gland and remains for asignificant period of time.
The report by the Health Physics Task Group of
the President's Commission presented internal dose
assessments. Based on the maximum concentration measured, hypothetical maximum individual
doses were calculated. Because of scarcity of positive data (the majority of the environmental samples yielded negative values, below minimum detectable limit), no population dose assessment frominternal exposure was performed.
The Task Group estimated maximum
internal1311
doses to individuals offsite from theintake to be
6.9 mrem to the thyroid of a newborn child and 6.5
mrem to the thyroid of a 1-year-old child. On site,
they estimated the maximum
dose to an adult thy166
roid to be 53 mrem.
The Task Group also estimated maximum internal whole body dose from theother radionuclides, such as 133 Xe, to be 0.3 mremand the lung dose to be 3 mrem. These estimates167
agree with those reported by the Ad Hoc Group.
Further confirmation of the type of radionuclides
released by TMI and the small internal populationdose was provided by whole-body counting.
Several hundred people residing in the environmentof TMI underwent this procedure and all results
were negative for radionuclides that could havebeen released during the accident. We find that thecontribution of internal exposure to the populationand individual dose was small compared to the dosefrom external irradiation.

c. Internal Dose Assessment
Radionuclides that enter the body result in a radiation dose to that individual. The dose is dependent
upon many factors, the most significant of which are
the degree of uptake, localization, the residence
ti me of the radionuclide(s), and the type and energyof the emitted radiation(s). The routes of intake ofradionuclides into the body are well known, and theenvironmental sampling program before and after
the accident is designed to detect and measure radionuclide concentrations in the environment. Whenthese concentrations have been determined, theresultant internal dose to members of the public canbe estimated. As described in Section II.B.2.f, theonly radionuclides released to the environment inmeasurable amounts, as a result of the TMI accident, were noble gases and, to a much lesser extent, radioiodines.
Noble gases, when inhaled, do not chemicallyreact within the body, and the major fraction is
promptly exhaled. A small amount of the noble
gases passes into the blood, a small fraction ofwhich is dissolved in body fat. Even this fraction
has a relatively short residence time. Thus, thedose received from internal exposure to noble gas
is very small in comparison to the external dose thatwould be received by a person in or near a cloud of
noble gas.

d. Skin Dose Assessment
I n case of an immersion in a plume of xenon-133(the major radionuclide released), the skin dosefrom beta radiation could be up to four times higher
than the whole-body gamma dose. 1 68 The maxi mum permissible dose to theskin, however, is six
169times that of the whole body.
Points of plume touchdown and data from TLDs
on integrated beta dose were not reported. In any
case, any individual in the plume would have benefited from shielding afforded by clothing. For thesereasons, the Health Physics Task Group did notquantitatively
assess the skin dose from beta radial68
tion.
The health effects of skin exposure are considerably smaller than those from whole-body exposure.
Thus, the possible additional skin exposure would400

not have any discernible effect. The Ad Hoc Groupreached similar conclusions. 170
e. Occupational Exposure
Met Ed reported three accident-related wholebody exposures in excess of the NRC quarterly limitof 3 rem. These doses were 3.9, 4.1, and 4.2 rem.
In addition, two workers received overexposures totheir hands. These doses have been calculated by
the NRC at about 50 rem to skin of the forearm of
one worker
and about 150 rem to the fingers of the171other . The worker who received 150 rem to his
fingers is the same individual who received awhole-body exposure of 4.2 rem. (On August 27,
1979, six workers received overexposures to theskin and extremities. The doses, as measured byTLDs, were up to 50 rads to the skin
172 and between
40 and 150 rads to the extremities.)
The potential for severe, additional overexposures existed during the first few days of the accident. Extremely high radiation fields, in excess of
1731000 R/h, existed in the auxiliary building.
Moreover, unauthorized entries to the building were madei n violation of station health physics procedures.
Although a person could have been severely
overexposed, there is no evidence that anyone was.
The total estimated occupational collective dose174
through June 30 was about 1000 person-rem.
Table 11-25 shows the number of individuals monitored and the collective occupational doses received for the period March through September
1979.
Table 11-26 shows the number of individuals who
received whole-body doses in excess of 100 mrem
during the period from March through September
1979. The data in this table were extracted fromMet Ed's TLD personnel dosimetry report.
The collective dose received by the 1596 individuals receiving doses in excess of 100 mrem is approximately 800 person-rem. These data show thatno individual has received a dose in 172
excess of the
The averallowable annual limit of 5000 mrem.
age dose received by these 1596 individuals was
10% of that limit.
Table 11-27 contains the dose accumulation rate
for the seven individuals receiving more than 3000
mrem during that 7-month period. The table showsthat most of the relatively high individual exposure
occurred during the first month after the accident.
The collective occupational dose is smaller thanthat received by the surrounding population,although it will continue to rise during recovery
operations. Moreover, the Health Physics and Do-

401

simetry Task Group of the President's Commission
concluded, after its review of the procedures anddata regarding the occupational exposures resulting
from the accident, that "the available data on occupational exposure at Three Mile Island mustbe"174
treated with caution. It may be incomplete.
Weagree with this conclusion.
We find that the accident at TMI-2 resulted inseveral exposures in excess of regulatory limits toplant personnel in the first few days following theaccident. We find further that the collective occupational dose and the extent of overexposure is notl arge in relation to the radiation fields and contamination levels encountered during the accident,
although the actual collective occupational dose is
not precisely known.
f. Health Effects of Low Level Ionizing
Radiation
The human health effects of ionizing radiation
may be classified as: (1) acute somatic effects, (2)developmental or teratogenic effects, (3) late somati c effects, and (4) genetic effects.
Acute somatic effects involve various forms of radiation sickness occurring shortly (a few days or
weeks) after whole-body doses of about 100 rad or
more. Teratogenic effects involve various kinds ofdevelopmental abnormalities following irradiation inutero. Such effects have been observed in animals
following doses as low as 5 radt76177
and in humans
There is nofollowing doses exceeding 50 rad.
evidence associating much smaller doses of radia178,179
tion to developmental effects.
The radiation exposures caused by the accident
resulted in individual doses considerably smaller
than those associated with acute and teratogenic
effects. The most important effects of radiation on
man which may be caused by low level radiation arethose which may appear, or continue to appear, atl ong intervals of time after exposure in the individual
i rradiated (late somatic effects) or in his or her progeny (genetic effects). (As used in this report, "lowl evel" or "low dose" refers to doses below individual
occupational dose standards of 5000 mrem peryear).
Late Somatic Effects-The most important latesomatic effect of low doses of radiation is the increase of incidence of cancer. Most human studies
on populations exposed to radiation (e.g., atomic
bomb survivors in Hiroshima and Nagasaki, radium
dial painters) indicate that radiation-induced lifeTABLE 11-25. Occupational dose March 1 to September 30, 1979

Month

March

Number of Dosimeters Distributed
1131

April

4504

June

2973

May

July

August75

Collective Dose(person-rem)
334

1 40

5282

350

2500 (approx.)

63

1 59

2500 (approx.)

September

1

63

2472

36

TABLE 11-26. Occupational doses in excess of 100 mrem March 1, 1979 to September 30, 1979

Dose Range( mrem)NumberofI ndividuals

1 002502515005017507511 000

1 0012000

20013000

30014000

40015000More than
5000

648

465

213

118

1 29

16

4

3

0

TABLE 11-27. Dose accumulation
rate for individuals receiving more than 3000 mrem from March 1,
1751979 to September 30, 1979

Period03/01-03/31

04/01-04/30

05/01-06/30
07/01-09/30

I ndiv.
A

I ndiv.
B

I ndiv.
C

1 60

10

915

4100
15

30

4120
30
15

1785
45

395

shortening is largely due to increased cancer mortality.180,181
Radiation-induced cancer is detectable only in astatistical sense. A182
particular case cannot be attributed to radiation . Human evidence for radiogenic cancer comes from epidemiological studies
conducted on relatively large population groups exposed to doses much larger than those experienced
by the population in the vicinity of the Three Mile Island Station. Numerous animal studies confirm thecarcinogenic properties of radiation, but those stu-

Dose (mrem)
I ndiv.
D

I ndiv.
E

I ndiv.
F

I ndiv.
G

40

990

915

1335

395

210

3575
220

70

2230

1 00

345

1785
45

2360
1 80

dies also necessarily involved exposure to relatively
large doses. Cancers induced by radiation are indistinguishable from those occurring from othercauses. Radiogenic cancer thus can only be inferred on the basis of an excess above the expected natural incidence.
Theoretical considerations suggest that at any
level of radiation, no matter how small, some carcinogenic potential exists. Thus far, nearly all humandata rely on observations at high dose levels andhigh dose rates (doses generally greater than 50
402

view of BEIR I and BEIR III that the linear nonthreshold extrapolation describes the upper limit of risk.
UNSCEAR concluded that at doses of a few rad, theestimates are likely to be too high and the actual
rate might be substantially lower. UNSCEAR also
states that the risk from irradiation due to radionuclides deposited within the body is not different fromthat from external radiation, provided that the absorbed dose to a given tissue is the same from bothmodes of irradiation. Thus, the risk from the total
radiation dose received by the population is thesame whether the dose is received from external
exposure or from radioactive materials that might
have been ingested or inhaled.
Upper limits of possible premature cancer deaths
resulting from this accident can be estimated using
the linear, nonthreshold dose-response relationship.
However, in addition to dose response relationships,
several other assumptions must be made in derivation of risk estimates. The ongoing human studies
suffer from many imperfections: imprecise dose
determination, limited number of subjects, and inability to control variables. Because these studies
are not completed, many assumptions have to be
made, including: (1) the duration of increased risk
following irradiation, (2) latent period (time interval
between irradiation and detection of effect), and (3)whether the risk following a given population doseshould be expressed by some number of excess
cancers, regardless of natural incidence (absoluterisk), or as a fractional increase of the natural risk ina given population (relative risk). Because of thenumerous assumptions that have to be made, therisk coefficients and risk estimation models pub189
lished by various scientific organizations differ.
The Radiation Health Effects Task Group of the
President's Commission on the Accident at Three
Mile Island applied risk factors and models published by various national and international risk assessment bodies, as discussed above, to estimatesof doses received by the population as a result of
the TMI-2 accident. Table 11-28, taken from thisTask Group's report, contains the ranges of projected numbers of 190
lifetime excess cancer among theThis table also shows theoffsite population.
ranges of the estimated additional risk of developing
cancer by the maximally exposed individuals in thevicinity of Three Mile Island Station. Our analysis
yields the same values.
We find, therefore, that it is extremely unlikelythat any individual will suffer discernible ill effects,
during his or her lifetime, from radiation exposure
associated with the TMI accident. The effects on
the population as a whole, if any, will certainly benonmeasurable and nondetectable.

rem and dose rates on the order of rads per minute)and the risk factors given in most scientific publica183,18a,185
are derived from these data. To
tions
quantitatively assess the health consequences of
the incremental radiation exposure received by the
population as a result of the TMI-2 accident, it isnecessary to determine how the risk factors derived
from relatively high doses and dose rates can beused in estimations of health effects resulting fromdoses of a few millirads to tens of millirads of low
LET radiation. (LET, linear energy transfer, is theaverage amount of energy lost by particle per unit oftrack length; low LET radiation characteristics ofbeta rays (electrons), X-rays and gamma rays, areradiations to which the population in the vicinity of
TMI was exposed.)
One way of determining radiation risk factors,
which serves as the basis of current radiation exposure standards, is to assume that the effects observed at high doses from high dose rates can bedirectly and linearly extrapolated to low dosesdelivered at very much lower dose rates, and that
there is no dose (or threshold) below which there is
no health risk. Applying these assumptions results
i n a linear, nonthreshold, dose-rate independent,
dose-effect relationship.

The majority of the scientific community considers that the linear, nonthreshold extrapolation
represents the upper limit of effects at very low
doses, and that the risk factors derived using suchan extrapolation probably overestimate the actual
risk 1 86 This view is stated in relevant publicationsof the National
Academy of Sciences (BEIR I and
185,187
and the United Nations (UNSCEAR
BEIR III)
188

77).
Both BEIR I and BEIR III indicate that the actual risk could be appreciably smaller for low level
irradiation, and even zero. However, they also indicate that, because of the greater killing of cells athigh doses and high dose rates, extrapolations
based on effects observed under such conditions
may be postulated to underestimate the risks. In
most cases, however, the linear hypothesis probably overestimates rather than underestimates therisk from low level, low LET radiation.

BEIR III further states that it is not known whether
dose rates of gamma or X-radiation of around 100
mrad/year are detrimental to exposed people; any
somatic effects would be indistinguishable fromthose occurring naturally or caused by other factors. The observed variations in incidence (fromplace to place and from year to year) are far greaterthan any likely effect of radiation delivered at suchdose rates.
The 1977 UNSCEAR report is consistent with the403

TABLE 11-28. Summary of various projected lifetime cancer numbers or risk estimates
for whole19obody external gamma radiation doses to offsite TMI population (within 50 miles)*
Source ofEstimates Or
Risk Factors

Ad Hoc Group

EPA***
General Pop.
AdultsChildren < 10 yr.
Reactor Safety Study

Upper Bound Model
Central Model

Lower Bound Model
UNSCEAR 1977
I CRP 1977

Projected Numbers of Cancers
At 3000 Person Rem**
Fatal

Non-Fatal

Total

0.6

0.6

1.2

0.3-1.6

0.3-1.6

0.6-3.3

0.24-0.5

0.24-0.5

0.5-1.0

Fatal

1.4/10Non-Fatal

5

1.4/10(0.7-1.4)/10

0.06-1.2

0.06-1.2

0.3

0.3

0.6

0.9/100.06

0.12

0.17/100.06

0.12-2.4

Cancer Risk Max. Exposed Person(approx. 70 mrem)**(0.7-14)/10

0.0

0.0

0.0

0.0

0.30

0.30

0.60

0.7/10

0.3

0.3

0.6

0.7/10

5

5
5

5

5

5

5

2.8/10( 0.7-1.4)/10(0.7-14)/10
0.9/105

0.17/100.0

0.7/10
0.7

5

5

Total

5

5
5

5

-(1.4-2.8)/10(1.4-28)/10
1.8/105

0.34/100.0
1.4/101.4/10

5

5

5

5
5

* Values obtained by applying projections or risk coefficients yielded by models in listed reports to TMI dose estimates used in this report.
** 3,000 person-rem 50% higher than most probable actual total collective dose, and 70 mrem the dose the maximally exposed individual estimated by HP&D Task Group.
*** Range for general population the sums of lower range values and upper range values for adults and children< 10 years. Extraordinarily high upper range values for children and general population due to inclusion of causallyquestionable association of high risk of childhood cancer with in utero diagnostic irradiation and to projection of theassumed high relative risk of radiogenic cancer in children (0-9 years) to the 50+ age group in the BEIR 1972 relativerisk model used.
Genetic Effects-When cells are exposed to ioniz-

extrapolation from low dose laboratory mouse data.

ing radiation, the chromosomes of the cell nuclei

The 1972 BEIR report estimated that spontaneous

may be damaged by the production of gene mutations, involving alterations in the elementary units ofhuman mutation rates may be increased between

0.5 and 5.0% per rem of gonadal dose, which isheredity that are localized within the chromosomes

equivalent to a mutation doubling dose of 20 to 200
92
rem1( A doubling dose is that dose which dou-

or by the induction of changes in the structure or

number of the chromosomes. When such changes

bles the frequency of any given effect.) The 1977
193

are induced in the germ cells, they may be transmit-

UNSCEAR Report provides similar estimates.

ted to descendants of the irradiated subject. Thishas been clearly established in experimental studies

Although such risk values are difficult to translate

Although similar genetic changes may also be in-eration might be expected in the United States to

i nto actual health effects, the 1972 BEIR report has

on short-lived animal species.

estimated that a cumulative dose of 5 rem per gen-

duced in humans, none has yet been demonstrated,

produce between 60 and 1000 genetically deter-

perhaps because the effect is too small to detect

mined illnesses of various sorts per million live
9
births4This would represent a 0.1 to 1.6% in-with the data resources available or with present
methods of observations.
Direct human information.177
i s therefore limited

crease over the expected incidence of 60000

Studies of Japanese children

conceived after their parents were exposed to atom

cases.
The estimates of genetic effects given in the draft

man data, estimates of the genetic risk to population

disorders per million live births in the first generationbomb radiation have not demonstrated an observ191
able increase in genetic defects.
For lack of hu-

BEIR III Report are not notably different from thosecited above: 5 to 75 additional serious genetic

from low dose and dose rates are based on linear

following parental dose of 1/rem. Such a parental404

dose will, according to BEIR III estimates, result over
all time (i.e., over many future generations) in a total
increase of 60 to 1100 serious
genetic disorders per
195
million liveborn offspring.
The ranges of risk estimates underscore the limited understanding of genetic effects of radiation onhuman population. But even the upper values ofrisk estimates are small compared to the current
estimates of the existing incidence of serious humandisorders of genetic origin-about 107 000 per million liveborn offspring. 196

tables are averages. Natural background radiation
varies widely; even large local variations are possible, as shown in Tables 11-31 and 11-32. People living
at high altitudes or in areas of high external terrestrial radiation receive much higher doses. 197
On the basis of a nationwide survey conductedby the U.S. Department of Health, Education, andWelfare, it is estimated that in 1970, out of a population of 200 million persons, 130 million had one ormore X-ray examinations. 198 The most commonly
performed procedures, radiographic chest examinations and dental examinations, result in a mean dose
to total active bone marrow of about 10 mrad per
examination. The annual per capita rate for each ofthese examinations is about 0.3. Some other exami nations, although performed with lesser frequency,
cause much higher mean marrow doses; e.g., upper
GI series, 535 mrad; barium enema, 875 mrad; pelvimetry, 595 mrad. It is estimated that in 1970 theactive marrow dose per each adult in the U.S. population from medical X-ray procedures was approxi-g. Radiation Doses Due To Natural
Background and Medical PracticeIn estimating the potential health impact of radiation doses received by the population in the vicinityof the Three Mile Island Station, it is useful to maintain a perspective by comparing these doses to radiation doses that the same population receives
from other sources, mainly natural background andmedical X-ray procedures. Mankind (and all otherliving things) has been exposed to ionizing radiation
since the beginning of time. There are three primarysources of this natural exposure: (1) solar andgalactic cosmic radiation, (2) very long-lived radioactive materials present in the earth's crust, and(3) radioactive materials produced by cosmic radiation in the atmosphere. Some of the naturally occurring radioactive materials are chemically indistinguishable from nonradioactive materials normallypresent in the human body and are therefore always
present inside our bodies (e.g., potassium-40,
carbon-14).
The average dose to the gonads and bone marrow of people living in areas of normal backgroundradiation is shown in Table 11-29. The average annual dose in the United States, shown in Table 11-30,
is not significantly different. The doses in these

TABLE 11-29. Global annual per capita doses
from normal exposure to natural sources ofradiation (in mrad) 19
GonadsActive Marrow

28

28

Potassium-40

15

27

Other Nuclides

2

4

Radiation Source

External Irradiation
Cosmic rays

Terrestrial radiation

I nternal Irradiation
Radon-222

0.2

ROUNDED TOTAL

78

TABLE 11-30. Average annual doses from natural
natural background radiation in the United States
2oo(in mrem)Radiation Source

GonadsActive Marrow

Cosmogenic radionuclides

0.7

0.7

Cosmic radiation

28

External terrestrial

26

Radionuclides in body
ROUNDED TOTALS

27
82

405

32

28
26

24
79

32

0.3

92

TABLE 11-31. Selected estimatesof natural "background" radiation levels in the United States
2o1(annual dose rate [mrem/year])
Location

Atlanta, Georgia

CosmicRadiation

Terrestrial
Radiation

I nternal
Radiation

Total

74.9

89.7

28

1 93

42.0

45.6

28

116

41.0

45.6

28

115

41.3

35.4

28

105

44.7

Denver, Colorado

HARRISBURG,PENNSYLVANIA

Las Vegas, Nevada

49.6

PENNSYLVANIA

42.6

New York, New York
Washington, D.C.
UNITED STATES (range)

57.2

28

19.9

29

36.2

40-160

1 30

98

28

0-120

28

1 07

70-310TABLE 11-32. Examples of differences202
in annual doses
due to natural background variations
Estimated Difference inAnnual Doses

Natural Background Variation

Living in Denver, Colo.
compared to Harrisburg, Pa.

Living in a brick house
i nstead of a wood frame house+ 80 mrem/yr

Added dose from potassium-40
due to being male instead of female(There is 25% less potassium inwomen than men.)mately 100 mrad.
The genetically significant
dose (GSD) from medical X-ray proceduresis es204(GSD isti mated at 20 mrem per person in 1970.
the gonad dose from medical exposure that, if received by every member of the population, would be
expected to produce the same total genetic effecton the population as the sum of the individual doses
actually received.) This lower estimate is due to thefact that in most X-ray procedures the dose to the
gonads is lower than the mean marrow dose, and in
calculation of GSD, the dose to the gonads isweighted, based on the expected number of futurechildren that the irradiated individual will have.
I n addition to natural background and medical Xray procedures, there are other sources of radiation
exposure to the general population; e.g., diagnostic
use of radiopharmaceuticals, consumer products+ 14 mrem/yr+ 4.8 mrem/yr

containing radioactive material, and air travel. The
contribution of these radiation sources to the total
population dose is small compared to the dose due
to natural background and medical X-ray procedures. The average dose, of 1.4 mrem, received
by the approximately two million people as a resultof the TMI-2 accident is less than 1% of the annual
dose from both natural background and medical
practice.

203

h. Cancer Incidence and Mortality in the
United States
Cancer is the second leading cause of death in
the United States, after heart disease. In 1976,
there were 377 312 reported deaths in the U.S. from406

cancer, which corresponds to 175.8 cancer deaths
per 100000 people and accounts for 19.8% of alldeaths. 205 The American Cancer Society estimatedthat in 1979 there would be 765 000 new cases ofcancer in the United States and 395 000 people will
die from it, which corresponds to the death rate of
180 per 100 000 people. 206 The estimated cancer
death rate for the United States varies from 57 in
Alaska to 250 in Florida (not adjusted for population
age distribution). The estimated death rate in
Pennsylvania is 208. 207 Based on this estimate, we
calculate that among the more than two million people living within 50 miles of the Three Mile Island
Station, there will be approximately 4000 cancer
deaths per year unrelated to the accident.
The American Cancer Society estimates that, if
the present rates continue, 25% of all people in the
United States will eventuallydevelop cancer and
208
15% will die from it.
Applying these approximate
statistics to the population within 50 miles of theThree Mile Island Station indicates that approximately 325 000 people in that area would normallydie of cancer.
The natural incidence of cancer varies considerably depending on the type and site of the cancer,
age, sex, geographic location, dietary habits, environment, and other factors. Because cancers induced by radiation are indistinguishable from thoseoccurring naturally, it is usually impossible to determine in cases of low level radiation exposure if thisradiation was causative in i t duction of a few of themany thousand cancer cases normally expected ina given population.

about 1 in 5 000 000. This risk is additive to the existing risk of fatal cancer of about one in seven.
The risk of nonfatal cancer is about the same as therisk of fatal cancer, and the combined normal risk
is about one in four.
The additional cancer risks due to internal irradiation and skin irradiation are very small comparedto the above values and can be regarded as being
i ncluded in the values presented above for wholebody gamma irradiation. Even if the cancer risks
defined above were to be expressed, the resultant
cancers would not be detectable among the population in the vicinity of TMI-2. (Note that zero additional incidence is not excluded.)
The whole-body external occupational exposureof 1000 person-rem has potential total cancer riskof less than 0.5 (zero not excluded). The risk to the
maximally occupationally exposed individual (4.2
rems) is about 1.2 in 1000 for both fatal and nonfatal
cancers.
The potential incidence of genetically related illhealth is considerably smaller than that of producing
a fatal or nonfatal cancer. This risk is estimated to
be about 0.002 cases per year, and about one caseper million live births for all future human existence.
This contrasts with an estimated 3000 cases per
year of genetically related ill health among theoffspring of the population in the vicinity of Three
Mile Island based on present birth rate (28 000
births per year), and not related to the accident.
I n our view, the fact that there will be no, or veryminimal, adverse health effects from the accident
has not been understood by the public. We believethat the public misconception that the risks associated with this accident, and with radiation in general,
are much greater than they are in fact is due to thefailure to convey credible information regardingthese risks in an understandable form. Thus, we
believe that substantial efforts are necessary to
educate the public to eliminate the apparent gap
between "real" and "perceived" risks of radiation.

i. Summary of Health Effects
Our analysis of the potential health effects resulti ng from radiation exposure due to the TMI-2 accident is in accord with the conclusion of the Radiation Health Effects Task Group of the President's
Commission. 209 As a result of the radiation exposure to the offsite population within 50 miles of the
TMI site, the projected incidence of fatal cancer isless than one; and fatal plus nonfatal cancers is lessthan 1.5, with zero not excluded. This projection is
to be contrasted to the nearly 541000 cancers(325000 fatal and 216000 nonfatal) expected inthis population over its remaining lifetime that are
not related to the TMI accident.
The additional lifetime fatal cancer risk to the individual receiving the maximum probable dose
offsite (less than 100 mrem) is about 1 in 100000.
The additional risk of fatal cancer to an individual
receiving the average offsite dose (1.4 mrem) is

Summary of Findings
We find that:• despite the uncertainties in the offsite TLD data,

it was adequate to characterize the magnitude of
the collective dose to the population (Section
II. B.4.a);• the collective dose as determined by the TLDs is
within the ranges estimated by the Ad Hoc Interagency Dose Assessment Group and the Task
Group of the President's Commission. Correcting
for occupancy factors, shielding, and reductionsin the population due to voluntary evacuation, the
407

•
•
•
•
•

population dose is believed to be somewhere in
the lower end of those ranges, about 2000
person-rem.
the maximum offsite individual dose was lessthan 100 mrem (Section II.B.4.b);the contribution of internal exposure to the population and individual dose was small compared tothe dose from external irradiation (Section
II. B.4.c);the accident resulted in several exposures in excess of regulatory limits to plant personnel in thefirst few days following the accident (Section
II. B.4.e);the collective occupational dose and the extent
of overexposure is not large in relation to the radiation fields and contamination levels encountered during the accident (Section II.B.4.e); andit i s extremely unlikely that any individual will
suffer discernible ill effects, during his or her lifetime, from radiation exposure associated with the
TMI-2 accident. The effects on the population asa whole, if any, will certainly be nonmeasurable
and nondetectable. (Section II.B.4.f).

maintenance of equipment, personnel monitoring,and the maintenance of accurate exposure records.
Fulfillment of these radiation protection functions
and goals, especially during normal power operations, entails a large amount of routine work; for example, the conduct of area radiation surveys; wipe
testing for contamination control; collection andanalyses of air and water samples; maintenance ofaccess control to radiation areas; issuance andcontrol of dosimetric devices; maintenance of dosimetry records; and calibration of instruments.
Radiation protection is frequently perceived as no
more than a "meter reading" and sample collecting
function. The management at Three Mile Island Station, as well as a large segment of the nuclear industry, had this misconception. Radiation protection
was regarded as distinctly secondary in importanceto power operations and a "necessary evil." The
NRC similarly did not attach great importance to radiation protection.
The radiation protection program at Three Mile
Island Station was seriously deficient. Many of its
deficiencies were made evident by the accident, butthey were, or should have been, known well before
March 28, 1979. The Three Mile Island Station program, although apparently below average, was not
significantly worse than radiation protection programs at other nuclear power stations. The NRC's
regulation of radiation protection programs has simil arly been inadequate.

5. RADIATION PROTECTION PROGRAM
The production of power by nuclear energy entails exposure to radiation of plant personnel, as
well as a risk of exposure to the general public. The
primary functions of a radiation protection, or healthphysics, program are to maintain those exposures
below limits specified in applicable Federal andState regulations and as low as reasonably achievable (ALARA).
The potential for exposure to both onsite andoffsite populations increases under non-normal conditions: when the plant is undergoing major maintenance or refueling, or accident conditions. Consequently, radiation protection functions assume
greater importance during such conditions.
Exposure and resultant doses can be kept
ALARA by proper engineering design, good work
practices, monitoring, and preplanning of the tasks
to be performed. A good radiation protection program requires a concerted effort and mutual understanding on the part of management, operations,and radiation protection personnel. The program
also requires an adequate staff of well-trained individuals who are supplied with appropriate instrumentation and protective devices and who have theauthority to control access to radiation areas. An
effective program also includes continual training
and refresher courses for all plant personnel,

a. The Regulatory Framework
The NRC has promulgated regulations regarding
radiation protection programs in 10 C.F.R. Parts 19,
20, and 50. In addition, the NRC Regulatory Guides(particularly Series 8 Guides) and Standard Review
Plans (particularly Chapters 12 and 13) provide guidance regarding radiation protection programs.
Industry standards are established by the American
National Standards Institute (ANSI). Other guidance
i s provided by sources such as the International
Commission on Radiological Protection (ICRP), theNational Council on Radiation Protection andMeasurement (NCRP), and the U.S. Bureau of Mines.
The technical specifications, a part of the operati ng license, require that a utility establish and maintain a radiation protection program that complies
with 10 C.F.R. Part 20. The NRC's Office of Nuclear
Reactor Regulation (NRR) approves the proceduresthat the utility initially establishes and any modification or amendment of them. The NRC's Office of Inspection and Enforcement (IE) reviews the operationof the radiation protection program.
408

operational occurrences. Met Ed classified plant
areas into radiation zones based on maximum
design dose rates and expected frequency andduration of occupancy. It described the location,size, and shape of significant sources of radiation in
the auxiliary and fuel handling buildings and the containment structure. Source term calculations werebased on: (1) 2772-MW thermal power, (2) a failed
fuel rate of 1%, and (3) an acceptable set of estimated leakage rates and partition factors. Pipes, demi neralizers, tanks, evaporators, pumps, and sampling
points containing radioactive materials were locatedi n shielded areas or compartments, and Met Ed proposed to use labyrinths, shield valve galleries andpenetrations, reach rods, remote valve actuation,and portable shielding to maintain exposures
ALARA. The assumptions used in Met Ed's shieldi ng calculations were considered conservative andacceptable to the NRC staff.
The NRC staff's review of TMI-2 consideredshielding for the primary coolant sample lines within
TMI-2 but did not consider shielding these lines
when they passed into TMI-1 where the primarycoolant sampling room that serves both units is located. The highly radioactive primary coolant
resulting from the accident and the failed TMI-2 fuelproduced high radiation fields in TMI-1, reducing accessibility in those areas through which the lines
passed. We find that the design of TMI-2 and the
NRC staff's review of this design did not adequately
consider the relationship between TMI-1 and TMI-2.
Although the NRC staff's conclusions regarding
the adequacy of shielding design were valid for normal operation, highly radioactive primary coolant
and wastewater were contained in the piping andtanks during the accident and produced radiation
l evels higher than anticipated by the design bases.
We find that the shielding was not adequate to copewith the accident.

The technical specifications for TMI-2 carry only
minimal specific reference to the radiation protection
program. Section 6.11 states:
6.11 RADIATION PROTECTION PROGRAM"

Procedures for personnel radiation protection shallbe prepared consistent with the requirements of 10
C.F.R. Part 20 and shall be approved, maintained,
and adhered to for all operations involving person211
nel radiation exposure.

The NRC staff reviewed Met Ed's radiation protection program
proposed in Chapter 12 of the212
TMI-2 FSAR
and discussed the review in Section
12 of the Safety Evaluation Report (SER). 213 It appears that the NRC staff review of radiation protection programs, including Met Ed's, focused on theiradequacy in the conduct214
of normal and anticipated"Anticipated operationoperational occurrences.
al occurrences" are defined by NUREG-0115 and
NUREG-0117 as "unplanned releases of radioactive
material from miscellaneous actions such as equipment failures, operator error, administrative error,that are not of consequence to be considered an
accident." It was implicitly assumed by the NRC
staff that the program and procedures developed
for normal operation would readily extrapolate toabnormal conditions. The error in this assumption
was demonstrated by the accident at TMI-2.
b. Implementation and Weaknesses of the
Radiation Protection Program

The deficiencies in TMI's radiation protection program, as well as the weaknesses in NRC regulationand the radiation protection response to the accident are discussed below.
Design- Consideration of radiation protection is acentral part of the design of a nuclear power station.
Traditionally, consideration of design has been
focused on providing shielding and radiation protection facilities adequate to support normal operations
and anticipated operational occurrences. During thecourse of the accident, the plant's design bases
were exceeded, resulting in serious radiation protection problems. As a consequence, the role of radiation protection in design will have to be increased.

staff's review of theVentilation Systems-The NRC
216
TMI-2 ventilation systems
concluded that theirdesign would ensure that personnel were not exposed to normal or abnormal airborne concentrations exceeding those in 10 C.F.R. Part 20, and wasconsistent with the ALARA concept by: (1) maintaining air flow from areas of low radioactivity potential to areas of high radioactivity potential, (2)preventing recirculating air in the auxiliary and fuelhandling buildings, (3) maintaining a negative pressure in the auxiliary and fuel handling buildings withrespect to the atmosphere, and (4) periodicallypurging the containment structure with outside air
through high efficiency particulate air and charcoal
filters. Various other areas of the plant contained

ShieldingThe NRC staff's shielding design re215
concludedthat expected exposure toview
operating personnel was consistent with the requirements of 10 C.F.R. Part 20 and the ALARA
concept during normal operations and anticipated409

high efficiency particulate air and charcoal filters tominimize the buildup of airborne radioactivity, andthe air filtration system in the control room wasdesigned to limit radiation exposure to occupantsconsistent with General Design Criterion 19 of Appendix A to 10 C.F.R. Part 50.
The NRC staff's assessment of the ventilation
systems of TMI-2 did not include a review of the engineering aspects of ventilation systems (e.g., fancapacity, duct size, and balance of system). Moreover, the NRC does not possess the expertise toassess the engineering adequacy of the ventilation
systems. 217
Operational experience with the ventilation system of TMI-2 during normal operation provided evidence of deficiencies in the system ventilation. The
ventilation of the nuclear sampling room and hood
was inadequate for the sampling of primary coolant
during normal operation. Sampling resulted inreleases of radioactive material out of the face ofthe hood and the alarming of the mobile airborne ra218
diation monitor in the nuclear sampling room.
Station personnel were aware that the monitor's
alarm was indicating inadequate ventilation of thesampling hood. During the accident, this ventilation
system deficiency resulted in the release of radioactive gases from primary coolant samplings, which
affected the accessibility of important areas.
We find that: (1) the ventilation system in the primary coolant sampling room was inadequate forboth normal and emergency operations, and (2) the
NRC staff's review of the ventilation system wasi nadequate.
Control Room Habitability-The NRC219
Staff's review
of control room habitability systems
concludedthat the TMI-2 design met General Design Criterion
19. The design used concrete shielding and high efficiency filter trains to ensure a habitable environment within the control room. In the event of a highradiation signal from the monitor located in the air
i ntake structure, the control room supply was to be
automatically shut off and the safety-grade filter
system (including particulate filters and carbon adsorbers) was to go into operation. The system
would process 15 620 cubic feet per minute (cfm) ofcontrol room air in a recirculating mode and would
process up to 1500 cfm of filtered outside air topressurize the control room. This mode of operation could also be manually initiated by the operator.
Until nearly 8:00 a.m. on March 28, 1979, theventilation air to the control room was treated in its
normal flow path by particulate filters only. At thisti me, a control room operator
manually activated the220
recirculation filter system.
At almost the same
410

ti me, this activation would have automatically occurred on high containment pressure (7:56 a.m.). In
any event, the control room was in the recirculation
ventilation mode from approximately 8:00 a.m., providing protection against iodines and particulates.
However, due to poor meteorological conditions, noble gases released from the facility did infiltrate thecontrol room.
Radiation Protection Facilities- Each unit was
designed to have a counting laboratory. However,
the TMI-2 laboratory was never made operational.
Thus, TMI-2 shared the TMI-1 laboratory. The facilities in each unit also included a calibration room formonitoring instruments, a locker room for changing
i nto protective clothing and respirators, and a personnel and equipment decontamination room. The
221
NRC staff's review
concluded that these facilities
were adequate.
During the accident, the counting laboratory wasdisabled at the most crucial time because of highbackground radiation that resulted from airborne radioactive releases into TMI-1 arising from samplingof the primary coolant. The decision to don respiratory protection in the control room, which hampered
communications, resulted from the inability to quickly analyze control room air. The control room air intake monitor (HP-R-220) alarmed at 9:48 a.m. forparticulates and at 10:10 a.m. for noble gases.
Masks were 222
donned by the control room personnel
at 10:17 a.m.,
and were on until 3:10 p.m. Masks
were put on for a second time at 2:11 a.m. on March
29, when the particulate channel of HP-R-220
alarmed, but the levels quickly decreased and themasks were removed at 3:15 a.m.223 We find thatthe improper design of the ventilation system of thesampling room and that loss of the counting room
were responsible for the conservative use of
respirators in the control room, which led to asevere reduction in communications ability among
control room personnel and added to the difficulty incoping with the emergency.
Because of its inability to analyze samples onsite, Met Ed began shortly after the accident tosend air samples to the Commonwealth ofPennsylvania's Bureau of Radiological Protection inHarrisburg for analysis. By 7:30 p.m. on March 28,
the NRC Region I mobile laboratory, which had
analytical capability, arrived at the site. A mobile laboratory from RMC arrived on March 29. Samples
were also sent to the home laboratories of RMC andTeledyne Isotopes.
We find that the design of, and the NRC staff's
review regarding, the sample counting room were
inadequate because the shielding and location ofthat facility did not provide sufficient protection tomaintain operability. We find further that Met Ed's
i mplementation of the design was inadequate because there was only one operational facility to beshared by both units.

quate consideration be given to radiation protection
matters, particularly:• shielding, including shielding of primary coolant••••

Decontamination Facilities- Prior to the accident,

Met Ed planned for routine emergency decontamination of personnel and small equipment, tools, andinstruments. Decontamination facilities were provided in the health physics area of each unit but contained supplies adequate only for the limited use expected during normal operation. These facilities
were utilized during the earliest stages of the accident to decontaminate personnel. At 9:10 a.m. on
March 28, the airborne radiation levels became toohigh in the TMI-1 health physics area and the use of
these facilities was lost. We find that inplant personnel decontamination facilities were inadequate tocope with emergency conditions.

sampling lines;
ventilation systems;
counting room location and shielding;i nplant personnel decontamination facilities; andthe relationship between two or more units at thesame site.

Management and Organization

The management and organization of a radiation
protection program should provide effective leadership and supervision of the program during normal
operation and emergency situations. The management and organization of the radiation protection
program failed to fill this role because of an inadequate organizational structure, personnel who were
not qualified for the positions they held, inadequate
communications at all levels, and, most significantly,
upper management's attitude that radiation protection was less important than production.
During the accident, the emergency organization
underwent several changes because of realignments of functions and relocations of key individuals. This added to the preexisting communications
i nadequacies and resulted in the loss of control over
the radiation protection program during the first
several days of the accident.

Summary of Findings and Recommendations
We find that:• the design of TMI-2 and the NRC staff's review ofthe design did not adequately consider the relationship between TMI-1 and TMI-2;• the shielding was not adequate to cope with theaccident;• the ventilation system in the sampling room wasi nadequate for both normal and emergency
operations;• the NRC staff's assessment of the ventilation
systems of TMI-2 did not include a review of theengineering aspects of ventilation systems;• the NRC does not possess the expertise to assess the engineering adequacy of the ventilation
systems;• the improper design of the sampling room andthe loss of the counting room were responsible forthe conservative use of respiratory equipment in
the control room, which led to a severe reduction
i n communications among control room personnel;• the design of, and NRC staff's review regarding,the sample counting room were inadequate because the shielding and location of that facility
did not provide sufficient protection to maintain
operability, and there was only one operationalcounting room shared by both units; and• inplant personnel decontamination facilities were
inadequate to cope with emergency conditions.

Preaccident Organization- The organization of theradiation protection staff was approved by the NRC
staff and is shown in Figure 11-16. This organization
has the Supervisor of Radiation Protection andChemistry, Richard Dubiel, reporting directly to thestation superintendent, the senior plant official.
However, a different organization (Figure 11-17) wasprescribed by Met Ed at the time of the accident,
which added another level of management between
Dubiel and the senior plant official. Moreover, Du224
biel actually reported to the unit superintendents.
Dubiel's theoretical and actual reporting responsibiliinconsistent with the technical specificaties were
225
tions.
Under the Met Ed organization as approved by
the NRC, the radiation protection-chemistry technicians (R-CTs) performed the dual functions of radiation protection and chemistry and reported along
two different chains of command. The dual functionof technicians
is common in the nuclear power in226
dustry.
The inefficiencies of this system detracted from the implementation of an effective radiation
protection program. One R-CT characterized thisas "the biggest, most devastating hindrance to our

We recommend, therefore, that licensees, in theirdesign, and the NRC, in its review, ensure that ade411

Met Ed's position of supervisor of radiation protection and chemistry corresponds with the position ofRegulatory Guide 1.8's radiation protection manager(RPM). The guide states that the RPM should be an
experienced professional in applied radiation protection at nuclear facilities dealing with radiation
protection problems and programs similar to thoseat nuclear power stations. The guide further indicates that he should be familiar with the design
features and operations of nuclear power stations
that affect the potential for exposures of persons toradiation; he should have the technical competence
to establish radiation protection programs; and heshould have the supervisory capability to direct thework of professionals, technicians, and journeymen
required to implement the radiation protection programs.
The guide states that the RPM should have abachelor's degree or the equivalent in a science orengineering subject, including some formal training
i n radiation protection, and should have at least 5
years of professional experience in applied radiation
protection. At least 3 years of the RPM's professional experience should be in applied radiation protection work in a nuclear facility dealing with radiological problems similar to those encountered in nuclear power stations, preferably in an actual nuclear
power station.
At the time of the accident, Dubiel, Supervisor of
Radiation Protection and Chemistry, had 6 1/2 yearsof power station or applicable industrial experience,a bachelor's degree in physics, and a master's
degree in nuclear engineering. 230 He thus satisfied
the requirements of the FSAR and Regulatory Guide
1.8.
The FSAR states that the radiation protection
supervisor shall have a minimum of 5 years ofexperience in radiation protection at a nuclear facility. He should have a minimum of 2 years of related
technical training. 231
Thomas Mulleavy, the Radiation Protection
Supervisor, had a total of 19 years of power station
or applicable industrial experience and met theminimum radiation protection experience criteria bya wide margin. However, there is no evidence toindicate that232
he met the minimum criteria for technical training.
Dubiel's time and attention were spread much too
thinly because: (1) he was acting (in conjunction
with the chemistry foremen) as chemistry supervisor, (2) he had the additional burden and responsibilities of running the radiation protection programfor a two-unit station, and (3) he had too many peo223
As a result, we find that
ple reporting to him.
Dubiel did not function as the RPM as defined in' REMAINED UNFILLED SINCE ISSUANCE OF THE TECHNICALSPECIFICATIONS. THE DUTIES AND RESPONSIBILITIES OF THISPOSITION WERE BEING FULFILLED BY THE SUPERVISOR, RADIATIONPROTECTION AND CHEMISTRY AND THE CHEMISTRY FOREMEN.

FIGURE 11-16. Organization of the Radiation Protection
and Chemistry Staff as Indicated inTechnical Specifications, Figure 6.2-1.
department." 227 We find that the dual functions ofradiation protection and chemistry that the R-CTs
performed were detrimental to the efficiency of theradiation protection program.

Qualifications- Minimum qualification requirements
for the radiation protection staff are contained in the
FSAR, Section 13, and Technical Specification 6.3.
The latter states:

Each member of the unit staff shall meet or exceed
the minimum qualifications of ANSI N18.1-1971 forcomparable positions, except for the Supervisor of
Radiation Protection and Chemistry, who shall meetor exceed the qualificationsof Regulatory Guide
228 229.
1.8, September 1975.
412

FIGURE 11-17. Actual Organization of TMINS Radiation Protection andChemistry Staff Before March 28, 1979 (NUREG-0600,
P.II-1-2)
234
This position was not filled, but thetraining.
functions and responsibilities of the position wereassumed by Dubiel in conjunction with the chemistry foremen. We
find that Dubiel was not qualified
230
for this position.
The positions of radiation protection foreman andchemistry foreman were established by Met Ed. We
find that the positions are not identified in the techn-Regulatory Guide 1.8, and that the role fell, by
default, to Mulleavy, who was not qualified for thisposition.
The FSAR states that the chemistry supervisor
shall have a minimum of 5 years' experience inpower station chemistry and water treatment, ofwhich a minimum of 1 year shall be in radiochemistry. He shall have a minimum of 2 years of related413

i cal specifications or the FSAR and that the NRC
does not require minimum qualifications for these
positions.
According to the FSAR, each radiation protection
technician should have a minimum of 2 years'
experience in radiation protection or closely relatedareas. He should have a thorough knowledge of thedesign and operation of all types of radiation monitoring
235and analytical instrumentation in the station.
Six of the 24 R-CTs did not have
2 years of236
working experience in their specialty.
In addition, the R-CTs were transferred between
functional areas and between units, with assignments seldom lasting more than 1 week. This
removed them from any particular duty area for
about 6 weeks, and provided little incentive for them
to become highly proficient in a certain area. 237 As
a result, R-CTs did not receive a thoroughknowledge of the design and operation of the radiation detection instrumentation. We find that R-CTs
did not develop or maintain adequate job skills anddid not meet FSAR requirements.
Communications - Serious communications gaps
existed between every level of the radiation protection organization. This was a substantial problem
that had existed for some time before the accident,
as noted238
in an audit of the program conducted for
Met Ed.
We find that the communication problem contributed significantly to the deficiencies noted in the radiation protection program.
Management Attitudes-A typical conflict in the nuclear industry existed between the operations staff,
which was production-oriented, and the radiation
23 240protection staff, which was service-oriented. s'
Station management, as well as the operations staff,
viewedradiation protection as a "necessary., 241-243
evil.
The conflict, and management's attitude, are discussed in detail in Section II.B.5.c.
The attitude of management and operations seriously impaired the effectiveness of the radiation
protection program and was reflected in:• violation of station
health physics procedures by
244
operations staff;• poor enforcement of station health physics pro•
•

•
•
•

cedures; 244,245
245gaslow morale of radiation protection staff;
failure of radiation
protection management to249
support R-CTs;
low priority in maintenance and repairof portable
250 251'
radiation survey instrumentation;
252
waivers of requirements of procedures;
andl ack of support (financial andpersonnel)ofradia251 253
tion protection depantment. '414

We find that the conflict between operations andradiation protection was serious, existed at all levelsof the plant's organization, and contributed in a major way to the deficiencies noted in the radiation
protection program.
Organization and Management During
theAccident- A radiation protection organization for
emergencies, different from the everyday organization, was prescribed by TMI's emergency plan. The
emergency organization changed several times duri ng the accident-first, back to the everyday organization, and then, due to forced relocations of the
ECS and agreements between Dubiel and Mulleavy,
several more times to different variations. With
each change, some control of radiation protection
functions was lost. The communications gap thatexisted during normal operations was compounded
during the emergency and contributed to confusionthat existed at the foreman and R-CT level. As aresult, radiation protection control during the accident was very poor, manifesting itself in unrestricted and uncontrolled access to high radiation areas
and other lapses from good radiation protection
practice.
I nitially, the emergency radiation protection
response organization approximated that indicatedi n the emergency plan (see Figure 11-18). Dubiel
served as Radiological Assessment Advisor to theEmergency Director. Control of the emergency radiation protection organization was from the emergency director through Mulleavy who served as the
ECS Director. In accordance with this organization,
Mulleavy should have controlled all of the emergency repair, chemistry, monitoring (inplant and offsite)
and washdown area activities.
At approximately 7:30 a.m. on March 28, 1979,
the emergency radiation protection organization assumed a new form that had been developed during
emergency drills and was more consistent with thenormal organization of the radiation protection organization. This second organizational structure isshown in Figure 11-19. Mulleavy now reported to Dubiel, who was his normal supervisor, although all radiation protection functions would continue to be
performed through Mulleavy at the ECS in the TMI-1
health physics laboratory area. Because of airborne
radioactivity at that location, the ECS was relocatedat about 9:00 a.m. to the alternative ECS in the
TMI-2 control room. This relocation impaired effective control of the inplant radiation protection andrepair party monitors.
Shortly after establishment of the alternative
ECS, Dubiel and Mulleavy met and determined that
Mulleavy would maintain control of onsite and offsite

FIGURE II-18. "Normal" Emergency Organization for Radiation Protection Functions

FIGURE 11-19. Emergency Organization for Radiation Protection in Effect on March 28, 1979, 7:30 a.m: 9:00 a.m.

monitoring activities and Dubiel would assume directcontrol
254 of all i nplant radiation protection functions.
Dubiel determined this action was necessary because the emergency plan did not containprovisions for dealing with the radiological conditions that then existed in the plant. This third organization is indicated in Figure 11-20. At about
10:30 a.m., the alternate ECS was relocated to the
TMI-1 control room, where Mulleavy assumed a new
function of Onsite and Offsite Monitoring Director.
The fourth emergency organization is shown in Figure 11-21.
Neither Dubiel nor Mulleavy nor anyone else actually provided effective supervision of radiation protection activities during the first several days. Consequently, the personnel they were supposed to supervise often acted on their own. For example, at
about 11:30 a.m., a washdown area to serve as amonitoring and decontamination
point for individuals254evacuating the island
was established at the
500-kV substation at the direction of Peter Velez, aradiation protection foreman. This action was taken
255
without the knowledge of Mulleavy or Dubiel.
The inplant radiation protection and repair party
monitoring function was not suitably under Dubiel'scontrol until the morning of March 29, 1979. Activities, including entries into the auxiliary building, occurred without his knowledge, although he believedthat he had control of this function and that he was
fully aware of all entries into the auxiliary building
and other radiation protection activities. 256 As
Michael Janouski, a Senior R-CT summarized, theradiation protection personnel acted on "instinct,"with nodirection. "It was like we did not have a257
boss."
There was, thus, a lack of management control of
the inplant radiation protection function early in theaccident. During the first several days of the accident, the radiation protection program was seriously compromised: (1) the radiation work permit( RWP) procedure was not used, (2) no logs of entries into the auxiliary building were maintained, (3)no accumulation system of pocket dosimeter dose
measurements was utilized for entries into high radiation areas, (4) records of dose rate surveys in theauxiliary building were made at times, but were notmaintained, (5) surveys of personnel contamination
were made, but in only one instance were records
maintained, (6) high radiation areas were not controlled in accordance with Technical Specification
6.12, and (7) no positive control over entries into theauxiliary building was maintained. We find thecompromise of the radiation protection program
during the accident was unjustified and contributed
to the potential for unnecessary and hazardous exposure of plant personnel to radiation.
417

The reduced emergency radiation protection program was in effect until approximately midnight on
March 30, 1979, when the RWP procedure was finally reestablishedafter continued urging of the258,259
NRC inspectors.
By this time, however,many uncontrolled entries had been made into theauxiliary building without adequate direction or
knowledge of previous entries; adequate communications between plant personnel; or adequate radiation protection instrumentation, personnel dosimetry, and radiation protection. These entries occurred while radiation levels in excess of 1000 R/hexisted in the auxiliary building. In view of these
conditions, the potential for serious radiation injuries
to employees making entries into the auxiliary building existed during this time; although, as discussed
in Section II.B.4, only three overexposures above
regulatory limits were reported. (See Section II.B.4
for further discussion of this point.) (Descriptions
characterizing the events and unauthorized entries
i nto the auxiliary building and overexposures experienced during the first 3 days of the accident arecontained in Section 11.3 of NUREG-0600.)
Summary of Findings and Recommendations

We find that:• the performance of the dual functions of radiation

protection and chemistry by the R-CTs is detrimental to the efficiency of the radiation protection
program;• Dubiel, the Supervisor of Radiation Protection
and Chemistry, did not function as the Radiation
Protection Manager (as indicated in Regulatory
Guide 1.8), and the role fell, by default, to Mull eavy, who was not qualified for this position;• Dubiel was not qualified for the position of Chemi stry Supervisor;• the positions of radiation protection foreman andchemistry foreman were not included in the FSAR
or the technical specifications and the NRC did
not require minimum qualifications for these positions;• the R-CTs did not develop or maintain adequate
job skills and thus did not meet FSAR requirements;• a serious communications gap existed at all levels of the radiation protection organization andcontributed significantly to the deficiencies noted
i n the radiation protection program;• a serious conflict existed between operations andradiation protection staffs at all levels of thestation's organization and contributed in a major
way to the deficiencies noted in the radiation
protection program; andFIGURE 11-20. Emergency Organization for Radiation Protection in Effect on
March 28, 1979, 9:00 a.m.-11:00 a.m.

418

FIGURE 11-21. Emergency Radiation Protection Organization in Effect on
March 28, 1979, 11:00 a.m., to March 30, 1979, 12:00 p.m.

• the compromise of the radiation protection pro-• the duties of a radiation protection manager

gram during the accident was unjustified andcontributed to the potential for unnecessary andhazardous exposure to radiation.

should be clearly specified and performed by aqualified individual;• the NRC require minimum qualifications for the
positions of radiation protection foreman andchemistry foreman;• the technical specifications be amended to include the positions of radiation protection foreman and chemistry foreman;

We recommend that:• the functions of radiation protection and chemis-try be separated and that technicians not be required to perform in both roles;419

survey forms, and maintenance of logs were notcomplied with during the first few days, resulting
in the loss of important data that could have beenused for briefing teams prior to entries into highradiation areas, observing trends to detectchanges in plant status and ensuring continuity
between personnel shift changes.

• technicians be given training adequate to meet
FSAR requirements and to develop and maintainadequate job skills; and• Met Ed take appropriate steps to eliminate theserious communications problems in the radiation
protection organization.

Met Ed had no written procedures for personnel
decontamination on site. The matter was left to thediscretion of the radiation protection supervisor.
Procedures to be used by Hershey Medical Centeri n cases of medical emergencies involving personnel
contamination were set forth in the emergency plan
as station HPP 1670.10. However, personnel contamination on site without any medical problem ismore probable than contamination that requires
medical attention. Onsite decontamination can be
more timely and more effective, but it needs to be
performed properly and by knowledgeable personnel using approved procedures. We find that Three
Mile Island Station did not have adequate procedures for onsite personnel decontamination.
The onsite personnel decontamination facilities
were used early in the accident. At 9:10 a.m., theairborne radiation levels became too high in the
TMI-1 health physics area and the use of these facili ties was lost. The TMI-2 decontamination area also
was lost very early due to high radiation levels.
The island was evacuated of nonessential personnel at 11:10 a.m. on March 28, and a personnel
release point was established at the north security
gate. The south gate was closed. To prevent
crowding at the north gate, a personnel release
point was established at the 500-kV substation.
Personnel and vehicles leaving the island weredirected to the substation for monitoring and decontamination, but no controls were established to ensure that all vehicles and personnel went there.
There had been no prior preparations for using
the 500-kV substation as an alternative release
point. A limited amount of equipment consisting of
paper coveralls, plastic boots, rags, and somecontamination-monitoring portable survey instruments (RM-14-HP-210 probe) was taken to thesubstation. It was first thought that no water supply
was available at this location; however, a water supply was located later on the first day. No shower
facilities or appropriate wastewater holdup capability were available and little decontamination was actually performed.
The personnel contamination detected at thesubstation consisted primarily of xenon that tended
to be adsorbed on clothing, particularly polyesters,
and on hair. Personnel were frisked, and 262
if count
rates in excess of 200 cpm were detected,
theirRadiation Protection Procedures

The radiation protection program for normal
operations at TMI is specified in Station Administrative Procedure 1003, Radiation Protection Manual( Rev. 12, 12/13/77). It is supplemented by station
health physics procedures (HPP) that specify thelimits; criteria; responsibilities; equipment usage; instrument issue, use, control, and calibration; area
posting and control; facilities; dosimetry; and training
and emergency procedures. Individual HPPs may
apply to the station as a whole or to each unit. The
procedures are developed by the radiation protection department and are reviewed by the respective
unit plant operating review committee (PORC). If theprocedures pertain to both units, then each unit
PORC reviews the procedure. Before June 1978,
station HPPs were approved by the station superintendent, and since that time the respective unit superintendents have approved the procedures.
Met Ed radiation protection procedures for normal operations were generally adequate but theiremergency procedures were inadequate. Generally,
during the first several days of the accident, Met Ed
did not comply with either the radiation protection
procedures for normal operations or the proceduresfor emergency situations. Those procedures thatwere used during the accident did not provide adequate radiation protection and contributed to unnecessary personnel exposures.
Radiation Emergency Procedures 1670.1 through1670.15 are intended to provide guidance during emergencies. However, they do not adequately address inplant radiation hazards or the role of the radiation protection staff during an emergency
response. This lack of necessary guidance to copewith emergencies contributed to serious deficiencies
i n the radiation protection program during the accident, for example:• the organization of the radiation protection staff
deviated from that specified in the emergency
plan;• access control to the auxiliary building was lost,
resulting in uncontrolled entries into high radiation260
andareas without proper protection;• the radiation protection program was compromi sed and essential procedures regarding suchmatters as radiation work permits, completion of420

clothing was exchanged for paper coveralls. If excessive contamination remained, the individuals
were detained until the xenon could dissipate, usually a matter of minutes to several hours. Levels of
up to 10000 cpm were observed.
With few exceptions, the personnel performing
frisking of personnel and vehicles were inexperienced, and without any written procedures to follow,. 263
their surveys were undisciplined
No thyroid surveys were made; no records or followups of any
personnel decontamination weremaintained; and no263,264
bioassay samples were taken.
On March 29, an R-CT established a decontamination area in the men's room of the observation
center. Because there were no written procedures,radioactive wastewater was flushed down the sink,contaminated clothing was "laying
around," and no265
logs or records were maintained.
Within the plant, personnel decontamination also
went unsupervised and was performed by the individuals themselves, primarily by showering, and insome cases, decontamination was performed inunauthorized facilities. No documentation of personnel contamination was maintained.
Met Ed did have emergency procedures foroffsite vehicle and equipment decontamination; however, they were not employed during this emergency. Decontamination of offsite vehicles and equipment was to be performed at specific locations on
Route 441, north and south of the plant. 260 These
preplanned areas were not used in the emergency
response. Equipment, supplies, facilities, and radioactive wastewater holdup capabilities were notavailable at these locations. During the emergency,
vehicle monitoring was performed at the 500-kV
substation. Decontamination consisted of keeping
the vehicles parked until the radioactive noble gases
decayed and dissipated.
Finally, there were no emergency procedures forcollection of primary coolant samples that contained
significant quantities of radioactive materials.
Therefore, ad hoc procedures were developed forthe initial sampling without adequate considerationof the high exposure rates. As a result, the initial
primary coolant sample was taken without appropriate dosimetry and instrumentation, and overexposures of some personnel were experienced. 266
Summary of Findings and Recommendations

We find that:the emergency plan radiation protection procedures did not adequately address the role of
the radiation protection staff or adequately ac421

count for inplant radiation hazards during the emergency response; and• there were no procedures for onsite personnel
decontamination.
We recommend that:• emergency plans provide for radiation protection
staff response to inplant radiation hazards; and• radiation protection procedures should be followed during emergencies, and appropriate documentation should be maintained.

Training

The level of training in radiation protection that
nuclear powerplant personnel need varies in relationship to the degree of association each person
has with radiation work and radiation areas. Basic
training may be adequate for nonradiation workers,
for temporary personnel working outside restricted
areas, and for workers who will be on site for only a
few days. A higher level of training is necessary forpeople working in radiation areas and in the control
room. Radiation protection technicians obviously
should be comprehensively trained. In addition to
the normal complement of workers at a power station, others such as the local fire, police, medical,
and civil defense groups need training. Anothergroup of individuals who need to be trained orwhose current knowledge of radiation protection
should be ensured, are contract health physics
technicians, commonly referred to as "rent-a-techs."
The TMI-2 FSAR, Section 12, and Technical
Specification 6.4 require that a training and retraining program for the unit staff be conducted and thatsuch training meet or exceed the requirements ofSection 5.5 of ANSI N18.1-1971.
The NRC staff
267
found this to be acceptable.
The training department at Three Mile Island Station had no substantive responsibility for radiation
protection training. 268 The responsibility for thedevelopment and implementation of the radiation
protection training and retraining program was vested in Richard Dubiel, the Supervisor of Radiation
Protection and Chemistry. He, in turn, delegated thetraining coordination and maintenance of training
records to Peter Velez, a Radiation Protection Foreman. Radiation protection training was provided inthree categories-nonradiation protection personnel, radiation protection personnel, and emergency
response personnel from surrounding communities.
The course titles and target groups of the program
are shown in Table 11-33.
Radiation protection personnel were dissatisfied
with the quality and extent of the radiation protec-

TABLE 11-33. Radiation protection training program Three Mile Island Station
Program Title
1. Basic I

2. Basic II (1 hour)

3. Basic III (3 hours)
4. I ntermediate I ( 3 hours)

5. Intermediate II (8 hours)
6. Advanced Radiation
Protection (2 weeks)

7. Comprehensive Radiation
Protection (3 months)

8. General Employee Training( No time specified)
9. Training for local fire,police and civil defense
departments.

259

Personnel Receiving Training

Temporary personnel on site less than 1day.
Temporary personnel working outside
restricted areas.

Permanent personnel working outside
restricted areas. Temporary personnel in
restricted areas for more than 1 day.

All radiation workers. All personnel underradiation work permits (RWP).

Maintenance personnel, engineers, supervisors, others requiring radiation work
permit clearance.
Auxiliary operators, control room operators,
senior licensed operators.
Radiation/chemistry technicians.

Selected temporary personnel (all permanent
personnel once per year).

tion training they had received in the past few
years. 270 '271 For example, some R-CTs requested
training in the use of SAM-2, an instrument intended
for emergency radiation monitoring, but did not receive such training. These individuals later learned
that their training records indicated that they did receive the training. When the R-CTs brought thisdiscrepancy to the management's attention, they
were given training on the responsibilities of radiological monitoring
teams, but not on the use of272
SAM-2.
The R-CTs' continued lack of familiarity
with the SAM-2 became apparent during the emergency, when the R-CTs could not properly operate
the instrument, lost confidence in it, and then abandoned it.
Dubiel and Mulleavy acknowledged that there
was no formal retraining program for themselves ortheir foremen. Dubiel further indicated that little time
was available to give the training and little time wasavailable to R-CTs to be formally trained becauseof273
a heavy workload and insufficient staffing.
The
R-CTs were working on a 6-week rotationalschedule, in which the sixth week was to be set
aside for training-retraining. However, understaffing
precluded any significant technical training for atleast 1 1/2 years before the accident, and the trainingthat was to be given in the sixth week was abandoned in an attempt
to keep up with vital health274
physics functions.
I n addition, notification of the R-CTs of changes
i n station procedures, one of the ANSI N18.1-1971
retraining requirements, was ineffective. Notificationof procedural changes was made to the radiation
protection staff by placing a note on the bulletinboard indicating a change. There was no formal
mechanism for ascertaining whether the R-CTs
read the change. 272,275
Radiation protection coverage during refueling,
maintenance, and other outages required the use of"rent-a-techs" to supplement the station radiation
protection staff. "Rent-a-techs" are not recognizedby the NRC as a group separate from regular licensee employees. Because "rent-a-techs" are, bydefinition, temporary employees, they often do nothave the same level of knowledge of the plant andstation procedures as the permanent staff.
Although the NRC regulations do not clearly sorequire, "rent-a-techs" should be subject to thesame training and qualification requirements for the
positions and functions that they fill.
422the R-CTs were given at least the minimum numberof hours required, the R-CTs performance during
the accident demonstrated the failure of the training
program.
We find that IE's inspection procedures for radiation protection training programs are inadequate
because the results of the programs, i.e., the expertise of the students, are not evaluated; and that the
NRC has not established standards for the evaluation of the training or retraining of the radiation protection personnel.
We find also that there is need to consider thefeasibility and advisability of licensing or certifying
radiation protection personnel. We note that licensing or certification of all radiation protection personnel at commercial nuclear power reactors has beensuggested to deal with this situation. Currently, the
NRC has before it a petition, PRM 20-13, submitted
on January 24, 1979, which calls for NRC certification of all health physics personnel.

As part of the training conducted by Met Ed,
paragraph 6.1.2 of the emergency plan requires the
conduct of an annual site or general emergency drill.
Station Health Physics Procedure 1670.9, "Emergency Training and Emergency Exercise," provides
for planning, conducting and documenting drills.
During calendar year 1978, Met Ed conducted sevenradiation emergency drills that satisfied the site or
general emergency drill requirements. These sevendrills were conducted between October 23 andNovember 8, 1978, and were, in effect, dress
rehearsals for the one that would be observed by
the NRC. The November 8 annual drill wasobserved by the NRC. No other drills which satisfied the TMI emergency plan requirements wereconducted during 1978.
Although spacing these drills throughout the year
may have been more effective, in retrospect, it was
perhaps fortuitous that an intensive set of drills was
conducted so near the time of the accident. Participation in the drills had a constructive effect on the
conduct of the emergency response. For example,
the relocation of the Emergency Control Station, adrill scenario, occurred during the accident. The
relocation went more smoothly than it probably
would have if there had been no drills. At the end ofeach drill, a formal critique of the drill was held forall participants, observers, and staff. However, participation in the drill critiques by all participants was
not required. Even though overtime was authorized
to attend the critiques, many did not
for R-CTs
278-278
We believe that participation of allattend.
personnel in drill critiques is necessary for proper
evaluation of the plant's performance.
We find that there was no adequate radiation
protection training or retraining program in effectprior to the accident, that radiation protection functions were performed, on occasion, by personnel
not adequately trained in radiation protection, andthat the NRC has never clearly specified the training
and qualification requirements of "rent-a-techs" inthe health physics area.
The NRC inspected the radiological aspects of
Met Ed's program a number of times during the past
2 years, but we found no evidence that the inspections detected the deteriorated condition of theradiological training program. The IE's inspections
for radiation protection training are usually limited toan audit of the training records and course outlines,
and do not include any attempt to determine the279competence of the instructors or the trainees.
Part of this can be attributed to the fact that NRC
has never established standards for the evaluationof radiation protection personnel or training programs. Although the training records indicated that

Summary of Findings and Recommendations
We find that:• there was no adequate radiation protection train-

ing or retraining program in effect prior to the accident;• the IE's inspection procedures for radiation protection training program are inadequate because
the results of the programs, i.e., the expertise of
the students, are not evaluated;• the NRC has not established standards for theevaluation of the training or retraining of the radiation protection personnel;• radiation protection functions were performed on
occasions by personnel not adequately trained inradiation protection;• the NRC has never clearly specified training andqualification requirements of "rent-a-techs" in thehealth physics area; and• there is a need to consider the feasibility and advisability of licensing or certifying radiation protection personnel.
We recommend that:• the NRC require the implementation of an ade-quate radiation protection training program byestablishing standards for licensee radiation protection programs and for competency of licensee
radiation protection personnel;• the NRC inspect for actual competence of the
trainees and trainers in addition to auditing
records of training; the NRC and the licensee review radiation protection staffing and organization423

to assure that radiation protection functions are
fulfilled by adequately trained personnel;• the NRC develop guidance regarding the specificuse and training of "rent-a-techs" at licensed facilities;• the NRC appoint a group of experts to examine
the feasibility and advisability of licensing or certifying radiation protection personnel at commercial nuclear power reactors. The report of thisgroup should be submitted within 6 months of its
appointment. Options to be examined include:- licensing by the NRC.
- licensing by a Government agency otherthan the NRC.
- requiring certification by the American
Board of Health Physics (ABHP) for specified functions (e.g., radiation protection
manager).
- requiring certification by another nongovernmental body; and• the NRC defer action on a petition (PRM 20-13)
presently pending before the Commission, which
requests that radiation protection personnel at alll evels in licensed activities be certified by theCommission until the aforementioned study iscompleted.

The NRC staff reviewed this program and282
found thearea monitoring system to be acceptable.

Fixed Area Gamma Radiation Monitoring System-

The area gamma radiation monitoring system wasdesigned to function separately for each unit, withreadouts in each control room. The system provides operators with indications and records of radiation levels at each monitored point. It provides
both audible and visual alarms in the control roomand local audible and visual alarms at those monitors located in areas where high radiation levels
may constitute a hazard. Each channel consists ofa detector located at a predesignated, fixed location, a local indicator, a power supply, a control
room readout module with alarms and alarm setpoint adjustment. Each channel is recordable by
one point of a multipoint recorder. 283 During theaccident, the fixed area gamma radiation monitoring
systems for each unit were used.
The area gamma monitoring system for TMI-1
consists of 15 channels equipped with ionizationchamber detectors as shown in Table 11-34. All
channels have a range of 0.1 mR/h to 10 R/h, except the TMI-1 reactor building dome monitor (RMG8) which has a range of 1 R/h to 1 x 10 6 R/h . 283
All TMI-1 area gamma monitors
were operational at284
the time of the accident.
The area gamma monitoring system for TMI-2
consists of 21 monitors as shown in Table 11-35. All
TMI-2 area monitors, with the exception of the reactor building dome area monitor (HP-R-214), are

Inplant Monitoring and Instrumentation

The inplant area monitoring program is described280281in the FSARs for TMI-1 and TMI-2
and specified in the health physics procedures for each unit.

TABLE 11-34. Area radiation monitors, TMI-1
ChannelTag. No.
RM-G1

Control Room

285

Area

Location

RM-G2

Radiochem Lab, Elev. 305 ft

RM-G4
RM-G5

Hot Machine Shop
Reactor Bldg. Personnel Access

RM-G3
RM-G6
RM-G7

RM-G8
RM-G9

RM-G 10

RM-G1 1
RM-G12
RM-G13
RM-G14
RM-G15

Sampling Room, Elev. 325 ft
Refueling Bridge 1

Refueling Bridge 2

Reactor Bldg. High Range
Fuel Handling Bridge

Bldg. Entrance, Elev. 305 ft

Near Waste Tank, Elev. 305 ft
Drumming Area

Building Entrance, Elev. 281 ft
Near Waste Evap.

Heat Exchange Vault, Elev. 271 ft
424

Building

Reactor

Auxiliary
Auxiliary
Auxiliary
ReactorFuel Handling
Fuel Handling
ReactorFuel Handling
Auxiliary
Auxiliary
Auxiliary
Auxiliary
Auxiliary
Auxiliarynuclear sampling room air monitor (RM-A12) and theTMI-1 control room air intake monitor (RM-A1) were
i noperable, and had been inoperable since April 22,
1977 and April 18,1978, respectively. 218
The atmospheric monitors for TMI-2 (described
i n Table 11-37) use isokinetic sample probes andhave a particulate filter, a charcoal cartridge fori odine detection, and a detector in a shielded290
At the time of the acvolume for gas monitoring.
cident, the TMI-2 waste gas decay tank 1A gas
monitor (WDG-R-1485) was inoperable,
and had218
been inoperable since February 16, 1979.
As a result of the accident, radioactive materials
were released into the atmosphere of the auxiliarybuilding. The resulting radiation levels exceeded the
response capabilities of many of the atmosphericmonitors. The noble gas channel of the stack monitor (HP-R-219) went off scale before 8:00 a.m. on
March 28, eliminating the only direct means of assessing the quantities and rate of release of radioactive material from the plant. This information
was vital to the evaluation of offsite consequences.

equipped with Geiger-Muller (G-M) tube type detectors and have a range of 0.1 to 104 mR/h. The
reactor building dome monitor is an ionization
287 and is conchamber with a range of 1 to 10 6 R/h218
having an aptained in a 2-inch-thick lead shield,
proximately 1/8-inch hole through it. 288
After the accident, the containment atmosphere
was severely contaminated with radionuclides. It is
possible that some of the contaminants penetrated
the hole and deposited on the surfaces of thedetector. Therefore, we find that the readings obtained on HP-R-214 could not be considered reliableindicators of the radiation fields within the containment structure.
Fixed Atmospheric Air Monitoring System- Eachreactor has a separate fixed atmospheric monitoring
system. There are 10 monitors in TMI-1 and 15
monitors in TMI-2.
The atmospheric monitors for TMI-1 aredescribed in Table 11-36. At the time of the accident
in TMI-2, the TMI-1 radiochemistry laboratory and
TABLE 11-35. Area radiation monitors, TMI-2
ChannelTag. No.

286

Area

Location

Building

HP-R-213

I ncore Instrm. Panel Area

Reactor

HP-R-215

Fuel Handling Bridge

Fuel Handling

HP-R-214
HP-R-218
HP-R-231

HP-R-232
HP-R-233
HP-R-234

HP-R-3236

Reactor Building Dome, Elev. 418 ft
Waste Disposal Storage Area

Aux. Bldg. Sump Tank Filter Room
Elev. 280 ft

ReactorFuel Handling
Auxiliary

Access Corr. Elev. 305 ft

Auxiliary

Access Corr. Elev. 305 ft

Control & Service

Access Corr. Elev. 305 ft
Reactor Building Purge Unit
Area Elev. 328 ft

Auxiliary
Auxiliary

Aux. Bldg. Exhaust Unit Area

Auxiliary

HP-R-201

Control RoomControl

HP-R-204

Reactor Building Emerg. Cooling
Booster Pump Area

HP-R-3238
HP-R-3240
HP-R-202
HP-R-205

HP-R-206
HP-R-207
HP-R-209

HP-R-210
HP-R-211

Fuel Bldg. Exhaust Unit Area
Cable Room

Auxiliary
Control

Auxiliary

Reactor Coolant Evap. Control Panel Area

Auxiliary

I ntermediate Cooling Pump Area

Auxiliary

Makeup Tank Area

Fuel Handling Bridge North

Fuel Handling Bridge South
Personnel Access Hatch

425

Auxiliary
Reactor

Reactor
ReactorTABLE 11-36. Atmospheric monitoring system, TMI-1 289
ChannelLocation

RM-A1

Control tower intake

RM-A2

Reactor Bldg.
Air Sample Line

RM-A4

Fuel Handling Bldg.
Exhaust Ventilation Ducts

RM-A6

Aux. Bldg. Exhaust
Ventilation Ducts

RM-A5

Condenser Vacuum
Pump Exhaust

RM-A7

Waste Gas Discharge

RM-A8

Aux. & Fuel HandlingBldg. Exhaust

RM-A9

Reactor Bldg.
ExhaustRM-A12

Radiological Lab
Monitor-movable

RM-A13Spent Fuel Area
Monitor-mobile

The absence of this information resulted in the useof indirect means of evaluation that were untimely
and inaccurate.
The NRC staff's assessment of the adequacy of
the atmospheric monitoring capability of TMI-2 did
not consider the air contamination levels that could
result from the degree of core damage experienced
i n the accident. We find that atmospheric monitors
were inadequate to measure the quantities of radioactive materials released, that critical information
was lost as a result, and that the NRC staff's SER
assessment of the proposed atmospheric monitoring system for TMI-2 was inadequate because it did
not consider the monitor response ranges in thepresence of high radiation background.
Liquid Effluent Monitoring System-Each unit has ali quid effluent monitoring system. The indicators,
alarms and recorders are located in the control
room of each unit.
The liquid effluent monitoring system for TMI-1
consists of nine monitors. Five of these monitors

426

Type of Monitor

ParticulateGas
I odineParticulateGas
I odineParticulateGas
I odineParticulateGas
I odineGas
I odineGas
I odineParticulateGas
I odineParticulateGas
I odineParticulateGas
I odineParticulateGas
I odineare used for monitoring closed cooling loops thatact as barriers against release of radioactive materials to the river. The primary coolant letdown
is292
monitored to detect defects in fuel cladding.
The
wastewater and the miscellaneous sump discharge
292
monitors are located prior to the dilution point.
Should a preset level be reached, the wastewater
monitorautomatically close the discharge
292 willvalve.
The plant effluent discharge monitor was
not in service during the accident and had been
i noperable since March 13, 1979. The backup monitor for the plant effluent discharge had been out ofservice since April 22,1977. 8
TMI-2 liquid effluent monitors are equipped withsodium iodide (Nal) scintillation detectors and areli sted in Table 11-38. MU-R-720 primary coolant letdown (failed fuel monitor) monitors reactor coolant
l etdown upstream of the purification demineralizers.
The output from the detector in this monitor is fed totwo channels, one measuring 1351
the gross gamma activity and the other measuring
activity.
One instrument in the spent-fuel cooling circuit

TABLE 11-37. Atmospheric monitoring system, TMI-2 291
ChannelLocation

HP-R-219

Station Vent

HP-R-221 A

Fuel Handling Exhaust
Duct Upstream of Filter

HP-R-221 B
HP-R-229
HP-R-225
HP-R-222
HP-R-228
HP-R-227
HP-R-220
HP-R-224

HDG-R-1480

WDG-R-1485
WDG-R-1486
VA-R-748

Type of Monitor

Particulate
I odine
Gas
Particulate

Fuel Handling Exhaust Duct
Downstream of Filter

Particulate

Reactor Bldg. Purge Air ExhaustDucts A&B

I odineHydrogen Purge

Aux. Bldg. Purge Air Exhaust
Upstream of Filter
Aux. Bldg. Purge Air Exhaust
Downstream of Filter
Reactor Bldg. Air Sample

Gas

Movable Monitor

I odineControl RoomParticulate

Waste Gas Discharge Duct

Waste Gas Tank WDG-T-1A
Discharge
Waste Gas Tank
WDG-T- 1 B Discharge

Condenser Vacuum Pump Discharge

Gas
Gas
Gas
Gas

( SF-R-3402) continuously monitors radioactive materials released in the spent-fuel storage pool. The
monitor is an offline sampler. The detection of radiation indicates possible leakage of radioactive materials from stored spent fuel . 2~aOne radiation monitor (WDL-R-1311) continuously
measures the radioactivity level in the plantdischarge line at a point upstream from thedischarge dilution point for the mechanical-draft
cooling tower. Should the preset radioactivity level
be reached, the monitor will initiate closing of liquidradwaste discharge valves and stop the evaporator
condensate pumps. In addition, an electrical interl ock is provided that precludes the simultaneousdischarge of liquid waste from TMI-1 and TMI-2.
One additional radiation detector continuously monitors the common plant effluent from TMI-1 and TMI2 to 294
the river. This monitor is a backup to WDL-R1311.

TABLE 11-38. Liquid293
effluent and process radiation monitors, TMI-2

able radiation survey instruments for TMI-2 were
described by type but not by number in the FSAR.

SF-R-3402

Channel

MU-R-720

Primary Coolant Letdown

I C-R-1092

I ntermediate Closed Cooling Water( Letdown Cooler)

I C-R-1091

I C-R-1093
WDL-R-1311
DC-R-3399
DC-R-3400
NS-R-3401

Portable Radiation Survey Instruments- The port-

427

Location

I ntermediate Closed Cooling Water

I ntermediate Closed Cooling
Water (outside of Reactor Bldg.)
Liquid Waste Effluent
from Unit 2

Decay Heat Closed Cooling Water
Decay Heat Closed Cooling Water
Nuclear Service Closed
Cooling Water

Spent Fuel Cooling Water

The NRC staff concluded in the SER that the TMI-2
portable 295
radiation survey instrumentation was acceptable.
Portable radiation survey instruments are maintained under the responsibility of radiation protection personnel. Met Ed's program requires aninventory of instruments for measuring alpha,. beta,
gamma, and neutron radiation. The inventory must
be adequate to allow for periodic calibration,
maintenance, and repair. The portable radiation
survey instruments available at TMI immediately
before the accident are listed in Table 11-39. It is
doubtful that the number of instruments in inventory
would have been adequate to support normal
operations, even if all of them had been operational.
As Table 11-39 indicates, less than 50% of the
instruments were operational at the time of theaccident. There were no instruments available todetect neutrons. We find that the number of portable radiation survey instruments that were available
at the time of the accident was grossly inadequate
to support normal, and certainly not emergency,
operation.

Existence of a backlog of portable radiation survey instruments in the TMI repair shop awaiting
repair, parts, or calibration was a common
occurrence stemming from the low priority the radiation protection program received. 299 In addition,
excessive damage to instruments occurred throughemployee neglect, carelessness, and absence ofaccountability. For example, one portable survey
i nstrument had been inadvertently crushed by the
radwaste trash compactor.
The outage at TMI-1
that immediately preceded the accident further
depleted the inventory of available instruments andexacerbated the problem. We find that the management of the portable radiation survey instrumentation program at Three Mile Island Station was inadequate.
Met Ed relied upon the station's normal complement of portable radiation survey instruments to
support an emergency. For this reason, only four
emergency kits were maintained for postaccident
monitoring. Each of131
the kits contained a SAM-2
i ntended to measure 1. The SAM-2 in one kit wasout of service at the time of the accident and the

TABLE 11-39. Portable radiation detection survey instruments at Three Mile Island296 298
I nstrument

Radiation
Detected

Type

Range

Available/Inventory
At Time of Accident

Eberl i ne
E-520

Beta
Gamma

GM

0- 2000 mR/h

6/14

Alpha

Scint

0-2x106 cpm

0/2

GM

0-1000 R/h

4/16

Neutrons

BF 3 -PC

0-5000 mrem/h

0/2

Beta
Gamma

IC

0-1000 R/h

4/14

Beta
Gamma

IC

0-5 R/h

5/12GM0-5x104 cpm

1 8/18Gamma

GM

0-100 mR/h

0/5

Eberline
PAC-4S

Eberline
Teletector#6112
Eberline
PBR-4
Eberline
PIC-6A
Eberline
RO-2

Eberline
RM-14 with
HP-210 probe
Victoreen
808 Vamp

Beta
Gamma

Beta
Gamma

GM = Geiger Muller
Sclnt - Scintillator
I C = Ionization Chamber
BF 3 -PC - Boron Trifloride Proportional Counter in Cadmium/Polyethylene Ball

428

SAM-2 in another kit was issued even though it
failed its calibration check. In any event, theSAM-2 was a poor choice for field use by technicians to measure 13 1, particularly in the presence of
noble gas.
I n short, there was not a sufficient supply of
i nstruments to perform personnel monitoring adequately and to conduct onsite and offsite radiation
surveys in response to the accident. Large
numbers of portable survey instruments of all types
had to be provided by vendors, other utilities, contractors, and Government agencies to augment theavailable inventory.
We find Met Ed's reliance on the routine inventory of radiation protection survey instruments for
emergency response left a serious gap in its ability
to support the necessary monitoring functions duri ng the initial phases of the emergency. We recognize that augmentation of portable survey instruments is inevitable in responding to accidents of thenature and duration of the TMI-2 accident. In addition, we find that the number of emergency kits andthe suitability of the instruments therein was inadequate.

released and as a result, critical information was
lost;• the number of portable radiation survey instruments that were available at the time of the accident was grossly inadequate to support normal,
and certainly not emergency, operations;• the management of the portable radiation survey
instrumentation program during normal operations was inadequate;• Met Ed's reliance on routine inventory of radiation
protection survey instruments for emergency
response left a serious gap in its ability to support its emergency response; and• the number of emergency kits and the suitabilityof the instruments therein was inadequate.

We recommend that:• the NRC reassess the requirements for inplant

fixed radiation monitoring instruments to ensurethat the instruments will be adequate for the radiation and contamination levels that could be expected to exist during an accident; and• the NRC evaluate and specify requirements for
type, quality, and quantity of operational portableradiation survey instruments for both normal andaccident conditions.

Radiation Counting Laboratory Instrumentation-Because the TMI-2 Ge-Li gamma spectrometer andthe liquid scintillation detector system were neverplaced in operation and the TMI-1 counting laboratory could not be used in the early stages of the accident, replacement analytical services were necessary.

Respiratory Protection and Protective Clothing

Respiratory protection is required by 10 C.F.R.
Part 20.103. However, the regulations, the FSAR,
and the technical specifications do not specify thetype, performance, or quantity of respiratory protection devices to be maintained on site.
As of February 1979, Met Ed had
the following
303
protective devices available on site:

Portable Air Sampling Equipment I n addition to the
fixed and mobile atmospheric monitors, Met Ed alsoutilized several portable air samplers. On March 28,
1979, 21 of the 24 air samplers in inventory were302
operational.

Self-contained breathing device, routine work: 44
Self-contained breathing device,
emergency egress: 6
Backup air supply bottles for self-contained
breathing devices, routine work: 15
Full-face respirator with particulate filter
cartridge: 150
Half-face respirator with particulate filter: 25

Summary of Findings and Recommendations
We find that:• the NRC staff's SER assessment of the proposed
atmospheric monitoring system for TMI-2 wasi nadequate because it did not consider the monitor response ranges that would be necessary in
the presence of high levels of radioactive materials;• readings obtained from the TMI-2 dome monitor(HP-R-214) during the accident could not be considered reliable indicators of the radiation fields
within containment;• the atmospheric monitors were inadequate tomeasure the quantities of radioactive materials

We believe the inventory was adequate for normal
operations.
The only air supply refill capability at Three MileI sland Station for the self-contained devices wasavailable in TMI-1. Due to high levels of airborne radioactive materials, this capability could not be usedduring the initial phases of the emergency because
the quality of the intake air could not be ascer304
tained.
429

The maintenance, inspection, and decontamination procedures for respiratory devices are discussed in station procedures HPP-1616. No one
person is accountable for these important aspectsof the respiratory protection program because of
the 6-week rotation schedule. Because respirators
are delicate, their care, maintenance, and decontamination (both biological and radiological) after use
i s important. This control could be more efficient if
i ndividuals were assigned to these tasks permanently. We find that control of the respiratory
protection program was inadequate during normal
operation because responsibility was shared among
all the R-CTs as part of the maintenance and inspection functions.
During the first several days of the accident, theissuance, maintenance, inspection, and decontamination of respiratory protection devices went uncontrolled because of lack of accountability and facilities and because of the large number of personnel requiring respiratory protection. Some respirators were reissued without decontamination 305 andsome were decontaminated with mproper materials,
306
We findcausing subsequent users to become ill.
that control of the respiratory protection program
during the first few days of the accident was inadequate.
Because Met Ed relied upon its normal complement of respiratory devices for emergency use, therespiratory protection program at Three Mile Island
Station had to be augmented during the emergency.
The need for additional equipment, including Scott
Air Pacs, was quickly realized and efforts were initiated to obtain the necessary support, which waspromptly provided by industry, vendors, and local
fire departments. Iodine adsorption canisters were
not available on site before the emergency. A perceived need for these canisters resulted because of
the loss of analytical capability, and they wereobtained from outside sources. Because there is no
approved iodine canister, the canisters obtained forThree Mile Island Station received temporary
appro307, "We findval from the NRC for limited use.
that the onsite inventory of respiratory protective
devices was insufficient to support a prolonged
response to an emergency.
Protective clothing available included shoe covers
and head covers (hoods and surgeon caps); gloves(cotton, plastic, rubber); coveralls; laboratory coats;plastic or rubber suits; and face shields. Adequate
supplies of protective clothing were on hand during
normal operations and for the initial phases of theemergency. These supplies were substantively
augmented during the accident. Although the protective clothing was available, some individuals

made entries
into contaminated areas without wear3-3r
i ng hoods. os
Summary of Findings and Recommendations
We find that:• control of the respiratory protection program wasi nadequate during normal operation because
responsibility was shared among all the R-CTs
as part of the maintenance and inspection functions;• control of the respiratory protection program duri ng the first few days of the accident was inadequate; and• the onsite inventory of respiratory protection
devices was insufficient to support a prolonged
response to an emergency.

We recommend that:• the NRC require that the responsibility for the

respiratory protection program be vested in asingle individual and that technicians be permanently assigned to perform the tasks of inspection, maintenance, and decontamination of
respiratory protection equipment;• the NRC specify the minimum number of functional respiratory protection devices required bytype and size for both normal operations and for
emergencies.
Personnel Dosimetry

Personnel dosimetry is used to assess the efficacy of maintaining the external and internal exposures received by the plant workers ALARA. Personnel dosimetry is required by 10 C.F.R. Part
20.202.
The personnel dosimetry program used at theThree Mile Island Station is specified in the station
health physics procedures. 312
This program is generally described in the FSAR
and was evaluatedby the NRC staff in its review of the operating
license application. The NRC staff found the proposed dosimetry313
program acceptable and indicated
The NRC regulations do not
so in the SER.
specify minimum standards for management of personnel dosimetry programs.
Personnel dosimetry at the Three Mile Island Station is the responsibility of the radiation protection
department and was conducted with the use of
TLDs and pocket chambers for determining wholebody exposures. Extremity monitoring was conducted by taping a TLD to the appropriate extremity. Internal dosimetry was based on urinalysis andwhole-body counting (WBC).314
430

Preaccident Personnel Dosimetry-The TLD systemis operated in accordance with Station Health Physics Procedure 1642, "Operation and Calibration of
the Thermoluminescent Dosimetry System," Revision 1, September 28,1977.
TLDs are issued to all personnel at the station
who enter the controlled area. During normal
operations they are processed monthly, or more
often if exposures are suspected. Harshaw, Inc.,
provides the dosimetry system, which uses a lithium
fluoride (LiF) two-chip dosimeter and Model 2271
reader. In addition to TLDs, self-reading dosimeters(pocket ionization chambers) are issued to individuals as required. Each individual is instructed in thenecessity of reading the self-reading dosimeter at
frequent intervals while in radiation areas. 312
Whole-body counts are taken if the nature of exposure or suspected exposure is such that internal
contamination is possible. The WBCs also assist inassessing the adequacy of the station radiation protection control practices.
The TMI-2 radiation protection procedures require that all contractor personnel provide a baseli ne urine sample prior to entry to a controlled area.
Urinalyses are also performed on contractor personnel upon completion of a specific job. The radiation protection supervisor has the option of orderi ng additional bioassay analyses and/or whole-body
312
counts on any personnel should the need arise.
Both WBC services and urinalyses were contracted
to offsite vendors.
No specific individual had been assigned responsibility for control of external personnel dosimetry atThree Mile Island Station. 315 '316 Each R-CT performed this function as a routinely assigned task.
Because of the weekly rotation of assignments, a
specific R-CT might be expected to read the TLDs
for 1 week, twice a year. The expertise gained by a
R-CT during his twice-yearly limited duty assignment at the TLD reader was diluted to the point thatnone of the R-CTs was familiar enough with theequipment and procedures to understand all aspects of the system. 316
The execution of an acceptable personnel dosimetry program requires specialized training andconstant attention to the details of the system. At
least two audits recognized this requirement. 315,316
Both audits recommended that a qualified individual
be assigned the sole responsibility for the dosimetry
program. No action was taken on these recommendations until after the accident, when a specialist
was hired to supervise the dosimetry program.
Pocket chambers for each individual entering acontrolled area were issued to the foreman incharge of the ongoing work and the foreman provid-

ed them to the individuals. Under these circumstances, individuals were not accountable for
their pocket chambers. As a result, during the TMI-1
refueling outage preceding the accident, several
hundred pocket chambers were lost over a 3-month
period. Upon leaving the TMI-1 controlled area, thei ndividual workers read their dosimeters, informed
the R-CT (controlling access) of the reading, andthen proceeded to another location where they
were supposed to turn in the pocket chambers. Often
the workers did not follow this procedure and kept
the dosimeters. Because there was no personalaccountability for each pocket chamber, there was
no way to recover them and the data regarding theirperformance were lost. After the loss of approximately 600 pocket chambers, the procedures werechanged. No personal accountability program
resulted from this change, and another 200 pocket
chambers were lost over the remaining 2 months ofthe outage. The lack of control over the pocket
chambers was attributed to insufficient personnel
and inadequate funding. 317 However, the loss of
800 pocket chambers, each costing an average of$50, would have made it well worthwhile to have
had a control mechanism.
We find that the management and implementationof the external personnel dosimetry program (TLDs
and pocket chambers) were inadequate during normal operation. We find, further, that the NRC has
not adequately addressed standards for management and control of a personnel dosimetry program.
Personnel Dosimetry During the Accident- On theafternoon of March 29, the TLD reader and support
equipment were moved from their normal location
on site to the observation center because of a significant increase in the onsite background activity. No
record is available to verify that proper calibration
had been performed prior to placement of thisequipment into operation.
The TLD system was operated until March 31 by
an R-CT who had received only 2 hours of on-thejob training in the use of the TLD system on June 6,
1977. He had not operated the equipment in abouta year and a half. The operator did not have a copyof the operating or documenting procedures. He
performed the job for approximately 48 continuous
hours with little or no assistance. His work included
the reading of all TLD badges that were turned inand the preparation (zeroing) of the badges to be is318
sued in April.
On March 31, the TLD reader was returned to thesite. At this time, Harshaw provided an additional
reader and assigned two engineers to assist with its
431• the performance of the external personnel do-

The second reader was
i nstallation and operation.
319
operational on April 1.
Additional personnel to operate and manage thepersonnel dosimetry program during the emergency
response were provided by the Electric Boat Division of General Dynamics Corporation and othercontractors. With the heavy influx of augmenting
personnel, large quantities of additional TLD badges
and self-reading dosimeters were rushed to the site
by the various suppliers. Extremity badges, whichwere not available on site prior to the accident, werealso provided and were used to monitor personnel
who were performing functions with potential forhigh extremity exposures.
During the early days of the emergency, entries
were made into high radiation areas and areas withunknown exposure rates within the auxiliary buildi ng. These entries were made without the use of
pocket chambers or with the wrong type (low range
vs. high range) of pocket chambers. Pocket
chambers that went off scale during these entries
were ignored. No system was used to assess andrecord the cumulative individual exposures determined by pocket chambers. We find that the external personnel dosimetry program during the accident was inadequate.
Two whole-body counters were on site for the
TMI-1 refueling (from Helgeson Nuclear Inc. and from
Radiation Management Corporation). Additional
technicians were also provided to assist in wholebody counting of plant personnel who were, or may
have been, contaminated because of the accident.
Individuals with gross skin contamination resulting
from activities such as sampling primary coolant andmaintenance were sent to the WBCs for counts. In
some instances these individuals were so contami nated that the radiation emanating from them sa320
There was no
turated the WBC equipment.
mechanism in effect to ensure that individuals who
were directed to obtain WBCs ever did so. Referral
records were not kept. We find that the use ofwhole-body counting for internal personnel dosimetry during the emergency was inadequate.

simetry program during the accident was inadequate; and• the use of whole-body counting for internal personnel dosimetry during the emergency wasi nadequate.

We recommend that:• Met Ed establish an improved system for control,
issuance, and recovery of personnel dosimeters;• Mat Ed ensure that their personnel dosimetry
program is managed and implemented by competent personnel; and• the NRC require licensees to ensure that adequate personnel dosimetry services, including
sufficient staff, be available and that personnel
dosimetry records, evaluations, and referrals forbioassay be maintained during emergencies.
c. The Responsibility of the Utility and the
NRC

The deficiencies in the radiation protection program at Three Mile Island were pervasive and serious. The utility was aware of the deficiencies in the
program before the accident, but its efforts to improve the program were slow and weak. The NRC
was, or should have been, aware of the deficiencies
but took no, or trivial, action to remedy the probl ems.
There appear to have been two reasons why an
i nadequate radiation protection program existed.
First, the attitude of both Met Ed and the NRC wasthat the program was of secondary importance and,accordingly, warranted much less attention than theoperational aspects and hardware. Second, both
Met Ed and the NRC shared the assumption that an
accident like TMI-2 would not occur because engineered safety features incorporated in the design
would prevent or mitigate any serious accident.
Under anticipated conditions, they believed the exi sting radiation protection program would provide
sufficient protection. The accident has shown thatthe attitude of Met Ed and the NRC was not properand that radiation protection must be given higher
priority that is on an equal level with operations.

Summary of Findings and Recommendations
We find that:• the management and implementation of the

Audits by the Utility

external personnel dosimetry program (TLDs andpocket chambers) were inadequate during normal
operation;• the NRC has not adequately established standards for management and control of a personnel
dosimetry program;

Met Ed's radiation protection program had been
audited before the accident by Met Ed's quality assurance department, by GPU, and by outside consultants. These audits identified numerous, andserious, deficiencies in the program and made432

recommendations
for correcting
them.
The
management did not take timely corrective actions
to implement these recommendations.

Their report noted the following deficiencies:

1. "The high frequency rotation of technicians
between chemistry and health physics activities
is probably inefficient."
2. "There is a problem with combining the chemistry
and health physics functions. Chemistry is closely related to the reliabilities of plant operation,
whereas Health Physics is more of a conscience
function." (Emphasis added)
3. "The Health Physics department does not review
everything that goes through PORC."
4. "The present 24-man technical staff is probably
marginal for routine operation of Unit 1 and 2 (notcounting outage considerations), and is probably
slightly (1 or 2 men) inadequate for Unit 2 startup,
but could be satisfied by overtime."
5. "Unit 2 has already made an impact on Health
Physics/Chemistry technical activities and overti me is currently required even with 24 technicians."
6. "Closer supervision of Health Physics/Chemistry
technicians by foremen is desirable."
7. "TMI is one of a growing number of plants performing inhouse external dosimetry (TLD). This
dosimetry service, which is a repetitive analysis
using specialized equipment and requires substantial data processing, would probably bebetter performed by one person."Internal Audits-Met Ed's internal audits were conducted according to a specific audit plan based onprocedures, regulatory guides, and applicable regulations, and contained a checklist of specific attributes to be audited within the subject area of interest. Upon completion of the audit, a report wasi ssued to the station manager, the supervisor of radiation protection and chemistry, and others. The
report established time limits for satisfactory completion of any required corrective action. The internal audit program provided for a mechanism to enforce the deadline for corrective action. Extensionsof the deadlines, however, were routinely requested
and granted, and the mechanism became ineffective.
Corrective actions, even on trivial matters, took
months for completion. For example, an audit of therespiratory program was conducted on March 16,
1978. The audit report was issued on April 28,
1978, with seven findings requiring corrective action. 321 None of these findings should have taken
very long to resolve; yet the earliest completion date
for any item was September 5, 1978. Two items
remained outstanding at the time of the accident, almost 1 year after completion of the audit.

Appropriate recommendations
were made to315
correct deficiencies.
However, little was done torectify the situation, as is shown in a subsequent
audit conducted for Met Ed by the NUS 2 years
later.

78-07-5 Maintenance records are not kept toprovide knowledge of service time for respirators,common failure modes of particular respirator
types, and personnel complaints on respirator
design.
78-07-6 The protection factors in HPP-1616 are
i nconsistent with the values specified in Regulatory
Guide 8.15.

The NUS Audit of the Radiation Protection
Program-At Met Ed's request another audit was
conducted from February
26 to March 2, 1979 by
323
the NUS Corporation.
The audit was intended toprovide an overview of the health physics programand not an indepth review. Even on the basis of thisli mited review, the NUS was highly, and correctly,
critical of the program. Among the findings made by
the NUS were the following:Items of this nature should have been easily
resolved since most required simple proceduralchanges or a letter from the station manager. They
should have also been found during IE radiation protection inspections. However, these deficiencies
were not reported by IE, even though it made four
i nspections between January 1978 and March 1979.
Action on finding 78-07-6 was not completed at theti me of the accident. This finding was consideredby Met Ed as "an itemof noncompliance with Regu321
l atory Guide 8.15."

1.

GPU Audit of Three Mile Island Radiation Protection
Program- I n June 1977, GPU and Pickard, Loweand Garrick, Inc., a consultant, conducted an auditof the 322
radiation protection program at Met Ed's request.

433

The present organization precludes the adequate performance of some critical healthphysics functions. The basic problem appears
to be that the health physics organization has
not been properly upgraded to meet current
demands. These demands include implementi ng the myriad of regulatory requirements thathave evolved during the past few years andproviding the health physics 324
coverage necessary for a two-unit operation.

2.

3.

The combination of health physics and chemistry groups is generally ineffective and has
resulted in serious problems at the technician
level. The scope of work is so extensive thatthe technicians are not properly qualified
to325
perform all of their assigned duties.
The assignments of the 24 health physicschemistry technicians are rotated on a 6-shiftschedule and technicians periodically perform
all tasks. The shift for "other station duties"
was at one time designated as a training shiftthat no longer exists. Because assignments
are for 1 week only, there is little incentive forthe technician to become highly proficient in
the various tasks within that area. The results
are that many tasks are done in a superficial
manner, some are performed
incorrectly, and326
some are not done.
The severity of the above situation is magnified for some jobs which are performed on amonthly basis. With the existing rotation
system and the vast number of tasks involved, a given technician may not perform
one of these monthly jobs more than once
every two years. A vital function in this

9.

10.

11.

category. .. is reading and documenting theresults of personnel radiation dosimeters.

4.

5.

6.

7.

8.

(Emphasis Supplied.)

The supervisor of radiation protection andchemistry has too many people reporting tohim because the position
327 of chemistry supervisor remains unfilled.
A major cause of inadequate health physicschemistry technician staffing is the misuse of
these personnel in doing the menial tasks oftool, 328
equipment, and respirator decontamination.
Technicians were doing a great deai of work
which should be performed by clerks. "Observed evidence was the misfiling of nearly
one-half (about 500-600) of the completed
Radiation Work Permits for the year 1978 ...
The only individual who is qualified and/or
available to compute, format, keypunch andli st the exposure data is also the only actual
personinthe
Radiation
clericalProtection/Chemistry Department. , 329
Because of the lack of rent-a-techs for thecurrent outage, on-the-job health physics
coverage, which is required for inexperienced
workers and is normally performed by renta-techs, is grossly inadequate. 330"The inadequacies in training of the Health
Physics/Chemistry technicians are readily apparent ... their actions are by rote ... whenconfronted by only slightly off-normal situa-

12.
13.

14.

tions, they often lack sufficient understandingof their job to confidently take the appropriate
action ... [and] also appear to have insufficient knowledge of plant systems, including
the radiological considerations that would apply if the system were opened." "A serious impact of the inadequate technician training isl ack of confidence, not only on the part of thetechnicians themselves, but also by their foremen and supervisors,
as well as other station
331
personnel.""The overriding of decisions made by healthphysics personnel has become a routine occurrence at TMI. Decisions made by Health
Physics technicians on the back shifts are frequently overridden by the Operations Shift
Foreman. "332
" Activities which may involve considerable
changes in radiological conditions are frequently conducted by operations personnel,
333
without notification of health physics.""A definite communications gap is apparent ...
between the Radiation Protection/Chemistry
Supervisor and the Health Physics Supervisor.
Another gap appears to exist between the
Health Physics Supervisor and the Health
Physics Foremen, and yet another between
the foremen and the technicians." 334"No effective method is employed to ensurethat all the335
technicians are aware of procedurechanges.""Personnel dosimetry is one of the weakest
areas within the TMI health physics pro336"A major reason for the weakness
gram."of the TMI personnel dosimetry program isthat no individual is assigned to conduct prop337
er reviews of the records.""Both the frequercy and locations at whichroutine air samples are taken appear to beinadequate." 338

Problems were also noted in radiation surveys andcontaminated tool control. The report made appropriate
recommendations
tocorrect
thediscrepancies.
The NUS report was issued on March 20, 1979.
Thus, Met Ed did not have the opportunity tothoroughly consider the report prior to the accident,
although Met Ed was well aware of the deficiencies
i n the radiation protection program. Ironically, ameeting among Dubiel, Station Manager Gary Miller,
and others to discuss the report had beenscheduled for the morning of March 28. 339
The findings of the NUS report, which we verified
particularly through depositions of Met Ed person434

nel, reflect the continued inadequacy of the radiation
protection program over the past several years .
Examination by the NRC

The serious deficiencies in the radiation protection program at TMI raise questions as to the adequacy of the NRC process for licensing and inspecti ng radiation protection programs at commercial nuclear power reactors.
Inspections of nuclear powerplants are conducted by IE at all phases of plant existence, from thei nitial management meeting before construction to
the closeout inspection and survey when the facility
is decommissioned. Areas of concern and emphasis change depending upon the specific stage ofplant construction or operation. The inspections at
the preoperational stage involve detailed evaluationsof the applicant's program. Operational inspections,which are performed annually, shift emphasis toconfirmation of adequacy of the radiation protection
program by review of records, documentation, andprocedures.
I nspections during refueling emphasize compliance with FSAR commitments, technical specification requirements, the need for special procedures,
and assessment of advance planning. These inspections occur approximately every other year.
The respiratory protection and access control programs also receive particular attention during refueling outage inspections.
We reviewed the IE Inspection Reports for TMI-2
for the period January 1978 to March 1979. Of the
44 inspections made during that time, only four
were made specifically for radiation protection: (1)January 5-6, and 26-27, 1978; (2) May 5 and August 9,1978; (3) October 6,10-12,17, and 19,1978;
and (4) February 13-15, 24-25, 28, and March 12,
1979. No items of noncompliance were found during
the first two inspections. During the other two inspections, items of noncompliance were reported
regarding the posting of high radiation areas, conduct of timely surveys, records maintenance of effluent sampling, high radiation areas without adequate instruments for continuous indication of doserate, and failure to adhere to certain procedures.
During an inspection for operations conducted on
May 10-12, 1978, two radiation protection related
items of noncompliance were indicated: (1) failure to
perform airlock surveillance, and (2) failure of an individual to monitor himself upon leaving a controlled
area. Also, an environmental inspection on April
17-21,1978 indicated three areas of noncompliance:(1) radiation levels in excess of regulatory limits in anunrestricted area, (2) failure to sample and analyze
435

air particulates and iodines, and (3) failure to meet
analytical sensitivity for 89 Sr in drinking water. 341
The IE inspections before the accident did not reveal the serious deficiencies in the radiation protection program discussed above. Only as a result of
its investigation of the TMI-2 accident did IE identify
these deficiencies. Although many of the deficiencies noted by the IE investigators after the accident
resulted in an issuance of notice of violation and imposition of civil penalties, 342 many deficiencies
could not be cited as violations because of thevagueness of regulatory requirements. For example:• Qualifications-"The review and interviews withthe technicians indicated five of the twelve radiation chemistry technicians did not appear to have
1 year of related technical training in chemistry orradiation protection. Nine of the twelve radiation
chemistry technician Juniors did not have 1 yearof related technical training. No apparent item ofnoncompliance was identified since the term
' should' as used in ANSI N18.1-1971, Section
2.2.1., denotes a recommendation, not a require343
ment. "• Portable Instrument Availability-"Many additional
survey instruments and air samplers were necessary to support the in-plant and environmental
monitoring after the accident .... No clear regulatory requirement or licensee commitment established minimum inventories
for portable survey344
i nstruments at this facility."• Personnel Dosimetry-"No regulatory requirements or license commitments establish minimum
standards for management of personnel dosimetry systems." 345

The vagueness of the radiation protection requirements raises questions as to the adequacy of
the NRC process for review and licensing of radiation protection programs at commercial nuclear
power reactors. The proposed radiation protection
programs are submitted for NRC staff review at the
CP stage and the OL stage. The radiation protection section of the radiological assessment branchi n the Office of Nuclear Reactor Regulation conducts the staff review of the proposed program.
The review is conducted in accordance with
Chapter 12 of the Standard Review Plan to determine compliance with the requirements of 10 C.F.R.
Part 20 and conformance to applicable regulatory
guides. The review is essentially a paper review ofthe program; it does not include a specific evaluation of the people, the equipment, or the facility, but
is focused on whether the applicant's-licensee's
program contains a consideration of these elements

i n their programs. The conduct of the NRC reviewof the Three Mile Island Station radiation protection
program is discussed in detail in Sections II.B.5.aand II.B.5.b.
An implicit assumption in limiting the review of radiation protection programs is that the total safety
review process ensures that engineered safety
features would mitigate the consequences of serious accidents. As a result, the focus of the radiation protection review has been predominantly on
normal operations and anticipated operational occurrences (i.e., major maintenance and refuelingoutages). 6
We find that the NRC review and inspection process in the area of radiation protection focused on
conduct of normal power operation. Radiation protection in accident situations, such as existed at
TMI-2, were not adequately considered in thelicensing review or inspection program.

The attitude toward radiation protection was also
manifested by a variety of decisions that involved
allocation of money or manpower. For example, an
extraordinary number of instruments needed for theradiation protection program were not operational at
the time of the accident. A significant factor contributing to this problem was that repair of instruments
needed for plant operations was given higher priority. Health physics instruments were repaired "when347
we can get to it,"
often months after the instrument became inoperable.
Management's attitude toward radiation protection developed in part because of its view that itwas not necessary to give priority to radiation protection to deal with normal operations and accidents
that could be reasonably anticipated. Regardless ofwhether management's assumptions of what could
be anticipated were reasonable, they have beenshown by events at TMI-2 to be incorrect.
We find that a conflict existed between operations and radiation protection due to management's
motivation toward production. As a result, radiation
protection was perceived as a "necessary evil," andi ts importance was subordinated to production.

The Attitude of Met Ed Management

Met Ed's management at TMI did not accord theradiation protection program the importance that theManagement
accident has indicated is necessary.
347
was "operations oriented,"
and its predominant348
concern was "to keep the plant running."
Radia349
tion protection always took a "back seat."
Management perceived radiation protection as a"necessary evil"-controls that stood "in the way,
many times, of production," but had to be applied "in350
order to comply with the current regulations."
Richard Dubiel, Supervisor of Radiation Protection
351
and Chemistry, agreed with this assessment.

The Attitude of NRC

The NRC similarly treats radiation protection as
secondary in importance to production. It appears
that there are few persons within upper and middle
management (above the assistant director level) of
the agency with adequate training in, knowledge of,and sensitivity to radiation protection and radiation
health. The NRC safety reviews of commercial nuclear power reactors have been hardware oriented.
The focus of those reviews has been on equipment
and engineered safeguard features to mitigate andsafeguard against accidents. As a result, the belief
that "accidents can't happen" has colored theagency's approach to radiation protection. As discussed previously, the focus for evaluating and inspecting radiation protection programs has been inassessing the adequacy of these programs to support normal operations and anticipated operational
occurrences. We find that the attitude that radiation
protection was of secondary importance was heldby the NRC.
I n addition, the NRC traditionally emphasizes theoffsite effects of accidents. The consequences ofaccidents analyzed for siting purposes are used as
the planning base for development of emergency
plans and for implementing procedures. The anal yses of these accidents address only theoffsite-site boundary consequences. Therefore, theemergency plans and the implementing procedures

Q. I have gained the impression from the testimonyof Messrs. Janouski, Velez and Mulleavy, thatthey believe ... that health physics is somethingof a stepchild in comparison, let's say, to operations ... someone who is getting smaller portions, someone who is not treated as well.
A. Yes, I think that is a fair assessment, understanding that operations are the moneymakers,
so to speak. They are the ones who are goingto keep the plant operating.

The low priority given to radiation protection wasreflected in the Met Ed organizational structure. Dubiel, the highest ranking member of the radiation
as a practicalprotection department, reported352
Thus, radiamatter to the unit superintendents.
tion protection was literally placed under the direction of operations. It is not surprising that the"stop-work" authority of the radiation protection
department was rarely exercised because attempts
by the department to exercise authority353
were regul arly overruled by operations personnel.
436

• Recommendation 2.1.6.b-Design review of plantthat have evolved comprehensively address offsite
related response actions, and actions related to inplant consequences and response are, essentially,
completely ignored.
We find that the configuration of emergency organizations, the scope and content of emergency
procedures, the design of the facility, and the equipping of emergency facilities do not adequately consider inplant consequences of accidents.

shielding of spaces for postaccident operations• Recommendation 2.1.8.a-Improved postaccident
sampling capability• Recommendation 2.1.8.b-Improved range of radiation monitors• Recommendation 2.1.8.c-Improved inplant iodine
i nstrumentation.

The NRR Lessons Learned Task Force Final Report (NUREG-0585) also made recommendations
regarding training (Recommendation 1.8) and emergency procedures (Recommendation 4) which, wheni mplemented, will improve the effectiveness of radiation protection programs. The IE Lessons Learned
Report (NUREG-0616) made nearly 100 recommendations to improve the NRC's inspection and enforcement process, many of which will significantly
improve radiation protection programs. On October
17, 1979, Harold Denton, Director of the Office of
Nuclear Reactor Regulation, wrote to Met Ed to inform them of the establishment of a special panel ofhealth physics experts to review their program.
All of these actions suggest that there has been achange in attitude toward radiation protection by
Met Ed and the NRC. It remains to be determined
whether their apparent change in attitude is real andwill continue or if they will lapse into treating radiation protection as a necessary evil after they are nolonger under the intense scrutiny that has followed
the accident.

A Change in Attitude?

The accident has engendered a substantial
amount of activity by both Met Ed and the NRC toi mprove the radiation protection program at TMI.
Met Ed-Significant changes introduced by Met Ed

have involved the respiratory protection program,the management of the dosimetry program,354
and thecontrol of access to high radiation areas.
Theapparent change in attitude is best illustrated by the
response of David Limroth, the Supervisor of Administrative
355 and Technical Support, to the following
question:

Q. To what do you attribute the increase in visibility
and authority of the health physics program?
A. This whole operation out here today is one hundred percent contingent on a sound health physics program faced with the problems which wehave now that the reactor has been brought
down to a quiescent state, if you will.... We're
faced with a massive clean-up effort with relatively unknown challenge in the reactor containment building.
Health physics or radiation protection is the
keystone to the success of this operation.

Met Ed's Radiation Protection Program Compared to
Other Commercial Nuclear Power Reactor Programs

We did not examine the radiation protection programs at other commercial nuclear power reactors.
However, the scope and nature of the deficiencies
noted in the program (Section II.B.5.a throughII. B.5.c) raise questions as to whether similar deficiencies might exist at other reactor facilities.
We have explored this avenue of inquiry in a limited manner via informal meetings with the NRR andthe IE radiation protection personnel. On September 25 and 26, 1979, meetings were held withsenior radiation protection personnel from each IE
regional office. The purpose of the meeting was toascertain, if possible, some comparison of the Three
Mile Island Station radiation protection program tothose of other commercial facilities. We also met
with the NRR radiation protection personnel on October 19, 1979. The purpose of this meeting was toascertain, if possible, whether the deficiencies noted
i n Three Mile Island Station's radiation protection
program were indicative of generic deficiencies in

The NRC- The IE investigation revealed many
weaknesses in the TMI radiation protection program
and resulted in a Notice of Violation and impositionof civil penalties on Met Ed. This Notice of Violation
contained numerous radiation protection violations. 356 The transmittal letter indicated that:

These noncompliances demonstrate serious
weaknesses in your ability to maintain an effective
health physics program ...

The NRR Lessons Learned Task Force
Report-Short Term Recommendations (NUREG0578) contained a number of recommendations
aimed at improving the overall radiological protection at reactor facilities. For example:
Recommendation 2.1.6.a-Integrity of systems
outside containment likely to contain radioactive
materials
437

the NRC's licensing process.
Transcripts of these357,3
ss Various elements ofmeetings were taken.
the licensee's radiation protection programs werediscussed at these meetings including management,
procedures, training, personnel dosimetry, personnel exposure and contamination experience, instrumentation (portable and fixed), contamination control, emergency planning, and environmental monitoring.
Based upon these meetings, we believe that theradiation protection program at TMI, although below
average, was not significantly worse than those atother commercial reactor facilities. These discussions also support the following findings discussed
i n this section:• Many regulatory requirements for radiation pro-tection are not clearly specified in the regulations
and technical specifications.
• The basis for review of licensee radiation protection programs has been focused on normal
operations and anticipated occurrences.
• The radiation protection programs at operating
commercial nuclear power reactors should be
reexamined to ensure that the lessons learned
from TMI-2 are appropriately reflected in them.
Summary of Findings and Recommendations
We find that:• a conflict existed between operations and radia-

tion protection because of management's motivation toward production. As a result, radiation
protection was perceived "as a necessary evil"
and its importance was subordinated to production;438• many of the deficiencies in the Three Mile Island

Station's radiation protection program existed
prior to March 28, 1979 and went undetected by
the routine E inspections;• many of the deficiencies in the radiation protection program, even if detected by routine E inspections, were not covered specifically by regulatory requirements and thus hampered IE fromrequiring any corrective action;• the NRC review and inspection process in thearea of radiation protection focused on conduct
of normal power operation. Radiation protection
i n accident situations, such as existed at TMI-2,
were not adequately considered in the licensing
review or inspection program; and• the attitude that radiation protection was ofsecondary importance was held by the NRC.

We recommend that• the radiation protection function at commercial

nuclear powerplants should be independent ofoperations and should be elevated to equal importance with production;• the NRC should give greater emphasis in its
licensing review and inspection processes to radiation protection. The NRC should reassess theradiation protection programs at commercial nuclear power reactors;• the NRC should give additional emphasis to radiation protection and radiological health in accordance with the agency's mandate "to protect the
public health and safety;"• the NRC should develop a regulatory base to ensure that inplant radiological conditions resulting
from an accident are considered in the planningof emergency procedures.

REFERENCES AND NOTESMet Ed, "Final Safety Analysis Report as amended,
Three Mile Island Nuclear Station Unit 2."2
NRC, "Safety Evaluation Report, TMI Nuclear Station
Unit 2,' NUREG-0107, September 1976.
3
NRC, "Final Environmental Statement and Supplement, Three Mile Wand Nuclear Station Unit 2," NUREG0112, December 1976.
4
NRC, "Investigation into the March 28, 1979 Three
Mile Island Accident by Office of Inspection and Enforcement," NUREG-0600, August 1979.
5
Letter from D. E Bennett, IN, Sandia Laboratories, toJ. Murphy, NRC, Subject. Sandia ORIGEN Core Calculations, dated April 4,1979.
e
NRC, "Final Environmental Statement Related to the
Operation of the Three Mile Island Nuclear Station Units 1
and 2," December 1972.
7
NRC, "Final Supplement to the Final Environmental
Statement Related to Operation of Three Mile Island
Nuclear Station, Unit 2," NUREG-0112, December 1976.
8
NRC, "Safety Evaluation Report Related to Operationof Three Mile Island Nuclear Station, Unit 2," NUREG0107, September 1976, and Supplements.
9
Applicabie Met Ed test procedures are TP 173/2,"Auxiliary Building Ventilation Functional Test," and TP
177/2, "Fuel Handling Building Ventilation Functional
Test."
10
NIRC, 'Investigation into the March 28, 1979 Three
Mile Island Accident by Office of Inspection and Enforcement,' NUREG-0600, August 1979, at N-1-31.
Interview NRR Radiation Protection Personnel on
Licensee Radiation Protection Programs for Nuclear
Power Plants at 159-160.
12See, for example, NRC, "Standard Technical Specifications for Babcock and Wilcox Pressurized Water Reactors," NUREG-0103, Rev. 3, July 1979.
NRC, "Standard Review Plan for the Review of
Safety Analysis Reports for Nuclear Power Plants-LWR
Edition," NUREG-75/087, Rev. 1., sec. 11.2.
14k1., sec. 11.3.
15
NRC, 'Three Mile Island Station Unit 2 Environmental
Technical Specifications Appendix B," NUREG-0432,
February 8,1978.
*
As defined in Atomic Industrial Forum National
Environmental Studies Project Report AIF/NESP-016, "deminimus Concentration of Radionuclides in Solid Wastes,"
April 1978, "de minimus" refers to "concentration of pollutants that are present in so minute amounts ... as to berelatively harmless to man and his environment" at iii. An
effluent satisfying 'de minimus" should be acceptable for
disposal or release without any special precaution ormonitoring programs.
17
Met Ed Test Procedure TP 231/3, "Waste Gas
Disposal Functional Test".
18
Maintenance Requests at Three Mile Island Station.
1eNRC, "Investigation into the March 28, 1979 Three
Mile Island Accident by Office of Inspection and Enforcement,'
NUREG-0600, August 1979 at 11-1-28.
20
Faust, Frederick, Scheimann, Zewe dep., Exhibit 7.
21
Three Mile Island Nuclear Station Unit 1 and 2
Radioactive Effluent Release Report for January 1-June
30,1979.
1

439

22

Radiological Chronology of Events, Item 5.
Collins dep. at 85.
24
NRC, "Investigation into the March 28, 1979 Three
Mile Island Accident by Office of Inspection and Enforcement," NUREG-0600, August 1979 at 11-3-2.
25This is established by "Technical Staff Analysis
Report on Transport of Radioactivity from the TMI-2 Coreto the Environs" to President's Commission on the
Accident at Three Mile Island, H. Lawroski Technical
Assessment Task Force, October 1979, and TMI-2 Field
Questionnaires No. 763 and 776.
28
Primary Auxiliary Operator's Log-LWDS Panel,
March 28, 1979, at 2.
27
F. P. Cardile and R. R. Bellamy, Ed., NRC, "Calculation of Releases of Radioactive Materials in Gaseous andLiquid Effluents from Boiling Water Reactors (BWR-GALE
Code)," NUREG-0016, Rev. 1, January 1979.
28
Faust, Frederick, Scheimann, Zewe dep. at 54.
29
Id. at 34-36.
30
Met Ed, "Third Interim Report on the Three MileI sland Nuclear Station Unit 2 (TMI-2) Accident," July 16,
1979.
31
Pickard, Lowe, and Garrick, Inc., "Assessment ofOffsite Radiation Doses from the Three Mile Island Unit 2
Accident," TDR-TMI-116, Rev. 0, July 31, 1979 at 5-1 to
5-7.
32 Nuclear Consulting Services, Inc., "Analysis of theAdsorbers and Adsorbents from Three Mile Island Unit 2,"
NUCON 6MT611/09, June 11, 1979.
33
Memorandum from R. R. Bellamy, NRC, to F. Miraglia, "Telephone Conversation Regarding TMI Iodine
Species,"November 13,1979.
34
Nuclear Consulting Services, Inc., "Iodine-131 Removal Efficiency Determination of Adsorbent Samples,"NUCON
6MT611/12.
35
FAA data for Capital City Airport, New Cumberland,
Pennsylvania. On file at the National Climatic Center,
Federal Office Building, Asheville, North Carolipa.
3B
Memorandum from L. H. Barrett, NRC, to Distribution, "Preliminary Estimates of Radioactivity Releases
from Three Mile Island," April 12,1979 at 2.
37
Met Ed, 'Third Interim Report on the Three MileI sland Nuclear Station Unit 2 (TMI-2) Accident," July 16,
1979
at sec. IV.B.
38
Pickard, Lowe, and Garrick, Inc., "Assessment ofOffsite Radiation Doses from the Three Mile Island Unit 2
Accident," TDR-TMI-116, Rev. 0, July 31, 1979 at 4-1 to
4-11.
19- J. A. Auxier et al., "Report of the Task Group on
Health Physics and Dosimetry to President's Commission
on the Accident of Three Mile Island," October 1979 at
139-148.
4O
H. Lawroski, "Technical Staff Analysis Report on
Transport of Radioactivity from the TMI-2 core to theEnvirons to President's Commission on the Accident atThree Mile Island," October 1979 at 3-2.
41Id. at 2-1.
42
NRC, Regulatory Guide 1.52, "Design, Testing and
Maintenance Criteria for Engineered-Safety-Feature
23

Atmosphere Cleanup System Air Filtration and Adsorption
Units of Light-Water-Cooled Nuclear Power Plants."
43
Military Specification MIL-F-51068, "Filter, Particulate, High Efficiency, Fire Resistant."
44
Letter from M. F. Travieso; Diaz, Shaw, Pittman,
Potts, and Trowbridge, to G. T. Frampton, SIG, dated
August 10, 1979.
45
GPU Engineering change Memo ECM 5-5915, andRevision
1.
46
Collins dep. at 65-66, 90-91.
47
A. G. Evans and L. R. Jones, Savannah River
Laboratory, "Confinement of Airborne Radioactivity Progress Report: July-December 1973," DP-1355 at 7-14.
48
Collins deposition at 69-70.
49
American Association for Contamination Control,"Tentative Standard for High Efficiency Gas-Phase
Adsorber Cells," AACC: CS-8T, July 1972.
50
Letter from R. Skowronski, Mine Safety Appliances
Company, to V. Hawkins, Burns and Roe, Subject: Jersey Central Power and Light Three Mile Island Unit 2,
dated November 20,1973.
51
American National Standards Institute ANSI N5101975, "Testing of Nuclear Air Cleaning Systems."
52 Nuclear Consulting Services, Inc., "Summarized Post
Accident TMI Unit 2 HVAC Adsorber Systems Sample
Data, "NUCON 6MT 611/13, October, 1979.
53
Subject: TMI-2
Letter, J. Lee,
Containment Building Water Sample Analysis Results,
dated September 14,1979.
54Teledyne Isotopes, Metropolitan Edison Company
Radiological Environmental Monitoring Report, 1978
Annual Report, prepared for the Three Mile Island Nuclear
Station, at 3.
55
Id. at 4.
56
Id. at 17.
57
Porter dep. at 25.
58
Memorandum from O. D. T. Lynch, Jr., TMI SIG, toFiles, Task Group 3, TMI SIG, "Meeting with K. Woodward
and T. Potter, Pickard, Lowe, and Garrick (PL&G) on
PL&G Involvement in the TMI Accident Response," June
22, 1979.
59
Graber dep. at 16.
60
Id. at 70.
111
Id. at 44.
621. at 61.
63
0. at Exhibit 3004.
84
Id. at 66.
85
Region I Radiological Assistance Program (RAP)
Response to the Incident at Three Mile Island, March
28-April 18,1979. DOE, Brookhaven Area Office.
66
Miller, Kevin, M. et al., Radiation Measurements Foll owing the Three Mile Island Reactor Accident, EML-357,
Environmental Measurements Laboratory, New York, May
1979.
67
Department of Energy Radiological Response to theThree Mile Island Accident, April 14,1979.
68Memorandum, DOE Albuquerque Operations, Sandia
Area Office, Gil E. Cordova, to DOE Office of Nuclear
Energy Programs, Robert Ferguson. Subject: Assistanceprovided by Sandia Laboratories, dated May 24,1979.
69
Memorandum, DOE Chicago Operations, to DOE

Office of Nuclear Energy Programs, Robert Ferguson.
Subject: Assistance provided by Chicago Operations andcontractors, dated June 6, 1979.
70
Memorandum, DOE Idaho Operations Office, Charles
E. Williams to DOE Office of Nuclear Energy Programs,
Robert Ferguson. Subject: Assistance provided by DOE
Idaho Operations Office and contractors, dated May 25,
1979.
71
Memorandum, DOE Oak Ridge Operations Office,Joseph A. Lenhard, to DOE Office to Nuclear Energy Programs, Robert Ferguson. Subject: Assistance provided
by Oak Ridge Operations and Oak Ridge National
Laboratory,
dated May 25,1979.
72
Memoranda, DOE Savannah River Operations, N.
Stetson, to DOE Office of Nuclear Energy Programs,
Robert Ferguson. Subject: Assistance provided by
Savannah River Laboratory and Savannah River Plant of
E. I. duPont de Nemours and Company, dated May 25,
1979 and April 25, 1979.
73
Memorandum, DOE Division of Naval Reactors, H. G.
Rickover to DOE Office of Nuclear Energy Programs,
Robert Ferguson. Subject: Assistance provided by DOE
Division of Naval Reactors, Pittsburgh Naval Reactors
Office, Schenectady Naval Reactors Office, Bettis Atomic
Power Laboratory and the Knolls Atomic Power Laboratory, dated May 24, 1979.
74 Memorandum,DOE Office of Nuclear Waste
Management, Sheldon Meyers, to DOE Office of Nuclear
Energy Programs, Robert Ferguson. Subject: Assistanceprovided by Naval Research Laboratory, dated May 23,
1979.
75
NRC, "Investigation into the March 28, 1979 Three
Mile Island Accident by Office of Inspection and Enforcement," NUREG-0600, August 1979,11-3-80.
76
Pickard, Lowe, and Garrick, Inc., "Assessment ofOffsite Radiation Doses from the Three Mile Island Unit 2
Accident," TDR-TMI-116, Rev. 0, July 31, 1979, at Table
D-10.
77Letter from T. M. Gerusky, Bureau of Radiation Protection, to B. T. Lundin, Pres. Com., dated June
18,1979 at 4.
78
Id. at 6.
79 Statement of Erich Bretthauer, EPA, before theHouse Subcommittee on Science and Technology, Lancaster, Pa., June 2, 1979, at 1.
8
OMemorandum from Stohr to Grier, NRC, dated
August 10, 1979.
81
Ad Hoc Population Dose Assessment Group, "Population Dose and Health Impact of the Accident at theThree Mile Island Nuclear Station-A preliminary assessment of the period March 28 through April 7, 1979."
Washington, D.C.: U.S. GPO, May 10, 1979, at 14.
82
Bureau of Radiological Health, Food and Drug
Administration, "Three Mile Island Dosimetry Project,"
May 7, 1979, at 1.
83
Letter from J. C. Villforth, HEW, to E. W. Bretthauer,
USEPA, Subject: Monitoring Activities of the Department
of Health, Education, and Welfare in Support of the Three
Mile Island Nuclear Incident for the Period from March
28-April 15,1979," dated May 7, 1979.
84
Id. at Attachment I.
85
Memorandum from J. Watson, the White House, to"LongJ. Califano, J. Schlesinger, and D. Costle,440term Environmental Radiation Monitoring at Three Mile
Island," April 13,1979.
88
Letter from J. C. Villforth, HEW, to E. W. Bretthauer,
USEPA, Subject: Monitoring Activities of the Department
of Health, Education, and Welfare in Support of the Three
Mile Island Nuclear Incident for the Period from March
28-April 15,1979," dated May 7, 1979 at Attachment II.
87Id. atAttachment Ill.
88Statement of Erich Bretthauer, EPA, before theHouse Subcommittee on Science and Technology, Lancaster, Pa., June 2, 1979 at 1-2.
89Id. at
2.
90
EPA Report, EPA Monitoring After the Three MileI sland Reactor Incident, undated, at 6.
91
Statement of Erich Bretthauer, EPA, before theHouse Subcommittee on Science and Technology, Lancaster, Pa., June 2, 1979 at 3-4.
112
0. at 4.
93
EPA Report, EPA Monitoring After the Three MileI sland Reactor Incident, undated, at Appendix I.
94Id. at
6.
95Id. at
8.
96
"DOE Radiological Response to the Three MileI sland Accident, 14 April 1979," at 1.
97
Id. at 2.
98/d. at 4, 5.
99Letter from E. H. Eisenhauer, NBS, to L. K. Cohen,
NRC, Subject: Exposure of Thermoluminescence Dosimeters to Radiation," dated April 20, 1979.
100
NRC, "Investigation into the March 28, 1979 Three
Mile Island Accident by Office of Inspection and Enforcement," NUREG-0600, August 1979, Table II-C-4.
101Id. atTable II-C-1.
102
Brookhaven Area Office Communications Log,
Three Mile Island Nuclear Power Plant Accident, March
28,1979, page 4.
103
NRC, "Investigation into the March 28, 1979 Three
Mile Island Accident by Office of Inspection and Enforcement," NUREG-0600, August 1979, Table II-C-5.
104
Observation Center Command Post Log, OCL-0001,
at 36.
105
NRC, "Investigation into the March 28, 1979 Three
Mile Island Accident by Office of Inspection and Enforcement," NUREG-0600, August 1979, Table II-C-6.
106
0bservation Center Command Post Log, OCL-0001,
at 101.
107Id. at
184.
108
Emergency Control Log, TMI Unit 1, ECC-001,
entries for March 31, 1979.
108
Observation Center Command Post Log, OCL-0001,
at 223.
110Id. at
265.
111Id. at355.
112Id. at
358 and 360.
113Id. at
403.
n4Id. at432.
115Id. at478.
116
NRC, "Investigation into the March 28, 1979 Three
Mile Island Accident by Office of Inspection and Enforcement," NUREG-0600, August 1979, Table II-C-2.

Table II-C-3.
DOE Brookhaven National Laboratories TechnicalWork Record 12587 at 16.
119Id. at
3.
120
0bservation Center Command Post Log, OCL-0001,
at 244.
121
DOE Brookhaven National Laboratories TechnicalWork Record 12587 at 20 and 24.
122Id. at
32.
123Id. at
34.
124Id. at40.
125Miller, Kevin M., et al., Radiation Measurements Following the Three Mile Island Accident, EML-357, Environmental Measurements Laboratory, New York, Table I.
117Id. at
118

126

Observation Center Command Post Log, OCL-0001
at 443.
1270.
at 435.
128Id. at
472.
1290.
at 473.
130
DOE Brookhaven National Laboratories TechnicalWork Record 12587 at 55.
131
Summary Report of Radiological Assistance Team
Actions: Three Mile Island Accident (WAPD-RC/E(TR)160), Bettis Atomic Power Laboratories, June 25, 1979,
Attachment
III at 6,7.
132
Title 10, Code of Federal Regulations, Part 20,
Appendix B, Table 2 at 209.
133
Preliminary Notification (PNO-79-67-W), April 16,
1979 at 2.
134
Preliminary Notification (PNO-79-67X), April 17,
1979 at 2.
135
Letter from M. B. LeBoeuf, Radiological AssistanceTeam Actions, to Manager, Schenectady Naval Reactor
Office, Subject: Summary of Radiological AssistanceTeam Actions: Three Mile Island Incident," undated, atAttachment
II, Table III.
136
EPA Air Monitoring Data Sheets, EPA Environmental
Monitoring and Support Laboratory, Las Vegas, Nev.,
79/07/09; Harrisburg, Pa. Air Results.
137
1nterim Report on the Three Mile Island Nuclear Station Offsite Emergency Radiological Environmental Monitoring Program, PGC-TR-171, April 27,1979, p. 4.
138
Memorandum: J. C. Villforth, BRH, FDA, to R. Cotton, DREW, FDA, Subject: Summary and Update of HEW
Activities with Regard to Three Mile Island, dated July 19,
1979, at 8, Table 3.
139Id. at
4.
140
EPA Environmental Monitoring and Support Laboratory, Las Vegas, Nev., 79/07/09, Harrisburg, Pa. Milk
Results.
141
1 nterim Report on the Three Mile Island Nuclear Station Offsite Emergency Radiological Environmental Monitoring Program, PGC-TR-171, April 27,1979 at 2.
142
Title 10, Code of Federal Regulations, Part 20,
Appendix B, Table 2 at 209.
143
EPA Environmental Monitoring and Support Laboratory, Las Vegas, Nev., 79/07/09, Harrisburg, Pa. Water
Results.
144
Letter from M. B. LeBoeuf, Radiological AssistanceTeam Actions, to Manager, Schenectady Naval Reactor
Office, Subject: Summary of Radiological Assistance441

Team Actions: Three Mile Island Incident," undated, atAttachment II, Table III.
145Preliminary Notification (PNO-79-67T (Corrected)),April 13,1979 at 2.
1 46 Preliminary Notification (PNO-79-67X), April 17,
1979 at 3.
147Report of the Task Group on Health Physics andDosimetry to President's Commission on the Accident atThree Mile Island, October 1979, at 93.
'48/d. at 87.
149k1 at 91.
15OAd Hoc Population Dose Assessment Group,"Population Dose and Health Impact of the Accident at
the Three Mile Island Nuclear Station-A Preliminary
Assessment for the Period March 28 through April 7,
1979," Washington, D.C.: U.S. GPO, May 10, 1979, at
25-27.
151L. Battist, et al., "Population Dose and Health Impactof the Accident at the Three Mile Island Nuclear Station,"
NUREG-0558, May 10, 1979 at 12-48.
15214. at 37-39.
15314. at 41-43.
1540. Appendix B, at B-1-B-6.
155J. Auxier, et al., "Report of the Task Group on
Health Physics and Dosimetry to the President's Commission on the Accident at Three Mile Island," October 31,
1979, at 16-17.
15614. at 17.
157w. at 124-127.
158/d. Appendix D, at 139-147.
15Id. at 147.
160Pickard, Lowe and Garrick, Inc., "Assessment ofOffsite Radiation Doses from the Three Mile Island, Unit 2
Accident," TDR-TMI-116, Rev. 0, at 4-17, July 31,1979.
161Id. at 4-18.
162 Memorandum from R. E. Shipping, MPB, DEP,
Bureau of Radiological Health, to Files, "TMI Photographic
Film Dosimetry Project," June 26,1979.
163L. Battist, et al., "Population Dose of Health Impactof the Accident at the Three Mile Island Nuclear Station,"
NUREG-0558, May 10, 1979, at 44.
164J. Auxier, et al., "Report of the Task Group on
Health Physics and Dosimetry to the President's Commission on the Accident at Three Mile Island," October 31,
1979 at 119.
185L. Battist, et al., "Population Dose and Health Impactof the Accident at the Three Mile Island Nuclear Station,"
NUREG-0558, May 10, 1979 at 48.
1WJ. Auxier, et al., "Report of the Task Group on
Health Physics and Dosimetry to the President's Commission on the Accident at Three Mile Island," October 31,
1979 at 21-24.
167L. Battist, et al., "Population Dose and Health Impactof the Accident at the Three Mile Island Nuclear Station,"
NUREG-0558, May 10, 1979 at 72.
168J. Auxier, et al., "Report of the Task Group on
Health Physics and Dosimetry to the President's Commission on the Accident at Three Mile Island," October 31,
1979 at 20.
169C F R, Title 10 Part 20.101,1979.
170L. Battist, et al., "Population Dose and Health Impactof the Accident at the Three Mile Island Nuclear Station,"
NUREG-0558, May 10, 1979 at 66-70.
171NRC, "Investigation into the March 28, 1979 Three
Mile Island Accident, by Office of Inspection and Enforcement," NUREG-0600, August 1979, at II.B.2-3.
172Preliminary Notification (PNO-79-375A), August 30,
1979.
173NRC, "Investigation into the March 28, 1979 Three
Mile Island Accident, by Office of Inspection and Enforcement," NUREG-0600, August 1979, at 11-3-48.
174J. Auxier, et al., "Report of the Task Group on
Health Physics and Dosimetry to the President's Commission on the Accident at Three Mile Island," October 31,
1979 at 105.
175Letter from M. Diaz, Shaw, Pittman, Potts, &Trowbridge, to J. Dienelt, Brownstein, Zeidman and Shomer. Subject: Summary of Occupational Exposures ofWorkers at TMI, dated November 20, 1979.
176United Nations Scientific Committee on the Effectsof Atomic Radiation, (UNSCEAR), "Sources and Effects of
Ionizing Radiation," 1979, at 7.
1771d., at 8.
1781d
179HEW, Interagency Task Force on the Health Effectsof Ionizing Radiation, "Report of the Work Group on Science," June 1979, at 5.
18OUnited Nations Scientific Committee on the Effectsof Atomic Radiation, (UNSCEAR), "Sources and Effects of
Ionizing Radiation," 1979, at 5.
1 National Academy of Sciences, Advisory Committee
on the Biological Effects of Ionizing Radiations (BEIR I
Committee), "The Effects on Populations of Exposure to
Low Levels of Ionizing Radiation," 1972, at 174-177.
1 2National Academy of Sciences, Advisory Committee
on the Biological Effects of Ionizing Radiations (BEIR III
Committee), "The Effects on Populations of Exposure to
Low Levels of Ionizing Radiation," Draft Report, 1979, at
234.
163 United Nations Scientific Committee on the Effectsof Atomic Radiation, (UNSCEAR), "Sources and Effects of
Ionizing Radiation," 1979, at 413-414.
184National Academy of Sciences, Advisory Committee
on the Biological Effects of Ionizing Radiations (BEIR I
Committee), "The Effects on Populations of Exposure to
Low Levels of Ionizing Radiation," 1972,170-171.
National Academy of Sciences, Advisory Committee
on the Biological Effects of Ionizing Radiations (BEIR III
Committee), "The Effects on Populations of Exposure to
Low Levels of Ionizing Radiation," Draft Report, 1979, at
339.
186Some scientists hold a different view. For example,
see:
T. F. Mancuso, A. Stewart, and G. Kneale, "Radiation
Exposures of Hanford Workers Dying from Cancer andOther Causes," Health Physics 33, 369-384 (1977).
I. D. Bross, M. Ball, and S. Falen, "Dosage Response
Curves for the 1 rad Range; Adult Risks from Diagnostic
Radiation" American Journal of Public Health 69, No. 2,
February 1979.
187National Academy of Sciences, Advisory Committee
on the Biological Effects of Ionizing Radiations (BEIR I
Committee), "The Effects on Populations of Exposure to
Low Levels of Ionizing Radiation," 1972, at 88.
442

210

United Nations Scientific Committee on the Effectsof Atomic Radiation, (UNSCEAR), "Sources and Effects of
Ionizing Radiation," 1979, at 67.
United Nations Scientific Committee on the Effectsof Atomic Radiation, International Commission on Radiological Protection; National Council on Radiation Protection and Measurements; and Committee on Biological
Effects of Ionizing Radiation.
190
G. Casarett, et al., "Report of the Radiation Health
Effects Task Group to the President's Commission on the
Accident at Three Mile Island," October 31,1979, at 51.
191 United Nations Scientific Committee on the Effectsof Atomic Radiation, (UNSCEAR), "Sources and Effects of
Ionizing Radiation," 1979 at 432-433.
192
National Academy of Sciences, Advisory Committee
on the Biological Effects of Ionizing Radiations (BEIR I
Committee), "The Effects on Populations of Exposure to
Low Levels of Ionizing Radiation," 1972, at 59.
'93 United Nations Scientific Committee on the Effectsof Atomic Radiation, (UNSCEAR), "Sources and Effects of
Ionizing Radiation," 1979, at 435.

MRC, "Standard Review Plan for the Review of
Safety Analysis Reports for Nuclear Power Plants-LWR
Edition," NUREG-75/087, Chapters 12 & 13, Rev. 1.
2 1
t NRC, "Three Mile Island Nuclear Station, Unit 2
Technical Specifications App. A to License DPR-73," atSec.2126.11.
Met Ed, "Final Safety Analysis Report (FSAR) as
Amended, Three Mile Island Nuclear Station Unit 2."
NRC, "Safety Evaluation Report, TMI Nuclear Station
Unit 2," NUREG-0107, September 1976.
214 Interview transcript, "Meeting with NRR Radiation
Protection Personnel on Licensee Radiation Protection
Program for Nuclear Power Plants," October 19, 1979, at
18-25.
215
NRC, "Safety Evaluation Report, TMI Nuclear Station
Unit 2," NUREG-0107, at Sec. 12.1, September 1976.
M
id. at Sec. 12.3.
2 7 Interview transcript, "Meeting with NRR Radiation
Protection Personnel on Licensee Radiation Protection
Program for Nuclear Power Plants," October 19, 1979 at
155.
27
BNRC, "Investigation into the March 28, 1979 Three
Mile Island Accident by the Office of Inspection and
Enforcement," NUREG-0600, at 11-1-23, August 1979.
213

194

National Academy of Sciences, Advisory Committee
on the Biological Effects of Ionizing Radiations (BEIR I
Committee), "The Effects on Populations of Exposure to
Low Levels of Ionizing Radiation," 1972, at 57.
195
National Academy of Sciences, Advisory Committee
on the Biological Effects of Ionizing Radiations (BEIR III
Committee), "The Effects on Populations of Exposure to
Low Levels of Ionizing Radiation," Draft Report, 1979, at
7.
196Id. at
8.
197
United Nations Scientific Committee on the Effectsof Atomic Radiation, (UNSCEAR), "Sources and Effects ofI onizing Radiation," 1979, at 12.
18
U.S. Department of Health, Education, and Welfare,I nteragency Task Force on the Health Effects of Ionizing
Radiation, "Report of the Work Group on Exposure
Reduction," June 1979, at 36.
199
United Nations Scientific Committee on the Effectsof Atomic Radiation, (UNSCEAR), "Sources and Effects ofI onizing Radiation," 1979, at 11.
200
National Council on Radiation Protection and Measurements (NCRP), "Natural Background Radiation in the
United States," NCRP Report No. 45, 1975, at 108.
201
L. Battist, et al., "Population Dose and Health Impactof the Accident at the Three Mile Island Nuclear Station,"
NUREG-0558, May 10, 1979, at 55.
202
Id. at 55.
203B Shlein, et al., "The Mean Active Bone Marrow
Dose to the Adult Population of the United States from
Diagnostic Radiology," FDA 77-8013,1977, at 12.

NRC, "Safety Evaluation Report, TMI Nuclear Station
Unit 2," NUREG-0107, at Sec. 6.4.1, September 1976.
220
McGovem Interview, May 18, 1979 at 18.
221
NRC, "Safety Evaluation Report, TMI Nuclear Station
Unit2222," NUREG-0107, at Sec. 12.4, September 3,1976.
Appendix 11.6, item 31.
223Id.
at items 48 and 49.
224
Dubiel dep. at 51-52.
225
NRC, "Investigation into the March 28, 1979 Three
Mile Island Accident by the Office of Inspection and
Enforcement," NUREG-0600, at II-1-1 and 11-1-2, August
1979.
226
lnterview Transcript, "Meeting with NRC Regional
I nspectors to Discuss Licensee Radiation Protection Programs for Nuclear Power Plants," September 25,1979, at
103-104.
227
Janouski dep. at 123.
219

228

204

HEW, "Gonad Doses and Genetically Significant
Dose from Diagnostic Radiology U.S., 1964 and 1970,"
FDA 76-8034,1976, at 21.
205

American Cancer Society, "Cancer Facts and Figures 1979," 1979, at 14.
Id. at 10.
207k1. at 12.

206

208k1. at 14.

G. Casarett, et al., "Report of the Radiation Health
Effects Task Group to the President's Commission on the
Accident at Three Mile Island," October 31, 1979, at 7-12.
209

443

Met Ed, "Final Safety Analysis Report (FSAR) as
Amended, Three Mile Island Nuclear Station Unit 2," atSec. 13.
229
Technical Specifications at Sec. 6.3.
230
Dubiel dep. at Exhibit 3045.
231
Met Ed, "Final Safety Analysis Report (FSAR) as
Amended, Three Mile Island Nuclear Station Unit 2," atSec. 13.1.3.1.15.
232
Mulleavy dep. at 8-13.
233
E. L. Murri and S. F. LaVie, "General Review of the
Health Physics Program at TMI," NUS-3364, at 2-1 and
2-3, March 20, 1979.
234
Met Ed, "Final Safety Analysis Report (FSAR) as
amended, Three Mile Island Nuclear Station Unit 2," atSec. 13.1.3.1.14.
235
Met Ed, "Final Safety Analysis Report (FSAR) as
Amended, Three Mile Island Nuclear Station Unit 2," at13.1.3.1.16.
236
NRC, "Investigation into the March 28, 1979 Three
Mile Island Accident at the Office of Inspection and
Enforcement," NUREG-0600, at 11.1-4, August 1979.

275

237

E.L. Murri and S.F. LaVie, "General Review of the
Health Physics Program at TMI," NUS-3364, at 2-2,
March 20,1979.
238!d. at 4-2.
239
Dubiel dep. at 208-209.
240
Velez interview, April 24, 1979, at 20-21.
241
Mulleavy dep. at 232.
242
Velez dep. at 64.
2'Dubiel dep. at 209.
244
Velez Interview, April 24, 1979, at 23.
245
Eigenrider Interview, May 9, 1979, at 15-16.
246
Velez Interview, April 24, 1979, at 33.
247
Janouski Interview, June 28,1979 at 11.
248
E.L. Murri and S. F. LaVie, "General Review of the
Health Physics Program at TMI," NUS-3364, at 4-2,
March 20, 1979.
249
Eigenrider Interview, May 9,1979, at 29-33.
25
ODubiel dep. at 229.
251
Janouski dep. at 106.
252
Eigenrider Interview, May 9,1979, at 7-9, 45.
253
Dubiel dep. at 200, 202, 206.
264
NRC, "investigation into the March 28, 1979 Three
Mile Island Accident by the Office of Inspection and
Enforcement," NUREG-0600, at 11-2-14, August 1979.
255
Dubiel dep. at 91.
256
Dubiel Interviews, May 22, 1979, at 18, 32 (tape251) and 21 (tape 252).
257
Janouski dep. at 25, 52.
2,5' Neely Interview May 2,1979 at 42-47.
259
NRC, "Investigation into the March 28, 1979 Three
Mile Island Accident by the Office of Inspection and
Enforcement," NUREG-0600, at 11-3-70, August 1979.
260!d. at 11-3-30 to 11-3-67.
261
Met. Ed., "Station Health Physics Procedure 1670.
11," Rev.O, dated January 16, 1978, Sec. 2.5.2.1, page 5.0.
262
Metropolitan Edison, "Three Mile Island Nuclear
Station Health Physics Procedure 1670.6, Volume I.
Emergency Plans and Procedures Off-Site Radiological
Monitoring," Rev. 2, Jan. 16,1978.
263
Velez Interview, April 24, 1979, at 14.
264
McCann Interview, May 3, 1979, at 17-18.
265
1-each Interview, May 3, 1979, at 17-18.
266
Velez dep. at 20-35.
267
NRC, "Safety Evaluation Report, TMI Nuclear Station Unit 2," NUREG-0107, at Sec. 13.2, September 1976.
268
Zechman dep. at 42.
269
Metropolitan Edison, "Three Mile Island Nuclear
Station, Station Health Physics Procedure 1690, Training
Requirements," Rev. 6, March 22,1978.
270
Janouski dep. at 82-85.
271

Velez dep. at

272

Dubiel dep. at 219-220.
Mulleavy dep. at 228-229.
277
Janouski dep. at 88-90.
278
Eigenrider interview, May 9,1979, at 5.
279
1 E I nspection Procedure 837408,
280 Met Ed, "Final Safety Analysis Report (FSAR) as
Amended, Three Mile Island Nuclear Station Unit 1,"
Docket 50-289, Sec. 11.4.
281
Met Ed, "Final Safety Analysis Report (FSAR) as
Amended, Three Mile Island Nuclear Station Unit 2," Sec.
11.4,12.1.4.
282
NRC, "Safety Evaluation Report, TMI Nuclear Station Unit 2," NUREG-0107, September 30, 1976, at 12-2.
283
Met Ed, "Final Safety Analysis Report (FSAR) as
Amended, Three Mile Island Nuclear Station Unit 1,"
Docket 50-289, Sec. 11.4.2.
284
NRC, "Investigation into the March 28, 1979 Three
Mile Island Accident by the Office of Inspection and
Enforcement,"
NUREG-0600, at 11-1-22, August 1979.
285
Met Ed, "Final Safety Analysis Report (FSAR) as
Amended, Three Mile Island Nuclear Station Unit 1,"
Docket 50-289, Figure 11-8.
276

286

Met Ed, "Final Safety Analysis Report (FSAR) as
Amended, Three Mile Island Nuclear Station Unit 2," Table
12.1-5.
287
Met Ed, "Final Safety Analysis Report (FSAR) as
Amended, Three Mile Island Nuclear Station Unit 2," Sec.
12.1.4.
288
Victoreen Instrument Division Calibration Sheets,
dated December 10, 1975.
289
Met Ed, "Final Safety Analysis Report (FSAR) as
Amended, Three Mile Island Nuclear Station Unit 1,"
Docket 50-289, Sec. 11.4.3.
290
Met Ed, "Final Safety Analysis Report (FSAR) as
Amended, Three Mile Island Nuclear Station Unit 2," Sec.
12.2.4.1.
291
Met Ed, "Final Safety Analysis Report (FSAR) as
Amended, Three Mile Island Nuclear Station Unit 2," Table
12.2-2.
292
Met Ed, "Final Safety Analysis Report (FSAR) as
Amended, Three Mile Island Nuclear Station Unit 1,"
Docket 50-289, Sec. 11.4.
293
Met Ed, "Final Safety Analysis Report (FSAR) as
Amended, Three Mile Island Nuclear Station Unit 2," Table
11.4-1.
294
Met Ed, "Final Safety Analysis Report (FSAR) as
Amended, Three Mile Island Nuclear Station Unit 2," Sec.
11.1.2.1.
295
NRC, "Safety Evaluation Report, TMI Nuclear Station Unit 2," NUREG-0107, at Sec. 12.4, September 1976.
296
Met Ed, "Final Safety Analysis Report (FSAR) as
Amended, Three Mile Island Nuclear Station Unit 2," Table
12.4-1.
297
NRC, "Investigation into the March 28, 1979 Three
Mile Island Accident by the Office of Inspection and
Enforcement," NUREG-0600, at 11-1-34, August 1979.
298
Review of Calibration Log, TMI, 0752.
2 9Velez dep. at 64.
30
OMulleavy dep. at 195.
3
Eigenrider Interview, May 9, 1979, at 9-11, 16 (tape180).

74-77.

NRC, "Investigation into the March 28, 1979 Three
Mile Island Accident by the Office of Inspection and
Enforcement," NUREG-0600, at 11-1-16,17, August 1979.
273

Dubiel dep. at

274

214.

E.L. Murri and S.F. LaVie, "General Review of the
Health Physics Program at TMI," NUS-3364, March 20,
1979, at 3-1.
444

Id. at 2-1.
Id. at 2-5.
326
Id. at 2-2.
324

302

NRC, "Investigation into the March 28, 1979 Three
Mile Island Accident by the Office of Inspection and
Enforcement," NUREG-0600, at 11-1-35, August 1979.
303
Metropolitan Edison TMINS Forms 1616-1.
304
NRC, "Investigation into the March 28, 1979 Three
Mile Island Accident by the Office of Inspection and
Enforcement," NUREG-0600, at 11-1-40, August 1979.
305
14. at 11-3-56.
306
1E Health Physics Shift Log, TMI-2 Accident, Entryof 0430, April 7,1979.
307
Memorandum from G. H. Smith, TMI, to Met Ed,
TMI-2, "Restrictions on the Use of Masks with MSA
88182 Cartridges During Decontamination of the
Auxiliary/Fuel Handling Buildings," April 30, 1979.
308"Procedure for the Use of Respirators in Iodine
Atmosphere (SOP 29-073, May 6, 1979)," May 4, 1979,
2100, approved by J. Collins, May 5, 1979.
309
NRC, "Investigation into the March 28, 1979 Three
Mile Island Accident by the Office of Inspection and
Enforcement," NUREG-0600, at 11-1-41, August 1979.
310
Rider Interview, May 3, 1979, at 14.
311
Janouski Interview, May 2,1979, at 26 (tape 100).
312
Met Ed, "Final Safety Analysis Report (FSAR) as
Amended, Three Mile Island Nuclear Station Unit 2," Sec.
12.3.3.
313NRC, "Safety Evaluation Report, TMI Nuclear Station
Unit 2," NUREG-0107, at Sec. 12.4, September 1976.
314Met Ed., "Three Mile Island Nuclear Station, Health
Physics Procedure 1640, Personnel Dosimetry, Issuance,
Administration and Record Keeping," Rev. 0, June 15,
1977.
315
T. Potter and D. Reppert, "Evaluation of the Health
Physics/Chemistry Organization at the Three Mile Island
Nuclear Station 1 and 2, undated at 3.
316 E. L. Murri and S. F. LaVie, "General Review of the
Health Physics Program at TMI," NUS-3364, at 5-3,
March
20, 1979.
317
Mulleavy dep. at 194-196.
318
NRC, "Investigation into the March 28, 1979, Three
Mile Island Accident by the Office of Inspection and
Enforcement," NUREG-0600, at 11-3-60, August 1979.
M
S. F. LaVie, "Evaluation of the Calibration Status of
the Thermoluminescent Dosimeter Readers at Three Mile
Island Nuclear Station Between 2/28/79 and 7/2/79,"
July320
12, 1979, Sec. 2.3.5.
Donnachie Interview, May 17, 1979, at 16-17.

325
327
328

329

!d. at 2-3.
Id. at 2-4.

33o

Id. at 2-5, 6.

ld. at 2-7.
331
Id. at 3-1.

Id. at 3-2.
' 33/d. at 4-1.
334
Id. at 4-2.
335
Id. at 4-3.
336
Id. at 5-1.
337
Id. at 5-2.
332

/d. at 6-2.
Dubiel dep. at 171.
340
Dubiel dep. at
170-78, 187-89, Limroth dep. at
127-29, Mulleavy dep. at 158-80.
341
NRC. "Draft Report to the Director, Office of Inspection and Enforcement on Lessons Learned from Three
Mile Island," NUREG-0616, Appendix D, October 1979.
342
Letter from V. Stello, NRC to R. C. Arnold, Met Ed.,
Subject: Investigation Report Number 50-320/79-10,
dated October 25, 1979.
343
NRC. "Investigation into the March 28, 1979 Three
Mile Island Accident by the Office of Inspection and
Enforcement," NUREG-0600, at 11-1-4, August 1979.
344
Id. at 11-1-36.
345
Id. at 11-1-38.
348
l nterview Transcript, "Meeting with NRR Radiation
Protection Personnel on Licensee Radiation Protection
Program for Nuclear Power Plants," October 19, 1979 at
19-33.
347
Velez dep. at 64.
348
14. at 64.
349
Id. at 91.
350
Mulleavy dep. at 232.
351
Dubiel dep. at 211.
338

339

352

Id. at 52.
MuIIeavy dep. at 166-170.
354
Limroth dep. at 139-141.
355
Id. at 137.
353

356

Letter from V. Stello, NRC, to R. Arnold, Met Ed,
Subject: Investigation Report Number 50-320/79-10,
dated October 25,1979.
357 Interview Transcript, "Meeting with NRC Regional
I nspectors," September 25-26,1979.
358
interview Transcript, "Meeting with NRR Radiation
Protection Personnel on Licensee Radiation Protection
Program for Nuclear Power Plants," October 19, 1979.

321

Met Ed., "Internal Audit Report 78-07," April 28,
1978, at 2.
322 Thomas Potter and Donald H. Reppert, "Evaluationof the Health Physics/Chemistry Organization at theThree Mile Island Nuclear Station Units 1 and 2," undated.
323E. L. Murri and S. F. LaVie, "General Review of the
Health Physics Program at TMI," NUS-3364, March 20,
1979.

445

C PLANT BEHAVIOR AND
CORE DAMAGE
1. DEFICIENCIES IN THE PLANT AND THEIRI NFLUENCE ON THE ACCIDENT

deficiencies can be considered the result of a single,
more fundamental cause. In the sections below, thespecific deficiency notes this connection, when appropriate. However, because of their importance,
two general concerns merit special attention here.

a. Introduction and Summary
At the time of the TMI-2 accident, certain conditions existed within the plant that, in retrospect,
have been suggested as deficiencies contributing to
the accident or preventing its prompt termination.
The results of our evaluation of the suggested deficiencies are compiled in this section; findings regarding the significance of each possible deficiency
and recommendations resulting from these findings
are also included.
Approximately 30 items are grouped into three
general sections according to particular plant systems. Those possible deficiencies dealing with aspects of the primary reactor coolant system are included in Section ILC.1.b, engineered safety features
i n Section II.C.1.c, secondary coolant system in Section Il.C.1.d. Additionally, a discussion of the qualfication and use of instrumentation in the accident is
i ncluded in Section II.C.1.e.

General Recommendation 1. Definition andConsideration of Design Basis Events and Accidents

The design basis for nuclear powerplants has
been developed and implemented with a widely held
judgment that this basis encompassed those eventsof primary importance in protecting the safety of the
public. Because of this judgment, balance in theconsideration of different types of accidents swung
markedly toward one type (the large break loss-ofcoolant accident), while other types received relatively little (if any) attention. Prior reports andevents notwithstanding, this lack of balanceremained steadfast until the events of March 28.
Some of the deficiencies discussed below point
to the lack of balance present in the regulatory process prior to the TMI-2 accident. Issues such as
the sensitivity of the Babcock & Wilcox (B&W) nuclear steam supply system, the design of the pressurizer and related equipment such as the pilotoperated relief valve (PORV), the radiological designof vital equipment, the isolation characteristics ofthe reactor building, and the actuation and control ofGeneral Recommendations

I n a number of instances, the findings regarding
specific deficiencies are symptomatic of problems ofa more general nature; that is, a number of specific447

the emergency feedwater system, among others,
are indicative of this problem.
For specific issues such as those mentioned
above, specific recommendations are derived.
These recommendations indicate the need for reexamination of such issues as the frequency of use of
the PORV in B&W plants, qualification of the reactor
coolant system pressure control system, the importance of steam generators and related equipment
during certain accident conditions, and the capability
for hydrogen removal from the reactor building.
Addressing and resolving such relatively narrowi ssues individually could be expected to improve thesafety of nuclear powerplants to some extent.
However, such a piecemeal approach would not
resolve the more fundamental cause of these concerns and, as such, would not provide the magnitude of safety improvement that the TMI-2 accident
indicates is needed. The achievement of the lattergoal requires a new balance in the regulatory process. A systematic, integrated approach to theexamination of a variety of accidents and thei nterrelationships within and among these accidents
is clearly a necessity.
The results of the evaluations of possible deficiencies lead us to the general recommendation
that: Reconsideration of the required "design basis"for nuclear power plants should be initiated immediately. Among the areas that must be reconsidered
are:General Recommendation 2. Use of Human Factors
Principles and Disciplines in the Design andOperation of Nuclear Powerplants
The lack of balance in the regulatory process has
resulted in a second, equally significant shortcomingof which particular suggested deficiencies discussed below are indicative. Issues such as the capability for bypass of engineered safety feature
equipment and the sensitivity of the B&W nuclear
steam supply system suggest the lack of proper
evaluation of human factors during the design,
licensing, and operation of TMI-2. The extent towhich human factors considerations have been included in the design and operation of nuclear powerplants would, of course, be expected to vary fromplant to plant. However, the paucity of such considerations in the particular case of TMI-2 clearly indicates that proper consideration has by no means
been ensured. The conclusions reached in thissection regarding the lack of proper human factors
evaluations are in agreement with those of Section
ILE, which specifically deals with human factors considerations in the design and operation of TMI-2.
For this reason, the general conclusion of Section
ILE is repeated here:Thus, we conclude that the integration of humanfactors principles and disciplines into all facets ofthe design, construction, operation, maintenance,
testing, and regulation of nuclear powerplants will
significantly improve nuclear safety.

• the level of safety that must be achieved by theplants;• the types of accidents for which the plants are

b. Possible Deficiencies Related to thePrimary Systemdesigned (such as small and large loss-ofcoolant accidents (LOCAs), total loss of ac
power, loss of main and auxiliary feedwater,
anticipated transients without scram (ATWS);

Sensitivity of the B&W Nuclear Steam Supply
System• the method by which the "design basis" is established (i.e., by the single failure criterion, qualitative and quantitative risk assessment);

Since the TMI-2 accident, the vulnerability of the
B&W nuclear steam supply system relative to otherpressurized water reactor designs has been thesubject of considerable discussion because of thedifferences in the operational responsiveness of thedesigns. A number of features of the B&W design
have been suggested as contributors to this apparently greater vulnerability. These features are
discussed individually in the sections below; the final
section then integrates the individual evaluations
i nto overall conclusions on the design's vulnerability.

• the criteria for the determination of "safetygrade" equipment, including both the determination of the equipment to be so qualified and theactual standards to which this equipment should
be qualified; and• the magnitude of the accident, including but notlimited to the severity of fuel damage and coredisruption, the magnitude of release of radioactive material, and the magnitude of hydrogen generation.

448

cally) in the belief that less, not more, water needed
to be added to the primary system. Although they
did not realize it, the stuck-open relief valve in the
top of the pressurizer was permitting coolant to flow
through the pressurizer and out of the system.
The first potential concern evaluated here is thatthe volume of the TMI-2 pressurizer might be relatively small compared to other pressurized water
reactors of comparable power. The specific concern in this instance is that a smaller volume would
result in greater changes in level in the TMI-2 pressurizer for any particular transient in the reactor.
Because the rapid rise in pressurizer level early in
the TMI-2 accident apparently contributed to theconfusion experienced by the operating crew, wemust consider the possibility that a relatively smallpressurizer volume was a design deficiency contributing to this accident.
An examination has been made of the volume ofthe pressurizers of a number of nuclear plants, thedetails of which may be seen in Table 11-40. This
examination indicates that the pressurizer volume in
TMI-2 is comparable to that in other plants.
A number of operational events have occurred in
B&W plants involving loss of pressurizer level indication in both the high and low directions. These
events, which are shown in Table 11-41, may be construed to imply that the pressurizer volume is insufficient to accommodate certain transient events.
However, consideration of the causes of these
operational events suggests that the pressurizer
volume is not directly the problem. Rather, it appears that the plant sensitivity to secondary sidetransients is the basic problem; that is, a sensitivity
to the amount of heat removal through the steam
generators and to the rapidity of the changes inheat removal capability during transient events.
This sensitivity is discussed in more detail below.

Pressurizer Size
The pressurizer is a steel cylinder with hemispheres welded on either end that is attached to thereactor coolant system by a pipe, as shown in Figure II-22. 1 The purpose of the pressurizer is tomaintain system pressure and to absorb system
volume changes during transients. Heaters near thebottom of the pressurizer heat the water so that asteam bubble is maintained in the top of the vessel.
This bubble serves as a cushion. The cushion canbe enlarged by additional heating, forcing water outof the pressurizer and back into the reactor coolant
system and thus increasing system pressure. By
cooling the pressurizer water, the bubble is shrunk,
decreasing system pressure.
The pressurizer also has a level indicator showi ng the level of water in the pressurizer; that is, thel evel of the boundary between the water and the
bubble. Operators commonly use the pressurizer
water level indicator to tell them about water level inthe entire primary system; if there is some level indication in the pressurizer, the rest of the systemshould be full of coolant under normal circumstances; if the pressurizer level disappears(goes to zero), there may be no certain way of telli ng how much water is in the system or even if thereactor core is covered with coolant water.
Pressurizer level can respond in a number ofways during transient conditions (such as reactor
trips and accidents). During the initial phase of theTMI-2 accident for example, the level first moved
upward, then downward, and then upward again.
The first upward movement was in response to the"bottling up" of heat in the reactor. As temperature
climbed in the reactor, the water expanded and increased the level in the pressurizer. The level thenmoved downward, when the reactor "scrammed"
and reduced the generation of heat by over 90%,thus causing the reactor coolant to shrink, and temperature and pressure to reduce sharply. When theoperators observed the decreasing level, they
responded immediately by stopping the normal "letdown" flow of water out of the reactor and increasi ng the "makeup" flow of water into the reactor
coolant system. The level moved upward again (asthe operators expected), but then something highly
unusual happened. The level did not stop going up,
but continued until it indicated to the operators-thatthe pressurizer was completely full of water. It wasat this point that operators throttled the high pressure injection system (which had come on automati-

Steam Generator Secondary Side Coolant Inventory
The design of the B&W pressurized water reactor(PWR) includes steam generators that are considerably smaller (in terms of secondary side water inventory) than Westinghouse or Combustion Engineering PWRs, as may be seen in Table 11-42. In
the event of an interruption of feedwater to thesteam generators, as occurred at the beginning of
the TMI-2 accident, the smaller size in the B&W
design results in a more rapid drying out of thesecondary side; this then results in a more rapid

449

FIGURE 11-22. Pressurizer Surge Line Loop Seal Arrangement450

TABLE 11-40. Pressurizer sizing
Plant

Vendor

ThermalPower (MW)Pressurizer
Volume (ft 3)

B&W

25684

15005

B&W

TMI-2

OconeeSan Onofre 2&3

CECE

St. Lucie

Surry

W

SequoyahW2772 2

Ratio: Pressurizer Volume (ft 3 )to Thermal Power (MW)

15003

33906

0.54
0.58

1500

25608

0.44

15009

2441 10

1300

3411 12

0.58

11

0.53

180013

0.53

TABLE 11-41. Instances of loss of pressurizer level in B&W plants

Plant

'

Date

Davis Besse

11/29/77

Rancho Seco

3/20/78

Davis Besse
TMI-2
TMI-2
TMI-2
TMI-2

Direction of
Level Losses
High
Low

9/14/77

X

3/29/78

X

4/23/78

11/07/78

3/28/79

Cause

X

Loss of ac power

X

Electrical malfunction-ICS

X

Main steam safety valves fail open

X

X

14.15

Loss of feedwater-stuck-open PORVBus failure-stuck-open PORV
Loss of feedwater

Loss of feedwater-stuck-open PORVTABLE 11-42. Steam generator secondary side coolant
i nventories for various pressurized water reactors

Total Steam Generator
Secondary Side
Coolant Inventory( Approximate)

Designer

Power (MW)

TMI-2

B&W

2772 2

Calvert Cliffs

CE2560 1 8430000 Ib 1 92441 10261000lb

Plant

OconeeSt. Lucie
Surry

Sequoyah

B&W
CE
W
W

2568 42560 83411 1 2451

1100001b

16

110000lb 17440000 1b 20
376000lb

21

22k)ss of heat removal from the primary coolant, causi ng its temperature and pressure to increase more
quickly.
A second design feature of the B&W steam generators also contributes to the more rapid heatup of
the primary coolant. In these steam generators, asignificant fraction of the area for heat transfer isused in increasing the quality of the exiting steam
by film boiling heat transfer. Thus lower portions of
the steam generator tubes are experiencing nucleate boiling while upper regions are experiencing
film boiling. Heat transfer coefficients in a region offilm boiling are significantly less than those in a region of nucleate boiling, so that a rapid change inwater level results in a rapid change in the mechanism of heat transfer and a correspondingly rapidchange in the amount of heat removal actually accomplished. Such rapid changes can occur whensecondary side water levels are affected by transients such as the loss of the main feedwater
pumps experienced at the beginning of the TMI-2
accident. As the water level decreases, theuncovered tubes experience a change from
nucleate to film boiling, reducing rapidly the heattransfer in that region. This then reduces the totalheat removal achieved from the primary coolant.
The fast response of the B&W steam generators
is a favorable feature in the context of plant generation of electricity. However, in the context of reactor safety, the faster response to abnormal transients (than experienced in other PWR designs) requires more rapid attention and intervention by theoperating crew and/or automatic controls toprevent or minimize the effects on the reactor
coolant system. Ed Frederick, a control room
operator who was manipulating the makeup andhigh pressure injection controls in the TMI-2 control
room during the initial stages of the TMI-2 accident,
has testified:
Specifically on the pressurizer, you often find yourself working very hard to maintain yourself withinthose limits, even on a simple reactor trip. It willtake several manual actions to maintain, for

TABLE 11-43. Operating experience with PORV'Per reactor year452

instance, the minimum 100-inch figure for keeping
the heaters covered. Much of the reactor trip procedure is devoted to pressurizer level control, so I
can't really think of anywhere that we purposely
ignore this or try to exceed it and/or let it beexceeded because they are so important to theplant pressure control.
Q: So you obviously ... are concerned with pressurizer level not going down:
23
A: Right.

Because of this need for rapid operator action,
we consider the B&W design to be fundamentallymore susceptible to human errors than other PWR
designs.
Use of the Pilot-Operated Relief Valve (PORVJ

I n the B&W pressurized water reactor design, the
PORV at the top of the pressurizer is used routinely
during transient events. When a transient event
causes the reactor coolant system pressure to increase, the PORV is designed to open in an attempt
to compensate for the increase. Because of thisdesign feature, the PORV is used about five times ayear in each B&W plant (see Table 11-43). In contrast, the Combustion Engineering (CE) and Westi nghouse PWR designs do not routinely use thepressurizer PORV. Data shown in Table 11-43 i ndicate that the frequency of use of the PORV is significantly less (a factor of 10 or more) than in the B&W
design.
Data assembled in Table 11-43 indicate the frequency of PORV failures to reclose for plants
designed by each of the PWR vendors. For the
B&W-designed plants, the frequency of experiencing
a stuck-open PORV is estimated to be about 0.1 to
0.3 per reactor year, depending on the inclusion or
exclusion of events occurring while the plants were
not in power operation. In plants designed by
Combustion Engineering, only one instance of a
PORV failing to reclose has been discovered; thisevent occurred while the26,28
plant (Palisades) was at
hot shutdown conditions.
If one assumes that

this event is relevant, then the frequency of such
events in CE plants is estimated to be about 0.03
per reactor year. In plants designed by Westinghouse, one instance of a PORV failing to reclose
has been noted. This event occurred in the NOK-1
plant in Beznau, Switzerland, 29 while the plant was
i n power operation. As Table 11-43 indicates, thefrequency of experiencing a PORV failing to reclose
i n Westinghouse plants is about 0.007 per reactor
year.
Data collected in the reactor safety study on
the probability of a pipe break comparable to thesize of a PORV opening indicates that this probability has a median value of about 0.001 per reactor
year. Because this value is less than that estimatedfor the failure of a PORV to reclose, one can conclude that such PORV failures can be major contributors to the likelihood of PWRs experiencing
small-break loss-of-coolant accidents. The data in
Table 11-43 indicate that B&W plants are particularly
susceptible to this problem.
Since B&W plants appear to be particularly
vulnerable, the question arises regarding the reason.
A comparison of the ratio of the number of PORVs
failing to reclose during power operation to thenumber of PORV openings shows that this ratio isessentially the same for Westinghouse and B&W
plants (no data exist in this case for CE plants). The
greater vulnerability of B&W plants is due to significantly greater use of (or demand upon) the PORV.
It is the particular design and operational characteristics of the B&W plants that, by requiring more
frequent reliance on the PORV, result in the significantly greater susceptibility of these plants to smalll oss-of-coolant accidents as the result of the sticki ng open of this valve.
Unlike a small loss-of-coolant accident resulting
from a pipe break, such an accident resulting from astuck-open PORV can be mitigated by use of the
PORV block valve. Thus, operator intervention toclose the block valve reduces, in effect, the likelihood of experiencing a serious, prolonged loss of
coolant. The experience in TMI-2, however, suggests that operator intervention cannot be overly reli ed upon.
I n summary, because of the frequent use in B&W
plants of the pressurizer PORV in mitigating various
normal transients, the likelihood of experiencing astuck-open valve is significantly higher in B&W
plants than in other PWRs. Because a stuck-openpressurizer PORV can be equivalent in consequence to a small loss-of-coolant accident (LOCA)
and can occur more frequently than other types ofsmall LOCAs, we conclude that prior to the TMI-2
accident the likelihood of a small LOCA (as theresult of a stuck-open PORV) was significantly

greater in B&W plants than in Combustion Engineeri ng and Westinghouse plants. (Actions taken since
the accident by NRC and the B&W utility owners
have reduced this frequency significantly.)
Lack of Anticipatory Reactor Trip

At the time of the accident at TMI-2 (like the incidents at other B&W plants) there were no provisions to cause the reactor to shut down automatically in response to a total loss of feedwater or aturbine trip. Instead, the integrated control system(I CS) was designed so that reactor power would automatically be run back in the expectation that thepressure increase caused by the loss of heat removal through the feedwater system would be mitigated by the opening of the PORV. The designers intended, through this combination of reduction in
power and operation of the PORV, to keep the primary system pressure below the "high pressure"safety limit at which the reactor automaticallytripped off, thus avoiding undesirable downtime.
I n contrast, had the reactor automatically
scrammed by an anticipatory trip when the turbine
tripped, there would have been a sharp decrease in
the amount of heat being added to the primary system, and the pressure might not have increased
enough to cause the PORV to open, thus preventing
the accident. An anticipatory reactor trip following
turbine trip requires a turbine steam stop valve closure or generator breaker open signal to the reactor
protection system for a near simultaneous reactor
trip. The anticipatory trip prevents, in most instances, the opening of the PORV and negates control rod runback, which is a feature of the B&W ICS.
Automatic reactor trip under these conditions
was not required by NRC regulations. Some othervendors-GE and Westinghouse-voluntarily provided for these "anticipatory trips" in their designs.
The NRC management had decided that such control systems32 and anticipatory trips fell outside of
the scope of the NRC staff review; therefore, thestaff had never performed a safety analysis todetermine the significance of anticipatory reactor
trips in dealing with various kinds of abnormal
events in the plant.
Of particular interest in this section is the effectof anticipatory trip on the overall responsiveness of
the TMI-2 plant. The influence of the lack of such a
feature is to decrease the time available to theoperating crew to cope with the event. The delay ofreactor trip causes the input of a significant amountof energy into the reactor coolant system abovethat which would have been input had the reactor
been tripped immediately. In transient events where
the normal cooling path is interrupted (e.g., when the453be analyzed. Implementation of the best available
solution should then be undertaken.
The analysis of methods to reduce the frequency
of PORV use should be undertaken as one part of asystematic evaluation of the potential safety implications of the sensitivity of B&W plants to transient
events. This more general evaluation should consider, for example, the implications of loss of pressurizer level indication (in the low and high directions) and of frequency of actuation of engineered
safety features, as well as the frequency of PORV
use noted above.
The failure to recognize this particular concern
before the TMI-2 accident can be attributed to themore general lack of adequate consideration oftransient-initiated accidents. The findings andrecommendations discussed here are indicative ofthe lack of balance exhibited in the licensing process. The analysis and resulting plant modifications
recommended here should therefore be consideredand pursued with general recommendation 1 in Section II.C.1.a clearly in mind. Although this concern
appears to be more significant for B&W plants, similar evaluations should be made of the other LWR
designs.
Because of the greater sensitivity of B&W plants
to human errors during transient events, proper human factors evaluation of the human factors in surveillance procedures, emergency procedures, andsystems and other equipment design should particularly be emphasized as such programs are initiatedwithin the licensing and regulation process. The
overall development and implementation of humanfactors programs are the subject of general recommendation 2; the specific findings and recommendations discussed here should thus be considered as
support to, and taken in the context of, this generalrecommendation.

main feedwater pumps and turbine are tripped), thisadditional energy input can substantially change thesteam generator dry-out time and affect the reactor
coolant system pressure and temperature. The
overall effect of the delay in reactor trip is, thus, adecrease in the time in which the operating crew
has to perform necessary actions. Because humanerrors become increasingly likely as the time to perform actions decreases, the lack of an anticipatory
trip in those B&W plants not having an immediate
trip upon turbine trip (like TMI-2) may be translated
i nto an increased susceptibility of these plants tohuman errors.
I n an overall sense, the sensitivity of B&W
designed plants to transient events causes theseplants to be more vulnerable to accidents than otherpressurized water reactor designs. The method ofreactor coolant system pressure control duringtransient events places reliance on a relief valve
with a known propensity for failing in an open position; this design feature results in a greater likelihood of experiencing a small loss-of-coolant accident through this valve. Other features of theplant design require the operating crew to makemore hurried judgments in response to the initiating
event and reduce the time available to take corrective measures. These features make the B&W
design less "forgiving" to errors by the operatingcrew.
Findings-Because of particular design features andoperational characteristics of B&W plants and theresulting plant sensitivity to transient events, theseplants have a significantly higher likelihood of experiencing a small loss-of-coolant accident as aresult of a stuck-open PORV than other pressurizedwater reactors and, further, have an increased susceptibility to human errors during plant transients
than other pressurized water reactors. The combination of these two aspects in the B&W plants has
contributed significantly to the accident at Three
Mile Island.

Pressurizer and Pressure Control System Design
Features

Recommendations- Methods should be developedand implemented that reduce the frequency of useof the PORV in B&W plants. Methods to reduce thisfrequent use implemented since March 28, 1979
(i.e., anticipatory reactor trip, PORV setpoint increase) provide a temporary, but not necessarily
optimum, solution to this concern. Alternate
methods of providing equivalent or greater degrees
of protection that also reflect a systematic consideration of a spectrum of transient events should

Design of the Pilot-Operated Relief ValveTwo aspects of the design of the pressurizer
PORV will be discussed in this section. The first is
the capability of the PORV to pass mixtures ofsteam and water. The second aspect is the possibili ty that the discharge piping arrangement from the
PORV in TMI-2 may have been the cause of thevalve remaining open when it was supposed toclose. These are discussed separately below.

454

Findings-The particular arrangement of the PORV
pilot valve discharge line in TMI-2 does not appear
to be the cause of the failure of the PORV to reclose.

Capability of the PORV to Pass Two-Phase Flow

The first issue of interest here is the capability of
the PORV to pass a two-phase mixture of liquid water and steam. The possibility arises that, upon thecomplete filling of the pressurizer, the two-phaseflow through the valve may have caused sufficientdamage to prevent any further operation. Investigation of this possibility was pursued with both the
manufacturer of the valve (Dresser Industries) andwith B&W. Dresser indicates that the PORV of thetype in TMI-2 has not been qualified for discharging
33
two-phase or liquid water flow.
However, statements by a B&W staff member indicate that, as partof their analysis of the ATWS issue, the capability
for water discharge through the relief and safetyvalves was evaluated. The conclusion of this B&W
evaluation was that, although these valves were notqualified for water discharge, this discharge would
not lead to "unacceptable damage." 34 Thus, considerable uncertainty remains as to the capability of
the PORV to pass two-phase or liquid water flow.

Reactor Coolant Pressure Control
Reactor coolant pressure is automatically controlled by pressurizer (1) electric heaters, (2) thespray valve, and (3) the power-operated relief valve.
(For detailed discussion of the operation of this control system see Refs. 36 and 37.) The pressure
control system is not classified by the NRC as asystem important to safety in their review of the
FSAR; 36 therefore, in the analyses the failure of thepilot-operated relief valve (PORV) to close was notconsidered to cause unacceptable consequences in
36,38
However,a transient mitigation sequence.
failures in the PORV and later in the electric heaters,
at about 3 hours into the accident, limited the abilityof this control system to maintain system pressure
above saturation at occasions when the operators
judged it necessary to increase system
39A0 pressure toretain the plant in a.safe condition.
Pressurizer
spray also became unavailable for pressure control
when the forced reactor coolant circulation was interrupted after the reactor coolant pumps were
stopped 41 by the operators. The operators at TMI
seemed to have forgotten that pressurizer spray capability cannot be maintained after the reactor
coolant pumps are stopped because they attemptedto spray after the pumps were stopped.
Electric power supply for the pressure control
system is provided by the offsite power source, andi nterruption of this power source would have madethe pressure control system unavailable indefinitely
and the PORV block valve (located between thepressurizer and the PORV) unable to close at theoperator's command. (See Section I.B.1 of this report for additional discussion.)

Findings-The capability of the PORV to discharge
two-phase or water flow appears to be sufficiently
uncertain to merit additional consideration.
Recommendations-Additional analysis and testingof the capability of PORVs to discharge two-phaseor liquid water flow should be required to establish
this capability definitively. This recommendation
supports the recommendation made by the Lessons
LearnedTask Force (short term recommendation
35
2.1.2).
Effect of PORV Discharge Line Piping Arrangement
on Reclosure Capability

The piping arrangement for the discharge fromthe PORV pilot valve has also been studied todetermine whether backpressure forces in that line
prevented closure of the PORV. This possibility has
been pursued with Dresser Industries, 33 and theresults of this inquiry indicate that forces in the particular pilot valve discharge line installed in TMI-2
would not be sufficient to hold open the pilot valve.
Since one would expect to experience such a failure
the first (and each) time the PORV was used, thelack of previous failures at TMI-2 resulting fromsuch backpressures would tend to support the conclusions reached by Dresser.

Findings- B&W, Met Ed, and NRC failed to acknowledge the safety significance of the reactor
coolant pressure control system. There was a lackof failure mode and effects analyses (FMEA) of thisand other control systems. Although NRC experts
recognized that such control systems were important to safety, it remained NRC policy to exclude
these control systems from safety review. (For additional information regarding staff evaluation ofcontrol systems, see Refs. 32, 42, 43, 44, and 45.)455

Recommendations-The categorization of the pressure control system as "nonsafety" should be
reevaluated. If this system is deemed important tosafety, as we believe, it should be designed to safety criteria, and at minimum, automatic closure of theblock valve by system pressure should be considered to limit the need for operator intervention.
Furthermore, to retain availability of the pressure
control system in the event of loss of the offsite
power sources, electrical interconnections should
be made to permit the supply of power to the pressure control system from the onsite ac powersources. As also recommended by the Lessons
Learned Task Force,46 FMEA of all control systems
should be conducted immediately for all plants.

the design deficiency and manually actuated safety
i njection.
Failure to attribute safety significance correctly topressurizer level, even following some telling incidents, 29 '48 allowed routine operational judgments
to dictate reactor coolant system performance.
Findings-It appears that thermohydraulic bounding
analyses, from which most of the principal instrumentation and control for reactor protection isderived, lack accuracy in predicting some systemvariations. The unexpectedly high-level indication at
TMI-2 and earlier during an incident at a foreign
reactor indicate the need for reassessment of somethermohydraulic models of accident sequences.

Use of Pressurizer Level Instrumentation

Recommendations-Bounding thermohydraulic analyses should be reevaluated to determine their accuracy in predicting system variations.
Automatic reactor protection actions should bederived, to the degree possible, from independent
process variables.
Automatic actions through coincidence of independent process variables should be limited, tothe degree possible, for nonreactor protection functions.
Pressurizer level instruments should be designed
to criteria applied for instrumentation systems important to safety, and emphasis should be placedon achieving diversity in the measured parameters.

An unexpectedly high water level in the pressuri zer persisted during the early events of the accident as a result of swelling of the overheated primary coolant, perhaps from the unavailability of emergency feedwater within the expected time and theformation of steam voids in the core. The expected
response in pressurizer level indication, following initial events in the TMI-2-type accident, is a rapid decrease in level when the emergency feedwater system is immediately available. However, the steam
void formation and, to some extent, the lack of theemergency feedwater caused the primary coolant toexpand, leading to a high pressurizer level; this implied that the primary system was filling to a solid
condition. This condition was not understood by
the operators, who used their approved written procedures 47 and intervened to interrupt high pressure
injection (HPI) and normal makeup and also increased the letdown from the system.
Level indication was provided by three physicallyi ndependent level transmitters, two of which failed
l ater during the accident, causing the use of alternate indirect methods to ensure continued level indication. This level indication remained important forthe continued assessment of the primary coolant
system pressure.
During an event similar to TMI-2 at a foreign
reactor of a different vendor, actuation of safety injection was never initiated automatically, as was required by abnormal system conditions that existed
during the event. 29 Automatic actuation wasdependent on the simultaneous decrease of pressure and level in the pressurizer. Since pressure
and level did not simultaneously decrease, as in
TMI-2, the coincidence permissives were not satisfied. Operators at the foreign reactor recognized

Surge Line Loop Seals

Another concern with the B&W pressurizer
design is that it includes a "loop seal" in the pressurizer surge line (see Figure II-22). We have studied the possibility that this loop seal contributed tothe artificially high pressurizer levels indicated to theoperating crew and, in this way, contributed to thethrottling of the high pressure injection system andthe resulting core uncovering and fuel damage.
In the first 1 to 2 hours of the accident, a numberof effects were influencing the pressurizer level,causing it to go off scale in the high direction andremain there. Among these influences were thestuck-open PORV, the high initial flow rates fromthe makeup pumps, the increase in coolant volume
because of heating, and perhaps the flashing in thepressurizer reference leg. Analysis since the time of
the accident suggests that, of all the effects noted
above, high coolant flow rates from the makeup
pumps were the most significant contributor
to the49
i nitial increase of the level off scale.

456

The particular influence of the surge line arrangement in the early hours of the accident is not soeasily discernable. Analysis done by Westinghousesince the TMI-2 accident on a small-break loss-ofcoolant accident in the pressurizer steam space( which includes a stuck-open PORV) indicates thatWestinghouse-designed plants would experience asimilar increase in pressurizer level resulting from astuck-open PORV. 50 Because Westinghouse plants
have a vertical surge line (i.e., no loop seal), it would
appear that the loop seal arrangement is not an important influence in causing increasing pressurizer
level during a break in the steam space.
During the time that water levels in the reactor
coolant system (RCS) were below the connection of
the pressurizer surge line to the hot leg, the loop
seal arrangement had a more pronounced effect on
the artificially high pressurizer level. With a loop
seal arrangement it is possible for a steam volume
i n the hot leg to support a column of water in thepressurizer if the system pressure is greater than
the saturation pressure of the pressurizer liquid.
Thus, during the time period in which the RCS
coolant level was below the surge line (including theti me period in which core exposure and damage occurred), the loop seal arrangement of the pressurizer surge line was a significant contributor to the artificially high pressurizer level seen and used by theoperating staff. The disjunction between water leveli n the pressurizer and water level in the core region
is most readily apparent (in hindsight) in this time
period.
Findings- Apparently the increase in pressurizer
l evel off scale in the first few minutes was due primarily to increased flow into the reactor coolant
system from the makeup pumps and not to the particular design of the surge line loop seal.
During the time of core uncovering and damage,the arrangement of the surge line loop seal was animportant contributor to the artificially high pressurizer level seen by the operating crew.
Recommendations- We believe that a more direct
method of indicating water level in the reactor coreis needed to complement the potentially misleadingpressurizer level instrumentation.

mary. This was needed because natural circulation
was inhibited because of noncondensible gases andsteam in the primary coolant system. Reactor
coolant pump operability was required to regain
forced circulation.
During various periods later in the accident, reactor coolant pumps were removed from service because conditions in the primary system exceeded
thoseallowable for continued pump opera51,52,53
tion.
Hence, the desired forced circulation
was interrupted for extended periods of time.
Several times operators were unsuccessful intheir attempts to restart reactor coolant pumps because various permissives in the start circuit of the54
The pumps werepump controls were violated.
started, however, when operators physicallybypassed permissives. The ac electrical power
supply to oil lift pumps for the reactor coolant
pumps was lost when two motor control centerswere inadvertently tripped immediately following thepressure surge of 28 psig in the containment justbefore 2:00 p.m. on the first day. This trip violated
a reactor coolant pump permissive (oil lift pump running) in the coolant pump start circuit. Operators,
however, manually bypassed this permissive andstarted the reactor coolant pumps with oil lift provided by other pumps powered from a dc power supply. The operators were able quickly to recognize
the correct permissives for bypassing because difficulties experienced before the accident with thesame permissives required similar actions to be taken.
Operation of the reactor coolant pumps at certain
ti mes mitigated the accident (see Section ILD) of thisreport). However, reassessments by the NRC andvendors following the accident have revealed thatan immediate trip of the reactor coolant pumps duri ng some small-break LOCAs are required to limit
the loss of inventory through the break. 55 Becauseof differences in the results of calculations done for
the Special Inquiry Group (see Section II.D) it is notpossible to conclude that this would have been theappropriate action at TMI.
Findings--The operators were required to have avery intimate knowledge of complex control permissives to complete circuits and place the pumps
back into service. Up-to-date control logics were
not made available to the operators to ensure accurate knowledge of the controls.
The desire to minimize loss-of-coolant inventory
has resulted in the requirement for immediate trip ofreactor coolant pumps following any incident to ensure that, in the event of a small-break LOCA, loss

Reactor Coolant Pump Control

Several times during the course of the accident,
forced circulation of the primary coolant was attempted to ensure decay heat removal from the pri-457

Before entering into a discussion of the capability
for natural circulation cooling in B&W plants during
abnormal circumstances, some discussion of thiscapability during normal circumstances is useful.
Since the TMI-2 accident, the capabilities of B&W
plants in such situations have been questioned.
Based on operating experience where natural circulation cooling was achieved and on specific natural
circulation cooling tests in B&W plants, ss it appears
that the capability for such a cooling mode undernormal circumstances is adequate.
I n the TMI-2 accident, the capability for natural
circulation cooling was initially lost within minutes
after the turbine reactor trip, caused by the initialdepressurization of the reactor coolant system(RCS) and the resulting flashing of RCS water into
steam. When the last reactor coolant pumps were
tripped at 5:40 am., the steam in the RCS collected
at the various high points of the system: the upper
head of the reactor vessel and the upper sections of
the hot legs (the "candy canes"). The presence ofsteam in the hot legs, in concert with the large
coolant mass loss out the PORV, prevented natural
circulation cooling at that time and for some timeafterward.
Very soon after the reactor coolant pump trip at
5:40 a.m., the core began to be uncovered as aresult of the continued coolant mass loss out the
PORV. For at least the next hour, the core waspartially uncovered and fuel temperatures rose very
high, causing the generation of hydrogen from themetal-water reaction. As this hydrogen was being
produced, it too was rising into the high points of
the reactor coolant system. Thus, from approximately 6:00 or 7:00 am. until about 5:00 or 6:00
p.m. the inhibition of natural circulation alreadyresulting from steam was compounded by the presence of noncondensible hydrogen. Because of
these two substances, attempts during this time toi nduce natural circulation by repressurization or toreinstitute forced flow by starting a reactor coolant
pump were unsuccessful.
Consideration of coolant levels and other factors
suggest that, upon tripping of the last reactor
coolant pumps at about 5:40 a.m., the reflux boiling
method of cooling was also inadequate. After thetime of the pump trip, water levels are estimated tohave settled to roughly the top of the core (seeSection II.C.2). At this time the B steam generator
was isolated, secondary side water levels were relatively low, the A steam generator water level being increased to about 21 feet, through the use of7
s Also, theone emergency feedwater pump.s •sstuck-open PORV had remained as yet undiscovered, so that coolant loss from the RCS con-through the break will not result in exposure of thecore.
Recommendations-If the immediate trip of reactor
coolant pumps remains a requirement for mitigationof accidents, automatic features should be installed
to ensure their immediate trip. If, however, thepumps are required to operate during any part of an
accident, their power supply and control systems
should be designed to the criteria applied for systems important to safety.
We believe that the requirement for an immediate
reactor coolant pump trip is a temporary fix, and werecommend that an immediate reevaluation be madeto ensure that the emergency core cooling system(EGGS) is designed with sufficient capacity to preclude uncovering of the core when the reactor
coolant pumps continue to run during any accident.
Control logics for all complex systems and components should be made available to the operators
to ensure their continued familiarity with all control
permissives and inhibits.
I nhibitions to Natural Circulation

Throughout the first day of the accident attempts
were made by the operating crew to induce natural
circulation cooling in the reactor coolant system.
During the interval when the reactor coolant pumps
were not providing forced circulation cooling (i.e.,from about 5:40 a.m. to about 7:50 p.m.), it was
judged that this mode of cooling the core was highly
desirable; however, attempts to induce it were apparently unsuccessful until about 4:00 to 5:00 p.m.,when some natural circulation may have beenachieved. In this section we evaluate the contribution of the plant design to the inhibition to natural
circulation under abnormal circumstances.
A distinction should be made concerning how"natural circulation" cooling is being defined andused in this discussion. For the purposes of thissection, the term "natural circulation" is used in the
narrow context of single-phase natural circulation
cooling; that is, cooling by the flow of only liquid water through the core and steam generators. An alternate method of cooling by steam generation in
the core will be referred to as the "reflux boiling"mode. In this reflux type of cooling, heat removalfrom the fuel is achieved by boiling water in thecore, which then flows as steam to the steam generators and condenses. The accumulation of liquidwater in the bottom of the steam generators, withsubsequent flow back into the lower part of thevessel (' refluxing"), replenishes the supply of waterin the core.
458

tinued. Under these circumstances some steam
condensation in the A steam generator may havebeen occurring. However, as the water level in the
RCS continued to fall and the horizontal sections of
the cold legs drained, the capability for continued
reflux boiling decreased.
With additional uncovering of the core, hydrogengenerated by the Zircaloy-steam reaction rose into
the hot legs, inhibiting steam flow to the steam generators. This "binding" reduces the heat transfer
capability, and the possibility of core cooling by reflux boiling is further decreased.
It thus appears that within 30 minutes after thetripping of the last reactor coolant pumps, the effectiveness of the reflux boiling mode of cooling wasessentially lost. This loss can be attributed to thecontinued coolant loss out the PORV and the inability to use the heat removal capability of the steam
generators effectively.
The eventual (apparent) restoration of some reflux boiling capability and the restarting of a reactor
coolant pump some time later appear to be attributable to substantial refilling of the RCS and the escape of some of the steam-hydrogen mixture fromthe loop A hot leg. This escape appears to havebeen due primarily to the depressurization of the
RCS beginning at about 11:40 am. This decrease inpressure allowed the mixture of steam and gas toexpand to the point that it could flow into the pressurizer through the surge line and then out the
PORV into the reactor building. The reduction in theamount of blockage in the loop A hot leg then apparently allowed sufficient flow to move through the
hot leg to provide some cooling. This reduction also
may have made possible the reactor coolant pumprestart at 7:50 p.m.
It becomes apparent from the above discussionthat the RCS hot legs were a primary source of theblockage that prevented natural circulation. Since
these are high points in the system, this is not unexpected; similar behavior would be expected in the
U-tube region of the hot legs in Westinghouse andCombustion Engineering pressurized water reactors.
However, because the hot-leg high points in these
PWRs are within the steam generators where feedwater can be used directly to condense and "unblock" steam pockets (without noncondensible gas),
the problem of steam blockage is not as serious a
concern as in B&W plants.
The presence of hydrogen or other noncondensible gases in the steam pockets in the hot legs of
any PWR makes the restoration of natural circulation or reflux-boiling cooling more difficult. However, the relatively larger volume of the B&W hot-leg
design than of the U-tube arrangement in other459

PWRs suggests that the amount of noncondensible
gas required to block natural circulation or reflux
boiling initially may be somewhat larger in B&W
plants. However, because this larger volume canalso retain a greater amount of gas, the ability to
sweep gas out once it accumulates (by use of thereactor coolant pumps) may be less in the B&W
design.
It appears, therefore, that the B&W PWR design
is somewhat more vulnerable to loss of both natural
circulation and reflux boiling capability during abnormal circumstances. This relatively greater vulnerability is due to the design of the hot legs that makes
steam or the combination of steam and noncondensible gas more difficult to remove once trapped.
Because of this, the concept of remote venting capability to be discussed below should be of greateruse for B&W plants.
An additional insight gained during this evaluation
merits some discussion here. As one considers thevarious problems encountered in achieving natural
circulation or reflux boiling (along with the more detailed discussion of the events of March 28 in Section ILC.2), it becomes apparent that the capabilityof the steam generators as a heat removal mechani sm was not well utilized or not well understood by
the operating crew on that day.
The capability for heat removal through thesteam generators when forced flow is not occurringin the RCS is dependent on a number of parameters. Among the more important are relative waterlevels on the primary and secondary sidesof the59,6oThe
tubes and the secondary side pressure.
actions of the crew during the first 16 hours of theaccident suggest that the maintenance of high waterlevels on the steam generator secondary side (orthe continued flow of emergency feedwater onto thetubes) did not receive attention appropriate to its
importance. Further, depressurization of the secondary side to improve its heat removal capability wasapparently not attempted during the accident. The
less-than-complete use of the steam generators
suggests the need for a better awareness on thepart of operating crews of the importance of thisheat removal mechanism during transient-initiatedand small-break accidents.
We note that, since the TMI-2 accident, B&W has
instructed its plant owners (of lowered-loop plants)
to require that steam generator level be raised tohigh levels (95% of the operating range) after RCP
trip in a small-break LOCA. 61 This action is a goodfirst step toward utilization of the steam generator
heat removal capability. Additional guidance in thisarea to provide both an adequate use and an understanding of this capability seems to be warranted.

Findings-Under normal circumstances, the capabil-

i ty for natural circulation cooling in B&W plants appears to be adequate.
Under abnormal circumstances, the ability to restore natural circulation cooling (once lost) appears
to be somewhat more difficult in B&W plants than inother pressurized water reactors.
The importance of the steam generators andtheir application as a mechanism for heat removal
during transient-initiated and small-break accidents
li ke that at TMI-2 does not appear to have beenadequately understood.
Recommendations- We believe that no specificrecommendations concerning inhibitions to natural
circulation cooling are necessary here; however, therecommendations listed below concerning the useof remotely operable vents at the RCS high points
are also germane to the natural circulation coolingconcern.
The importance of appropriate use of the steam
generators as a heat removal mechanism duringtransient-initiated and small-break accidents should
be a matter of careful discussion among the regulatory, vendor, and utility staffs.
The apparent lack of understanding of the importance and capability of the steam generators can beconsidered symptomatic of the larger concern of
the lack of balance in the regulatory process discussed in Section II.C.1.a. Thus, this specific finding
and recommendation should be considered as supportive to, and taken in the broader context of, theneed for a reevaluation of the design basis establi shed for nuclear plants, as discussed in generalrecommendation 1 in Section ILC.1.a.

ation environment in the reactor building, it was notpossible to go to the valves and open them.
I n the sense that the accident recovery process
was hampered by the lack of remotely operable
vents at high points of the RCS, the B&W plantdesign (as well as other reactor designs) may beconsidered deficient. The addition of remotely operable valves, or the modification of currently installed manual vents appears to be a desirable
change.
It should be noted that the addition of remotely
operable valves would not be without some negative
safety implications. Such valves provide additional
possible paths for losses of coolant from the RCS
because of the inadvertent opening of a vent valve
due to equipment failure or human error or to the intentional, malicious opening by a person. Thus, theaddition of these vents increases to some extent
the likelihood of a loss of coolant from the RCS.
Care should be taken in the design of such a ventsystem to minimize the possible effects of equipment failures and human interactions.
Findings-The lack of a remotely operable vent at
the reactor coolant system high points significantly
i mpeded the recovery from the TMI-2 accident.
Recommendations- We believe that the capability
to remotely vent the high points in the RCS of lightwater reactors is an important feature that should
be provided. Because certain failures in such vents
could lead to a loss of coolant from the RCS, dueconsideration of this possibility should be one aspect of the design requirements. Measures toreduce the likelihood of unintentional (or malicious)
use of these valves also merits consideration.

Lack of Remote Vent Capability at the Reactor
Coolant System High Points

Leaks in the Reactor Coolant System

During the first 5 days of the accident, two significant concerns arose because of the trapping ofsteam and noncondensible gases (hydrogen, xenon,
krypton) in the various high points of the reactor
coolant system (RCS). As discussed above, thepresence of these substances in the RCS hot legs
i nhibited attempts to restore natural circulation cooli ng and impaired the accident recovery during thefirst day. During the subsequent 4 days, the presence of a hydrogen "bubble" in the upper head of
the reactor vessel was a major concern.
It was known at that time that manual vent valves
were located at both the tops of the hot legs andthe top of tke reactor vessel. However, thesevalves required local operation; because of the radi-

Before the accident, the pressurizer relief valve
was apparently leaking into the reactor coolant
drain tank (RCDT) at approximately 6 gallons per
minute. This continuous leakage caused the boron
concentration to continuously increase in the pressurizer and the relief valve exhaust to continuously
i ndicate approximately 180°-200°F (the normal is
130°F). (See Refs. 62 and 63 for additional details.)
Approximately 2600 gallons of water weretransferred each shift (8 hours) from the RCDT to
the makeup tank (MUT) via the RCDT up to the shift
on which the accident occurred. During the first 41/2 hours of the shift on which the accident occurred, 1800 gallons were transferred, indicating a

460

pressure. The course of the TMI-2 accident showsthat the postulated sequence is invalid as the design
requirement for RB isolation.
For a considerable time before isolation, radiation
was released to the auxiliary building during the accident by reactor coolant letdown, reactor coolant
drain tank vent, and reactor coolant pump seal injection return. Following isolation, the plant operators manually defeated the isolation signal from thereactor coolant letdown and the reactor coolant
pump seal injection to place both systems, letdown
and seal injection, back in operation because theyjudged both systems necessary for the recovery of
the plant. This action further contributed to radiation releases in the auxiliary building.

substantial increase in the leak rate to approximatel y 3600 gallons per shift on March 28,1979.
Since plant startup, there had been leaks detected in the waste gas system, and plant documentsi ndicate that some efforts had been made to determine the source of the leaks. Some of the identified
problems apparently were not corrected prior to theaccident, which caused releases to be larger thanthey normally would have been. Makeup tank ventvalves had
been suspected of leaking prior to the64
accident.
I n violation of technical specification requirements, the licensee was operating the facility, atl east during the March 22-28, 1979 period, with al eak rate in excess of 1.0 gallon per minute. The
operators became used to operating the plant withthe excess leakage and were unable to recognize
more serious leakage without larger deviations inplant parameters.

Findings-The deficiency of the RB isolation systemappears to be associated with (1) the lack of direct
measurement of all important parameters (e.g., radiation), (2) inadequate LOCA analyses (e.g., small
break) to determine accurate setpoint values of alli mportant parameters, and (3) inadequate hardwareand operating procedures that permit resetting ofi solation signals and the66
reactivation of selectedcomponents and systems.
The operator actions to defeat isolation manuallydemonstrate the need for reconsideration of which
systems should be immediately isolated and whichshould be selectively isolated.

Findings- The PORV had been leaking at least
since October 1978, and the discharge line temperature had been in the range of 180°-200°F.
The licensee had operated the facility in violationof technical specifications with a leak rate in excess
of 1.0 gallon per minute.
The plant continued to operate with known leakage and excessive temperatures at the PORV;
therefore, the operators were desensitized and unable to recognize the failure of the PORV to close
after the primary system pressure was reduced.

Recommendations- Transient and LOCA reanal yses should be performed to confirm importantparameters for actuation of reactor building isolation, to the degree possible, from direct measurements of such parameters.
Reevaluation should be made to determine theneed for removal of isolation from any component
and system during an accident mitigation sequence.
(See Ref. 67 for additional recommendations.)c. Possible Deficiencies Related to theEngineered Safety Features
Reactor Building Isolation

To ensure that radiation from contaminatedgases and liquids was contained within the reactor
building (RB), isolation of certain piping systems was
actuated by the high RB pressure (4 psig) safety
features actuation signal (SFAS), which wasreached approximately 4 hours after the start of theaccident.
The design that provided RB isolation for TMI-2
on high pressure alone is based on postulated
bounding large LOCA analyses that assume rapid
increase in reactor building pressure before radiation releases resulting from the postulated fuel dam65
age. (See Lessons Learned Task Force reportfor additional discussion.) Other operating plants include reactor building isolation on high radiation orsafety features actuation on low reactor coolant

Reactor Building Hydrogen Concentration Control

Approximately 10 hours following the initial openingof the PORV, hydrogen in the reactor building
reached flammability concentration. The primarysource of the hydrogen is attributed to thezirconium-water reaction in the reactor core, when
the core overheated as a result of its prolonged uncovery.
The lack of an automatic hydrogen recombination
system allowed the hydrogen to accumulate andthen ignite, creating a pressure surge of about 28
psig in the reactor building. The building at TMI-2 isdesigned to withstand pressures in excess of 60

461

66

psig,
although some reactor buildings can only
withstand pressures of about 12 psig.
The regulatory criteria, applied to TMI-2, required
provisions for hydrogen recombination systems todeal with slow (several days) postaccident generation of hydrogen, following a LOCA, from (1) about
1 % of clad metal-water reaction, (2) corrosion of materials inside the reactor building, and (3) radiolytic
decomposition of water. 69 The primary source ofhydrogen would in this case be from corrosion ofmaterials inside the reactor building and not fromthe clad metal-water reaction that was the major
source at TMI-2.
The provisions at TMI-2 called for postaccident
i nstallation and operation cf external hydrogen
recombiners. These recombiners would be hooked
up at the 36-inch reactor building penetrations thatwere used for normal reactor building purging.
However, such recombiners are not capable ofpreventing the rapid increase in pressure (28 psig)
attributed to hydrogen ignition at TMI-2. (See Section I.B.1 of this report for additional discussion.)
Findings-The design basis applied to TMI-2 result-ed in an inadequate hydrogen recombination system.
Recommendations-It appears necessary to deter-mine more accurately the principal sources of hydrogen generation for the implementation of an appropriate hydrogen recombination system, or consideration should be given to containment designs
that would not require hydrogen recombination systems.
I nadequacy of Shielding and Leakage Control ofEngineered Safety Features

During the course of the accident and the postaccident recovery, significant problems arose relati ng to high radiation fields in the auxiliary building.
These problems influenced decisions being made at
the time concerning access to and work done in theauxiliary building and the method by which the RCS
would be cooled down. Thus, the contamination in
the auxiliary building suggests possible plant deficiencies. In this section, possible deficiencies in theradiological design of core cooling and othersafety-related equipment are considered.
Pressurized water reactors typically have twocomplements of core cooling equipment used fornormal and emergency situations: the decay heatremoval (DHR) system (for normal shutdown andl ong term cooling) and the emergency core coolingsystem (for accident cooling). The DHR system
462

provides core cooling at relatively low RCS pressures by drawing coolant from one core outlet pipe(a "hot leg"), passing it through the DHR pumps andheat exchangers in the auxiliary building, and injecti ng it back into the reactor vessel via either the core
i nlet piping (a "cold leg") or directly into the vessel
downcomer.
The emergency core cooling systems in PWRs
are designed first to draw coolant from an uncontaminated water supply such as the borated water
storage tank (BWST) at TMI-2. Upon depletion ofthis tank, supply lines are switched to use water inthe reactor building sump. This water is then drawn
i nto the decay heat removal pumps and pumped either back into the RCS (if RCS pressure is sufficiently low) or to the suction of the high pressure inj ection pumps, with subsequent flow back into the
RCS. The containment spray system uses a similar
method of supplying water, drawing first from the
BWST and subsequently from the reactor building
sump.
Early on the first day of the TMI-2 accident thewater in the RCS and the water collecting in thereactor building began to be contaminated with radioactive material being released from the damaged
fuel. It soon became evident that the contaminatedwater could cause significant radiological problems
i n the auxiliary building if circulated through previously uncontaminated equipment (e.g., the decay
heat removal pumps) and areas. For this reason, amethod of core cooldown was chosen that would
minimize the likelihood of drawing radioactive wateri nto previously uncontaminated areas. Thus, in effect, the two options for core cooling that would
have been expected to be used following an accident (i.e., emergency core cooling recirculationand long term heat removal by the DHR system)
were considered highly undesirable.
The design basis radiological hazard for the DHR
and emergency core cooling equipment and areas is
described in Chapters 12 and 15 of the TMI-2 FSAR.
Chapter 12 established the design basis upon whichshielding is provided for certain components of theemergency core cooling system (ECCS). That vital
equipment, which is part of the makeup and purification system or the decay heat removal system, isshielded to compensate for the assumed radioactivity levels in the reactor coolant resulting from normal
operation of the plant. Apparently, other vital equipment that is not normally used during plant operation (e.g., in the containment spray system) is not
required to have even this amount of shielding. 70
Contamination of these systems by highly radioactive coolant was apparently not contemplated within
the established design basis.

Findings- Contamination of ESF and DHR equipment by radioactive coolant appears not to havebeen considered part of the design basis for thisequipment.
Recommendations-The capability for postaccident
radiation shielding and leakage control for vital
equipment using potentially radioactive reactor
building sump water and for long term coolingequipment (i.e. the DHR system) using potentially radioactive RCS water should be examined and,
where necessary, improved in all LWRs. Accessibility to surrounding areas and equipment by plant
personnel during accident mitigation and recovery
should be a primary consideration in this regard.
This recommendation complements a similar recommendation made by the Lessons Learned
Task
71
Force (short term recommendation 2.1.6).
The lack of adequate shielding in the TMI-2 accident is indicative of the lack of consideration of
accidents that could result in significant core damage. As such, the findings and recommendations
related to this specific deficiency are indicative of
the more general need for reconsideration of thedesign basis by which nuclear plants are licensed,
as discussed in general recommendation 1 in the introduction to this section.
High-Pressure Injection (HPI) Bypass

One of the crucial contributors to the accident
was the interruption early in the accident of HPI flow
and its subsequent throttling and the increase in letdown flow from the primary,the operators, as
72,7 , bys 74 Those actions bethe accident progressed.
came possible only after reset (bypass) of the safety features actuation signal (SFAS), because without
reset the continued presence of the SFAS would
automatically reinstate equipment inservice immediately following interruption by the operators.
Emergency procedures at TMI for a number ofabnormal conditions including small-break LOCAs
require the immediate reset of the SFAS because of
the deficiency in the ability of the HPI pumps, decay
heat pumps and reactor building spray pumps towithstand runout-a condition that can cause damage to pumps from excessive vibrations. Operators
are also instructed early in the LOCA procedures toprevent the primary system from filling solid by interrupting makeup flow to the reactor coolant systems. A solid reactor would be subject to overpressure transients that the operators were instructed to
avoid. Such operator interventions, however, are
not in compliance with the NRC stated regulatory
position that credit for operator action is only given

if such actions are taken 10 minutes
or more after
75,76
i nitiation of the accident signal.
This regulatory
position implies that adequate design features
should be in place to control automatically the mitigation of the accident for at least 10 minutes without
operator intervention.
The LOCA emergency procedures for TMI-2
further instruct the operator to reactuate manuallyreactor building isolation and cooling following reestablishment of electric power supply in the event theoffsite power sources were lost during the accident
after the SFAS was reset. This instruction wasplaced in the procedures because it was recognizedthat loss of power removes the SFAS-that actuatedcertain systems, and with return of power the SFAS
must be manually reinstated. However, the instruction erroneously assumes that isolation and cooling,which is only a part of SFAS, includes safety injection. (See Section I.B.1 of this report for the historical perspective on this issue.)If l oss of offsite power had occurred at TMI-2,
the emergency procedures would have been inadequate to ensure a delayed reinitiation of importantsafety features. The vulnerability to loss of required
safety function following SFAS reset continues toexist to a varying degree in many operating plants.
The NRC staff has erroneously testified before theli censing board for TMI-2 77 that the issue of safety
i njection reset is not applicable to TMI-2.
The NRC and B&W have failed to act on the repeated warnings from their own staff and therecommendations of the Advisory Committee on
Reactor Safeguards (ACRS) to carry out theirrespective regulatory
responsibilities to resolve the. 78.79 80
i ssue of reset
A survey conducted by the
NRC Office of Inspection and Enforcement81 erroneously reported that adequate procedures are inplace in all operating reactors including TMI-2 tocover all necessary operator actions before andafter SFAS reset.
Findings- Deficiencies in operating plants continue
to require operator intervention (early SFAS resetand manual control) to ensure adequate emergency
core coolant injection or to prevent damage to safety components and systems. This may be improperin some circumstances.
Recommendations- Engineered safety feature systems and components should be designed to be capable, to the extent possible, of performing their intended function without operator intervention for atl east 10 minutes following a real safety feature actuation signal initiation.

463

At other times the operators, following failures inmanual attempts to start certain pumps, placedthese pumps in the off-normal position to preventthe pumps from starting automatically after they hadcommenced other pumps in operation manually.
The inability to start pumps manually is attributed
to intermittent failures in latching relays, degraded
power supply to the control circuit, or the operator's
not completing control switch action.

A thorough evaluation should be performed todetermine adequate response requirements for automatic or manual reinitiation of engineered safety
features following inadvertent loss of power supply(e.g., offsite power) during a critical transient or accident mitigation sequence. (See Refs. 78, 79, 82,
83, 84, 85, and 86 for additional discussion on potential failure modes following inadvertent loss of
power.)

Recommendations-The engineered safety features
actuation signals (SFAS) should automatically remove components and systems important to safety
from off-normal position and place them back tonormal alinement for safety actuation. If it can beshown, however, that immediate realinement to normal is not required, the off-normal position should
be indicated with an alarm to alert the operators to
the system unavailability.
Control circuit components should be designed
and periodically tested at expected degraded power
supply conditions to ensure that they are capable ofperforming their intended function.

High-Pressure Injection Control

Throughout the course of the TMI-2 accident,
high-pressure injection pumps (1A and 1C) were either inadvertently tripping or were unable to start byautomatic or manual commands. 87,88,89
Failure to keep high-pressure injection (HPI)
pumps operating has been attributed to control
component deficiencies and to undesirable operator
actions. Control switches were placed in pull-tolock off position whenever the operator deemed it
necessary to take pumps out of service. Pull-tolock is an off-normal position prohibited by technicalspecifications during plant operation or accident mi90
At this off-normal position, automatic
tigation.
commands cannot start equipment whenever required by system conditions.
The inadvertent or deliberate placement of control switches in the pull-to-lock off position caused
pumps to be inoperable when high-pressure injection was called upon (SFAS) by abnormal system
conditions later in the accident sequence.
The lack of automatic override features to remove the pumps from the off-normal position or toalarm when pumps are not alined for safety injection
is a deficiency that may have confused the operators regarding operability of the pumps, when thepumps would not start automatically, and the operators were unaware of the pumps' placement in theoff-normal position. 91
Other unsuccessful attempts to start pumps automatically or manually appear to have been attri92
buted to contact bounce of latching relays or de93,94
graded power supply.

Core Barrel Vent Valves

The B&W design for a pressurized water reactor
i ncludes core barrel vent valves. These valves are
i nstalled in the upper region of the reactor vessel,and under certain conditions, the valves permit flowfrom the region above the core into the downcomer
region. The vent valves were installed in B&W reactors to mitigate potential problems from thephenomenon of "steam binding" during a large
l oss-of-coolant accident. Steam binding is an effectpostulated to occur in accidents in which high steampressure above the core impedes the refilling of thecore region with coolant. The vent valves aredesigned to relieve this pressure and thus assist in
the refilling of the core region. During certain partsof the TMI-2 accident, conditions appear to havebeen correct for the vent valves to have opened. In
this circumstance, water and steam that would haveotherwise traveled into the steam generators andbeen cooled would be returned into the downcomer
and subsequently to the inlet of the core. Thus theheat removal capability of the steam generators may
have been compromised.
Efforts to resolve the importance of this issue
were undertaken by the Special Inquiry Group. We
have found no clear evidence to support thesuggestion that significant harmful effects resulted
from the presence and operation of these valves;
however, analysis to resolve the issue has not, inthe time available, provided conclusive answers.

Findings-We find that, as the operators continued
to be guided by pressurizer level to determine primary coolant inventory, manual actions were taken
to control what was perceived, as excess coolant
i njection from automatic actuation of high-pressure
i njection pumps. The operators, at times, in anticipation of an automatic signal, placed pumps in offnormal position, thus removing them from the automatic controls.
464

Findings-Resolution of the issue of the effect of thecore barrel vent valves on the course of the TMI-2
accident has not been possible.

hot-leg injection capability would have enhanced thecooldown of the fuel in this accident.

Recommendations-We recommend that an explicit
assessment of the effects of the core barrel ventvalves be included as part of the small-break lossof-coolant accident analyses begun since the TMI-2
accident.
The question of the effect of these valves during
the TMI-2 accident can to some extent be attributed
to the lack of balance in the regulatory process discussed in the introduction of this section (Section
II.C.1.a). That is, these valves were installed to compensate for a particular concern in a large loss-ofcoolant accident, apparently without clear consideration of the possible effects during other typesof accidents. The resolution of this issue should
thus be undertaken in the context of a more systematic and integrated approach to accident
analysis and general recommendation 1 discussed inthis section's introduction. We believe that explicit
consideration of this concern in the transient andsmall-break accident analysis expected to result
from this more general reconsideration is also
necessary.
Lack of Hot-Leg Injection Capability

There exists a capability in some pressurizedwater reactors (i.e., some of those designed byWestinghouse) to inject emergency core coolingwater directly into the reactor coolant system hotlegs in addition to the cold legs. The TMI-2 plant,li ke all B&W plants, does not have such a capability.
We examine here whether, in situations such as thatat TMI-2 where uncovery of the core occurs, a capability to pump water into the hot legs and directly
onto the top of the core may be of significant benefit.
The capability for hot-leg injection to cool the topof the uncovered fuel is dependent on a number offactors. First, the area covered by the in-rushingwater is dependent on the flow rate from the emergency core cooling system, so that fuel near thecenter of the core may not experience much additional cooling. Second, flashing of the water would
be expected as it contacts the hot fuel; this steam
generation, in concert with other steam generationfrom lower core regions, may entrain some liquidand carry it back into the hot legs or through thecore barrel vent valves. This then could result in
l ess overall cooling of the fuel, compared to cold-leg
i njection of equal amounts of coolant. As such, it is
not readily apparent that the availability and use of a

Findings-It i s not readily apparent that the lack of
hot-leg injection capability in B&W plants significantly affected the course of the TMI-2 accident.
Adequacy of Debris Protection for the Reactor
Building Sump

During the course of the accident, the gradualdepletion of the primary water supply for the ECCS
(the borated water storage tank) raised the possibility that ECC recirculation from the reactor building
sump would be necessary. In the consideration ofthis, two concerns relating to the desirability of usi ng the sump water arose. The first concern was
the possibility that debris might have entered thesump that could then be drawn into the ECC equipment and cause damage. The second concern wasradioactive contamination of the sump water. Because this water would have been drawn out into
the ECC equipment in the auxiliary building, undesirable additional contamination of that building would
have occurred. This latter concern is discussed
separately in a previous section on the inadequacyof shielding and leakage control of engineered safety features.
The reactor building sump design was considered in the licensing of TMI-2 to be part of theengineered safety features systems and as such
was discussed in Chapter 6 of the Final Safety
Analysis Report (FSAR). 95 The FSAR specificallyaddresses sump debris elimination and indicatesthat the sump is completely enclosed in screensthat minimize the likelihood of debris entry into thesump. Thus, for the conditions experienced during
the TMI-2 accident, it appears that debris blockageof the reactor building sump should not have been asignificant concern.
Findings- The reactor building sump design appears to have been adequate to protect vital equipment from debris damage in the event of sump water use in the recirculation mode of emergency corecooling.
Diesel Generator Lockout

The emergency diesel generators started automatically by the safety features actuation signal( SFAS) about 2 minutes into the accident. These
diesels provide an alternate onsite power supply toequipment important to safety in the event of loss ofthe offsite power sources.
465

Shortly after their start the diesel generators
were turned96,97
off by the operators, as instructed byprocedures.
This was done after it was established that offsite power was not lost and thediesels were running unloaded. The diesels at
TMI-2 are not designed for prolonged operation unloaded because the exhaust system can be damaged from excessive carbon deposits. Unloaded
operation is only permitted for 30 minutes. Therefore, following SFAS reset the diesels were turned
off. Diesel generators of a different design can run
unloaded at sufficient length of time without damage
from excessive carbon deposits.
To prevent subsequent restarts of the diesel
generators following reinitiation of SFAS, the operators defeated the automatic starting capability by
shutting off the fuel at the fuel injectors in the diesel
rooms.
Shutting off the fuel to the diesels left the plant
vulnerable to total loss of ac power supply in theevent of loss of offsite power. The diesels could
have been made available at a later time, however, if
it was recognized in time that the fuel was shut off.
However, operator interviews have revealed that the
principal operating staff was not aware at all times
that the fuel was shut off. 97
At a later time (9:30 am)when the station electrical engineer arrived at the site, he instructed theoperating staff to reset the diesel fuel racks andcontrol the diesels at the control room. Control
switches used to place the diesels out of service
during maintenance were placed on manual control
at that time. 98
The inability of the diesel generators to run unloaded was acknowledged and accepted by the
NRC staff for the TMI-2 and other plants cur enty
operating. Acceptance was based on the postulatethat the need for the diesels would only occur
simultaneously with an accident or transient. Thispostulate has been contested by individual NRC ex100
perts and the ACRS. 86,99 The ACRS since 1976
has requested a generic resolution for this issue.
However, the NRC staff has not acted and has notincluded this issue for resolution in any of their generic issues submitted to Congress.
Our review of the emergency procedures on
LOCAL has revealed that instructions to the operator to reinitiate safety injection manually after SFAS
reset and following loss of offsite power would nothave resulted in the appropriate safety features actuation for safety injection. In recognition of the potential for loss of offsite power the instructions in
the procedures call for manual reinitiation of reactor
building isolation and coolant actuation. This actuation, however, is independent of the safety injection
initiation of the SFAS, and therefore, if offsite power466

was lost following SFAS reset, injection systems
would not have functioned property.
Resetting of the SFAS gives the operator an opportunity to take manual control of components andsystems that have actuated automatically by the
SFAS. The actuated components normally seal theactuation by their individual controls, and therefore,
removal of the actuating signal (reset) would not affect their actuated status. Flowever, loss of power
to these components will drop them from the actuated status, and restoration of power will not return them unless the SFAS is present.
Findings- There is no evidence of any formal

analysis by the NRC or the licensees and their suppliers of the consequences of interruption of engineered safety features at any time during a transient or accident mitigation sequence. The procedures for manual reinitiation do not take into account the consequences of the interruption prior tothe manual reinitiation.
The deficiency in the diesel generators to run unloaded without damage resulted in an insufficient
redundancy in power supply during a crucial periodof the accident.
Recommendations- Analysis should be performed
to determine the consequences of inadvertentinterruption of engineered safety features from lossof power at any time during a transient or accident
mitigation sequence.
If the analysis shows that interruption of engineered safety features is unacceptable for any interval of time before automatic restoration of powerfrom another source (e.g., diesel), consideration
should be made for (1) simultaneous paralleling ofoffsite with onsite power supplies by SFAS, (2)simultaneous paralleling of offsite with only one trainof onsite power supply by SFAS, or (3) either
enhancing or removing available offsite power fromthe engineered safety features during a transient or
accident mitigation sequence.
Decay Float Removal System Not Designed forOperating Pressures

The decay heat removal (DHR) system in pressurized water reactors is designed for use during anormal plant shutdown rather than during accident
situations. It is designed for use after the plant has
been cooled down and depressurized by other systems (e.g., the emergency feedwater system) to relatively low temperatures and pressures. After thisis accomplished, the DFIR system is initiated to provide the long term cooling of the reactor core.

About 7 hours into the accident an attempt wasmade to depressurize the reactor coolant systemfrom high pressures (about 2100 psia) to pressuresat which the DHR system could have been used(about 300 psia). it was believed by the operatingcrew that the use of the DHR pumps, which have amuch higher pumping capacity than the makeup
pumps, would more quickly reduce the temperatures seen in the reactor coolant system. 102 However, the pressures in the RCS could not be decreased sufficiently low to use these pumps.
We have studied whether the relatively low
design pressure of the DHR system is a plant deficiency that was detrimental to the recovery fromthis accident. In one sense the low design pressurei s a deficiency in that it did not permit use of the
DHR pumps at the time period discussed above. In
another sense the low design pressure of the DHR
system is not a deficiency. For accidents such asthat at TMI-2, where reactor coolant system pressures remain high, another cooling system with thecapability to operate at high pressures is designed
and installed, this being the high pressure injection(HPI) system. A DHR system designed for highpressures thus may be considered a backup system to the HPI system.
In the TMI-2 accident the high pressure injection
system was automatically actuated and began tooperate as designed a number of times. Subsequent crew actions reducing the flow from the HPI
system greatly compromised the capability of thesystem and were the direct cause of the damage tothe core. The apparent need for the DHR system(as perceived by the TMI-2 crew) is thus predicatedon their prior actions that compromised the capability of the high pressure injection system.
An additional point to be made deals with thepossible effects if the RCS pressure had dropped
sufficiently low to allow DHR system operation.
First, indications available to the operating crew
during this time period on hot-leg conditions suggested that the legs were filled with superheatedsteam. Because the DHR pumps draw coolant fromone of the hot legs, superheated steam or a steamwater mixture might have been drawn into thepumps, with uncertain consequences. Further, RCS
coolant was highly radioactive by this time, meaningthat contamination of the DHR system and surrounding areas in the auxiliary building would also
result. Thus, a switch to using the DHR system duri ng this time period may have worsened the situation rather than improved it.
A decay heat removal system designed for
operating pressures thus may be thought of as additional equipment redundant to the high pressure
i njection system. This additional redundancy of467

equipment has the potential for somewhat improving
the reliability of the high pressure cooling function.
However, it seems likely that operator actions tocompromise one system, as was the case with the
HPI system of TMI-2, could also compromise any
additional equipment. It is therefore not readily apparent that the lack of a decay heat removal systemdesigned for operating pressures is a significant deficiency contributing to the accident at TMI-2.

Findings-A decay heat removal system designed

for operating pressures would in essence be additional equipment redundant to the high pressure injection system. It is not clearly evident that thepresence of such a system would have significantly
altered the course of the TMI-2 accident.
d. Possible Deficiencies Related to theSecondary Coolant System
Emergency Feedwater Actuation and Control

Loss of main feedwater, which initiated the accident, resulted in the actuation of the emergency
feedwater system-the emergency feedwater
pumps were performing at full pressure within 40
seconds. However, because the discharge block
valves were closed, feedwater did not enter thesteam generators until 8 minutes into the accident
after the block valves were manually opened. The
steam generators automatically rose to a designlevel of 34 inches for recovery from a loss of feedwater transient as opposed to 32 feet (75% full) thatthe B&W analysis postulates for small-break accidents. (See Ref. 103 for additional details regarding the B&W analysis for small-break LOCAs.)
By the time the block valves were opened, thesteam generators had boiled dry, the PORV had
failed in the open position, and high pressure injection actuation had been initiated. Hence, a smallbreak LOCA was in progress and the emergency
feedwater system should have supplied water to thesteam generators to raise the level to 32 feet-thel evel required for successful mitigation of smallbreak LOCAs. The emergency procedures for
TMI-2104 did not include instructions for steam generator level requirements for the mitigation ofsmall-break LOCAs. Additional studies, however,following the accident have resulted in revised procedures that include105,1
specificlevel requirements foros ,107 It should be recogsmall-break LOCAs.
nized, however, that the emergency feedwater
enters the steam generator at the 32-foot level at
TMI-2 and sprays down the tubes to the liquid level,thereby providing high level cooling whenever thesteam generator is being fed.
According to B&W 108 high emergency feedwaterlevel control is significant for the mitigation ofsmall-break LOCAs. The analysis presented to the
NRC by B&W in topical report BAW-10075A, Rev.1,
was based on a 32-foot emergency feedwater level.
This level, however, and its significance to mitigationof accidents were not reported to the NRC andwere not included in the TMI-2 small-break LOCA
emergency procedures.
Operator interviews have indicated that thesteam generator level at TMI-2 during emergencies
is supposed to be 21 feet. It is uncertain, however, whether the course of the accident would havebeen altered even if the 21-foot level was automatically reached, because an analysis does not appear
to have been made by B&W for the 21-foot level andthe reactor coolant pumps running. 111
The 21-foot emergency water level in the steam
generators that the operators thought was proper
might have been reached during the accident if highpressure injection actuation had been coincident
with loss of offsite power (reactor coolant pumps
tripped)112 However, because offsite power was
not lost at TMI-2, the integrated control system(ICS) controlled the steam generator level at only 34
inches because the ICS did not recognize the incident as a small-break LOCH.
A design feature that controls steam generator
level at 34 inches during feedwater transients appears to have been desirable to maintain pressurizer level indication by limiting shrinkage in the primary coolant. The need for dual level setpoint in
the steam generator had become apparent in another B&W operating plant in the past. B&W did not inform its customers or the NRC of the deficiency inthe control system to recognize small-break LOCAs
with reactor coolant pumps running. 113
The deficiency of the system design to recognize
properly the steam generator level requirement of
32 feet may have contributed to the high pressurizer level indication, which the small-break LOCA emergency procedures do not predict would occur.
Emergency procedures for small-break LOCAs
predict low pressurizer level. Hence, the operators
did not apply the small-break LOCA procedures andcontinued to throttle high pressure injection toprevent the primary system from filling solid.

gency feedwater pump operability. Such closure
was required because of the known deficiency inthe emergency feedwater level control valves (EFV11A and B) in preventing leakage to the steam generators whenever the pumps were tested. 114,115
The emergency feedwater system was notdesigned to respond properly to a small-break
LOCA; that is, to fill the steam generators to theemergency level required for successful mitigationof the accident.
Met Ed and B&W failed to integrate emergency
feedwater response with the proper accident
analysis. (See Section I. B.1 for the historical perspective on this issue.)
Recommendations-Surveillance procedures should
not permit the simultaneous defeat of redundant
systems important to safety.
The emergency feedwater system should bedesigned, at minimum, with a diverse and redundant
automatic SFAS actuation of pumps, discharge
valve alinement and emergency steam generator
level. This automatic actuation should be independent of the ICS.
Condensate Polisher

The condensate polisher removes impurities fromthe turbine steam condensate by means of deionizi ng resin. The polisher is part of the station condensate feedwater system that supplied water tothe steam generators of the nuclear steam supply
system.
There are eight polisher units, with any seven in
operation at one time. The eighth is free to have theresin bed regenerated. Regeneration consists of removing a polisher from service, transferring theresin bed to a regeneration skid, regenerating, andreturning the resins to the polisher. Each polisher isequipped with an air-operated inlet, inlet bypass,and outlet valve.
The condensate feedwater system is not considered safety-related equipment based on the factthat the total loss116of normal feedwater is ananalyzed accident.
Therefore, this equipment
was not inspected as rigorously by Met Ed as it
would have been if it had been classified safety related.
The condensate polisher was originally designed
for the Oyster Creek No. 2 plant, which never materialized, and was transferred to the Three Mile Island facility. Early in the fabrication process, adesign change was incorporated to have the inlet
and outlet valves of each polisher unit failin the117"as-is" position on loss of air or power.
The

Findings-Surveillance performed on the emergency
feedwater system on March 26, 1979, resulted in
the closure of the block valves (EF-V12A and B).
The surveillance procedure allowed the simultaneous closure of the block valves when testing emer468

equipment for this design change was installed andthe essential component calibrations and electricaltests were performed in preparation for the functional test 118,119 The equipment functional tests
120
failed to verify the "fail as-is" feature.
Apparently,
subsequent to the calibration and electrical tests,
the control wiring to the solenoid valves that effectthe "fail as-is" feature were disconnected. 121 I n addition, at the time of the accident, these solenoid
valves had a manual override feature that was actuated, so that even if the wires had been connected, the "fail as-is" feature would have been
bypassed. Further investigation did not produce
evidence to indicate that this was an authorized
modification of the equipment. We can only specul ate why this feature was disarmed. Some possibilities are that the actual design was unworkable, that
there was improper installation, that the previously
mentioned tests were never performed, or that there
were incorrect operating procedures, incompetent
operators, or incompetent maintenance.
The disarming of this feature could possibly havecontributed to the initiation of the loss-of-feedwatertransient that ultimately resulted in the accident.
This will be discussed in detail below.
On February 19, 1977, it was identified by theGeneral Public Utilities Startup Group that thetransfer of resins could not be accomplished satisfactorily without the injection of service air todisperse the resins. Consequently, a % -inch diameter pipe was installed, connecting the service
air122
header to each individual polisher unit.
Hereagain, this minor alteration may have played a parti n the initiation of the feedwater transient and will be
discussed later.
Either the design or the installation (or both) of atleast the electrical systems in the condensate polisher were of questionable quality. From August 30,
1976 to October 6, 1977, there were 28 electrical
work 123
requests issued against the condensate polisher.
It is possible that the disconnectedsolenoid valve control wires occurred at this time.
The final acceptance of the condensate
polisher124
occurred on November 17, 1977.
On October 19,
1977, just before this acceptance, water was
noted
125
i n the service and instrument air systems.
Thiswater caused, directly or indirectly, the outlet valveson the condensate polishers to close and resulted ina loss of feedwater. Fortunately, the facility was not
at power and no adverse effects were noted. However, the author of the report stated that, "If thiswould have happened while at power, the unit would
have been placed in a severe transient condition
This resulted in a recommendation by Metropolitan Edison that the Architect-Engineer, Burns
469

and Roe, consider installing an automatic valve to
bypass the condensate polisher on high differential
pressure or low flow conditions. This recommendation was rejected on November 17, 1977. 126
Again, on May 12, 1978, water was inadvertently
introduced into the service and instrument air system. The operator felt that the water resulted fromthe failure to close the individual air valve on one
127
polisher unit before it was returned to service.
Two memoranda were written on May 15 and 16,
1978. One recommended installation of an automati c bypass around the polishers and isolation of thei nstrument air from the service air system. 128 The
second memorandum endorsed 129
the first and directed immediate action to be taken.
No evidence ofthe directed actions could be found.
The facility experienced a trip from 90% poweron November 3, 1978, because of a loss of feedwater transient. The master power switch to the condensate polisher control panel was inadvertently
de-energized by a technician. This caused theoutlet130
valves on the condensate polishers to closeagain
If the "fail as-is" feature had been properly
installed, this trip should not have occurred. Thel oss of power caused valve position control
solenoids to dump the pneumatic signal air. If the"fail as-is" feature had been armed, it would haveblocked this loss of signal, freezing the inlet andoutlet valves in position.
A change in the operating procedure was initiatedon January 25, 1979, in an attempt to control thevalve positions-in essence, to treat the symptom
rather than the cause. The change directed that local air switches for the inlet, inlet bypass, and131
outletvalves be placed in the manual-open position.
Finally, on March 27, 1979, at 4:00 p.m., 12 hours
before the start of the major accident, a resintransfer from the No. 7 polisher was started. The
operator noted in his log book at 11:00 p.m.
(the shift132
change), "Relieved shift resin clogged."There
are no more significant entries until April 1, 1979,
because at approximately 4:00 a.m. on March 28,
1979, the condensate polisher discharge valvesclosed once more, unexpectedly, initiating the accident.
Metropolitan Edison, the NRC, the President's
Commission, and this Special Inquiry Group havenot been able to establish conclusively the exact
cause of these valves closing. The following is apossible account based on the current facts as reviewed by this special inquiry.
During the early postaccident days it was felt thatthe condensate polisher service air connection allowed water to flow from the condensate polisher
units, back through the service air system, throughSecond, it would not be expected that water interfering with a pneumatic valve operator would
cause all valves to close simultaneously. Third, thecondensate polisher differential pressure recorder,
135
Itwhich is air operated, went to zero differential.
is known that at least one condensate pump continued to run for a considerable time after the transient iss Based on this, the differential pressure
would have attained some value above zero. Therefore, it appears that the instrument lost operating air
pressure.
It appears now that a single component, such as
the instrument air dryer, was affected by the waterthat caused a loss of instrument air, thus causing
the condensate polisher valves to close, the differential pressure recorder to give false indication,and the emergency feedwater valves not to
respond.

the service-instrument air cross-section, and out
through the instrument133
air system to the condensate
The amount of water repolisher control panel.
quired to flood these systems can range from 3000
to 6000 gallons. For example, there are several air
rPreivPrs with vnlumes as follows:
Instrument Air Receivers

IA-T-1A
IA-T-1B

57 ft
57 ft3426 gallons
426 gallons

SA-T-1A
SA-T-1B
SA-T-1C
SA-T-2
SA-T-396 ft396 ft396 ft33
235 ft3
235 ft718 gallons
718 gallons
718 gallons
1757 gallons
1757 gallons
6520 gallons

3Service Air Receivers

Lack of Automatic Bypass on the
Demineralizer- Polisher

The 6520 gallons of water does not include thevolume of the piping and the fact that there are automatic water drains throughout the two systems.
Even if one assumes that the tanks never become
full, it is reasonable to postulate that several
thousand gallons of water are required to cause water to be seen at the condensate polisher control
panel. If one assumes a 10-gallon per minute flowrate (which is high) through a ' -inch diameter pipe,
it would take 5 hours to fill 50% of the 6000-gallon
capacity air receivers. If one assumes a more reali stic 5-gallon per minute flow rate, it would take 10
hours to fill 50%. It is interesting to note that theNo. 4 condensate polisher was put into service
12
132
If an
hours and 40 minutes before the accident.
operator inadvertently had left the service air valve
open on No. 4 polisher and returned it to service, it
could have been the source of the large volume ofwater required to create the transient. It is very
doubtful that the intermittent opening and closing of
the service air valve on the No. 7 polisher to unclog
resins could have been the source of all that water.
The only other explanation is that during thetransfer of resins from the No. 7 polisher the service air valve and the transfer water valve were left
open simultaneously for the same extended periods.
It has been postulated that water alone caused
the valves to close. In view of the following analysis,
it is more plausible to hypothesize that the water
caused a partial or total loss of instrument air. Thisis supported by several other facts. The first is thatthe operator experienced difficulty in getting the air
operated emergency feedwater valves EF-11A andEF-11B open immediately after the reactor trip. 134

The initial loss of main feedwater at the start of
the accident before the reactor trip has been attributed to resin clogging the condensate polishers,
which resulted in the closure of the polisher outlet
valves. 137 Bypass valves, COV-12, around the polishers are manually controlled from the control
room, and therefore the initial transient probably
could not have been prevented because it is unlikelythat the operators could have acted quickly enoughto have prevented reactor trip and the subsequent
high pressure injection. Automatic actuation of the
bypass valves with isolation of inlet or outlet valvesat the polisher could have maintained main feedwater flow and have prevented the PORV from openi ng. Operators have indicated that automatic
bypass valves at TMI-1 have prevented similar transients from occurring. 138
Efforts to open the bypass valve from the control
room failed because the valve had
previously been
139,140
making thej ammed in the closed position,
motor operator unable to unseat the valve. The motor breaker was tripped by the torque limiting
switches (that protect the motor) whose settings
were exceeded. A description of the functional performance of141the feedwater system142
is included in theplant FSAR and the EPRI report.
Instrument Air System

The loss of the main feedwater pumps, which initiated the turbine trip followed by a reactor trip, hasbeen attributed to the presence of water in the instrument air system that caused the condensate

470polisher air operated outlet valves to close. aIt
i s postulated that water at 100 psig in the condensate polisher entered the service air system, which
is at 80-100 psig, through a failed-open checkvalve. Station service air used to free blockage inthe resin transfer line is cross-connected with the
instrument air system. Inadequate capacity in the
instrument air system caused the licensee tocross-connect the service air to the instrument air
as a normal mode of operation of the two systems.
The mode of operation for air supply on the day of
the accident was the cross-connected system.
The Met Ed crew had installed air dryers at various points in the instrument air system to preventthe accumulation of moisture. In particular, an airwater separator was installed in the condensate
polisher instrument air line in series with two pressure regulators. This arrangement processed all air
to the condensate valve controls and instruments
located on the condensate polisher local control
panel.
" Met Ed has performed tests on the condensate
polisher instrument air system subsequent" to theaccident and has indicated that upon isolation of"instrument air from the condensate system, thecondensate outlet valves for each polisher tank go
closed." However, the tests also "indicated that introduction of water into the air system did not affectthe polisher outlet valves, in that the air-water145
separator functioned properly."
14

144

Findings-We have been unable to establish conclusively the exact cause of the valve closing that
led to the failure of the condensate polisher system,
which initiated the TMI-2 accident, although a reasonable scenario has been developed.
I n addition to the condensate-feedwater system,
the instrument air system, which supplies motive
power for the emergency feedwater control valves,
was compromised by the cross-connected operation with the service air system. Only selectedcomponents of the instrument air system are quality
group classified.
There was ample evidence that the condensate
polisher was not trustworthy and was capable of inducing "analyzed accidents." The warnings of theoperators were not heeded and the NRC inspectors
were apparently not charged with the responsibilityof
i dentifying
theproblem.
Becausethecondensate-feedwater system was not safety related it was beyond the purview of the NRC.
The inadequate capacity of air systems resulted
i n a compromise of the independence of an instrument air system from a process system whose use
resulted in the disturbance to the plant. Although471

safety design criteria for instrument air systems
postulate the loss of air supply to cause systems
i mportant to safety to be placed in a fail-safe mode,the failure mode of control or process systems is
generally not known. Hence, limiting the interactions between control and safety systems could
minimize plant disturbances.
Recommendations-The distinction between "safety" and "nonsafety" related systems should be replaced by a graded scale of significance.
It is understandable that certain systems andcomponents should not be considered safety related. However, some mechanism must be established to control peripheral systems, such as thecondensate-feedwater, that can initiate transientsthat challenge the reactor's protection systems.
System designs should consider implementationof piping configurations that can permit periodic
testing of valves at system conditions (e.g., differential pressure, temperature, etc.) expected during
emergencies. Proper torque switch settings could
be verified by comparison of the power-torquedelivered to the valve assembly during a test withthe maximum setting of the torque switches forvalve motor trip.
Interconnections of control, process, and safetysystems should be limited unless suitable isolation
can be provided to ensure that failures in the control
or process systems do not cause unacceptable
plant disturbances.
Condenser Hotwell Control

Following the initial turbine trip and closure of themain steam isolation valves, steam release to themain condenser
continued through the turbine
14
bypass valves. s However, in the course of the accident, the hotwell level control valve controller
failed in the low-level setting and caused the hotwell
to be flooded from the condensate storage tank.
The failure of the level control valve controller
caused the hotwell makeup valve to remain open,
allowing condensate storage tank water to flood the
hotwell and interrupt steam release to the condenser.
Subsequent to the flooding of the hotwell, theoperators attempted to reduce the level bydischarging the hotwell to the condensate storagetank through a condensate pump. 147' 148 However,
failure of the hotwell level reject valve did not permit
the discharge until about 3 hours into the accident
and after the reject valve was manually opened.
For general discussionof the hotwell control, see
14s
the EPRI report.

to survive and function under the following environmental conditions: 150,151

Following recovery of hotwell level, the condenser vacuum started to decrease and eventually
was lost. Condenser vacuum is also a required
function to maintain the ability to release steam tothe condenser. Loss of vacuum resulted from lossof the auxiliary boiler that provides sealing steam forthe interface between the turbine shell and the main
shaft.
The important decay heat removal through thesecondary was interrupted (at about 9 hours) whenthe main turbine condenser was lost (because of
failures in the hotwell level control and condenser
vacuum), and the atmospheric dump system wasordered stopped. For the period of time that thesecondary system heat removal was lost, theoperators maintained primary pressure control byreleasing primary coolant inventory through the
PORV block valve.

Normal Conditions
40-120°F, atmosphericpressure, 40-70%
relative humidity, and25 mR/hPostaccident
Conditions

286°F, 51.3 psig, 100%
humidity, and total
2 X 104 roentgens(24-hour operability)

Cables were generally qualified according tomore stringent environmental requirements. From
what we know, there is no reason to believe that the
TMI accident environment should have damaged the
RPS and SFAS systems in the first day of the accident.
Other instrumentation was classified according towhether it was or was not required for safety. The
former category included instrumentation required
for accident monitoring and for safe shutdown.
Some of the instrumentation in each subclass was
also contained in the RPS and SFAS and, therefore,
was qualified according to the higher environmental
conditions. Accident monitoring instrumentation(Table 11-44) was also designed to operate in the
postaccident environment. However, instrumentation required for safe shutdown (Table 11-45) was
not required to be qualified to these conditions, unl ess it also formed part of the RPS or SFAS.
The most vital data in accident situations arefrom accident monitoring instrumentation. It is clear,too, that systems and controls designed for safe
shutdown are also vital for postaccident management. In addition, there is a clear need for instrumentation to enable the plant to be maintained in astable, safe condition after shutdown.
The least severe qualifications were required of
instrumentation that was thought to be "not required
for safety." This category included such systems as
automatic reactor coolant pressure control, pressurizer temperature measurement, automatic pressurizer level control, the integrated control system, andthe control rod drive control system.

Findings-It appears that the importance for removal of decay heat through the secondary was notwell recognized by the operating staff throughout
the accident.
Recommendations - An assessment should bemade to determine the extent to which the secondary heat removal systems should be designed toensure their continued availability during postulatedtransient and accident conditions.
If the condenser steam dump or the atmospheric
dump systems are required to maintain the plant ina safe condition for a range of transients or accidents, as a minimum, the controls and power supply for these systems should be designed according
to criteria for systems important to safety.
e. Environmental Qualifications and Use of
I nstrumentation and Plant Data
The reliability and the accuracy of the informationthat was available to the operators during the TMI
accident and to the investigators after the accident
have been the subject of much discussion. In thissection an attempt is made to document the environmental qualifications of the instrumentation andto summarize the uncertainties in the data recorded
at TMI during the accident.

Limits of Operability

The ranges of operability of instrumentation systems (the maximum ranges of the transducers) are
shown in Table 11-46. The ranges of indication available to the operators are shown in Table 11-47.
Small excursions past the limits of operability should
not damage instrumentation systems. However, ex-

Environmental Qualifications of Instrumentation

I nstrumentation within the TMI reactor building, if
part of the reactor protection system (RPS) or safety features actuation system (SFAS), was required

472

TABLE 11-44. Accident monitoring instrumentation

End-Point
Parameters
ESF busses
energized

Recognize
Accident
Condition

Follow
CourseofAccident/
Transient

Functioningof
Mitigating
EquipmentxRequired for

Large
X

LOCA

Small

Transient

X

X

Pressurizer
Level

x

X

X

SG Press.

RC Press.
( wide range)

X
X

X

X

RC System
FlowxContainment
Press.

x

Emer. Feed.
Press.

RC Temp.
hot/cold

X

X

X

X

X

X

X

X

X

X

X

DH Cooler
OutletTemperature

X

X

X

X

X

x

X

X

X

x

X

X

X
X

x

X

X

X

BWST Switchover Valves

X

X

X

X

x

Feed Latch( valvei ndication)

x

X

X

HPI Flow
LPI Flow

X
Xx

DH Pump
Suction Temp.

X
X

X

Containment
I solation

Area Rad.
Monitor &Grab Sampling

X

X

X

X

X

X

X

x

H Content( grab sample)
SG Level( Startup &OperateRange)

X

473

X

X
X

X

TABLE 11-44. Accident monitoring instrumentation -Continued

End-Point
Parameters

Reactor Bldg.
Spray Pump
Flow

Recognize
Accident
Condition

Pressurizer
Electromatic
ReliefRequired for

Large

LOCA

X

X
X

TABLE 11-45. Systems required for safe
shutdown
Control Rod Drive Control System
Makeup Pump Control

Letdown Line Isolation Valve Control
BWST Suction Valve Control
EFW Control

Pressurizer Spray Valve Control

Electromatic Relief Valve Control

Decay Heat Removal System Controls

Nuclear Services Closed Cooling Water System
Nuclear Services River Water System

Supporting Systems (Electrical, Air, etc.)
cursion past the indicating limits means that the information is not available to the operators.
Acceptability of Plant Data

Follow
CourseofAccident/
Transient

Functioningof
Mitigating
Equipment

The acceptability of data depends on a numberof factors, some of which are subjective and difficult
to quantify. Sensors, signal conditioning equipment,
data display devices, and data recording devices
are all subject to some inherent error. In addition to
the error in equipment that is nominally in goodworking order, there is a problem of reliability; thatis, some instruments break down. Finally, there is
the question of utility; vitally needed data might beaccepted and used even if the accuracy and reliability cannot be guaranteed.

Small

Transient

X

X
X

Accuracy of the TM! Data

Required frequency of calibration and accuracies
of classes of data are specified in the Final Safety
150
the technical specificaAnalysis Report (FSAR),
153
52
It
tions,and the surveillance procedures.
should be expected that instrumentation in good
repair will always fall within the accuracy limits
shown in Table 11-48.
Errors found at the most recent calibration of
selected instruments are given in Table 11-49. It canbe seen from this table that the requirements of the
FSAR were met, at least immediately after calibration. When several components are cascaded, theoverall error is approximately the algebraic sum of
the error of individual components. For example, if
a sensor, a bridge network, a compensator, and arecorder each have errors of 0.5%, the overall error
when cascaded is approximately 2% (2.015%, exactly).
Two sources of error are not covered either byspecifications or calibrations: reading error andchart timing error. Reading error of charts or meters is governed by the width of the recording or indicating band and by the fineness of graduations. A
chart on which the recording is spread out over awide band can obviously be read with greater accuracy than one on which the reading is tightly crowded into a narrow space. Likewise, finely graduatedcharts or meters can be read with higher accuracy
than coarsely graduated charts. However, coarse
graduations can often be more easily read quickly.
As a rule of thumb, it is estimated that reasonablereading accuracy to one-half the finest graduation ispossible; however, on a few very finely graduatedcharts, accuracy is considered reasonable only tothe finest whole graduation. Table 11-50 showsachievable reading accuracy for a number of strip
charts. It will be seen that each channel should be474

TABLE 11-46. System ranges
Item

ReactorCoolant
Temperature

ReactorCoolant
Pressure(SFAS Input)

Level

Pressurizer
Temperature
OTSG A
Level

SystemDesig.

I nd.
Type

RC-5A-TE2( Cold Leg)
RC-5A-TE-4( Cold Leg)
RC-5B-TE3( Cold Leg)
RC-5B-TE4( Cold Leg)I ndicator

50-650°F

I ndicator

50-650°F

I ndicator
I ndicator

50-650°F
50-650°F

RC-15A-TE1( Hot Leg)
RC-15A-TE2( Cold Leg)
RC-15A-TE3( Cold Leg)
RC-15B-TE1( Hot Leg)
RC- 15B-TE2(Cold Leg)
RC-15B-TE3( Cold Leg)
RC-3A-PT3

Recorder0-800°F

Recorder0-800°F

RC-3A-PT4

I ndicator

0-2500 psig

RC-2-TE2

I ndicator

0-700°F

Recorder0-400 inRecorderRecorderRecorderRecorderRecorderI ndicator

RC-3B-PT3
RC-1-LT2

RecorderRC-1-LT3
RC-2-TE1

I ndicator

RC-2-TE2

I ndicator
I ndicator

SP-1A-LT1

0-800°F
0- 800°F
0-800°F

0-800°F

0-2500 psig

0-2500 psig

0-400 in
0-700°F

0-700°F

0- 600 in

SP-1 A-LT2

Recorder96-388 in

SP-1 A-LT4

I ndicator

0-250 inSP-1 A-LT3

OTSG B
Level

Range

RecorderSP-1 A-LT5

I ndicatorSP-1 B-LT1

I ndicatorSP-1 B-LT2

RecorderSP-1 B-LT3

RecorderSP-1 B-LT4

I ndicatorSP-1 B-LT5

I ndicator475

96-388 in
0- 250 in
0-600 in

96-388 in
96-388 in
0-250 in
0-250 in

TABLE 11-47. Information readouts available to the operator for monitoring conditions in the unit

Measured Parameters
Source Range Neutron
Level
Source Range Startup
Rate
I ntermediate Range
Neutron Level
I ntermediate Range
Startup Rate

Power Range Neutron
Level
Power Range Neutron
Level Imbalance

Types of
Readouts

No. ofReadouts

I ndicatorRange

I ndicator
Accuracy 3

I ndicator
Location

Purposeor
Usage

Total No.
Reqd. Ch.

No. of Ch.
Available'

No. ofSensors ina Channel

1

2

2

B,F

3

10 -' to 10`6 cps

±3

A,B,D

A

1

2

2

A,F

3

-1 to 10 dpm

±3

A,B,D

A

1

2

2

B,F

3

10 - " to 10 -3 amp

±3

A,B,D

A,B

1

2

2

A,F

3

-1 to 10 dpm

±3

A,B,D

A

3 2,4

4

4

A,F

3

0 to 125% FP

±2

A,B,D

A(B)

3 2,4

4

4

A,F

3

-62.5 to 62.5% FP

±2

A,B,D

A(B)

1

520 -620 F±2

B

2(1/Loop)

6(3/Loop)

3/Loop

A,E,F

4/Loop

RC Loop Inlet Temp.
( Narrow Range)2(1/Loop)

4(2/Loop)

4/Loop

A,E,F

4/Loop520° -620° F

±2

B,D

B

2(1/Loop)

4(2/Loop)

2/LoopA,F2/Loop50° -650° F

±2

B,D

B

_s

_s

_s

A

1/Loop520 -620 F

±2

B

A

1/Loop

A,E

2

A,E,F

3

RC Unit Outlet Temp.

RC Loop Inlet Temp.
( Wide Range)
RC Unit Tc

RC Loop Avg. Temp.
RC Unit Avg. Temp.

RC Loop Temp. Diff.
RC Unit A T

c

RC Loop Pressure (Wide)

RC Loop Pressure (Narrow)
Pressurizer Level

_s

_s
_s
_s
_s

s

_s

_s

_s
_s

_s

_s

_s

_s

_s

1

1

1

1

3

3

E

A
E

A

A,E,F

520°-620° F°°

1520° -620° F

1

520 -620 F

1

°

°

°

°

0-70 F°-10° -10° F

0-2500 psig

1700-2500 psig
0-400 in H 2 O±2BRC Loop Outlet Temp.

±2
±2

+2

±2

B,C,D

B
B
B
B

±2

A,B,C

B

±2

A,B,C,D

B

A,B,DPressurizer Temp.

1

2

2

A,F

-5

E

2

0-700° F

±2
±3

A,B,D

0-600 in H 2 O

±2

B,D

B

3/Loop0-250 in H 2 O±2

A,B,C,D

B

E,F

2/Loop0-100%

±2

B,D

B

A

1/Pump30-100%

0-100 psig(-5 psig to-10 psig)

±2

B,E

B

-

-

B

±2

A,B,C,D

B

±2

B,D

A

B,D

B

2/Loop10-180x106 l b/h

1/LoopA,F2/Loop2(1/Loop)

2/LoopA,F2(1/Loop)2(1/Loop)

2/LoopEmergency FW Press.

2(1/Pump)

2(1/Pump)

1/PumpContainment Isolation
Status42(1/Loop)2(1/Loop)

2/LoopSteam Gen. Full Range
Level

2(1/Loop)2(1/Loop)2(1/Loop)

RC Total Flow

Steam Gen. Startup
Range Level

Steam Gen. Operate
Range Level

Emergency FW Status
Containment Pressure (RPS)( SFAS)

Containment Temp.

-52(1/Loop)
2
2

-s

-s

2/Loop1/Loop

C,F

1

A,E,F

4

1/ValveC

1/Valve

1/Loop
4
3

-5

20

A

1

-

-

±2

100° -650° F±2

0-6.5x10 6 1 b/h±2

2(1/Loop)

4(2/Loop)

2/Loop

A,E,F

3/Loop0-1200 psig

Startup FW Flow

2(1/Loop)2(1/Loop)

1/Loop

A,E,F

3/Loop0-1.5x106 1 b/h

2/LoopA,F2/Loop0-500 ° F

Main FW Flow

Feedwater Temperature
Nuclear Services
River Water Pump
Discharge Pressure

N.S. River Water PumpMotor Amps.
N.S. River Water Hdr.
Temperature
N.S. Cooler Outlet
Temperature2(1/Loop)

4(2/Loop)

2/LoopA,F

A,E,F

2/Loop3/Loop±10-300° F

Steam Gen. Outlet Press.
Steam TemperatureB±30-90x10 6 1 b/h

A,F

RC Loop Flow

B,D

A,B,E

13,13
B

B

B,D

B,D

B

B

B

4(2/Loop)

2/Loop1/Pump4(1/Pump)

1/PumpA,F3(1)/Pump

0-100 psig

±1

B,D,E

B

1/Pump4(1/Pump)

3/Channel

A,F

12(Total)

0-100 amps

±1

B,D,E

B

1/Hdr

2(1/Hdr)

1/Hdr

A,F

3(1)/Hdr

20° -220 F

±1

B

B

1/Cooler2(1/Cooler)

1/Cooler

A,E,F

3(1)/Cooler

20° -220 ° F

±1

B,D,E

2(1/Loop)2(1/Loop)

4(2/Loop)°±2

TABLE 11-47. Information readouts available to the operator for monitoring conditions in the unit-Continued

Measured Parameters

Total No.
Reqd. Ch.

No. of Ch.
Available )No. ofSensors ina Channel

Types of
Readouts

No. ofReadouts

I ndicatorRange

I ndicator
Accuracy 3

I ndicator
Location

Purposeor
Usage

Decay Heat Closed System
Service Cooler River
Water Outlet Temp.

1/Cooler2(1/Cooler)

1/Cooler

A,E,F

3(1)/Cooler

20 ° -220° F

±1

B,D,E

B

Nuclear Services River
Water Pump Disch.
Hdr. Pressure

1/Hdr

2(1/Hdr)

2/Hdr

A,F

3(1)/Hdr

0-100psig

±1

B,D,E

B

Decay Heat Service
Cooler Cooling Water
I nlet Temperature2(1/Cooler)

1/Cooler

1/Cooler

A,F

3(1)/Cooler

20 ° -220° F

±1

B,D,E

Decay Heat Service
Cooler Cooling Water
Outlet Temperature

1/Cooler

1/Cooler

1/CoolerA

1/Cooler

20 ° -220° F

±1

B

B

Decay Heat Closed
Cooling System
Disch. Pressure2(1/Pump)

4(2/Pump)

1/PumpA

2(1)/Pump

0-100 psig

±1

B,E

B

Decay Heat Closed
Cooling Surge
Tank Level

1/Tank2(1 /Tank)

1/TankA

2(1)0-5 ft 6 in

±1

B,E

B

Nuclear Services
Closed Cooling Pump
Suction Hdr. Pressure

1

1

1

A,F

2

0-30 psig

±1

B,D

B

Nuclear Services
Closed Cooling Pump
Disch. Hdr. Pressure

1

1

1

A,F

2

0-100 psig

±1

B,D

B

Nuclear Services
Closed Cooling
Service Coolers Inlet
Temperature

1

1

1

A,F

2

20 ° -150 ° F

±1

B,D

B

Nuclear Services
Closed Cooling Service
Coolers Outlet Temperature
Nuclear Services
Closed Surge Tank Level
Core Flooding Tank Level
Core Flooding Tank
Pressure

Makeup Pump Suction
Hdr. Pressure
High Pressure
I njection Flow

Decay Heat Removal
Reactor Outlet Temp.
Decay Heat Removal
Pump Discharge
Pressure

Decay Heat Removal Flow
Borated Water Storage
Tank Temperature

Borated Water Storage
Tank Level
Sodium Hydroxide
Storage Tank Level

Sodium Hydroxide
Storage Tank Temp.

Decay Heat Removal
System Cooler Outlet
Temperature
Spent Fuel Cooling
Pump Discharge
Pressure

1/Cooler2(1/Cooler)

1/CoolerF

2(1)/Cooler

20° -150° F

±1

D,E

B

1

1

1

A

2(1)

0-8 ft 0 in

±1

B,E

B

2/Tank4(2/Tank)

1/Channel

A,F

2/Channel

0-14 ft 0 in

4(2/Tank)

4(2/Tank)

1/Channel

A

1/Channel

0-800 psig

±2

B

A

1

1

1

A

1

0-100 psig

±1

B

B

1/Loop4(1/Loop)

1/LoopA

1/Loop0-600 gpm

±2

B

B

1/Loop2(1/Loop)

1/LoopA

1/Loop0-350 ° F

±2

B

B

1 /Pump

1 /Pump

1/PumpA

1 /Pump
1/Loop0-600 psig

0-5000 gpm

±2

E

B

1

1

1

A

1

0-200° F

±2

B

2

2

1

A,F

3

0-56 ft 0 in

±2

B,D

1

1

1

A

2(1)

0-50 ft 0 in

±2

B,E

1

1

1

A

1

0-200O F±2

B

1/Cooler2(1/Cooler)

1/CoolerA

1/Cooler

0-300° F±2

B

B

1/Pump2(1/Pump)

1/PumpA

2(1)/Pump

0-160 psig

±2

B,E

B

1/Loop1/Loop1/Loop

A

±2

±3

13,13

B

B

TABLE 11-47. Information readouts available to the operator for monitoring conditions in the unit-Continued

Measured Parameters
Spent Fuel Water Cooler
Outlet Temperature
Spent Fuel Pool Temp.
Spent Fuel Surge
Tank Level
Borated Water Pump
Discharge Pressure
Spent Fuel Cooling Flow
to Demineralizer
Area Gamma Monitors
Reactor Building
Dome Monitor
Atmosphere Monitors( Particulate, Iodine
and Gas)Gas Monitor

No. of Ch.
Available)

No. ofSensors ina Channel

Types of
Readouts

No. ofReadouts2

I ndicatorRange

I ndicator
Accuracy3

I ndicator
Location

1/Cooler2

1/Cooler1

1/Cooler
1/Channel

A,F
A,F

3(1)/Cooler2(1)0-250°F
0-200°F

±2

B

±2

B,D,E
B,D,E

1

1

1

A

1

0-40 in

±2

B

B

1

1

1

A

2(1)

0-160 psig

±2

B,E

B

1
20
Monitors1120(1/Monitor)
1

1

A

2(1)

0-250gpm

B,E

B

1/Monitor
1

B,E
B,E

-7

0.1 to 104 mr/h
103 to 108 mr/h

±2±2 of setpoint
±2 of set
point

A,B

B

A,B

B

A,B

B

A,B

B

A,B

B

A,B

B

Total No.
Reqd. Ch.

126

Liquid Monitor

10

4(1/
Monitor)
1/Monitor

Failed Fuel Detector( Gamma and Liquid)

1

1

Legends: Type of Readout
A-Linear Scale Indicator
B-Log Scale Indicator
C-Indicator Light
D-Digital Indicator
E-Recorder
F-Plant Computer Output

4

12(1/Monitor) 1/Monitor

B,E

-7

1/Monitor

B,E-7

1/Monitor

B,E

7

1

B,E

3

Indicator Locations
A-System Cabinets
B -Control Room
C-Local Auxiliary Panels
D-Plant Computer Printout
E-Local

Number of transmitters that are fed by the sensors providing the signal to the instrument siting.
Number in parenthesis indicates number of local indicators with no electrical channel.
3 Accuracy at a percent of full measure.
4 Assumes one channel in bypass.
sTwo or more signals combined to produce indicated parameter.
e Includes two portable monitors.
Multiple readouts (more than 3).
2

3

101 to 106 counts
per minute
101 to 106 counts
per minute
101 to 106 counts
per minute
101 to 106 counts
per minute±2 of setpoint
±2 of setpoint
±2 of setpoint
±2 of setpoint

Purposeor
Usage

Purpose or Usage
Blank-Information only
A-Total number of channels required for unit startup according to
Tech. Specs.
B-Total number of channels considered to be essential for safe,
normal operation.

TABLE 11-48. Accuracy required by FSAR
Parameter

Range

Accuracy,% of Range

520-620°F±2

RC Outlet Temp. NR'

520-620°F

RC Inlet Temp. WR*

50-650°F

RC Inlet Temp. NR*
Loop 0 T

Loop Press. WR

0-90x10 6 l b/hOperate Range

±2
±2

±3
±2

0-100%

St. Gen. Press.

0-1200 psig

HPI Flow

0- 600 gpm

BWST Level±20-250 in

0-100 psig

Steam Temp.

±12°0-400 in

RB Press.

RB Temp.

±20-2500 psig

Loop Flow

Startup Range

±2°

±2

1700-2500 psig

Pressurizer Level±2

0-70°F

Loop Press. NR

Accuracy,
i n Units

±2
±1

±2

0-300°F±2

100-650°F±2±2

0 56 ft

±2

-

±2°

± 1.4 °

±50 psi± 16 psi±8 in±2.7x106 l b/h
±5 in
-2%

± 1 psi±6°±24 psi±11°± 12 gpm± 1.12 ft*RPS temperature loops must be accurate to ±1%.

gives no assurance that the chart has not been
tampered with between events. Time can be established on a few charts with an accuracy of 3
minutes. However, as a general rule, 12 minutes, oreven greater variations, must be considered
representative.
However, the reactimeter data are much more reli able. There is no possibility of an amplitude error
other than the instrument channel error, and time
can be matched to within a few seconds. Therefore, in attempting to match reactimeter data to
strip-chart data, disagreements have been resolved
i n favor of the reactimeter.

readable to an accuracy at least up to the specified
i nstrument accuracy.
Chart timing error should be easy to assess. It
ought to be possible to read to 0.1-inch accuracy; atthe most common chart speeds (2 inches per hourand 1 inch per hour) the reading error would notexceed 3 to 6 minutes. However, the following improper practices were found at TMI-2:• Time of day was not accurately or clearlymarked.

• Charts were translated without new markings.
• Chart speed did not match the speed written on
the chart.

• There were insufficient fiducial time markings.
• Chart speed obviously changed during recording.

Reliability of the TMl Data

Data channels that had given trouble in the pastundoubtedly would be viewed as less reliable thanthose that had operated without difficulty. From asample of 45 incidents reported in the TMI-2 "In-Because of these improper practices, the only
way that timing can be read with any confidence onthese charts is to locate two known events andmeasure the distance between them. Even this481

TABLE 11-49. Errors at most recent calibration of selected instruments
I nst.
No.
RC3A-PRI
RC5A-TI2
RC4A-TI2
RC4B-TI2
RC5A-TTI
RC5A-TT2
RC2-TEI
RC2-TTI
RC1-LTI
RC1-L11
RC1-LT2
RC1-LT3
RC1-LR
RC2-TT2
RC9-TE
RC10-TE1
AH-YMTR5017
AH-TE-5012
AH-TE-5022
BS-PR-1412
BS-PR-4388
DH3-LT2
DH3-LI1
DH3-LT2
DH3-LI2
SP6A-PI1
SP6B-PI1
SP6A-P12
SP6B-P12

MS-TE-1097
MS-TT-1097
SP1A-LT2
SP1A-LAMI
SP1A-LR
SP1A-LT4
SP1A-LT5
SP1A-LT1
SP1A-LI1

Cal. Date

Error
Full Range

RecorderI ndicator
I ndicator
I ndicator
BridgeBridgeSensorBridgeTransmitter
I ndicator
Transmitter
Transmitter
RecorderBridgeSensor

6/30/78
3/30/78
4/13/78
4/13/78
5/22/78
3/12/78
3/3/77
3/6/78
3/25/78
8/9/76
12/29/78
9/23/78
1 2/22/77
5/4/77
3/3/77

0
0
0.5%
0
0
0.03%
0.04%
2.0%
0.05%
0
0.14%
0
1.5%
0.71%
0.09%

Sensor

3/3/77

0.01%

RecorderSensor

3/23/79
11/19/77

0.15%
0.1% '

Sensor

1 2/19/77

0.17%

9/9/780

SystemRCS Pressure, N.R.
RCS Inlet Temp.
RCS Outlet Temp.
RCS Outlet Temp.
RCS Inlet Temp.
RCS Inlet Temp.
Pressurizer Temp.
Pressurizer Temp.
Pressurizer Level
Pressurizer Level
Pressurizer Level
Pressurizer Level
Pressurizer Level
Pressurizer Temp.
Pressurizer Inlet
Temp.
Pressurizer Relief
Outl. Temp.
RB Temperatures
RB Temperature, RCDTArea
RB Temperature, 330
ft Elev.
RB Pressure
RB Pressure
BWST Level
BWST Level
BWST Level
BWST Level
Steam Gen. Press.,
Loop A
Steam Gen. Press.,
Loop B
Steam Gen. Press.,
Loop A
Steam Gen. Press.,
Loop BOTSG A Outlet Temp.
OTSG A Outlet Temp.
OTSG A Oper. LevelOTSG A Oper. LevelOTSG A Oper. LevelOTSG A Startup LevelOTSG A Startup LevelOTSG A Full range
OTSG A Full range

Type

RecorderRecorderTransmitter
I ndicator
Transmitter
I ndicator
I ndicator
I ndicator

11/22/76
11 /22/76
2/17/79
8/4/77
12/10/77
1/30/76
9/9/78

0
0
0.22%
1.79%
0.26%
0.18%
0

I ndicator

4/13/780

I ndicator

4/13/78

0.4%

SensorTransmitter
Transmitter
Compensator
RecorderTransmitter
Transmitter
Transmitter
I ndicator

5/10/78
9/5/78
11/7/78
4/11/78
1/14/79
11/9/78
11/9/78
11/8/78
6/29/76

0.5%
0.05%
0.30%
0.08%
0
0.12%
0.10%
0.18%
0.67%

some others, although this is unlikely to be significant, given the small size of the data sample.
Past operation of the data channels cannot give
much information on the actual, as opposed to perceived, reliability. Conditions during the accident(e.g., temperature, humidity, and radiation) weremuch more challenging than at any time in the history of the plant. For example, the peak temperaturestrument Out of Service Log," 42% were alarms,
33% were radiation monitors, 13% were temperaturechannels, 4% were pressure channels, and theremainder were equally divided among level, flow,
and electrical channels. It is probable that alarms
and radiation monitors would be perceived as lessreliable than other data. There were somewhat
more problems with temperature channels than with482

TABLE 11- 5 0. Estimated recorder reading accuracy
Range

Est'd Rdg
Accuracy

Req'd Instrument
Accuracy

RCS Temp.

0-800°F5°

1 6°

Steam Gen. Temp

0-800°F

5°

16°

RCS Unit Tave.

520-620°F

1°

2°

RCS Unit Outlet Temp.

520-620°F

1°

2°

RCS Press. MR)

0-2500 psig

25 psi50 psiRCS Press. (NR)

1 700-2500 psig

5 psi

16 psiReact. Bldg Press. (NR)-5-+10 psig

0.2 psi'0.15 psi

React. Bldg. Press. MR)

0-100 psig

1 psi'

1 psi

React. Bldg. Temp.

0-200°F1°

6°600-1200 psig

5 psi

24 psiPressurizer Level

0-400 in

2.5 in8 in

Steam Gen. Level

0-100%

1%

2%

Makeup Tank Level

0-100%

1%

SRM and IRM

8 decades

0.1 decade2

2%
3

Rad. Monitors

5 decades

0.1 decade2

40-110X106lb/h

1x106Ib/h

5.4xl06lb/hParameter

Steam Press.

RCS Flow' Chart alternates between wide and narrow range. Reading of each trace is different when
not in2Log
its own
range.
scale-accuracy
varies. This is an estimated average.
33% of full range.
42% of setpoint; varies with instrument.
bad data, and it has generally not been possible todetermine whether out-of-range data are correctlyi ndicated without access to additional information.
High reliability can be ascribed to data confirmed
from an independent source. Redundant reactimeter and strip-chart data generally tend to confirm
each other, although the low accuracy and poor legibility of some of the strip charts make comparison
difficult. Reactor coolant system (RCS) pressure
and temperature data appear to be particularly wellconfirmed, while PORV block valve opening andclosing times cannot be unequivocally confirmed.
Estimates of data reliability are given in Table 11-51.
The most vital information pertains to core water
i nventory. Because they lacked this information, theoperators depended on an inappropriate substitute:pressurizer level, and this dependence on pressurizer level readings actually caused incorrect actions

measured on the incore thermocouples (2580°F)
was near to the liquidus temperature of the Inconel
sheaths (2600°F). As a result, melting of junctions
and rewelding of false junctions is a distinct possibility. Further voiding of the pressurizer referencel eg because of evolution of dissolved hydrogen may
have occurred.
Degradation of insulation due to high temperature, humidity, and radiation in the reactor building
could have caused false readings. Whether environmental extremes caused misperformance of instrumentation can only be a matter of conjecture.
Even if a channel is found to be inoperative in a
postmortem examination, it is not usually possible todetermine when the failure occurred.
Perceived reliability is, of course, lower for outof-range channels. Furthermore, the plant computeruses the same symbol for data out of range as for483

TABLE 11-51. Estimated data reliability
Data

Confirmatory Sources

Primary Data Source

Reliability
Ranking

RCS Pressure

Reactimeter

Strip charts, utility printerGood

Press. Level

Reactimeter

Strip charts, utility printerGood

Reactimeter

Strip charts

RCS Temp.

Press. Temp.
OTSG LevelOTSG Press.

Strip charts, utility printerReactimeter
Utility Printer-Reactimeter

Strip charts

Good
Good
Fair

Very PoorEFW Flow

OTSG Level Change

PORV Block Valve
Opening

Operator Recollection

Tailpipe temp., RB Press. and
Temp.

Poor

I ncore T/C's (alarm
printer)

One set of manually readvoltagesPoor

MU Flow

BWST Level

Core Temps.
Pump Start and
Stop

None

Good

BWST Level

Operator Recollection

Logs

Alarm printer

Poor

None

Fair

Operator recollectionGood

cident sequence. Training in the importance ofcorrect marking and stricter administrative control
should ensure better marking practices. Also, some
additional consideration should be given to the importance of historical reconstruction when selecting
the channels to be recorded.
Accident reconstruction would also have been
aided by more complete data recording on tape.
The reactimeter data were quite helpful, but would
have been even more useful if the entire range ofeach channel had been recorded and if the datachannels had been specifically selected for accident
analysis. Postmortem analysis would be easier andbetter if a similar recording device was dedicated toanalysis of accidents and other abnormal occurrences.

to be taken. Similarly, the lack of emergency feedwater flow indication caused the operators to seize
on a set of substitutes-discharge pressure,"eleven-valve" opening, and steam generator level.
This set of substitutes did, however, eventually leadto the correct conclusion, but only after a considerable delay.
Nearly as important as the lack of some needed
data was a confusing excess of unnecessary information. As an example, one of the factors leading
to the alarm printer falling behind was the great
number of alarms caused by feedwater heaters.
These alarms were not germane to the situation,and suppression of them would have helped clear
the computer for more useful tasks.
Utility of Data for Historical Reconstruction

Needs for Improved Instrumentation

For a reconstruction of the accident sequence,
additional data would have been useful. This isespecially true when trying to understand the
motivation for actions taken, where a voice recordi ng of operator discussions would probably havebeen helpful.
The improper practices concerning strip-chartmarking have hindered reconstruction of the ac-

There is a need for improved instrumentation ofseveral kinds, which we discuss here.
Need for Disturbance Analysis Systems

On October 5, 1966, the Enrico Fermi Atomic
Power Plant, a 200-Mwt sodium cooled liquid metal484

fast breeder reactor underwent a fuel melting incident. Prior to this incident the Fermi Plant staff
had noted anomalous thermocouple readings at theoutlets of several fuel subassemblies. While investigating the anomalous thermocouple readings, it wasobserved that several subassemblies had abnormally high outlet temperatures, and there was leakageof fission products into the reactor buildings. A
subsequent investigation found that melting of a
portion of two fuel assemblies had taken place.
This was caused by a loose zirconium deflector
plate that blocked the inlet nozzles of several fuelsubassemblies.
As a result of this incident a study was initiated154 to determine a prompt, reliable, and economicmeans to detect malfunctions and enable corrective
action to be taken to prevent damage to the plant
and the environment. This study determined thatsufficient information was available from existing instrumentation that, if accurately and rapidly
analyzed, could have detected the occurrence ofabnormal conditions in sufficient time to reduce andprobably eliminate fuel melting. Consequently, an
online computer, called a malfunction detection
analyzer (MDA), was designed and added to thereactor to detect anomalous conditions involving
reactivity, core outlet temperature, and fission product releases.
The MDA utilized an IBM 1800 computer and was
put on line within a few years of its conception. It
compared measured values with predicted values ofsubassembly temperature rises on the basis ofsubassembly power generation, total core power,
and primary flow rate. If the difference between
predicted and measured temperature rises exceeded prescribed values, the MDA would initiate awarning. Similarly, anomalous reactivity or fission
product releases would initiate warnings. The MDA
was installed as an operator aid and was not connected to the reactor protection system.
At first, operators considered the MDA and thecomputer a "black box," and were apprehensive
about it. Subsequently, with increased understandi ng and reliable use, the MDA became a valuablereactor monitoring and data acquisition device thatwas considered an indispensable aid by the operations personnel.155

have not felt a real need. The Electric Power
Research Institute is spending a great deal of money on a sophisticated neutronic analysis system toi mprove plant efficiency during normal operations, 156
and General Electric and Combustion Engineering(to name only two) also have developed experimental systems for anticipatory control that have notbeen sold to any U.S. utility.
In Europe, however, the situation is somewhat
different. The Halden Reactor Project (in Norway)
has been developing and testing computerized
reactor control and disturbance analysis systems on
their small reactors for a number of years. The
Kraftwork Union (German PWR vendor), working
both independently and cooperatively with the Halden Project, has developed and installed computerized xenon transient controls on Biblis A&B reactors(1300 MWe) and disturbance analysis capability in
the Grafenrheinfelt reactor.
Recommendations - TMI has shown us that theplant operators need more help in analyzing
anomalies, and utilities should be required to install
MDAs in each plant to assist the operators in controlling the plant.
Instrument Failures
Very few instrument failures occurred during theaccident. This is significant when one considers theduration of the accident, the flooding, radiation in thereactor building, and the degree of core damage.
Conditions of high humidity and radiation havecontinued at TMI-2 since the accident. There has
also been considerable flooding by water that is still
far from pure. The possibility of cables being underwater in an electrical conducting solution for amatter of months was not considered in the design.
The total integrated radiation qualification of manysystems may have been exceeded. However, no
failures have been ascribed to this condition alone.
It is clear, however, that the requirement that systems be operable for 24 hours in an accident environment is far too lenient.
Pressurizer level indicators did fail. These areconsidered "accident monitoring instrumentation"
and, as such, are designed for the postaccident environment. The first such failure occurred at 9:14
p.m., March 29, 1979.157 This was more than 24hours after the accident began and, hence, does nottechnically demonstrate a lack of compliance withthe environmental qualifications.
Some incore thermocouples appear to have beendamaged in the accident. These were considered
not related to safety and would not necessarily be

Findings- Today about a dozen years after theconception of the Enrico Fermi Plant's MDA, no
operating reactor in the United States has such ananalyzer. This is due in part to the much greater
complexity of the neutronics of a large LWR, to regulatory disincentives, and to the reluctance of theutilities to spend money for a system for which they485

flow and high pressure injection were continuously
throttled by the operators to control pressurizer level, and the instantaneous flow indication was used
for that control. This indication, however, was notrecorded for later reference, and it became important for assessment of water inventory in the reactor.
The lack of flow recording for reactor coolant
makeup, letdown, and high pressure injection has
hampered evaluation of reactor inventory assessment during the accident.

expected to survive environments more severe thannormal operation.
Moreover, no matter what
category these instruments had been placed in, theferociously severe core environment probably would
have damaged them. Temperatures of 3000°F andhigher are most challenging for any instruments,
given our present technology. The same is true forself-powered neutron detectors. However, consideration should be given to installing thermocouples as a matter of course and to protecting leads
from high temperatures to the maximum extent possible.

Findings- Very few instrumentation failures occurred, and almost all systems performed far in excess of their requirements. The failures that did occur can be ascribed to too lenient environmental
qualification, to exceptionally severe environmental
conditions, and to qualifications for too short a time.
The RPS and SFAS systems and, to some extent, accident monitoring systems are environmentally qualified for postaccident environments. Systems required for safe shutdown are not so qualified. No category is established for instrumentation
required to maintain stable conditions after shutdown, as existing qualifications call for only 24-hour
operation in the accident environment.
Accuracy of instrumentation from preaccident
calibration appears to be adequate. However, poor
control room practices resulted in difficulties in chartreading.
The reliability of alarms and radiation monitors
were perceived to be lower than other data channels. Considerable confidence can be placed onmost RCS parameters, within their specified accuracy, and subject to the difficulties in chart timing error. However, PORV block valve opening and closi ng times cannot be reliably determined.
The utility of the data for operation wascompromised both by the lack of some vital data
and by a confusing superfluity of low priority data.
Little thought appears to have been given to the utili ty of data for historical reconstruction of the accident. Inappropriate substitutes were used for unavailable data.

Lack of Sufficient Range Indication on Temperature

Display instruments for incore thermocouples
have an indication range to a maximum of 700°F.
Thermocouple temperatures during the accident exceeded 2000°F but were not indicated by the instrumentation available to the operator. However,externally placed instruments (digital voltmeters)with sufficient range recorded these higher temperatures during the accident. Because such temperatures were not anticipated and provisions were
not made for use of display, the operators did notplace the proper significance on the higher temperature readings recorded. Operators have indicated in interviews that they were reluctant to attribute significance to the readings because the thermocouples were not assessed as important to safety and were not designed to safety standards.
Reactor coolant temperatures also exceeded thendicated
range of their display instruments duringithe accident. The indicated narrow range for hotl eg and cold-leg temperatures is 0-620°F and
0-520°F, respectively. Strip-chart recordings havea range of up to 800°F, which was also exceeded.
Computations for average temperature readings
are based on the indicated narrow range of the
hot-leg and cold-leg temperatures. Therefore, theaverage temperatures computed during the accident
remained at about 570°F (hot leg) and 10°F (cold leg)
lower than normal operating temperatures. These
readings of the average temperatures appear tohave misled some operators who did not recognizethat the average temperature
readings of the instru15 ,159
ments were in error. s

Recommendations- Many of the recommendations
made in the following sections are covered
in Revi157
No.
2
toRegulatory
Guide
1.97
and
the
sion
American Nuclear Society Standard 4.5 (draft). 1 O
Therefore, if these guides are adopted, the recommendations marked with an asterisk(*) will be superfluous.

Lack of Recording of Reactor Coolant Makeup
Flows

Throughout the accident, flow indication of the
makeup and high pressure injection was very important to the operators, particularly when thesesystems were placed on manual control. Makeup

Specification of Environmental QualificationsDesign of cables and some sensors for operation
486

after flooding should be considered, and their required time for postaccident operation should be
l engthened.
Categories of Systems- Accident monitoring andsafe shutdown systems should be qualified to full
accident conditions.* In addition, a category shouldbe established for "systems required to maintain theplant in a stable condition" that are qualified tooperate in full accident conditions.* Careful review
of instrument and control systems should be carriedout to make sure that items such as pressurizer
heaters do not get left out or get placed in improper
categories.
Accuracy and Reliability of Data-Administrative review of instrument repair records is necessary sothat unreliable systems will be upgraded. Stricter
control on strip-chart marking should also be instituted.
Utility of Data- Data presented to the operators
should be reviewed to make sure that importantdata are continuously available.* Consideration
should be given to layout so that important data canbe readily assimilated without distraction by less important displays.*
Recording devices meant to document data forhistorical reconstruction of accidents or off-normal
incidents, such as control room voice recorders,magnetic tape, disk recording of important parameters, and dedicated strip charts, should be installed.
2. CORE DAMAGE AND RECOVERY
a. Data Analysis for the First Sixteen Hours
Introduction

This discussion analyzes the thermal, hydraulic,and neutronic conditions inside the reactor primarysystem during the period in which damage to thefuel assemblies most probably occurred. The information on the behavior of several of the reactor
system parameters has been gathered from several
sources. Table 11-52 lists the data sources for thoseparameters found useful in the analysis.
I n several cases, the behavior of the reactor system parameters had to be inferred from other data.
For example, the opening and closing of the block
valve upstream of the pilot -operated relief valve(PORV) had to be inferred from both an analysis of
the reactor building pressure strip chart for indications of changes in slope and an analysis of thealarm printer indications of the alarming and clearingof the alarm for the tailpipe temperatures of the
PORV. The data given for the system saturation
temperature, Tsat, are calculated from the systempressure and are given for reference purposes only.
Because large temperature differences existed
simultaneously among various parts of the systemat many times during the accident, the calculated
T,,t can only be used as a reference point to judge
the deviation from condensible vapor behavior at
any given time during the accident.
The time conventions used in this discussion are
as follows: the time since the start of the accident
i s given in hours and minutes (e.g., 1 hour 15
minutes), assuming a time zero of 04:00:00 a.m. on
March 28, 1979, and clock time is given on the 24hour clock-time basis and Eastern Standard Time(e.g., 05:33:22 a.m. is 5 hours, 33 minutes, and 22
seconds of a 24-hour day).
The abbreviations used in the status summaries
and much of the following text are defined in Table
11-53. An isometric drawing of the reactor primarysystem is presented in Figure 11-23, and a schematic
showing volumes in the system is presented in Figure 11-24. The most important features and elevations are identified. A plan view of the pressurizer isshown in Figure 11-25.
The plant parameters that seem to have somecorrelation to each other and to the total systembehavior are plotted in Color Plates III, IV, and V.
The time scales of each of the plotted parameters
have been matched to the best accuracy possible,
but except where otherwise noted, a time coincidence of no better than about 3 minutes should be
expected for events or responses that actually were
simultaneous. 161
Other parameters have been plotted and exami ned for correlation to system behavior, such aspressurizer heater trips and makeup tank levels, but
did not correspond to the data presented in Color
Plates III and IV. Thus, the data on these parameters are not reported in this section.
General Description of the Accident Sequence

While the available data in the early minutes of
the accident are of interest to thermal-hydraulic experts, data of interest to those involved in the estimation and evaluation of the damage to the coredoes not develop until the last reactor coolant
pumps were shut down at 1 hour 40 minutes. Therei s no evidence to indicate that any damage to thecore had occurred earlier.
When the second set of reactor coolant pumps
were turned off, the two-phase coolant mixture
487

TABLE 11-52. Sources of data about reactor system parameters
Data Sources

I nferredfrom
Alarm PrinterI nferredfrom
Strip Chart

Pressurizer Pilot Operated
Relief Valve (PORV)

X-tail pipe
temp alarms

X-building• reactor
pressures
X-building
temperature

Pressurizer Block Valve

X-tail pipe
temp alarms

X-building
reactorpressure
X-building
temperature

Parameter
Hot-and cold-leg temperatures (OTSG)(T H , TC )Reactor system pressures( RCP)OTSG pressures and levels
Pressurizer temperature(T

Utility
Typer 3

HourlyComputer Log o

StripChart s

x

X

X

X

x

X

X

Reactimeter
Log 1
X

Alarm
Printer 2x

pzr)

Pressurizer surge line
temperature (T surge )Pressurizer spray valve
operation

Makeup pump operation
Reactor Coolant Pump
( Operation
RC-P1 A, 2A, 1 B, 2B)
I ncore Thermocouple
temperatures(Incore T/C)

Self-Powered Neutron
Detectors (SPND)
1

X

X

X

x
x

x

x
X

X-plus one
set of instrument
measurementsx

X

TMI Reachmeter Patch Log March 28, 1979 (NRC Reel OPS-2-806.283).

2TMI Control Room Computer Alarms Data March 28, 1979 (NRC Reel OPS-2-800.2784).

3TMI Operator Special Summaries March 28. 1979 (Utility Printer) (NRC Reel OPS-2-802).
4

TMI Station Log March 28. 1979 (Log/Typer) LSL 0001 (NRC Reel OPS-2 -801.2960).

5TMI Plant Strip Charts. By name-OTSG and Primary System Temperatures, March 21, 1979 to April 4, 1979. SC-0043 Recorder 10 (NRC Reel OPCP-2-803).

TABLE 11-53. Definitions and abbreviations
RCP-Reactor coolant pressure, reactor primary system pressure.
RC-P-Reactor coolant pumps 1 A and 2A, on OTSG A, 1 B and 2B on OTSG B.
MU-P-Makeup pumps 1A, 1B, and 1C.
Lpzf-Indicated level of water in the pressurizer in inches.
Atmos. Dump Valve-The valve that allows the steam developed in either or both steam generators to be
dumped to the atmosphere outside the reactor building.
OTSG A-Once-through steam generator A.
OTSG B-Once-through steam generator B.
Tsur e- Temperature indicated by a thermocouple strapped on the outer surface of the surge line
between the OTSG A hot leg and the pressurizer.
T-Temperature in °F measured in the interior of the pressurizer, just above the heaters, by a resistance thermometer called an RTD.

SRM-Counts per second of the Source Range Monitor (SRM), sensing thermal neutrons from the reactor
core, primarily from the peripheral bundles. In this accident, SRM is mostly an indicator of waterl evel in the downcomer in the reactor vessel. However, sudden changes in count levels may also be
i ndicative of major changes in geometry of the core.
THA-Temperature in °F of the hot leg between the reactor vessel and OTSG A, measured by an RTD
about 54 inches below the tangent point of the curve at the top of the hot leg.
THB-Hot-leg temperature for OTSG B.
TC1A, TC2p, ' TCB-Temperature in °F of cold legs 1A and 2A of OTSG A, and either 1B or 2B (believed tobe 1 B) for OTSG B, measured a few inches below the inlet to the pertinent reactor coolant pump.
PORV-Pilot-operated relief valve on the pressurizer.
Block Valve-The gate valve positioned in the line between the pressurizer and pilot-operated relief valve( PORV) that was stuck in the open position.
RTD-A platinum resistance thermometer used to measure system temperature.
Engineered Safety (ES) System Actuation-A series of valve and pump actuations automatically performed when certain safety limits in the total reactor system are exceeded. It includes isolation of
the reactor containment building, tripping of MU-P1 B (unless the trip is bypassed), starting of MUP1A and 1C, opening of the four "16" valves for maximum makeup flow of about 1000 gpm total fromtwo MU-Ps, start of containment and sprays, start of decay heat pumps.
Steaming to Condenser or Condenser Vacuum-The normal mode of heat removal from the system is bysteam production in the OTSG, steam passage through the generating turbines, and condensation in
the steam condenser. The flow of steam to the turbines can be bypassed.
PZR Spray Valve-The valve in the pressurizer spray line connecting the outlet side of the RC-P2A to the
top of the pressurizer and used for "spraying down" the pressurizer in normal operation to decrease
the system pressure.
Pressurizer Vent Valve-A separate venting valve located on the top of the pressurizer which can be used
to reduce system pressure.

489

FIGURE 11-23. TMI-2 Isometric Schematic Drawing
still open, and the system was still slowly "blowing
down."
Almost immediately after the pump shut down,
the water level in the core began to decrease, as itboiled off to escape the system or be condensed in
an OTSG, and the exposed sections of the fuel rods

separated, water going to the lower levels andsteam to the upper. We estimate that water filled
about one-half of OTSG B, about one-quarter of
OTSG A, and to about the top of the core of thereactor vessel. However, the pressurizer still contained a two-phase mixture because the PORV was
490

FIGURE 11-24. Coolant System Flow Diagram

FIGURE 11-25. The Pressurizer

492

COLOR PLATE III. PLOT OF SYSTEM PARAMETERS FOR THE
FIRST 16 HOURS OF THE TMI-2 ACCIDENT.

COLOR PLATE IV. HOT AND COLD LEG TEMPERATURES IN THE
LATER HOURS OF THE TMI-2 ACCIDENT.

COLOR PLATE V. EXPANDED TIME PLOT OF REACTOR LOOPTEMPERATURES AND STEAM GENERATORLEVELS.

began to heat up. When the hottest part of a fuelrod reached 1500±100°F, the rod ballooned andburst, releasing the gases in the gap between thefuel and the cladding to the reactor vessel, and ultimately to the reactor containment via the pressurizer, the open PORV, and the reactor coolant draintank. At about 2 hours 12 minutes, the pressure in
the reactor primary system began to increase eventhough the PORV was still open. By the time the
PORV block valve was closed by a shift supervisor
arriving 162,163
early for his shift duty (2 hours 20
minutes)the system pressure had increased
164from 670 to 750 pounds per square inch (psi).
By this time, the two hot-leg temperatures had
reached 580° and 650°F. The operation of the RCP2B at 2 hours 54 minutes produced a great burstof steam and pressure as the coolant from OTSG B
caused water in the core to rise and cover parts ofthe very hot fuel rods. It is believed that the major
damage to the fuel rods in terms of oxidation of thecladding in the upper parts of the fuel bundles had
occurred by this time and that the rapidly rising water level in the core, coupled with the large increasei n steam production, thermally shocked the embrittled fuel rod cladding, shattered it, and produced a
bed of fuel rod and fuel pellet debris in the upper
part of the core.
The various behaviors of the pressurizer level indication, the hot- and cold-leg temperature time
curves, the system pressure versus time, the SRM
count rate, the opening and closing of the PORV
block valve and the pressurizer spray valve, and theoperation of the makeup pumps require close examination in any interpretation of the systembehavior. Shortly after the operation of the RC-P2B
coolant pump had failed to return the system to normal behavior, the operators attempted to "blow thesystem down" to a pressure low enough to start removal of core heat by the decay heat removal (DHR)
system. After about 2 hours of confused manipulation of valves and pumps, failure of the pressurizer
level indication to respond as expected, and failure
to get the system pressure low enough for DHR, theoperators decided to repressurize the system to"collapse the steam bubbles in the hot legs," 165 notrealizing the presence of large amounts of noncondensible hydrogen. After reaching a system pressure of about 2150 psi, the PORV block valve wascycled open and closed to maintain the systempressure between about 1950 and about 2100 psi.
The valve was closed for about 120 to 140 seconds,
during which time the system repressurized to theupper limit, and then it was opened for the 70 to 75
seconds required to depressurize to the lower limit.
After about 1'/2 hours of such cycling, the operators
became concerned that the valve might fail and de-creased the lower limit to about 1850 psi. Eventually, the decision was again made to "blow down" toattempt the DHR system. They never made it. The
system pressure finally did get low enough to allow
the core flood tanks to inject a small amount of
coolant but never low enough to allow the DHR system to take over (which requires a system pressure
lower than 400 psi). At about 9 hours 50 minutes, apressure spike to 28 psig occurred in the containment building, but the operators aware of it considered it a spurious signal and disregarded it.
At about 11 hours into the accident, the hot- andcold-leg temperatures in OTSG A began to approach saturation temperature for the system pressure, indicating that that loop of the system wasagain approaching the behavior expected for one
containing a condensible vapor. OTSG B still
seemed to be blocked.
With the final closure of the PORV block valve at
13 hours 22 minutes and the repressurization andthe operation of MU-P1C, the system began to refill
to the point that a reactor coolant pump could bestarted at 15 hours 50 minutes. The system wasagain under control.
The behavior of the system is discussed in moredetail in the following pages.
System Status at Successive Time Periods During
the Accident

The following discussion of the sequence of
events in the reactor primary system related to thedamage of the core is broken into 10 time periods
for an easier and more comprehensible presentationof important observations, events, and correlations
to facilitate a better understanding of the behavior of
the system and the interactions occurring therein.
Period : 0 Hours 0 Minutes to 1 Hour 0 Minutes
4:00 a.m. to 5:00 a.m., March 28, 1979

After the first few minutes of operator action andsystem response related to a turbine and reactor
trip, the reactor primary system came to essentiallya steady state condition at about 1100 psi systempressure, about 556°F coolant temperature, a relatively constant leak rate of mixed water and steam
or steam only out the open PORV, a slowly increasi ng buildup of voids (decreasing density of coolant)
i n the circulating water, and a relatively constantsteam pressure in the secondary side of bothonce-through steam generators. Makeup pump 1A(MU-P1A) was operating with the flow probably
throttled to a relatively low rate because the pressurizer level was high at 380 inches. Both OTSGs
were filled only to about 4% to 5% on the operating493

range. (This may be a minimum reading for the instrumentation, rather than a "zero" on the scale
used.) System parameters for the first 30 minutes
are shown in Figure 11-26.

Period III: 1 Hour 40 Minutes to 2 Hours 20 Minutes
5:40 a.m. to 6:20 a.m.

The following system data are recorded for thisperiod.

Inferences and Comments-There is no evidence toi ndicate that the core was damaged at this time,even though there probably had to have been ashort period of voiding in the core in the first 5
minutes. The OTSG A was steaming to the condenser.
Period ll: 1 Hour 0 Minutes to 1 Hour 40 Minutes
5:00 a.m. to 5:40 a.m.

The following system data are recorded for thisperiod.
RCP-1100 psi±25.
RC-P-B's off at 1 hour 12 minutes, A's off at 1 hour
40 minutes.
MU-P1A-on, throttled.
Lpz -380±10 inches.
Atmos. Steam Dump Valve-open.

OTSG A-pressure fell from 1000 to 78 psi, levelremained at 5%.
OTSG B-pressure fell from 980 to 160 psi, levelrose from 5% to 15%.
SRM-counts rising slowly, oscillating.
TH550°F, falling to 510°F.
T&-550'F, falling to 510°F.
°
TSu
518 F at 1 hour 18 minutes.
Decay Heat-32 MW at 1 hour.

Inferences and Comments- During this period, thesystem remained relatively stable except that the vibration of the reactor coolant pumps increased tothe point that both B pumps were turned off at 1hour 12 minutes to prevent damage, and both A
pumps were turned off at 1 hour 40 minutes, the endof the period. The source range monitor (SRM)
readings became increasingly irregular as the average level increased slowly, indicating the increased
amount of voids in the coolant in the downcomer.
The condenser vacuum was lost at the beginning of
the period, so the atmospheric steam dump valve
was opened to permit heat removal from the
OTSGs. Hot- and cold-leg temperatures were thesame; they decreased about 40°F in the last 8 to 9
minutes of the period.

494

RCP-1100 to 670 psi.
RC-P-A's off; B's off.
MU-P1A-on, throttled.
L pzr370 to 320 inches.
Atmos. Steam Dump Valve-open.
OTSG A-pressure fell from 780 to 530 psi, levelrose from 5% to 50% operating range (OR) andheld.
OTSG B-pressure varied from 160 to 190 psi, level
fell from 15% to 4% OR and held.
SRM-counts fell one decade in 1 to 2 minutes, regained in 6, rose another decade in 15, leveled off.
T1. -rose from 525°F to 680°F, fell to 655°F.
THB-held at 532°F to 536°F for 16 minutes, fell to
513°F, rose to 570°F.
TCA -fell from 510°F to about 490°F.
Tc fell from 510°F to 480°F.
Decay Heat-25.5 MW at 2 hours.
Inferences and Comments-When the last reactor
coolant pumps were shut off at 1 hour 40 minutes,
the circulating mixture of water and steam separated. If reverse flow had been induced in OTSG B
during the operation of RC-P1A and 2A, the coolant
would have drained to the level of the impeller facesof the B pumps, leaving the primary side of OTSG B
half full at most. The primary side of OTSG A had
to have been nearly empty during pumping in thel ast few minutes; therefore, only the water in thecold legs would have drained back into the OTSG,
possibly leaving it as much as one-fourth full. The
drastic decrease in SRM counts indicate that the
downcomer was full to about the top of the core immediately after the pumps were turned off. The
steady rise in SRM counts over the next 20 or sominutes indicates that the level of the coolant water
i n the core dropped from about the top of the core
to less than half full and leveled off. Various estimates give a level from 7 to 9 feet or more below
the top of the 12-foot core. The water boiled off i n
the core was condensed in the two OTSGs or vented out the pressurizer.
Since the B OTSG may have been filled to thelevel of the RC-P casing, the condensate in it may
have been immediately returned to the core by dribbling through the horizontal section of the B cold
legs. However, the level in the primary side of the A
OTSG was considerably lower at the start of theFIGURE 11-26. System Parameters for the First Thirty Minutes of the TMI-2 Accident
495

Inferences and Comments-The leak out the pressurizer PORV stopped when the PORV block valve
was closed at 2 hours 20 minutes. If the wide
range reactor system pressure recording strip chart
can be indexed to an accuracy of ±3 minutes, itappears that the decrease in pressure in the reactor
primary system stopped abruptly at 2 hours 12
minutes and began a relatively rapid increase atleast 4 minutes before the block valve was closed
at 2 hours 20 minutes (8±3 minutes for the strip
chart, ±1 minute on block valve closure). The pressure ramp shows two definite inflection points, at 2hours 25 minutes with 630 psi indicated and at 2hours 54 minutes with 1300 psi indicated. The firstoccurred very close in time to abrupt changes in the
hot- and cold-leg temperatures for the OTSG, andthe second appears to be in time coincidence withthe starting of RC-P213 at 2 hours 54 minutes.
The rapidly increasing hot-leg temperatures forboth OTSGs can occur only if superheated steam ispresent in the hot legs and they are voided of water.
The pressurizer level indicator showed a rise in thepressurizer of 74 inches in 5 minutes. This change
i n level is equivalent to 237 cubic feet of water (3.2ft3 volume per inch of level in the pressurizer). It isthought that the major oxidation damage to the Zircaloy cladding occurred during this period. This isdiscussed in detail in Section II.C.2.b.
During normal power operation, the radiation
detector HP-R-213 (incore instrument panel area
monitor) located above the primary system is sensi16
tive to the short half-life N i sotope formed from theoxygen in the coolant water, which it sees mainly inthe hot leg of the primary coolant loop. In this case,the detector would sense radioactivity (gamma) fromxenon (Xe) and krypton (Kr) released by burst fuelrods as it was entrained by steam flowing throughthe hot legs into the OTSGs and still remaining in
the primary system. It did so at 2 hours 25 minutes
before any activity was released to the containment.

period, so that much more condensate was required
to fill it to the point of returning the condensate to
the core. The core was then being cooled by refluxing and the loss out the pressurizer and the letdown line. As the coolant in the core was boiled off,the exposed fuel rods began to heat up because
they were cooled only by steam at very low flow
rates. When the hottest part of the fuel rods
reached a temperature of about 1500°F±100'F, thecladding of the fuel rods ballooned and burst andreleased the gases from the gap between the fuelpellets and the interior surface of the cladding. It isestimated in Section II.C.2.b that the hottest fuelrods in the center bundle (highest power) reachedtemperatures above 3500°F about 45 minutes after
the pumps were turned off, and many others
reached such temperatures in the minutes following.
The hot and cold legs of the OTSGs were voided,and superheated steam was produced in the top of
the core in the first few (about 5) minutes after the
top of the core was uncovered. The period ended
when the block valve for the PORV was closed, andthe loss of system pressure and coolant from theopen pressurizer PORV was stopped. However, thel oss of coolant from the letdown line continued.
Period I V 2 Hours 20 Minutes to 2 Hours 54
Minutes 6:20 a.m. to 6:54 a.m.

The following system data are recorded for thisperiod.

RCP-670 to 1300 psi.
RC-P-all off.
MU-P1A-on, throttled.
Lpz -level at 300 inches until 2 hours 51 minutes,
then rose to 330 inches.
Atmos. Steam Dump Valve-open.
OTSG A-pressure fell steadily from 530 to 320
psi, level rose from 50% to 68% OR.
OTSG B-pressure held at 190±10 psi, then rose to
300 psi, level rose from 4% to 40% OR.
SRM-counts slowly decreased until 2 hours 54
minutes.
THA -rose from 655°F to 810°F over the period, thenfell to 800°F.
T.6-rose from 570°F to 770°F over the period.
T A felt from 490°F to 400°F and recovered to
430°F.

Period V:: 2 Hours 54 Minutes to 3 Hours
12 Minutes 6:54 a.m. to 7:12 a.m.

The following system data are recorded for thisperiod.

RCP-1300 to 2100 to 2140 psi.
RC-P-2B on.
MU-P1A-on, throttled.
L .._changed from 330 to 380 to 360 inches.
Atmos. Steam Dump Valve-closed at 3 hours.
OTSG A-pressure fell steadily, level fell from 68%
to 60%.
OTSG B-pressure changed from 300 to 410 to
380 psi, level rose from 40% to 60%.

rose from 495°F to 500°F, then fell to
C2A
450°F.
TCBfell from 480°F to 440°F.
Block Valve-closed at 2 hours 20 minutes.
Reactivity-detected at 2 hours 25 minutes in primary loop by area monitor.
T

496

Atmos. Steam Dump Valve-opened at 4 hours 30
minutes.
OTSG A-fell from 200 to 40 psi at 3 hours 42
minutes, decreased to 20 psi at 4 hours 30 minutes,
rose to 80 psi at end of period; level ranged from
60% to 48%.
OTSG B-pressure fell slowly from 380 to 320 psi,level rose from 58% to 65% and held.
Condenser-steaming until vacuum lost at 4 hours
30 minutes.
SRM-count rate dropped one decade abruptly at 3
hours 18 minutes when makeup pumps on HPI, fell
steadily about one-third decade to 3 hours 43
minutes, jumped one-third decade abruptly, andslowly decreased to about 2x10 3 cps at end of
period.
THA 780°F at start of period, rose 790°F at 3
hours 18 minutes, fell to 700°F at 3 hours 28
minutes, rose to 760°F at 3 hours 42 minutes, fell to
690°F at 4 hours, then rose and held at 700±10°F
for rest of period.
T.~very similar behavior but with peak temperatures at about 820°F, ending at 745°F.
TC,Afluctuated from 480°F at start to 320°F at 3
hours 41 minutes to 440°F at 3 hours 45 minutes to
310°F at 4 hours 4 minutes to 350°F at 4 hours 13
minutes to 300°F at 4 hours 30 minutes.
TC2A-rose from 440°F at start to 485°F in 6
minutes, fell t^ 320°F at 3 hours 43 minutes, rose to
510°F at 3 hours 48 minutes, fell to 450°F at 4hours, and fell to 190°F at end of period.
TC8fell from 445°F at start to 220°F at end of
period with several oscillations of 20 to 40°F withsharp changes in slope.
Block Valve-open and closed several times inperiod.
PZR Spray Valve-open from 3 hours 42 minutes to
4 hours 6 minutes.
Decay Heat-20 MW at 4 hours.

Steaming to Condenser.
SRM-count rate dropped one decade in seconds
and then rose to recover most of the drop by 3hours 12 minutes.
T,-changed from 800°F to 770°F to 780°F.
TCIA-430°F to 480°F.
TC2A -changed from 450°F to 430°F to 440°F.
TCB-changed from 440°F to 470°F to 445°F.
Block Valve-closed.
PZR Spray Valve-open.
Decay Heat-22 MW at 3 hours.
Inferences and Comments-After the RC-P2B was
16started, the operators reported ' that there waswater flow through the RC-P2B pump for only avery short time (a few minutes at most), as the vibrations and low power in the pump were again observed very shortly after it was started. The reactimeter data show flow in the OTSG A hot leg forless than 9 seconds. If the OTSG B had been half
full at the time the 2B pump was started, less thanabout 1000 ft 3 of water would have been pumped
into the core. The very sharp increase in reactor
coolant pressure starting at 2 hours 54 minutes wasprobably due to a very large burst of steam produced when the water from the OTSG B hit the very
hot core.
Calculations by R. Cole, Sandia (Appendix 11.9)
estimate that 1000 ft 3 of gas flowed by the flow meter in the hot leg of OSTG B. Because the flow inthe hot leg was induced by the flow of water leaving
the OTSG B through the pump, an equal volume ofwater should have been displaced. At about thesame time, there was an abrupt rise in the steampressure in OTSG B and a small, sharp decrease inlevel.
Period VI: 3 Hours 12 Minutes to 5 Hours 18
Minutes 7:12 a.m. to 9:18 a.m.

The following system data are recorded for thisperiod.

Inferences and Comments- At the start of theperiod, the reactor coolant pressure dropped rapidly
to 2000 psi. When the makeup pumps were turned
to high pressure injection (HPI) of about 500 gallons
per minute from each pump, the influx of water apparently chilled the downcomer region, and thepressure dropped very rapidly to 1500 psi and leveled off as MU-P1C was changed from HPI to normal
flow. When HPI by MU-P1A was stopped in another6 minutes, the pressure in the system rose to about1560 psi at 3 hours 39 minutes. When the block
valve was opened at 3 hours 42 minutes and thepressurizer spray valve was opened at the sameti me, the system pressure decreased to 1480 psi
and then increased to 1710 psi very quickly. When

RCP-fell from 2140 to 2000 psi rapidly, fell more
slowly from 2000 to 1500 psi, then fell to 1240 psi
with three intermediate periods of increase.
RC-P-all off.
MU-P1A-on until 4 hours 21 minutes, then locked
out, 1B and 1C on at 4 hours 27 minutes, 1A and 1C
on HPI for 6 minutes at 3 hours 18 minutes and 3
hours 57 minutes, 1C on normal at 3 hours 24
minutes for 12 minutes, 1C on normal for 17 minutes
at 4 hours 3 minutes.
Lpzr fell from 360 inches to 230 inches in 13
minutes then rose to 400 inches in 20 minutes andremained above 390 inches for remainder of period.
497

HPI was again initiated at 3 hours 56 minutes onboth MU-P1A and 1C, the pressure again began adecrease to 1510 psi at 4 hours 6 minutes. The
pressurizer spray valve was closed at 4 hours 6
minutes and the block valve opened for about 6
minutes between 4 hours 12 minutes and 4 hours 18
minutes. The block valve was opened again at 4hours 36 minutes and remained open for the rest of
the period. The RC pressure decreased rapidly
when the MU-PlC was started again at about 4hours 27 minutes to 1310 psi, and rose to 1390 psi
at 4 hours 54 minutes, even though the block valve
was opened at 4 hours 36 minutes. The pressurethen decreased to about 1250 psi at the end of theperiod, when the block valve was again closed torepressurize the system.
MU-P1A was shut down and locked out for theremainder of the accident because the operators
were having considerable difficulty in keeping it inoperation. It tripped off and had to be restarted
many times during the first 4 hours of the accident
period. When it could not be restarted after the last
trip at 4 hours 21 minutes, the operators "locked itout" to prevent its actuation during activation of theengineered safety system, and replaced it with
MU-PIB. However, there was a period of about 6
minutes when no makeup coolant was flowing into
the system. It should be noted that the major
responses of the system seem to occur with theoperation of MU-PlC, the block valve, and the pressurizer spray valve. Operation of MU-P1A or 113
seemed to have little or no effect on either systemtemperatures or the pressure.
The large and sudden increases in the cold-leg
temperatures of OTSG A were almost coincident
with the opening of the block valve and the pressurizer spray valve. The sharp but relatively small increase in the SRM signal was also coincident withthe opening of these two valves.
Period VI!: 5 Hours 18 Minutes to 7 Hours 39
Minutes 9:18 a.m. to 11::39 a.m.

The following system data are recorded for thisperiod.
RCP-increased from 1240 psi to 2150 psi, cycled
between about 2150 psi and 1850 to 1900 psi with
about 2 minutes of pressure increase and about 1
minute of pressure decrease.
RC-P-all off.
MU-P-both 1B and 1C operating, with various degrees of throttling.
Lpzr-constant at 400 inches.
Atmos. Steam Dump Valve-open.
498

OTSG A-pressure dropped slowly from 80 psi tol ess than 20 psi at 7 hours, remained below 20 psi
for rest of period, level remained at 48% until refill
started at 5 hours 54 minutes, reaching 100% OR at
7 hours.
OTSG B-pressure dropped slowly from 320 psi to
290 psi at end of period, level fell from 65% to 62%.
Tsurge -310°F at 5 hours 15 minutes.
Tpz -recorded at 345 to 350°F in last half hour of(period.
SRM-count rate dropped slowly from beginning to
end of period, with one small "bump" occurring
between 6 hours 45 minutes and 7 hours 6 minutes.
THA -increased from 690°F at start to 735 to 740°F
at 6 hours and remained at 735±5°F to end of
period.
THB paralleled T HA exactly but at 50°F higher temperature.
TCA -temperature record appears that of 1A. Rosefrom 190°F at start to 220°F at 5 hours 45 minutes
and held for rest of period.
TSB -dropped from 220°F at start to 210°F at 5hours 30 minutes, then gradually fell to 185°F at end.
Block Valve-cycled open and closed to bleed offpressure to prevent opening of safety valves.
PZR Spray Valve-closed.
Decay Heat-17 MW at 6 hours.
Inferences and Comments- The operators statedthat during this period they planned to collapse the"steam bubbles" in the hot legs of the OTSGs bypressurizing, so that they could ultimately put into
effect the natural circulation mode of cooling the166system.
Since the system pressure was increasi ng to the level at which the safety valves would be
opened, the block valve was manipulated to keep
the pressure as high as possible without "lifting thesafeties." The system increased in pressure from1
about 1900 psi to 2070-2100 psi in 2 to 2 /2
minutes (114 to 150 seconds) and decreased fromabout 2100 to about 1980 psi in about 70 to 75
seconds. This procedure was continued for morethan 1 1/2 hours. Because the operators feared thatthe block valve would fail through excessive use,l eaving them with no control of system pressure,they decided to depressurize to less than 400 psi
so that the system could receive coolant from thecore flood tanks. During this period, the OTSG A
was filled to 100% of the operating range (OR), but
OTSG B was left isolated and at 60% OR. There isa small "bump" in the SRM counts at 6 hours 45
minutes to 7 hours that cannot be keyed to any
system parameter and cannot be explained. The
block valve was opened at 7 hours 39 minutes andremained open for more than 1 /2 hours. Pressurizer
temperatures were requested from the plant computer by the operators for the first time during theaccident. If a bubble existed in the pressurizer, thetemperature of about 345°F would be equivalent toa steam pressure of about 130 psia, and theremainder of the pressure would have been due to anoncondensible gas, presumably hydrogen.
1

Period VIII: 7 Hours 39 Minutes to 10 Hours 21
Minutes 11:39 a.m. to 2:21 p.m.
The following system data are recorded for thisperiod.

RCP-dropped from 2050 psi at the start to 1580 in
4 minutes, to 1460 at 7 hours 51 minutes to 1120 psi
at 7 hours 57 minutes, then at an exponential decay
to about 500 psi at 9 hours, held 500 to 490 psi to
9 hours 48 minutes (utility typer gives 440 to 450psi), rose to 550 psi at 10 hours 5 minutes and fell
to 520 psi at end of period.
RC-P-all off.
MU-PIC-on until 9 hours 6 minutes, 113 on for entire period; HPI on both at 9 hours 50 minutes.
Lpzr395 to 400 inches.
Atmos. Steam Dump Valve-closed at 9 hours 15
minutes, no heat removal from system except during
letdown flow and opening of pressurizer valves.
OTSG A-pressure near atmospheric to 10 hours 18
minutes, rose to 40 psi at 10 hours 21 minutes, level
constant at 95% OR.
OTSG B-pressure decreased slowly from 280 to
250 psi except for small increase to 310 psi at 7
hours 54 minutes; level constant at 60% to 65% except for brief rise to 66% at 7 hours 54 minutes.
T-requested twice by operators, 310°F at 8
urgehours and 330°F at 8 hours 18 minutes. Surge line
temperature is not reported again.
Tpzr pressurizer temperatures were requested
several times by the operators, circa 350°F, andthen were reported as "trend data" in Operators
Group C Summary afterward. Temperature held at
350°F with slight increase with time until 9 hours 30
minutes when an increasing rate of temperature rise
began. At 10 hours 21 minutes, the pressurizer temperature was within a few degrees of, or equal to,saturation temperature for the system pressure. It
did not rise higher than saturation temperature forthe system for the remainder of the accident.
SRM-count rate increased slowly from start ofperiod until 9 hours 48 minutes, showed a small
sharp increase and decrease, then returned to the499same curve as before, and remained constant forrest of the period.
T. -dropped sharply from 730°F at start of period
to 700°F in 6 minutes at 7 hours 51 minutes, thenvery slowly increased to 715°F at 9 hours 51
minutes, dropped sharply to 660°F at 10 hours, anddropped slowly to 650°F at end of period with one
excursion to 630°F and return in 9 minutes.
T .-Paralleled THA behavior except 50 to 80°F
higher, ending period at 725 to 730°F.
TCA fell slowly from 220°F at 7 hours 39 minutes
to 160°F at 9 hours, rose to 190°F at 10 hours, andheld for remainder of period.
T.6-fell gradually from 185°F at 7 hours 39
minutes to 150°F at 9 hours and held.
Block Valve-closed at 9 hours 15 minutes for 6
minutes, closed at 9 hours 32 minutes for 17
minutes, and opened from 9 hours 49 minutes
through end of period.
PZR Spray Valve-opened at 8 hours, closed at 9hours, and opened at 10 hours.
Pressurizer Vent Valve--opened at 7 hours 54
minutes and closed at 9 hours 9 minutes.
Engineered Safety System Actuation-at 9 hours
50 minutes on high building pressure, decay heatpumps started, reactor building isolated, reactor
building sprays started, both makeup pumps on HR
for 1 minute. Reactor building spray pumps stopped
at 9 hours 56 minutes.
Reactor Building Pressure-spiked to 28 psi at 9hours minutes, observable on strip-chart recording
reactor building pressure and as an inverse pressure on the OTSG steam pressures (since the pressure sensors use building pressure as the reference
pressure).
Decay Heat-14 MW at 9 hours.
Inferences and Comments- During this period, theoperators were attempting to "blow the system
down" to get to a pressure low enough to allow thesystem to be opened to the core flood tanks. This
would allow injection from the core flood tanks
when the system pressure dropped below 600 psi,
but significant flow would not occur until the systempressure dropped to less than 200 psi or so. The
pressure leveled off at about 490 to 500 psi without
dropping below that for about 45 minutes. Also, thesystem pressure remained at 490 to 500 psi for almost 30 minutes even with the PORV block valve
closed for the time period around 9 hours 30
minutes. At about the time of the engineered safetysystem actuation, when the makeup pumps went
onto HPI, the system pressure started rising slowly
to about 550 psi at about 10 hours 5 minutes andthen slowly dropped down to about 520 psi at theend of the period.
The reactor building pressure pulse recorded at
9 hours 50 minutes on the reactor building strip
chart was thought by the. operators to be a spurious
signal or "electrical noise," both then and later.
However, the inverse of the pressure pulse can beseen by plotting the steam pressures of the OTSGs
for the time period 9 hours 45 minutes to 9 hours
55 minutes, as shown in Figure 11-27, with the datataken from the reactimeter tabulation at 3-second
intervals. The pressure sensors of the OTSGs use
the reactor building pressure as the reference pressure. The data show that the pressure rose to apeak over a 9-second time interval, decayed tonearly the original pressure in about 100 seconds,
and then dropped suddenly to below the original
pressure. This was the "hydrogen burn" to be discussed later.
While the reactor core was floating on the coreflood tanks from 8 hours 30 minutes to 9 hours 12
minutes because system pressure did not drop
below 400 psi, the response of the core flood tankpressure showed that only a small amount of water
could have entered the primary system. For a partof the time, the pressure in core flood tanks was
rising as indicated by high pressure alarms (thecheck valves may have leaked).
One of the more important observations of theperiod may be that the temperature of the pressurizer rose to the saturation temperature for the system (based on the system pressure) for the firstti me since about the time the primary coolant pumps
were turned off at 1 hour 40 minutes.
The "blip" in the SRM count rate strip chart
should be noted, but no cause can be assigned to it
by our analysis, and it is not quite in time coincidence with the reactor building pressure spike at
9 hours 50 minutes, although it may be within thetiming coincidence error of the several strip chartsand data acquisition systems.

MU-P-1B on for entire period, throttled 1C on for 6
minutes at 10 hours 30 minutes, on for 10 minutes at
11 hours 18 minutes and for 3 minutes at 11 hours 33
minutes; no HPI in the period.
L
380 to 400 inches from 10 hours 21 min to 11
hours 3 minutes, dropped very rapidly to 175 inches
at 11 hours 18 minutes, held 175 inches to 11 hr 33
minutes, rose steadily to 400 inches at 12 hours 30
minutes, dropped to 390 to 380 psi for rest of
period.
Atmos. Steam Dump Valve-closed.
Condenser Vacuum-pumps started at about 13
hours.
OTSG A-pressure rose from 40 psi at start ofperiod to 80 psi at 10 hours 45 minutes with abruptchange at 10 hours 30 minutes; dropped slowly toabout 50 psi at 11 hours 45 minutes, then rose at increasing rate to 160 psi at end of period; level constant at 97% to 98% OR.
OTSG B-pressure dropped slowly from 250 psi atstart to 240 at 11 hours 30 minutes, then rapidly to
150 psi at 11 hours 54 minutes, and held at 150 for
rest of period; level dropped from 60% at start to
57% at 11 hours 33 minutes and rose rapidly to 96%
OR at 12 hours, holding 96% for rest of period.
Tpz-rose slowly or level, within a few degrees ofsaturation temperature for pressure of the systemthroughout the period.
SRM-count rate increased only very slightly during
the entire period.
T. -dropped very rapidly from 650°F at 10 hours
21 minutes to 500°F at 10 hours 32 minutes, rosevery rapidly to 570°F at 10 hours 40 minutes, fell to
460°F at 11 hours 6 minutes, started rapid rise at 11
hours 15 minutes to 560°F at 11 hours 23 minutes,
rose slowly to 590°F and held to 12 hours 33
minutes, dropped at increasing rate to circa
Tsar=500°F at 13 hours 6 minutes and held at Tsarfor rest of the period.
T- rose slowly from 725°F at start to 755°F at 12hours 33 minutes, dropped very rapidly to 630°F at
12 hours 42 minutes, rose to 710°F at 13 hours 3
minutes and to 715°F at 13 hours 15 minutes.
TcA-two curves observable, 1A and 2A cold legs,
behavior is different. TC2A preceded T CIA, andreached higher temperatures. TC2A reached 440°F
at 11 hours 21 minutes, TCIA reached maximum of
400°F at same time. Both were about 360±10°F at
11 hours 36 minutes, and both reached Tsar circa
480°F at 12 hours 15 minutes, held at Tsat forremainder of the period.
TCB fell from 150°F at start of period to 125°F at 11
hours, held 125°F to 11 hours 45 minutes, rose rapidl y to peak at 170°F at 12 hours, fell slowly to 145°F at
end of period.

Period IX:• 10 Hours 21 Minutes to 13 Hours 15
Minutes 2:21 p.m. to 5:15 p.m.
The following system data are recorded for thisperiod.
RCP-fell from about 520 psi at the start of theperiod to 460 to 470 psi with a drop to 409 psi for 1
to 2 minutes at 10 hours 36 minutes, and rose backto 420 to 425 psi. Slow rise starting at 11 hours 10
minutes, leveled off at 650 to 660 psi at 12 hours 39
minutes for rest of period.
RC-pumps-off.

500

FIGURE II 2'1. Hydrogen Burn at 9.9 Hours

Block Valve-closed at 11 hours 9 minutes, opened
at 12 hours 30 minutes, closed at 12 hours 40
minutes, opened at 12 hours 45 minutes, and open
for rest of period.
PZR Vent Valve-opened at 12 hours 45 minutes,
closed at 12 hours 57 minutes.
PZR Spray Valve-closed at 11 hours 57 minutes.
Decay Heat-13 MW at 12 hours.

RC-P-pump 1A "burped" at 15 hours 33 minutes tocheck operation, started again at 15 hours 50
minutes to run for many days.
MU-P1B-on for entire period, 1C started at 13 hours
21 minutes, throttled at 14 hours 41 minutes, stopped
at 14 hours 43 minutes, run for 7 minutes at 15
hours 32 minutes and 11 minutes at 15 hours 45
minutes.
LpZr-dropped rapidly from 390 inches at 13 hours
18 minutes, to 275 inches at 13 hours 30 minutes,
rose slowly to 290 inches at 13 hours 54 minutes
and rapidly to 400 inches at 14 hours 21 minutes.
Atmos. Steam Dump Valve-closed.
Steaming to Condenser-started at 14 hours for
OTSG A.
OTSG A-pressure dropped slowly from 160 psi atstart of period to nearly zero at 15 hours, rose fromcirca 10 psi at 15 hours 30 minutes to 70 psi at 15
hours 42 minutes, and fell to 20 psi at 16 hours; level constant at 95% to 96% except for "dip" to 88%
at 13 hours 51 minutes.
OTSG B-pressure constant at 150 psi to 15 hours
30 minutes, dropped to 40 to 50 psi at 16 hours.
Tincreased slowly or held steady for entire
pzr
period-no decrease; started at saturation temperature for the system pressure but did not increase
with it as system pressure rose to 2350 psi;reached 520°F at 16 hours.
SRM-count rate was steady or showed only veryslight increase over the entire period except for"bump" at 14 hours 30 minutes.

Inferences and Comments- During this period ofti me, the reactor primary system displayed some ofthe symptoms of thermal-hydraulic behavior expected of a system having condensible vapor in it.
The hot and cold legs of OTSG A showed abehavior indicating that there was again steam flow
and condensation in the A steam generator, and the
response of the steam generator pressure was inaccordance.
However, the pressurizer level
dropped 230 inches between 10 hours 54 minutes
and 11 hours 18 minutes, equivalent to a volume displacement of 736 ft3. The system pressure rosel ess than 100 psi, and it was delayed relative to thedrop in the pressurizer level. An operator responded to the sudden drop in the pressurizer level indication by greatly increasing the makeup flow
rate.165
Although the OTSG A hot-leg temperaturereached the saturation temperature for the system(based on system pressure) for a short time, it rose
to about 100°F superheat again for much of theremainder of the period and again fell to saturation
temperature at the end of the period. This may berelated to the startup of MU-PlC and the closing of
the PORV block valve. The cold-leg temperatures
for OTSG A reached the system saturation temperature in the middle of the period and held it for
the rest of the period. The OTSG A hot- and coldleg temperatures, the pressurizer temperature, andthe system saturation temperature were the samefor the first time since the reactor coolant pumps
were turned off.

THA-rose from circa 500°F at start of period to
590°F at 14 hours 45 minutes and fell slowly to
575°F at 15 hours 33 minutes, dropped sharply to
420°F when RC-P1A "burped," rose again to 525°F
at 15 hours 50 minutes and dropped to 365°F when
RC-P1A started.
T,. responded as THA but 150 to 200°F higher.
TCA-TC2A started rapid drop from 490°F at 13hours 30 minutes to 315°F at 13 hours 45 minutes to
280°F at 14 hours 9 minutes, held to circa 14 hours
45 minutes, and started to rise to 415°F at 15 hours
33 minutes, dropped to 330°F, and ended period at
365°F.
TcyA-behaved much the same way after fallingslowly from 490°F at 13 hours 30 minutes to 425°F
at 14 hours.
Tcg held 145°F from start of period to 14 hours,rose rapidly to 210°F at 14 hours 15 minutes andslowly to 230°F at 14 hours 39 minutes, fell to 210°F
at 15 hours 33 minutes, and rose to 365°F at 15
hours 50 minutes.
Block Valve-closed at 13 hours 24 minutes andremained closed for rest of period.

Period X:: 13 Hours 15 Minutes to 16 Hours 5:15 p.m.
to 8:00 p.m.
The following system data are recorded for thisperiod.
RCP-the pressure was constant at 660 psi until 13hours 25 minutes, rose to 2350 psi at 14 hours 48
minutes, fell to 2320 psi at 15 hours 35 minutes,
dropped almost instantly to 1500 psi, rose rapidly
back to 2120 psi, and fell to 1350 psi at 15 hours 50
minutes.

502

PZR Vent and Spray Valves-closed.
Decay Heat-12 MW 15 hours.
Inferences and Comments- At the start of thisperiod, the operators decided to repressurize and toi ncrease makeup flow to collapse the "steam bubbles" thought to exist in the hot legs of the steam
generators. 167 -168 The pressurizer temperature
continued its slow rise but did not follow the saturation temperature based on the system pressure.
This indicated that the system was not being pressurized by a steam bubble in the pressurizer but by
makeup flow and other factors. The system pressure showed a very rapid increase at 14 hours 35
minutes rising from 1400- psi to 1900 psi in less than
2 minutes. The rate of increase then slowed, indicating a massive input of heat to the system vapor
phase. The reactor coolant pump 1A was successfully "jogged" at 15 hours 33 minutes and flow, motor amperage, and pump vibration were found to be
acceptable. The motor had to cool for 15 minutes
before it could be started again.
RC-P1A was started again at 15 hours 50 minutes
and ran continuously for more than a week. The
hot- and cold-leg temperatures almost immediately
merged to within about 5°F of the same value, or
365°F, although the "quenching" of the hot leg of
OTSG B appeared to be delayed by 1 to 2 minutes.
The system pressure dropped very rapidly to 1350
psi, rose to 1400 psi in about 8 minutes, and thenfell smoothly and slowly to 1000 psi at 18 hours(10:00 p.m.). MU-P1B continued to run. The system
was "stable," the core was being cooled by flowing
water, and OTSG A was steaming to the condenser.
Additional Data

I n addition to the facts given above on the various parameters of the reactor primary system, there
are certain other sets of data pertinent to any interpretation of the sequence of events and their effects during the accident. Among these are thechanging levels of the borated water storage tank
( BWST), the indication of the incore thermocouples
l ocated just above the top of the fuel rods in the instrumentation tubes of 52 of the fuel assemblies(there were 177 assemblies in the core), and the indications of the self-powered neutron detectors(SPND) located in the same instrumentation tubes
as the incore thermocouples.

ed water storage tank (BWST), and injection of
borated water via the high pressure injection (HPI)
valves (MU-V-16A, 16B, 16C, and 16D). The BWST
supplies the water necessary for the reactor coolant
system (RCS) beyond that available in the normal
makeup tank (small capacity-4500 gallons) andthe reactor coolant bleed169holdup tanks (three tanks
at 80000 gallons each).
The changes in level inthe BWST can be used to calculate the amount ofwater injected into the RCS by the makeup pumps,
providing that all of the water removed from the
BWST is injected and there is no other path for lossof water from the BWST. The BWST levels are notnormally recorded except in operator logs and appear on the alarm printer when specifically requested by an operator. The data available were compiled previously 170 and are tabulated in Table 11-54.
Only 15 000 gallons of water were removed fromthe BWST during the first 3 1/2 hours of the accident;
132 000 gallons were removed in the next 3 1/2 hours
and 50000 more in the following 2-1/3 hours. It isi mportant to note that more than twice the volumeof the RCS (90000 gallons) was removed from the
BWST in the first 9 hours of the accident and supposedly was injected into the RCS by the makeup
pumps. It is also important to note that 37 000 gallons were removed from the BWST in the 1 1/2 hours
i mmediately following the last closure of the PORV
block valve to repressurize the RCS. There are atl east three paths for water to be removed from the
BWST without being injected into the reactor
coolant system. These include: (1) a pipe in the Ali ne in the containment (feeding the A cold leg of
OTSG B) cracked between two check valves, whichleaks significantly only at higher pressures, (2) the
DH-V6A and 6B valves, which were opened unwittingly, allowing the BWST water to drain into thesump, and (3) a relief valve on the makeup tank,which opened as it did several days later, to provide
TABLE I1-54. Water usage from the borated water
storage tank 170
Accident
Time

Avg.
(gpm)

37

1 47 000

1 32 000

643

23400037000

150

9 h 15 min

31

19800022271 000

14 h 45 min

503

Used in
Period( gal)

53.04

13 h 20 min

The normal reactor trip procedure requires thatthe supply to the makeup pumps be from the borat-

Total
(gal)

3 h 30 min
6 h 55 min

Borated Water Storage Tank Discharges

Level
(ft)

26.5

1 5 000

15 000

40000
37000

70

357

560

a path from the BWST through the makeup pumps
to the makeup tank and vented to the reactor
coolant bleed holdup tanks.
Incore Thermocouples

A type K (Chromel-Alumel) sheathed thermocouple with a grounded bead was located in the top ofeach of the 52 instrumentation tubes positioned in a
specific spiral pattern in the core. 171 Each instrumentation tube was located in the center of a fuelbundle and was permanently fastened into the bottom support plate for the core. Each also contained
seven self-powered neutron detectors (SPND)
spaced at about 1% -foot intervals vertically and located between neighboring grid spacers. The instrumentation was being used in an experimental
study of power tilt and power shaping in the coreand is not normally present. The incore thermocouples measured water temperatures exiting the bundles, and the SPNDs measured the neutron flux andflux profile in the bundles. The physical elevation of
the incore thermocouples was in a flow mixing cup
contained in the lower part of the upper end fittingof the bundles and was 12 inches above the top of
the fuel in the fuel rods of the bundles. The datafrom both the thermocouples and the SPNDs could
be requested from the plant computer via either thealarm printer or the utility typer at operator option.
Both were connected to print out on the alarm
printer when the set reading range limits, 700°F and2x10-6 amps, had been exceeded. Data fromselected SPNDs were also available on two
multiple-point recorders located in the control room.
The incore thermocouples began going off scale(indicating temperatures above 700°F) during thel ater part of the time the alarm printer was unavailable between 5:15:16 and 6:48:08 a.m. At the timeof the earliest record of alarming of the incore thermocouples, between 6:55 and 7:13 a.m. (2 hours 55
minutes and 3 hours 13 minutes accident time), 39
of the 52 incore thermocouples were recorded off
scale, i.e., above 700°F. The records thereafter are
i ncomplete because either some thermocouples
were missed in an ordered sequence of recording,or only a partial listing was requested, or they simply were not requested by the operators from either
the alarm printer or the utility typer for a considerable period of time. The datathat are available have
170,172,173
been reported elsewhere.
A set of measurements of temperature was made at the computer
terminals in the cable spreading room by using acalibrated thermocouple
reader instrument and174
manually recorded.
Temperatures as high as

2650°F were measured, 175 as shown in Figure 11-28.
The trend of the data on incore thermocouples indicating temperatures greater than 700 ° F either at theti me of recording or both before and after the period
show that 49 of the 52 thermocouples read above
700°F in the period between 3 hours 13 minutes and3 hours 21 minutes, 33 between 3 hours 21 minutes
and 3 hours 36 minutes, 44 between 3 hours 44
minutes and 3 hours 47 minutes, and 26 between 4hours 34 minutes and 4 hours 47 minutes. The
number above 700°F decreased thereafter in reasonable order, but 11 were still up scale at 00:43
a.m. the next day (March 29, 1979), 3 were still up
scale at noon on March 29, 1979, and 1 was still up
scale (greater than 700°F); 20 were above 300°F at
10:22 a.m. on April 1, 1979, more than 4 days after
the start of the accident. No evidence available atthis time can determine whether the temperaturesi ndicated were measured at the thermocouple beadi n the mixing cup of the upper end fitting or were
those at newly formed junctions located in the"liquefied fuel" region of the core. Attempts tomeasure the resistances of the legs of the thermocouples could not resolve the question, nor could
other types of measurement made to determine thecontinuity of the thermocouple wires.
Self-Powered Neutron Detectors

The self-powered neutron detectors (SPND) located in the 52 instrumentation tubes are experimental devices used in TMI-2 to measure flux,
power tilt, and power shaping in the core. There
are seven in each instrumentation tube, locatedabout I% feet apart vertically; each consists of ashielded emitter and collector head about 3 inches
long that senses neutrons by a flow of electrons required to replace those emitted from the rhodium
surface of the emitter after impingement by a neutron. The emitted electrons travel through an oxide
i nsulator to a grounded sheath. This system canbecome a thermoionic converter when the temperature is raised to some elevated temperature,
currently estimated to be above 1000°F, withthe173
electrons being emitted by thermal excitation.
Inaddition, the current flow changes from negative topositive as the converter temperature is increased.
This means that an alarm change from "BAD" to"NORM" can be due to either cooling or continued
heating, and there is no way to distinguish between
them from the alarm printer notation. The behavior'of these systems in both thermal and radiation fields
i s the subject of an experimental study being con-

504

1

2

3

4

5

6

7

8

31

30

9

10

29

28

11

12

13

14

15

A
B

355
32

C
33

0
34

E

545

1275

7

165

2441
9

455

2352

37

2655

405

25

1930
1

1370

445

39

21

2251

19

457

395

16

2253

14

485

42

0

2402

425

673

43

1927

1775

50

375

41

N

20

18

13

625
305

2

705

40

M

23

22

1951

12

1575

24

405

1886
38

295

2453

1849

11

L

51

26

3

2527

K

4

8

10

335

5

2055

6

36

375
575

35

G

1035

52

27

1075

F

H

375

1855

17

49

425

435

15

2242

535

47

48

1175

385

44

P

315

45

R
1

2

3

4

5

6

425
7

46

8

9

550
10

11

12

13

FIGURE 11-28. Temperatures Measured by Incore Thermocouples on March 28, 1979,
8:00 a.m.-9:00 a.m., Using Fluke Meter at Computer Terminal Board

505

14

15

discussed in the interpretations in the following section.
I n the later hours, many of the SPNDs at the levels of 3-7 flickered between BAD and NORM, theaverage alarm number first increasing gradually andthen decreasing, particularly after the PORV block
valve was last closed at 13 hours 24 minutes andthe makeup flow was increased to repressurize thesystem. Over the next 4 days, SPNDs continued toreturn on scale, the last one having "quenched out"
on April 1, 1979, as shown by one of the multipoint
recorders.177 The physical meaning is debatable,
but the pattern is that the number of SPNDs indicating upscale decreased continuously after about 12
to 13 hours accident time. The coincidence with thedecrease in the apparent size of the "hydrogen bubble" discussed in Section II.C.2.e is to be noted.

ducted by EPRI-NSAC.
Both the results of thestudy and of the subsequent analysis of the SPND
alarm and strip-chart data (signals from about 40 of
the SPNDs were on two multipoint recorders, aswell as on the alarm printer) will be reported by
EPRI-NSAC later. 176 For the present, it seems adequate to consider only the first time an SPND is reported by the alarm printer as BAD, meaning that
the SPND has seen a rise in temperature highenough to cause a flow of negative current of about
2000 nano-amps. It is estimated that this temperature must
be well above 1000°F and approaching172
2000°F.
During the time between the start of the boildown
in the core after 1 hour 40 minutes and the time thealarm information again became available at 2 hours
48 minutes, many SPNDs at levels 4, 5, 6, and 7
went off scale as they heated up, as many of them
are shown by the alarm printer as being NORM andmany others are shown as being BAD. Because thenotation of NORM would not be shown on the alarm
printer if the SPND had not been shown as BAD
earlier, it can be concluded that these SPNDs had
already been heated up significantly when first
not177i ned on the alarm printer. The strip-chart data
dicate that the level 6 SPNDs near the center of thecore first started up scale at 2 hours 30 minutes,
and those near the periphery started up scale at 2hours 34 minutes. In the first 7 minutes after 2hours 48 minutes, 40 level 4 alarms (both BAD andNORM without reference to specific strings) and 46
level 3 alarms were received. Also, one level 2
alarm (BAD) was received.
Alarms of NORM noted for SPNDs at levels 3-7
i mmediately after the RC-P2B was started at 2hours 54 minutes may indicate that part of the core
was cooled, but not quenched, and reheating beganalmost immediately.
In the following hour, many of the SPNDs oscillated between BAD and NORM alarm position, but it is
impossible at this time to determine whether they
were heating or cooling. However, between 3 hours
44 minutes and 47 minutes, the alarm BAD appeared for the first time for SPNDs at level 1 or 2 in
18 instrumentation tubes (strings). Alarms for threestrings had appeared about 20 minutes earlier. Fivestrings were known to have been inoperable atthese levels before the accident. Level 1 SPNDs areabout 10 inches from the bottom of the fuel in thefuel rods, and level 2 SPNDs are located about 30
i nches from the bottom of the fuel. Although this indication means that the SPNDs at these levels
reached temperatures greater than about 1000°F, it
does not mean that the water level in the reactor
core had reached this level or below. This will be
176

b. Interpretations of Accident Sequence
I ntroduction

The reconstruction of the sequence of events, interactions, and system behavior of the reactor primary system during the first 16 hours of the TMI-2
accident has been found to be a difficult task requiri ng many calculations, estimations, and deductions
based on too little quantitative and recorded data.
Despite the wealth of instrumentation and data
available on normal operation, the amount of data
important in the accident reconstruction recorded ineither the data acquisition systems or on strip
charts is appallingly small.
Much valuable information was lost when thealarm printer was inoperable at important times during the first 3 hours of the accident. A very large
amount of useful data available from the plant computer through the utility typer (operator special summaries) was either never requested by the operators or requested only 6 to 7 hours after the accident began. No requests asked for previously acquired data. Some of the information important to
the postaccident analysis was available to theoperators during the accident on their panel as diali ndications, but it was neither noted in the operators'l og nor recorded permanently in any form. Other
data that could be quite useful in reconstruction, in
the absence of the losses discussed above, were
never taken because no instrument existed, or thedata were taken in such a form that reconstruction
analysis is not possible.
It has been found to be impossible to establish
with an acceptable accuracy even an approximate
water inventory in the primary system as a function506

of time, to determine a heat balance across the
OTSGs, or to know with certainty the position(open, closed, or throttled) as a function of time ofseveral valves important in controlling the parameters of the reactor primary system. This, then,forces the reconstruction to be based on inferences, interpretations, arguments, and rationalizations with the use of too little quantitative, recorded
data, thus precluding decisive and unequivocal
selection of any one interpretation from the several
that can be presented.
There appear to be as many interpretations of
the events of the first 16 hours of the TMI-2 accident as there are groups examining the problem
and attempting a reconstruction. The interpretation
given below is based on three separate analyses ofcore damage: that of the Special Inquiry Group; abase case calculation by Battelle
Columbus Labora178
tories using the MARCH codeto evaluate the "Alternative Scenarios" or "what ifs; " and a study conducted by Sandia Laboratories, 179 at the request of
Task Group 2 to ensure that some of the less probable scenarios were not missed.
The agreement between these interpretations
180,181,182
and those proposed by others
is, in general, much stronger and broader in the important
aspects of the accident sequence than is thedisagreement. For example, all estimate (1) thatbetween about 50% and 70% of the core has beendamaged, with 35% or more of the Zircaloy metal
converted to oxide, (2) that temperatures in theneighborhood of 4000°F or higher were reached in
the upper part of the core, that significant amountsof "liquefied fuel" were formed and no direct meltingof U0 2 occurred (5200°F required), and (3) thatabout 750±100 pounds of hydrogen were formedby the oxidation of the Zircaloy cladding. The areasof disagreement center primarily on whether thereactor core was covered by coolant after 2 hours
54 minutes and at subsequent times and on thenumber of periods the core was uncovered.
Although these are important in the collation of thesystem data, they may not be too important in estimating and understanding the extent of damage tothe core and the times at which it occurred, as wellas the significance of what actually happened tomeet our broader needs to understand reactor
safety.
Critical Observations

There are several critical observations in therecorded data which must be considered in thereconstruction and interpretation of the accident
scenario. Their causes and effects must either be
507

described or the data shown to be in error or due toa false indication by an instrument. Those deemedmost important at this time are listed in Table 11-55
and can be examined in the curves of Color Plate III.
General Description of the Accident Conditions

Because of the failure of the pressurizer pilotoperated relief valve (PORV) to close again following
the initial surge of pressure, reactor coolant wascontinuously leaked through the valve greatly in excess of the makeup rate for approximately 140
minutes until the block valve (another valve in thesame line) was closed. Although the data indicate ahigh water level was maintained in the pressurizer,
the quantity of liquid in the reactor primary systemdecreased throughout this period. While the reactor
coolant pumps were in operation, a mixture of
steam and liquid water was pumped through thecore, and that flow effectively cooled it. However,when the last set of reactor coolant pumps wasshut off at 1 hour 41 minutes, the liquid and steam
phases separated, with the liquid phase apparently
falling to the level of the top of the core. For the
next half hour, some of the steam generated by decay heat in the core was released to the pressurizer
and out the open valve, and the remaining steam
condensed in the A steam generator. The waterlevel on the primary side of the steam generator
was not high enough, however, to permit the condensed water to flow back into the reactor vessel toresupply the core. For this reason, the water leveli n the core continued to drop to approximately 4 to
6 feet from the bottom of the core.
At 2 hours 18 minutes into the accident the block
valve in the relief line was closed and that loss ofwater from the system was stopped, but the letdown flow continued. The water level in the coreapparently began to rise slowly over the next halfhour, at which time one of the reactor coolant
pumps in the B loop was turned on for 19 minutes.
During the first few minutes of pump operation, sufficient water was pumped to fill the annular downcomer region in the vessel and to force some additional water into the core. Although a few feet of coreremained uncovered following operation of the reactor coolant pump, the greatest extent of core heatup
probably preceded this event and the core was significantly quenched at this time.
Additional damage apparently occurred to thecore at 3 hours 45 minutes, as indicated by several
sets of system data. We believe that at this time
there was slumping and densification of the debris
bed produced earlier, with the formation of a steam
bubble below a crust in the bed. The displacement

TABLE 11-55. Critical observations
1.

2.

3.

4.

5.

6.
7.
8.
9.
10.

Source Range Monitor (SRM):a.
The sharp changes in the count rates of the Source Range Monitor (SRM) at 1 h 40 min, 2 h 54
min, 3 h 18 min, and 3 h 42 min,b.
the rises in count rate starting at 1 h 45 min and 2 h 54 min, andthe increasing deviation above the "normal decay curve" after 4 h.
c.
Pressurizer Level Indications:
The rapid increase in pressurizer level indication at 2 h 50 min,a.
b.
the decrease beginning at 3 h 6 min followed by the rise starting at 3 h 27 min,c.
the accelerating rate of decrease in level starting at about 11 h,
the slow rise after 11 h 30 min,d.
e.
the decrease and subsequent increase between about 13 h 15 min and 14 h 20 min, and,f.
the "full" reading observed for most of the time after 3 h 45 min.
Hot-Leg Temperatures:
The indicated temperatures for the OTSG hot legs,a.
b.
the changes observed,c.
the nearly parallel behavior of the two hot legs from 3 h 56 min to 10 h 6 min and the independent behavior thereafter, andthe sudden change in the behavior of the A hot-leg temperature after 10 h 21 min and in the Bd.
hot leg at 12 h 3 min.
Cold-Leg Temperatures:a.
The changes in cold-leg temperature behavior for the A legs at 3 h 45 min, 11 h 6 min, and 13 h
30 min,the separation in both time and magnitude of change for the two A cold legs (1A and 2A), andb.
the lack of such changes in the B cold-leg temperatures.
c.
Reactor System Pressures:a.
The rapid changes in reactor system pressure starting at 2 h 51 min, 3 h 10 min, 3 h 18 min, 3h 45 min, 4 h, and 14 h 36 min, andb.
the increases observed in reactor system pressure at 2 h 12 min, 3 h 45, min and 4 h 30 min atti mes when PORV block valve was open.
The behavior of the pressurizer temperature, particularly its apparent independence to changes insystem pressure, valve opening and closing, and operation (or flows from) the makeup pumps.
The coincidences in time among the several observations.
The decrease in levels in the borated water storage tank (BWST).
The behavior of the incore thermocouples over 4 days.
The behavior of the self-powered neutron detectors (SPND).

of water below the debris bed by the steam allowed
more Zircaloy cladding to heat up and oxidize, embrittling cladding to a greater depth and producing
more hydrogen.
The high-pressure injection system was actuatedfor a few minutes at 3 hours 20 minutes into the accident, apparently recovering the core. High pressure injection was again actuated at 3 hours 56
minutes for a short time period. After this time, thecore was probably never uncovered again, althoughsome severely damaged regions of the coreremained very hot and steam blanketed for approximately 4 days. The steam released from the hot re-gions was condensed in water in the upper plenum
before reaching the hot legs.
At 4 hours 27 minutes, significant makeup flow to
the primary system was established from makeup
pumps B and C and maintained until 9 hours. The
flow through the core during this time period washigh enough that all of the decay heat in the core
could be removed without boiling the water. Afterleaving the core, the heated water flowed throughthe pressurizer and out the relief valve to the reactor coolant drain tank and then to the containmentbuilding. In this time period, the upper portions of
the two hot legs and steam generators were508

tiated by the tripping of a condensate pump asecond or two earlier. About 8 seconds later, thereactor tripped because the system pressure hadreached the 2355 psig setpoint. The PORV on thesystem pressurizer had opened at 2255 psig 5
seconds earlier, but this apparently did not provide
enough relief to prevent further pressure rise.
When the system pressure decreased after the trip
to 2205 psig, the PORV failed to close as it should,
and the reactor underwent a small loss-of-coolant
accident that was not recognized as such by thereactor operators until more than 2 hours later.

blocked to steam flow by hydrogen that had been
produced earlier from reaction of steam with zirconium. Because the hot legs and steam generators were well insulated, the temperatures measured
at the tops of the hot legs remained nearly constantfor a number of hours at approximately 750°F, thetemperature to which they had been heated during
the period of core uncovering.
The attempts made to collapse the steam bubbles in the hot legs of the OTSGs failed, although
the system was repressurized and there was morethan 1'/2 hours of feed and bleed operation by cycling the PORV block valve open and closed because of operator failure to recognize that the pressure was not due only to steam but to noncondensible gases as well. The block valve was thenopened for a long period of time to "blow the system down" to get to a pressure low enough to bringon the core flood tanks or the decay heat removal( DHR) system. The system pressure did not drop
enough in more than 3 hours, but the depressurization did seem to bleed most of the rest of the hydrogen out of the system, at least to the point that
the OTSGs were no longer completely blocked byhydrogen.
The hydrogen bled from the system out the
PORV during the various depressurizations, accumulated in the containment to reach a concentrationhigh enough to cause a "iydrogen burn" at 9 hours
54 minutes.
Around 13 hours into the accident, the decision
was made to increase makeup flow significantly,
close the PORV block valve, repressurize to coll apse steam or gas bubbles in the hot legs, and attempt to start a reactor coolant pump. The condenser vacuum had been restored to the secondary
system, and the permissives in the reactor coolant
pump controls had been bypassed to allow them to
be started.
At 15 hours 35 minutes, reactor coolant pump
RC-PIA was jogged to check starting and operation.
At 15 hours 50 minutes, it was turned on and thetransient was terminated; that pump worked continuously thereafter for more than a week.

Periods I and 11:: 0 Hours to 1 Hour 40 Minutes

There is much evidence to indicate that the reactor core was not damaged before the last of thereactor coolant pumps was turned off at 1 hour 40
minutes of accident time. The reactor coolant system had lost a major part of its water inventory out
the open PORV, the steam generators had lost almost all of their heat removal capability by being"boiled dry," and the makeup flow was probably automatically throttled by the high pressurizer level indication. (There are no data to show that the pressurizer level control had been taken out of "automatic" control or that the "16" valves (high pressure injection valves) had been left open by theoperators). The water inventory and distribution in
the primary system near the end of Period II are
shown in Figure 11-29. In OTSG B, mixed water andsteam was "dribbling" over the top of the hot leg
and separating into a steam phase in the upper partof the primary side of the OTSG and a water phasei n the lower half, which returned to the downcomerof the primary vessel by overflowing through thel ower part of the inlet casing of the reactor coolant
pumps and into the cold legs. That this normal
direction of flow existed is proved by the fact that at
1 hour 30 minutes to 1 hour 35 minutes the temperature of the OTSG B hot leg was 5°F higher than thecold leg, as shown in Color Plate V. In OTSG A, thebehavior is similar except that the water in the lower
part was being pumped out by the reactor coolant
pump to keep that level quite low. Because the
OTSG A coolant pumps were running, a mixed
phase of water and steam was being fed to thepressurizer by the A hot leg and was being vented
out the open PORV into the reactor coolant draintank (RCDT).

I nterpretation of the Data

This accident interpretation is keyed as much as
possible to the 10 time periods described in Section
II.C.2.a of this report, "Data Analysis for the First
Sixteen Hours," each part beginning and ending at
the times of certain occurrences thought to be important in the progress of the accident.
At about 4:00 a.m. on March 28, 1979, the TMI-2
plant suffered a turbine trip that was apparently ini-

Period Ill. 1 Hour 40 Minutes to 2 Hours 20 Minutes-

When the reactor coolant pumps RC-PIA and
RC-P2A were shut down at 1 hour 40 minutes, the509

FIGURE 11-29. Reactor Primary System at 90 Minutes

two-phase mixture of water and steam that had
been circulating separated into a steam phase in theupper parts of the reactor primary system and awater phase in the lower parts.
When the A pumps were last operating, any flow
i n OTSG B had to have been induced rather thanforced, while that in OTSG A was driven by thepumps. When the pumps stopped, the fluid in the
hot legs would have drained back into the top of thecore. OTSG B would have been left about half fullon the primary side, with water in the cold legs tothe "dribble level" through the pump casings into thehorizontal section of the cold legs and into thedowncomer.
The pumped flow in the A loop filled the hot leg,
fluid passed over the top of the candy cane, andthen dropped and separated into a steam phase at
the top and a water phase at the bottom of the
OTSG. Because the coolant pumps were still
operating and the letdown line was also removing
water, the water level in the bottom part of the primary side of OTSG A remained quite low. Whenthe pumps stopped, the fluid in the hot leg drained
back into the top of the core, and the level in the
OTSG A settled out at less than half full, and probably not more than about one-fourth full, as the major amount of water present was that in the coldlegs.
The settling out of the water levels and theseparation of the fluids into a steam phase and awater phase filled the downcomer with water. This
then caused the abrupt and large decrease in SRM
count rate observed at 1 hour 40 minutes. Because
the SRM count rate started increasing immediately
after the abrupt drop and the hot-leg temperaturestarted to increase soon afterward, the water leveli n the core could not have been much above the top
when it settled out.
The hot- and cold-leg temperatures of both
OTSGs are plotted on an enlarged scale in Color
Plate V for the time period around that of pump
shutdown. The temperature for hot-leg B showed adefinite increase in temperature by 1 hour 44
minutes, and a definite deviation from the continued
decrease of hot-leg A and both cold-leg temperatures at 1 hour 42 minutes. The A hot-leg temperature also showed a small but definite increase intemperature at 1 hour 43 minutes before it again decreased at the same rate as that of the cold legs inapproximate concert with the refilling of OTSG A as
shown by the A startup level (SU). We believe that
this indicates that superheated steam could havebeen present in both hot legs at the location of the
RTD near the top of the candy cane no later than 1hour 42 or 43 minutes.

Because the mass of metal in the upper internalsof the reactor above the core and the 50-foot lengthof the hot leg would absorb considerable heat, thetop of the core would have had to have been uncovered immediately upon shutdown of the pumps.
However, no conclusion can be drawn as to whatl evel below the top of the core the water settled.
There can be no question that superheated steam
was in the A hot leg by 1 hour 52 minutes because
the temperature of the A hot leg started a rise that
did not stop (other than for two small reversals) until
the temperature was greater than 800°F. The temperature of the B hot leg fell after its initial rise anddid not begin a final rise to more than 800°F until 2hours 3 minutes, even though OTSG B was not bei ng refilled on the secondary side at this time. We
conclude that the time the top of the core was firstuncovered must have been between 1 hour 42
minutes and 1 hour 52 minutes. The increase in
SRM count rate starting at 1 hour 42 minutes reinforces this conclusion.
The sharp drop in SRM count rate occurring at 1hour 40 minutes is interpreted as indicating that alarge increase in fluid density or level occurred at
the time the reactor coolant pumps were shut down;i. e., the downcomer was filled with a higher density
fluid than that which had been circulating. The following rise in count rate, first rapidly, then more
slowly, and then leveling off, is believed to indicatethat the boiloff of water in the core occurred over a
period of 20 to 30 minutes and then leveled off atsome position between the bottom and the midplaneof the core. Calculations by Sandia Laboratories(Appendix 11.10) in the TMI-2 SRM study indicate that
the SRM count rate is quite sensitive to water levelin the downcomer within ±1 foot of the top of thecore and relatively insensitive to changes in levels
below that. Count rates for levels 2 and 6 feetbelow the top of the core differ only slightly, especially if the increase in boron content is included as
the water boils off and the boron concentration
i ncreases. The slight rise in count rate after 2 hours
is thought to have been due to the decreasing density of the water left in the vessel as the systempressure continued to decrease, and the slow dropi n count rate after 2 hours 18 minutes is thought tobe due to increasing fluid density in the core as thesystem pressure increased. Undoubtedly, there
was some adjustment in level in the core due tomakeup and letdown flows, but there are no data on
which to base a judgment. This interpretation wouldi ndicate that the water level in the core reached asteady state level at about 2 hours, which balanced
the rate of boiloff in the core with the refluxing ofcondensate from one or both OTSGs, the loss due
511

to letdown flow and open PORV, and the increase
due to makeup flow.
Once the reactor coolant stopped circulating andthe water level in the core began decreasing, theportions of the fuel rods no longer covered by water
began to heat up. The rate of temperature rise, thedegree of oxidation, the formation of "liquefied fuel,"
and the oxidation damage done to the core aredescribed after Period IV in the section entitled"Core Damage Before Three Hours."
The system pressure began to rise at 2 hours 10
minutes, about 8 minutes before the PORV block
valve was closed by the operators after they had finally realized that the PORV had failed to close earli er. Such a pressure rise could have occurredunder the circumstances either because of thecore's heating up and producing a pressure increase at a rate greater than could be relieved by
the open PORV or because of reduced heat removal by the A OTSG when the emergency feedwater
spray at the top of the OTSG was stopped at 2hours 12 minutes. The primary system depressurization rate was being controlled by the OTSG
steam pressure. The increase in system pressure
was relatively slow at first but then increased more
rapidly.
Period IV- 2 Hours 18 Minutes to 2 Hours 54
Minutes

When the block valve to the open PORV wasclosed at 2 hours 18 minutes, the leak from the system was stopped and the system pressure continued to rise. In an attempt to return the system to its
normal cooling mode, the operators attempted tostart the reactor coolant pumps sequentially. Only
RC-P2B could be started. The operators reported
that the pump operated normally only for a very
short time and started vibrating. It was finally shut
down again at 3 hours 12 minutes.
It is during the period from the first uncovering of
the core at 1 hour 42-52 minutes to the thermal
shock produced by inflooding water at 2 hours 54
minutes that we believe that the major embrittling
damage to the core occurred and much of the hydrogen was produced. The progress of the heatup
is discussed in the following section "Core Damage
Before Three Hours."
We believe that the condition of the core at 2hours 54 minutes based on an estimated boildown
to 4 feet from the bottom of the core to be as follows: all fuel rods had burst; the Zircaloy cladding
i n the fuel rods was embrittled to a depth of at least
6 feet from the top of the fuel stack, between 26%
and 31 % of the Zircaloy in the core had been con-verted to zirconium dioxide; "liquefied fuel" (U0 2 dissolved in either molten Zircaloy metal or the eutectic
li quid formed between Zircaloy metal and its oxi de)18'3 had been formed to at least 36 inches fromthe top of the fuel in the fuel rods in the center ofthe core and to at least 40 inches in the periphery;
the Inconel grid spacers had been melted to at least
4 feet from the top; a rubble bed had been formedby fragmented fuel rods on the spacer grids locatedat about 5'/4 feet from the top of the fuel stack; asignificant fraction of the fuel rods probably still
maintained their original structural geometry above
the 4-foot level from the top of the fuel stack,although part or all of the Zircaloy cladding had
melted and flowed away, and the U0 2 fuel pellets,
for the most part, remained in the original rod
geometry; and the control rod guide tubes and instrumentation tubes remained in place and intact,
although oxidized to a greater or lesser extent. The
notation of the BAD indication on the alarm printerfor the SPNDs at the 4 to 7 levels (from midplane to
the top of the core) at this time are consistent withthis interpretation, as are the alarm printer indications that many of the incore thermocouple temperatures were off scale (above 700°F).
I nstrumentation tubes and control rod guidetubes survived longer than the neighboring fuel rods
because they were not significant heat sources andbecause they served as "percolator tubes" during
depressurization, in which steam bubbles, formed in
the annuli, caused liquid water to percolate above
the average level in the core to reach higher temperature regions before evaporating. The net effect
was to produce a much higher mass flow of steam,
as well as velocity of steam flow, through the annuli
between the guide tubes and the control rods (andi n the double annuli of the instrumentation tubes)
than occurred in the subchannels between neighboring fuel rods. Thus, the guide tubes, control
rods, and instrumentation tubes stayed much cooler
than otherwise expected during depressurization
and, consequently, lagged significantly in temperature rise compared with their surroundings. Their
heatup started later, and the heat absorbed by them
was transferred by radiation from neighboring fuelrods and by conduction-convection interaction withthe steam in the fuel subchannels.
At the end of Period IV, not less than 154 poundmoles of the hydrogen gas (308 pounds) was produced during oxidation of the Zircaloy cladding attemperatures less than about 3600°F. A significant
amount of hydrogen (probably 100 to 200 poundmoles) was produced later by continued oxidation of
the zirconium contained in the Zr-Zr0 2 eutectic and"liquefied fuel" formed, but no accurate estimate canusing relatively precise analytical expressions, few
simplifying assumptions, and parametric treatment
of several of the system variables. The code wasused to estimate the sensitivity of the answers tovariations of such parametric variables as depth ofboildown, time of boildown to a given depth, convective heat transfer coefficients in steam at low
flow rates, and radial peaking factors in the TMI-2
core (related to power in the bundle from center toperiphery). The details of the calculations arepresented in Appendix 11.8. The principal variationon the amount and extent of damage results fromparametric variation in the depth of boildown, all of
the other parameters affecting primarily the time atwhich a given temperature was reached but not themagnitude of the temperature. Time-temperatureelevation plots for 1-foot increments on the fuel rod
are shown in Figures 11-30 and 11-31 for the center
bundle for a boildown in 20 minutes and a boildown
i n 33 minutes to 8 feet from the top (4 feet from thebottom) of the core. A summary of the results ofpresented in Appendix
the calculations
isTables 11-8 and 11-9.
Boildown to 5 feet from the bottom would produce much too little damage, according to ouranalysis, and boildown to 3 feet from the bottom
much too much. We then conclude that the boildown was probably to 4± 1/2 feet from the bottomof the core. The damage estimates at this level are
believed to be consistent with the estimated amountof hydrogen formed, the amount of fission products
released, and the data from the incore thermocouples and from the SPNDs.
Data indicate that the first detection of significant
l evels of radioactivity in the primaryloop occurred at
186
which would be
6:25 a.m. on March 28, 1979,
consistent with a time of boildown of 33 minutes to
8 feet, and a time of core uncovering of about 1 hour
52 minutes into the accident. A review of the calcul ations indicate that the major conclusions reached
for a time of boildown of 20 minutes can be applied
to that for 33 minutes if appropriate corrections are
made for the slower rate of uncovering. Thus, therods would have burst about 30 to 40 minutes after
the top of the core was uncovered. The type andextent of damage to the core would be essentiallyunchanged, since in both scenarios the peak temperatures and greatest depth of damage had been
produced before the reactor coolant pump was
turned on at 2 hours 54 minutes into the accident.
The principal results of the calculations show thatthe ranges of time and location of rod burst(1500±100°F) are from about 13 to 25 inches and
20 to about 40 minutes from center to periphery for
all ranges of boildown and time to boildown depth.

be made for two reasons: (1) the actual extent andcondition of the "liquefied" material is not known,and (2) there are no data on the oxidation kinetics
of such material.

Core Damage Before 3 Hours

On Friday, March 30, 1979, shortly after the "hydrogen burn" was accepted as a real occurrence inthe reactor containment building just before 2:00
p.m. on Wednesday, March 28, calculations indicated that the amount of hydrogen present in the containment at the time of the burn and left in the primary system as either a hydrogen gas bubble or as
dissolved hydrogen in the reactor coolant was
equivalent to 35% to 40% of the Zircaloy present in
the core having been converted to zirconium dioxi de. This was the first measure of damage to thecore, and it applied to the amount of damage to thecore at the time of the burn.
Later, a simple set of calculationsof the heatup
184
to produce boundingof the fuel rods was madeestimates of core damage using simplified assumptions, constant specific heats, constant rate ofboiloff, a constant heat loss fraction, and manualand graphical solutions. This estimate gave a totalof 25% to 30% of the Zircaloy cladding (fueled
length only) converted to zirconium oxide at 3
hours, and estimated the depth of damage to reachas much as 6 feet from the top in the central regionof the core. In the worst case estimate, a large partof the cladding in the top half of the 12-foot core
reacted with the zirconium oxide to form a liquid eutectic phase at 3455°F. This flowed into the gap
between the fuel and the cladding to react with thea liquid
U0 2 fuel, partially dissolving it, and formed
183
phase of Zr-U-O termed liquefied fuel.
At most,about 10% of the fuel present in the upper half of thecore was thought to have formed liquefied fuel. In
the least damage case (decay heat only, no heat ofoxidation of the Zircaloy added for heatup), it wasestimated that the depth of embrittlement of the Zircaloy cladding was essentially unchanged from theworst case, but the extent of formation of liquefied
fuel was confined to only the top of the highest
power central fuel assembly. No attempt was madeto continue the calculations beyond 3 hours of accident time because of a lack of sufficiently accurate information beyond that time. As the damage
estimate of 25% to 30% conversion was made at 3
hours, there is no significant disagreement with theprevious estimate of 35% to 40% at 9.9 hours.
185
was reAn engineering code called TMIBOIL
writtentocalculatemore
preciselythecentlyme-temperature
relationship
for
the
fuel
rods
by
ti
513

FIGURE 11-30. Fuel Temperature Histories

FIGURE 11-31. Fuel Temperature Histories

However, the maximum depths for formation ofli quefied fuel and the peak temperatures reachedvary quite considerably, with boildown to 7 feet producing only a small amount of liquefied fuel in the
peripheral bundle while boildown to 9 feet not only
producing liquified fuel down to the midplane of thecore but also calculated temperatures in excess ofthe melting point of UO 2 for several feet of length offuel rod. In addition, the calculated temperatures
were still increasing when the calculations were
stopped at the time for the reactor coolant pump
RC-P2B to be turned on.
The estimate of damage present in the core at 3
hours depends on the time assumed for the first uncovering of the core. The best evidence available
for determining this time is shown in Color Plate V
where the temperatures of the hot and cold legs ofthe two OTSGs and the levels of coolant on thesecondary side are plotted as functions of time.
There are two possible interpretations of these
data. When the prior level in OTSG B is considered(shown in Color Plate V), it can be argued that thefirst break in the curves for the hot-leg temperaturesof both steam generators at 5:42 a.m. (1 hour 41
minutes of accident time) indicates that superheatedsteam was detected in both A and B steam generators at the top of the hot-legs. The continued riseand subsequent decrease in temperature for OTSG
B could indicate flow of superheated steam into a
condenser that was saturating in heat. The reversion of OTSG A hot leg temperature to a decreasing
temperature-time relationship, paralleling the previous curves and the succeeding curves for the coldl egs, could indicate that OTSG A could absorb no
significant amount of heat (it was already known tohave been boiled dry) until its refilling had begun.
Thus, it can be argued that the core was first uncovered at 102 minutes. It can be stated with certainty that the core had been uncovered no later
than 5:52 a.m. (1 hour 52 minutes or 112 minutes ofaccident time) because at that time the OTSG A hot
leg temperature began to rise without stopping (other than for two short inversions) until a temperatureof about 820°F was reached at 6:52 a.m. (2 hours
52 minutes or 172 minutes accident time). These
two times, 102 and 112 minutes of accident time, all ow placement of the TMIBOIL zero time and theti me at which the RC-P2B pump was started on theti me temperature-elevation plots, so bounds for theamount of damage to the core at 3 hours can be
estimated. It must be assumed that at least a small
amount of water was pumped by RC-P2B into thecore to reverse the heatup of the fuel rods, even iffor only a few minutes.

If it is then assumed that the TMIBOIL calculations for boiloff to 8 feet in 33 minutes apply (thebest estimate based on such information as theamount of hydrogen and radioactivity released, theSRM data, and the first detection of radioactivity inthe primary loop), the PORV block valve was closed
at 6:20 a.m. (2 hours 20 minutes accident time), andthe RC-P2B was started at 6:54 a.m. (2 hours 54
minutes accident time), then the amount of coredamage at 7:00 a.m. (3 hours accident time) can bebounded.
With these assumptions, it can be estimated that(1) the great majority of the fuel rods burst at about
the time the block valve was closed at 140 minutes
and all of the rods were burst within the next 10
minutes, (2) first liquefied fuel formation occurred
about 10 minutes after the block valve was closed,(3) the maximum depth of formation of liquefied fueli n the hot assembly occurred about 20 minutes after
the block valve was closed and about 10 minutesl ater in the lowest power assembly, and (4) the
maximum temperature reached in the fuel rods wascirca 4400°F for a middle power assembly at about
30 minutes after the block valve was closed and at
about the time the RC-P2B was started. Additionally, peak temperatures of about 4300°F or more
were reached in portions of more than two-thirds ofthe core by the time the RC-P2B was started. The
maximum penetration of the formation of liquefied
fuel was to about 40 inches in the lowest powered
assemblies on the periphery of the core and toabout 35 inches in the center of the core. (Thesteam production rates decreased greatly as theperiphery of the core was approached, and thus thecooling capability of the steam flow. This may be an
artifact of the code because crossflow of steam was
not allowed.)
The Zircaloy cladding was embrittled by oxidation
down to at least 4 feet from the top of the fuel in thefuel rods. Considerable amounts of liquefied fuelhad formed and flowed down between remaining
oxidized cladding shells to freeze on reaching al ower temperature at a lower level. When the reactor coolant pump was turned on at 2 hours 54
minutes, the embrittled cladding would have been
thermally shocked by the influx of coolant (whether
steam or water) and would have shattered to produce a rubble or debris bed of cladding fragments,
Zircaloy oxide shells, fuel pellets, and liquefied fuelsupported by fuel rod stubs, unmelted grid spacers,
and intact guide and instrumentation tubes. A significant part of the debris bed would be melded or
glued together with liquefied fuel that had frozen
after flowing from a higher position and temperature.

516

Additionally, it is estimated that the amount of
Zircaloy converted to oxide as a result of the events
to 7:00 a.m. (3 hours accident time) is between 32%
and 39% of the Zircaloy in the fueled part of thecore, and between 26% and 31% of the total Zircaloy in the core, including plenum regions and end
plugs. This estimate includes complete oxidation of
the Zircaloy contained in the liquefied fuel. Theseamounts are equivalent to 300 and 360 poundmoles of hydrogen, respectively. Because of theevidence that more hydrogen may have been produced at a later time, this is not to be taken as an
estimate of the amount of hydrogen present in thecontainment and the primary system at 1:34 p.m.
(9.9 hours accident time), the time of the hydrogenburn in the containment.

entered the OTSG A through either or both of the A
cold legs.
In the 18 minutes of this period, 39 of the 52 incore thermocouples were reported off scale by thealarm printer; i.e., having temperatures greater than
700°F. Five more recorded temperatures between
650 and 700°F, and 8 registered between 500 and
650°F.
The alarm printer showed most of the SPNDs atlevels 4 to 7 as BAD or NORM, and alarms for manyat level 3 were alarmed, indicating that they were at
t80
temperatures well above 1000°F.
The combination of the data for the SPNDs and the incore thermocouples constitute measurements showing thatthe core at the midplane (or a little below) was at
temperatures well above 1000°F for the entire period
and could not have been filled with water, although
the RC-P2B was running, in concurrence with theconclusion in the discussion above. (The debris bed
would not have been filled with water even though
there was water above the core, since the bed was
too hot.)
The PORV block valve was closed, and the leveli ndication in the pressurizer began to rise from 290
i nches a few minutes before the start of this period
to reach a peak value of 380 inches, a total rise ofabout 90 inches in about 12 minutes. Because eachi nch of level in the pressurizer is equivalent to 3.2
ft3 of volume, this rise amounts to about 290 ft 3 ofwater. As the hot leg of OTSG A contained only
steam plus hydrogen at this time, either the level indication is wrong, some other source must be found
for the water required, or some other mechanism
must be found for the change indicated. In addition,
the pressurizer spray valve was opened at 2 hours
54 minutes 33 seconds, providing an open line
between the top of the pressurizer and the 2A coldl eg of OTSG A. With the pressure in the system
rising, the height of the water leg in the pressurizer
spray line must be less than that in the pressurizer
plus its surge line (the lowest elevation of the surge
li ne between the OTSG A hot leg and the pressurizer is lower by about 7 feet than that for the sprayli ne at the outlet side of the RC-P2A), and hydrogenplus steam can be entering both the spray line andthe surge line into the pressurizer to increase thepressure in the top of the pressurizer.
The pressure and material balances are quite difficult to estimate. It is difficult to see how water canremain suspended in the pressurizer when gas isbubbling through the surge line and the spray line
i nto the pressurizer to increase the pressure in the
top of the pressurizer. Also, the temperature of the
A hot leg dropped 50°F in the first 6 to 8 minutes of

Period V: 2 Hours 54 Minutes to 3 Hours 12
Minutes

The operation of RC-P2B at 2 hours 54 minutes
produced a sudden influx of water from OTSG B
i nto the overheated core, causing a great burst of
steam to be produced to increase the pressure very
rapidly (at approximately 30 psi per second), as
shown in Color Plate III. Such a rate of pressure increase could have been produced only by a veryl arge input of energy to the vapor phase of the system and must have been the result of water fromthe OTSG B raising the level in the core highenough for the water to encounter the overheatedparts of the fuel rods. Since the fuel rod cladding
was seriously embrittled by the oxidation it received
i n the preceding time, and much of it had been converted into zirconium dioxide, much of it would haveshattered by thermal shock when the water fromOTSG B was forced into the core by RC-P2B.
There is no evidence to indicate that the coreremained covered following the influx of water.
To the contrary, the continued presence of superheated steam in the hot legs supports the argument that the core was not covered. In addition, thedata in the reactimeter at this time show flow for
only two successive readings taken 3 seconds
apart, indicating that flow occurred for at least 3
seconds and less than 9 seconds. As the flowmeter is located in the top portion of the hot-leg candy
cane, the flow measured was only gaseous andwas probably caused by the displacement of water
i n the lower part of the OTSG by the pump operation. No actual measure of water flow can be given,3
but we believe it to be about 1000 to 1100 ft . The
abrupt changes in cold-leg temperatures may indicate that at least part of the water sucked from the
OTSG B by the operation of the 2B pump may have517

the period, at the same time the pressurizer level indication rose about 80 inches. The drop in temperature would be expected if the pressurizer werevoiding into the A hot leg, but this would require adecrease in pressurizer level, not the increase indicated. This apparent contradiction in behavior canbe explained if the pressurizer reference leg issomehow being voided at the same time as thepressurizer. A decrease in reference leg level produces the same signal indication as an increase inpressurizer level, because the instrumentation
measures only a differential pressure between thereference and reading legs of the level indicator. An
alternate explanation is that because the water temperature in the pressurizer was greatly supercooled
relative to the steam temperature in the hot leg, alarge amount of steam (about 2200 pounds required) condensed to increase the amount of waterin the pressurizer and surge line. This does not explain how the water in the pressurizer can remainsuspended in the pressurizer when there is an open
gas line connection from the top of the pressurizer
to the voided 2A cold leg to equalize the pressuresthroughout the system. The level began to fall at 3
hours 6 minutes when the block valve was opened.
Opening the spray valve did not affect the rate ofrise of the level in the pressurizer. We are left withdifferent explanations, none wholly satisfactory forthis period of the accident.
The opening of the PORV block valve a few
seconds before the end of this period allowed thesystem pressure to drop very rapidly (in seconds to
200 psi) and then more slowly to 1900 psi at theend of the period.

tial transient as shown by thermocouple reading
above the core. Although superheated jets ofsteam from the damaged regions would be expected to penetrate into the upper plenum, condensationand mixing would occur before the fluid reached the
hot legs.
Between 3 hours 42 minutes and 3 hours 46
minutes, something happened to the core, drastically changing the configuration and the state. The
SRM signal showed a very sharp rise by a factor of
about 2 in count rate; the system pressure rose
more than 100 psi in a few seconds (a total rise ofabout 210 psi in about 7 to 8 minutes); both cold
legs of the OTSG A rose very rapidly (130°F in 1
minute in 1A, and 200°F in about 2 minutes in coldleg 2A), as did the cold leg of OTSG B; both hotlegs showed definite changes in temperature; andthe rate of pressure drop in the secondary side of
OTSG A decreased significantly. The pressure increase occurred even though the PORV block valve
was open. The increase in the 1A cold-leg temperature started approximately 30 seconds before thepressurizer spray valve opening was recorded by
the reactimeter (both are recorded on the reactimeter making the time difference precise to 3
seconds), so the event does not seem to have been
precipitated by the opening of the spray valve. It isbelieved that a condensation or slumping of coregeometry occurred just before the pressurizer sprayvalve was opened, causing the formation of moreli quefied fuel in the reheating debris bed, which thendropped into the water in the lower part of the core.
We believe that this produced a burst of steam that
not only began the pressurization of the system butthat may have either flowed through the core barrel
vent valves into the A cold legs to condense in thecold water in the partially filled cold legs at a level
below the RTDs where the cold-leg temperatures
are measured or water in the downcomer wasforced into the cold legs and the OTSGs by the expanding steam bubble below the debris bed in thecore. The opening of the pressurizer spray valve
provided a path for steam and hydrogen flow
through the 2A cold leg to the top of the pressurizer, increasing the flow rate of fluid into that cold leg
and increasing the temperature rise in it. In addition,
the spray valve opening, combined with the openingof the PORV block valve, removed the pressure differential suspending the water in the pressurizer
between the OTSG hot leg pressure and the external pressure.
I n the first 7 minutes of this period, 49 of the 52
i ncore thermocouples were recorded on the alarm
printer as being above 700°F, and the remaining 3
as being between 650 and 700°F. In the following

Period Vl: 3 Hours 12 Minutes to 5 Hours 18
Minutes

At 3 hours 20 minutes and at 3 hours 56
minutes, the high pressure injection system wasturned on for a few minutes and then reduced inflow rate. The rapid pressure drop from 2000 to1500 psi, which occurred at 3 hours 20 minutes,
with the block valve closed is apparently the resultof steam in the system flowing through the core
barrel check valves and condensing on the water inthe downcomer. As shown by the source range
monitor, the downcomer was rapidly refilled following the initial actuation of the high pressure injection
system and probably remained filled for the rest of
the accident. Refilling of the pressurizer after 3hours 30 minutes is probably an indication that thewater level had increased to the surge line at thistime. Some severely damaged regions of the coreremained very hot for several days following the ini518

15 minutes (3 hours 21 minutes to 3 hours 36
minutes), 33 were and 2 probably were above
700°F, 9 were between 650 and 700°F, and 1 was
between 600 and 650°F. Also, in this period, thetemperatures of 51 of the 52 thermocouples weremanually measured over a period of 1 to 1 1/2 hours
with a direct reading thermocouple instrument by instrument technicians working at the computer terminal board in the cable spreading room. They measured temperatures as high as 2655°F (assuming
75°F cold junction correction); 18 thermocouples
showed temperatures greater than 1500°F. As thesequence of measurements was made starting at
about 4 hours and ending after about 5 hours into
the accident apparently in progression from thecenter bundle and out the spiral in succession ofstring number, the temperatures recorded are notrepresentative of the core at any particular timewithin the period and were influenced by the progression of changes during the time period.
The alarming of 18 SPNDs at levels 1 and 2
between 3 hours 44 minutes and 3 hours 47
minutes can only mean that temperatures greaterthan 1000°F were reached in the fuel rods at many
places at elevations of 10 to 30 inches above thebottom of the fuel.
From the above evidence, we believe that thedebris bed and shattered core produced in the priorperiod were further consolidated by additional formation of liquefied fuel to form a crust in the bed,
which spread over much of the core. This crust effectively sealed the debris bed off from cooling bysteam percolation, and a steam bubble was formed
below the debris bed. This allowed additional oxidation of the fuel rod stubs by dryout, producing
damage to a greater depth in the core. The debris
bed and crust were penetrated by the increasing
steam pressure from below, and much of the bed
and crust suddenly slumped to lower levels in thecore, part of it dropping or dripping into the water inthe lower part of the core. The sudden local pressure generation may have forced a radial displacement of part of the core material into the region
between the core and the downcomer. Also, insome assemblies, liquefied fuel flowed down thesmall channels surrounding the instrumentation tube
to reach levels as low as 10 inches from the bottomof the fuel in the rods, or lower, producing the activation of levels 1 and 2 SPNDs observed and formi ng a hot casing around it below the average waterl evel in the core. This then would have formed asteam jet through the annuli of the instrumentation
tube to keep the upper part of the tubes cooled
enough to survive until the overall system cooled
below about 2600°F. This consolidation and slump-i ng of the core can explain the abrupt change in the
SRM data by the dropping of the "source," the increase in incore thermocouple readings, the activation of the level 1 and 2 SPNDs, and the very rapid
i ncrease in pressure observed.
As one result of the additional oxidation, coreslumping, and formation of liquefied fuel, more hydrogen was formed by reaction between Zircaloy
and steam. Additional sources of hydrogen would
be oxidation of the stainless steel upper end fittingson each of the fuel assemblies and oxidation ofsome of the UO 2 to a higher oxidation state. However, bounding calculations (see Section II.C.2.d) indicate that the maximum contributions by thesesources could not be more than a few tens ofpounds of hydrogen, which is not an important contribution in comparison to the probable 100 to 200
pound error range in estimates for the production ofhydrogen from the steam-Zircaloy reaction.
We believe the condition of the core at this time
to be roughly as follows: the debris bed plus crust
has been lowered in the core so that its lower boundary may be as low as 4 1/2 to 5 feet from the bottom of the fuel in the fuel rods, and its upper boundary may be as low as 3 feet from the top of thefuel stack in the original fuel rods; its density has
been increased toward 90% of full density; it rests
on fuel rod stubs that may be no more than 5 to 6
feet long; and many assembly sections contain dripsof frozen liquefied fuel reaching as far down as 10
i nches from the bottom of the fuel. This would indicate that at least 50% and perhaps somewhat moreof the Zircaloy in the core has reacted or been embrittled.
The pressure rise that began at about 3 hours
44-45 minutes was stopped and reversed whenhigh pressure injection (HPI) was started at about 3
hours 56 minutes. When the HPI was stopped, thepressure again began to rise, as did the hot-leg temperatures of both OTSGs. This pressure rise was,i n turn, stopped by the starting of MU-PIB and MUPIC at about 4 hours 22 minutes. Because the system pressure again began to rise, within a few
minutes of pump startup, it seems likely that theflow from the pumps was throttled.
After 4 hours 30 minutes the makeup flow to thevessel was enough to allow the removal of the entire decay heat from the core without boiling. Thei njected water flowed into the cold legs through thecore, through the hot leg in the A loop to the pressurizer surge line, and out the open PORV. The
temperatures measured in the surge line and in thepressurizer in this time period show that this water
was subcooled. We believe that the injection ratefrom the borated water storage tank of 640 gallons
519

186
i s probably
per minute reported in NUREG-0600
higher than was typical for this time period because
the average includes two periods of high injection
rate. However, at 5 hours 45 minutes, for a decay
heat level of 6.2x10 British thermal units per hour, aflow rate of 640 gallons per minute and an inlet temperature of 110°F, the core outlet temperature would
be 300°F. The temperature measured at the pressurizer surge line at this time is 310°F.
The secondary side steam pressure of OTSG A
i ncreased concurrent with the increase in reactor
coolant system pressure after 4 hours 30 minutes,
i ndicating that additional heat had been removed
from the primary system through OTSG A. The
heat removal capability of OTSG A continued, andthe system pressure began to drop at 5 hours. As
the pressure dropped about 180 psi in about 18
minutes, it seems likely that the generation of heatby oxidation of zirconium either still in fuel rod
geometry or in the liquefied fuel and debris bed
geometry had decreased to a negligible rate, andwith that the production of hydrogen had stopped.
Although it is quite difficult to estimate with assurance the additional damage to the core producedby this event, it seems certain that some significant
amount of damage did occur. If it is assumed that
another foot of fuel rod was oxidized as a result of
the event, then an estimated 50 pound moles (100pounds) of hydrogen would have been formed in thenext few hours. This would then yield a total production of hydrogen of about 410 pound moles (820pounds). The hydrogen production estimated would
then range from about 354 to about 410 poundmoles (700 and 820 pounds), which indicates that
30% to 35% of the total Zircaloy in the core has
been converted to zirconium oxide.
The period ends with the closing of the PORV
block valve to bring about repressurization to "collapse the steam bubbles" in the primary system,
which is believed by the operators to be necessary
to allow natural circulation to cool the primary system.

Period VII: 5 Hours 18 Minutes to 7 Hours 39
Minutes

When the PORV block valve was closed at 5hours 18 minutes, the pressure began to rise immediately at a rate of about 13 to 14 pounds per
square inch per minute. It increased to about 2100
psi, at which time the operators began to cycle the
PORV block valve open and closed to maintain thepressure between about 2150 and 1975 psi. The
pressurization times were about 120 to 130 seconds
long and the depressurization times about 70 to 75

seconds. The temperature of the pressurizer was
reported in this time period for the first time in theaccident sequence on the utility typer as 345°F, andthe pressurizer surge line temperature was reported
just before the start of this period as 310°F. The
pressurizer temperature may have been 20 to 30°F
higher at that time. At this temperature, the vapor
pressure of steam in the vapor space of the pressurizer would have been no higher than 125 to 130
psia.
As in the previous time period, the core decay
heat was removed by the makeup flow passing
through the core and out the pressurizer. With thewater in the system subcooled, the primary systempressure in this period was determined by thecompression of the noncondensible gases trapped
i n the upper regions of the hot legs and steam gen565
erators. Assuming a net makeup flow rate of186
andgallons per minute (based on NUREG-0600)
3
a perfect gas, a gas volume of 2540 ft can be inferred from the system pressurization rate during
the periods of pressure increase. A possible breakdown of this gas volume could have been: the reactor coolant pump volume (400 ft), half the volumeof the cold ft),legs (476 ft 3), half the volume of the hotlegs (469
half the volume of the upper head3
(254 ft 3) and 500 ft i n each steam generator.
Although it is difficult to reconstruct accurately the
distribution of gas among the different volumes in
the primary system, the gas volume inferred fromthe pressurization rate is reasonable for this time
period.
Earlier in the accident when the core was uncovered, some of the hydrogen generated fromzirconium-water reaction flowed into the hot legs
and upper portions of the steam generators. The
presence of the hydrogen in the legs effectively
blocked the flow of steam from the core to thesteam generators. Because the primary system iswell insulated (the characteristic thermal decay
period for the walls is approximately 150 hours), thehot legs that had been heated to 750 to 800°F duri ng core uncovery remained hot for a number ofhours. Even the flow of subcooled water throughthe A loop hot leg into the pressurizer surge line
was ineffective in cooling the upper portion of the
hot leg. The thermal conductance along the pipe is
too small to have reduced the wall temperature significantly. Furthermore, the hydraulic regime of hot
fluid above cold fluid is thermally stable and would
not have induced convective cooling.
During this and the previous period, the decreasei n level in the borated water storage tank (BWST)
i ndicated that at least 132000 gallons of borated
water had been pumped into the reactor primary520

system if all of the water removed from the BWST
went into the primary system. As the primary system has a water volume of only 90 000 gallons, thisamounts to about 1.47 times the total volume of the
primary system, without allowing for the water
volume present (about 45000 gallons) at the startof the period.

II. C.2.a, caused actuation of the containment building
sprays as well as isolation of the containment. The
sprays produced a fog that cooled the hot legs
between 50 and 60°F, and the cold legs between 25
and 30°F in a period of 6 to 7 minutes.
Neither of the "blips" in the SRM count rate duri ng this and the previous period can be explained.

Period VIII: 7 Hours 39 Minutes to 10 Hours 21
Minutes

Period IX: 10 Hours 21 Minutes to 13 Hours 15
MinutesWith the decision of the operators to "blow thesystem down" to allow the core flood tanks to flood
the core (since it proved impossible to "collapse thesteam bubbles" in the hot legs), the PORV block
valve was opened, and when the depressurization
slowed, the pressurizer vent valve was opened. Fora reason we have not determined, the pressurizer
spray valve was also opened by the operators,
although there was no water flow available to produce a spray in the top of the pressurizer (normal
operating procedure would call for pressurizer sprayactuation to decrease system pressure).
At 9 hours 4 minutes the makeup flow rate wasdecreased, and by 10 hours 20 minutes the watertemperature in the pressurizer reachedsaturation.
5X107
Based upon a decay heat level of
Britishthermal units per hour, the net makeup flow (including the discharge of flooding tanks) must have beenless than 270 gallons per minute to result in saturated conditions at the core outlet. This is consistent
with the operation of one makeup pump in this time
period. The filtering of hydrogen from the primarysystem by the water in the pressurizer and surge
line continued during this period, the hydrogen content of the system finally reaching a level sufficiently
low for the OTSG A to begin to operate as though
the vapor space was no longer blocked by a noncondensible gas.
Of particular note is the approximately 45-minuteperiod between about 9 hours and 9 hours 45
minutes in which the system pressure did notchange significantly whether the PORV block valve
was opened or closed. This behavior did not stop
until both MU-PIA and PIC were actuated in HPI at
9.9 hours by the engineered safeguards actuation
as a result of the increase in containment pressure
after the hydrogen burn discussed below.
The bleeding of hydrogen from the reactor primary system into the containment atmospherethrough the PORV block valve in the previous period
and the depressurization in this period resulted in aconcentration of hydrogen in the containment
atmosphere high enough to permit a hydrogen burnto occur. This hydrogen burn, discussed in Section

At the start of this period, three important observations indicate that most of the hydrogen generated earlier by oxidation of the Zircaloy cladding had
been removed from the system: the A hot-leg temperature dropped 150°F in about 9 minutes, thepressurizer temperature reached the system saturation temperature calculated from the system pressure, and the OTSG A showed a sharp, althoughsmall, rise in steam pressure. All of these indicatethat steam was once again flowing through the A
loop in significant quantities to be condensed in the
OTSG A.
From 11 hours to 11 hours 20 minutes approximately 640 ft3 of water appears to have drained
from the pressurizer. If the pressurizer level reading
is correct, a consistent hydraulic picture must beable to explain where this large quantity of water
went. A plausible explanation is that the A loop cold
legs and pumps also contained hydrogen following
core uncovering and the water filled this volume.
This may also explain the reason the RC-P1A pumpcould not be operated at 4 hours 10 minutes.
The reactor primary system pressure increased
relatively slowly after the PORV block valve wasclosed, in contrast to previous behavior, despite
operation of MU-PIC for a total of about 15 minutes
after closure. In this period, there was no heat removal capability from the entire system when the
PORV block valve was closed, except for the flowout the letdown line. However, heat was being removed from the core into the OTSG A, as shown by
the increasing steam pressure in the secondary sideof A and the rise in the A cold-leg temperature toreach the system saturation temperature at about 12
hours 9 minutes, both of which continued to the endof the period.
Period X: 13 Hours 15 Minutes to 16 Hours

At about the start of this final period of ouranalysis, the decision had been made to repressurize, increase the makeup flow, and attempt once
more to get a reactor coolant pump operating. The
condenser vacuum pumps had been started suc521

then more than 34000 gallons of water werepumped into the reactor coolant system after the
PORV block valve was closed for the final time
(37 000 gallons were removed from the BWST in
this time period). Since the reactor coolant volume
i s 90 000 gallons, including about 11500 gallons in
the pressurizer, this amount is more than one-thirdof the total water volume in the system.
The distribution of the water and gas inventory of
the primary system at 16 hours is shown in Figure11-32. At that time there were four gas bubbles inthe system, one in the top of each OTSG, one in the
top of the pressure vessel, and one in the pressurizer. Coolant water was being pumped through the
hot leg of OTSG A, flowed over the top of the candy
cane, and dropped through the gas bubble to fill the
lower part of the OTSG and be recirculated by thepump. The reactor pressure vessel was filled above
the hot-and cold-leg nozzles, and hydrogen wastrapped in the pressure vessel head.

cessfully, so vacuum was being established in thesecondary steam system to allow the A OTSG to
start steaming to the condenser at about 14 hours.
Heat removal capability of the OTSG had once
again been established.
The PORV block valve was closed at 13 hours 21
minutes, but the system pressure did not begin toi ncrease until about 12 minutes later. At about 13
hours 36 minutes the system pressure began to increase, rising to about 2325 psi before makeup flow
was throttled back and the pressure allowed to decrease slightly. At the same time, the hot-and coldleg temperatures in the OTSG A deviated from thesaturation temperature, and the two A cold-leg temperatures began two distinctly different behaviors,
the temperature for the 1A cold leg lagging behindthat for the 2A cold leg by as much as 30 minutes,
or differing as much as 150°F in temperature at agiven time. There is no obvious reason for thisdifference in behavior. Both are on the same
OTSG; therefore, both should have been filled to thesame level, and the only known difference between
the two cold legs is that the letdown line is on the 1A
leg.
With the "jogging" of the reactor coolant pump
RC-P2A for a few seconds at 15 hours 36 minutes,
the hot-and cold-leg temperatures showed immediate changes. The rises in temperature observed in
the hot legs immediately after the pump was
stopped (100 to 130°F) were caused by the thermal
bounce of the walls of the hot-leg pipes reheating instagnant steam because they had not been significantly chilled by the very short time flows inducedby the jog operation of the coolant pump.
When the reactor coolant pump RC-P2A wasagain started at 15 hours 50 minutes, all hot-and
cold-leg temperatures immediately equilibrated(within less than 3 minutes) at about 360°F, and thesystem pressure dropped to less than 1400 psi.
The transient had been terminated and the reactor
was finally put under control.
At the time of the very rapid pressure rise, theSRM count rate, increasing very slowly over many
hours, had again reached the same value it had had
at the time of the core reconfiguration at 3 hours 45
minutes. This was probably due to a concentrationof fuel from the top of the core into the debris bed
at about 6 to 8 feet from the bottom of the core asa result of the change in core geometry at 3 hours
45 minutes (which would decrease the SRM "viewangle" of the fuel in the core), a slow heatup of thewater in the downcomer, and little effect of changes
i n downcomer water level above midcore height.
If the makeup flow rates reported by the operators of about 425 gallons per minute were correct,

Summary and Conclusions of the Interpretation of
Accident Sequence
1.

The major features of this interpretation are:

All of the water removed from the BWST
(271000 gallons) during the 16 hours passed
i nto and through the reactor primary system,
through the pressurizer, and out the PORV,
when it was open or was used to pressurize
the system when the PORV block valve wasclosed.
2. Makeup flow rates are generally based on the
average values reported for the several periods
i n NUREG-0600 (which, in turn, are based primarily on changes in BWST levels) but aremodified as necessary to make the materialbalance fit.
3. The maintenance of high temperatures in the
hot legs of the OTSGs for all times after about
3'/z hours was due to the blockage of steam
flow by the presence of hydrogen and the very
low heat losses through the insulation present
on the outer surfaces.
4. The top of the core was uncovered within thefirst few minutes after the reactor coolant
pumps were stopped.
5. The top of the core remained uncovered until
about 3 hours 20 minutes and was never uncovered again, although some parts of thedamaged core remained steam blanketed andvery hot for up to 4 days.
6. The major damage to the core had occurred by
the time the reactor coolant pump was started

522

FIGURE 11-32. Reactor Primary System at 16 Hours

at 2 hours 54 minutes, although additional
slumping occurred at 3 hours 45 minutes.
7. All of the fuel rods in the core burst, during anapproximately 30-minute (center bundle) to
40-minute (lowest power peripheral bundles)
period after the top of the core was uncoveredat depths ranging from 1'/2 feet (center bundle)
to 2 feet (peripheral bundle) from the top of thefuel rods.
8. Temperatures at which liquefied fuel (U02 dissolved in the zirconium metal-zirconium dioxide
liquid eutectic at about 3500 to 3600°F) could
be formed were calculated to have first beenreached at 6 inches from the top of the fuel inthe fuel rods in the central fuel bundle about 33
minutes after the top of the core was uncovered and were reached as low as 36 inchesfrom the top of the fuel. Such temperatures
were calculated to have been reached in the
peripheral bundles at a depth of about 14
inches from the top of the fuel in about 46
minutes after the core was uncovered and at a
depth of about 41 inches in 57 minutes.
9. The peak temperatures calculated for the fuelrods ranged from 4370°F in about 52 minutes
for the highest powered bundle to a maximumof 4412°F for a medium powered bundle at 58
minutes to about 4358°F for a lower powered
peripheral bundle at about 78 minutes.
10. The amount of hydrogen formed by oxidation ofsolid Zircaloy cladding during the temperature
excursion was calculated to be about 308
pounds, and that formed from all of the damaged Zircaloy, including that contained in theli quefied fuel present at 3 hours, was calculated
to be about 720 pounds. This is the minimum
amount of hydrogen estimated to have been
formed. The maximum could be as high as 820
pounds.
11. The major releases of hydrogen to the containment occurred before 4 hours accident timeand during the long depressurization around 8hours. No significant amount of hydrogen was
produced after about 4 hours.
12. The minimum water level occurring in the core
up to 3 hours is estimated to have been 4± '/2
ft from the bottom of the fuel in the fuel rods on
the basis of the amount of hydrogen produced,
the amount of radioactivity released, the time atwhich significant levels of radioactivity weredetected, and the structural damage estimatedi n the core.
13. The total amount of Zircaloy oxidized is calcul ated to be not less than 16 400 pounds andmay have been as high as 18 700 pounds; i.e.,

between about 31% and 35% of the total Zircaloy in the core.
14. The damage in the core extends from the top
downward at least 7 feet, and probably 8 feet,over most of the core and consists of oxygen
embrittled Zircaloy cladding topped by a bed ofdebris that probably consists of fuel pellet fragments, partially dissolved fuel pellets, shells of
Zircaloy oxide, and segments of embrittled Zircaloy cladding with outer skins of Zircaloy oxide, all glued together with liquefied fuel into a
relatively tight and compact mass extending
entirely across the core from wall to wall andpenetrated by only a few vertical passageways,
at most. In addition, fingers of liquefied fuel extend downward from the debris bed in several
continuous subchannels between fuel rods, encompassing the neighboring fuel rods, to adepth of about I foot above the bottom of thefuel stack in the fuel rods. Not less than 32%
of the fuel assemblies have such fingers ofliquefied fuel.
c. Core Damage Estimates from Fission
Product Release
At shutdown the reactor core contained fission
products, activation products, and actinides. Someof these, notably krypton and xenon, are gaseousand can diffuse through the fuel pellet to collect in
the gap between the fuel and the cladding. To al esser extent, the halogens (iodine and bromine) can
also diffuse into the fuel-clad gap. Any perforationof the cladding can release these fission products
i nto the reactor coolant.
If the fuel temperatures are higher than operating
temperatures, but well below melting, other radioactive materials are volatilized and can diffuse out.
Also, diffusion of the noble gases and halogens increases so that a larger fraction of these can bereleased. The release of cesium is quite variable
and could be caused by compound formation. Because of this variability and what is now known
about cesium, it is not possible to determine precisely the temperature at which a reasonably large
fraction of the cesium would be released; however,
it is believed temperatures would not be lower than
1300°C (2370°F).187,188
At higher temperatures that cause the liquefaction or melting of fuel, some fraction of other fission
products such as tellurium can be released. Data
reported show that the escape of tellurium depends
on many factors other than temperature.189 Under
oxidizing conditions some ruthenium may be524released before melting. In general, rather large
fractions of both tellurium and ruthenium arereleased in melting; but under some conditions,these materials can also be released before melt.
The presence of ruthenium and tellurium does notprove that melt has occurred, but the absence ofhas not occurred.
them is a good indicator that melt
187,190
More recent experimental work,
while tending
to confirm previous data, has not resolved all thequestions regarding conditions-especially temperature conditions-under which fission products
would be released.
Many of the fission products and most of theactinides occur as refractory oxides and arereleased only in relatively small amounts even atelevated temperatures. However, if damaged fuelpellets are rewetted, some of the more refractory
radioactive material can be leached out. This process is slow and only small fractions of thesematerials find their way into the coolant by leaching.
The longer damaged fuel is in contact with water,
the more materials are released.

the most severely damaged fuel. Small fractions,approximately 10% or less, could have beenreleased from perforated but otherwise undamagedrods, but this cannot be well estimated.
Leaching from Irradiated Fuel

Very small fractions of the remaining groups may
have been released from the very hottest fuel. The
principal mechanism for release of these refractorymaterials is probably leaching. Leaching from irradiated UO2 has not been thoroughly
studied. Howev192,193
er, the X94
work of Katayama
and of Forsyth andEklundhas shown that the leaching rates are
slow, comparable to those from glass. Quantitative
data, especially for the temperatures and conditions
existing in TMI-2, are too sparse for a reliable calculation of the rate of leaching, especially when one
considers that the condition of the damaged fuel iscompletely unknown.
An additional complication is presented because
the effective surface area of irradiated fuel presented to the water is almost impossible to estimate because of cracking and porosity. The most that canbe done with the available data is to form an "educated guess" as to whether the fuel appears to bemainly in the form of very large pieces or in the formof very fine fragments. Without additional data it is
not possible to estimate the actual size distributionof the fragments. However, a small fraction of themost refractory material can be expected to havefound its way into the reactor coolant. An approximate leaching calculation is presented in Appendix
11. 7. On the basis of this approximate calculation, it
is possible to state, with very low confidence, that alarge fraction of the fuel can presently be fragmented and that the size of the fragments is more likely
to be a few millimeters than dustlike. A similarcal191
His
culation has been carried out by Powers.
conclusions, although not identical with these, indicate that the observed activity may have beencaused either by leaching from large-sized fragments or by distribution of particle sizes no morethan a few percent smaller than 2 millimeters in diameter and none smaller than 0.6 millimeter in diameter.

Categories of Fission Product Releases and Their
Relation to TMI-2

Fission products and actinides can be divided
i nto typical release groups, based on the ease withwhich they are volatilized. One such grouping (fromRef. 191) is in order of decreasing volatility.
I
II
III
IV
V
VI
VII
VIII

Noble gases (Kr, Xe)
Halogens (I, Br)
Alkali metals (Cs, Rb)
Tellurium (Te)Alkaline earths (Sr, Ba)
Noble metals (Ru, Rh, Pd, Mo, Tc)
Rare earths and actinides
Refractory oxides of Zr and Nb

The fraction of gaseous and volatile fission products released depends on the temperature and thesize of the fuel fragments. If the temperature is highor if the fuel is highly fragmented, nearly complete
release of the volatile materials can be assumed.
Under the conditions that havebeen calculated
188
for the accident at TMI-2,
nearly complete
release of groups I and II can be assumed from allfuel that was severely damaged, plus some additional fraction from fuel rods whose cladding was
perforated without damage to the fuel. This additional amount from perforated but otherwise undamaged rods is probably partly balanced by theamount not released from severely damaged fuel.
A major fraction of group III and a much smaller
fraction of group IV could have been released from

Expected Dispersion of the Fission Products fromthe Reactor

Principal fuel damage probably started before 3
hours after turbine trip. There was probably only
minor damage
before 2 hours. The calculated total
195
i nventoryof fission products, activation products,
525

TABLE 11-56. Activity in release groups*
Group

Activity

12.97 x 10 8 Ci

III

4.6 x 10 Ci

IIIV

4.47 x 10 8 Ci
71.61 x 108 Ci

V

3.85x 108 Ci

VII

2.69x 109 Ci

VI

VIII

Total

er, the very high solubility of iodine in water and thestrong tendency of atmospheric iodine to plate out
on surface quickly reduces the amount of iodine in
the air. Cesium, less volatile, is not expected to bepresent in the air in a significant quantity. On theother hand, the solubility of xenon and krypton isvery low; these gases will be found almost entirelyin the air.
To summarize, nearly complete release of noble
gases, iodine, and cesium from damaged fuel is expected, even if the temperature is below the melting
point. Significant releases of tellurium, ruthenium,
and more refractory materials will occur only if thetemperature approaches the melting point. Most of
the noble gases will be found in air, and most of theother fission products will be found in water.

6.34 x 108 Ci
4.80 x 108 Ci

5.11 x 109 Ci**Distribution of Fission Products at the TMI Site

*A few elements of low total activity, notably Fe, Cu,
As, and Sb, have been arbitrarily located on the basis of
melting point.
**Total does not quite agree with calculated total
activity because of rounding.

Analyses of samples of containment air, reactor
coolant water, and auxiliary building tank water are
summarized in Ref. 197. Reactor coolant analyses
show between 7% and 15% of the calculated inventory of iodine and cesium isotopes to be in the
coolant. If these measurements are corrected for
dilution by water from the borated water storagetank, the fractions will be a factor of 3 higher.
Results for refractory materials show great variation.
A sample taken on April 10 was analyzed by four laboratories. There was a large variation from laboratory to laboratory, indicating low confidence in the
results. Analyses of krypton and xenon isotopes in
the containment atmosphere also showed considerable variation. However, based on the most abundant isotopes (85Kr and 133 Xe), there seemed to be
29% to 62% of the core inventory of noble gases in
the containment air. Only 2% to 3% of the iodine
and cesium was found in the auxiliary building tanks.
On August 28, 1979, a hole was drilled into thereactor building and samples of sump water were
removed. Analyses of these samples showed 22%
to 48% of the core inventory of iodine andcesium to198
be in the reactor building sump water.
I n addition
to iodine and cesium, very small amounts of Ru, Zr,
Nb, Sb, La, and Ag were found. As expected, little
9O
Sr was found. At most, the amounts corresponded to a few millionths of the core
inventory. About
129mTe0.02% of the core inventory of
was found.
All of these sample analyses were corrected for
decay of the radionuclides to the time of analysis.
This correction process is certainly more accurate
than the analyses themselves; i.e., the accuracy ofthe estimates does not depend on the accuracy ofand actinides is given in Table 11-56 for 3 hours after
shutdown.
A detailed discussion of the fission productrelease pathways begins in Section 11.13 of this report where a short summary is included. Radioactive material released to the reactor coolant may
have been partially flushed to the containment
through the open PORV (RC-R2). Some of the material may have been flushed to the containment prior to the containment isolation and then pumped tothe auxiliary building. However, the coolant may
have contained only a minute fraction of the total
activity at this time; it is highly improbable that a significant fraction of the coolant was released before
the reactor building sump pumps were shutdown.
There is an unsubstantiated possibility'" that morewater leaked to the auxiliary building after pump
shutdown. This leakage would have terminatedwhen the reactor building was isolated after 3 hours
56 minutes.
Most of the material flushed out of the RCS probably remained in the reactor building. Some additional material may have volatilized from the makeup
tank. Aside from these losses, which are not expected to be very large, estimates of the total activity released from the fuel can be made by analyzing
the reactor building air and water samples, the reactor coolant, and the auxiliary building tanks.
Iodine is quite volatile, and it may be supposedthat a significant fraction is found in the air. Howev-

526

the cladding around the fuel with the steam generated by the boiling water. In this section several aspects of the hydrogen "problem" are discussed.
The following subjects are treated in this section:

the decay calculation. Table 11-57 is a recapitulationof the release of volatiles.
Findings

1. hydrogen production,
2. hydrogen accounting,
3. calculation of bubble size,
4. removal of the hydrogen bubble, and5. the hazard from the hydrogen bubble.

From these results, one can cautiously conclude
that between 40% and 60% of the core inventory of
release groups I-III was released to the coolant; that
only a small fraction of group IV was released; andthat only minute amounts of the remaining groups
were released. The amount of refractory isotopes
released is consistent with leaching (see Appendix
11. 7).
These data tend to confirm other analyses ofcore damage. The data on radioactivity released
are too sparse and variable for a precise conclusion
to be made on the amount of core damage; however, the following conclusions appear to be supported.

Hydrogen Production
Two possible sources of hydrogen are considered: metal-water reactions and radiolysis. Other conceivable sources include oxidation of UO2,
which has not been investigated. The production ofhydrogen from metal-water reactions is known tohave been large; therefore any hydrogen from othermechanisms is expected to be small in comparison.
Radiolysis is not expected to produce large
amounts of hydrogen. It is investigated because thepossibility of oxygen production was considered at
the time of the accident. If oxygen had beenreleased, the hydrogen that was trapped in thereactor coolant system could have become flammable.

1. About 50% of the reactor core was damaged sufficiently to release the most volatile fission products.
2. The low fractions of tellurium, ruthenium, andstrontium indicate that no significant quantity offuel reached the melting point of U02 (5200°F).
3. The amount of refractory isotopes in the reactor
coolant is consistent with leaching.

Metal-Water Reactiond. Hydrogen Production, Removal, and Hazard

Many metals are oxidized by water. The reaction
i s very slow at low temperatures for most metals.
Both steel and zirconium are oxidized at an increasi ng rate as the temperature rises. The oxidation of
zirconium, the major constituent of the cladding, oc-

I ntroduction
One of the surprises of TMI-2 was the formationof large amounts of hydrogen from the reaction of

TABLE 11-57. Total volatile isotopes released from core
ReleasedTo

1 33XeEnvironment

0.011

-2

-

-

RB Atmosphere

0.463

-

-

-

RB Water

-

0.224

0.484

0.344

RC Water

-

0.144

0.124

0.084

Aux. Bldg. Tanks

-

0.03

0.03

0.02

0.46

0.39

0.63

0.44

TotalsI sotope (fraction of core inventory)
1 37Cs
1 311

1 See Ref. 199
2Dashes indicate low values (generally less than 1%)
Best estimate
from data in Ref. 197.
4Averageof observations.

527

1 34 Cscurs rapidly as the temperature approaches themelting point. The reaction is
Zr + 2H 2 0 - Zr0 2 + 2H 2

Each mole of steam produces precisely 1 mole ofhydrogen, so that no change occurs in the volume
of gas.
If the zirconium is in the form of a fine powder,
the reaction takes place very rapidly because thewater vapor has instant access to metallic zirconium
with, at most, a very thin shield of zirconium oxide.
However, the cladding is solid metal and the water
has access only to the exterior. Any water vapor
on the inside of the cladding is rapidly exhausted
and can only oxidize a minute quantity of metal.
The initial oxidation of the exterior is very rapid.
However, the formation of an oxide layer shields theunreacted metal from access to the steam. This
formation causes the reaction to proceed slower as
the oxide layer becomes thicker. The shielding is
not perfect, however, and some oxidation still occurs even with a relatively thick oxide layer. Experiments have shown that, when the temperature of
the zirconium is constant, the thickness of oxide
can be approximately represented by the equation
h2 = Kt

where h is the thickness of oxide produced up to
the time t. The quantity K can be reasonably well
represented by
K = Aexp (-E/RT)

where A and E are experimentally derived constants, R i s the gas constant, and T is the absolutetemperature. Most investigators now use theCathcart-Pawel rate constants in which A =0.00349 in2 /s and E/R = 32 512°R.
I n a reactor accident the temperature of the cladding is not constant. Each kilogram of zirconium
oxidized releases about 6 1/2 MW. The release ofthis energy raises the temperature of the cladding.
The table below shows how the oxidation rate increases with increasing temperature.
Temperature ° F

K in 2 /s

1000

1.9 X 10 -13

2000

4.4 X 10 _

1500
2500

3000
3500

4000

1.0 X 10 -10
5.3 X 109

-8

3.1 X 10 -7
1.2 X 10 -6
3.2 X 10

-6

For a given oxidized thickness, the speed of thereaction is proportional to the quantity K, so thatwhen the temperature increases from 2000°F to
4000°F, the reaction proceeds nearly 1000 times
faster.
Because of the very large energy release in oxidation, the cladding heats up faster than the steam
can eliminate heat. (At high temperatures the reaction power can exceed the decay power.) Becauseof the speed with which oxidation proceeds, once it
has started, minor errors or uncertainties in the rateequations are not very important. What is critical is
the water level in the reactor vessel. If the waterlevel is low enough for a long enough time to oxidize
about 10% of the thickness, the remainder can beoxidized in a short time. Oxidation acceleration is
also possible due to fracturing or transformation of
the formed oxide layer at high temperatures. However, these mechanisms are not expected to be
operative until the runaway oxidation has begun,and they would not change the results appreciably.
These remarks must be tempered by consideration of clad melting. As soon as the melting temperature of the clad (or of the mixture of metal andoxide) is reached, the molten material can run down
the rod-like candle wax and refreeze in a lower,
cooler zone. This procedure takes the unreacted
metal away from the runaway oxidation reaction, sothat oxidation can be at least partially limited bymelting. The molten metal-oxide mixture readily
dissolves U0 2 , and the rate of oxidation of theresulting mixture is not well known. Therefore, onceliquefaction has occurred, there is great uncertainty
about the extent of oxidation that follows. This uncertainty, coupled with the lack of precise
knowledge of water level, means that rather widebounds must be placed on our ability to calculate
the amount of hydrogen produced.
Hydrogen also can be produced by the reactionof water with steel. However, the amount produced
appears to have been small in the TMI-2 accident.
Calculations of the steel-water reaction have been
performed. The uncertainties are even greater thanthose involved in the zirconium-water reaction. Because of the low production of hydrogen by thisreaction, the overall uncertainty is not greatly affected.
A check on the calculation of hydrogen production occurs. The summed partial pressures ofsteam and hydrogen must equal the system pressure. The partial pressure of the steam is only approximately known; therefore an exact check is notpossible. However, the partial pressure of hydrogenat any time must certainly be less than systempressure; this fact can help to reduce the uncertainty in the calculation.

528

suppressed. Under boiling conditions an almost
stoichiometric mixture of molecular hydrogen andoxygen could form in the vapor space. The production is always slowed because some recombination
exists before the molecular products are removed.
This recombination is particularly important when
the boiling rate is low, which was typical of conditions in the TMI-2 accident. An excess of hydrogen
will reduce the effective yields of hydrogen and oxygen even when boiling is taking place, although the
reduction is not as impressive as in the nonboilingregime.
Honekamp, et al. have calculated that the contribution of radiolysis during boiling could have raised
the oxygen concentration in the bubble only to
0.7%. 202 Cohen calculated a maximum203
oxygenconcentration of about 1% from all sources.
Iodine and other halogens also promote decomposition, but by another process. Halide ions act asradical scavengers, and thus inhibit recombination.
Experiments have been conducted with dilute halide
solutions, and marked scavenging of radicals has
201
been observed .
However, it would be difficult toquantify the extent to which the trace concentrations of iodine in the TMI-2 accident might havescavenged radicals.
Schwartz has calculated the effect of reactive im204
purities.
He shows that the amount of impurities
present is more than 2 factors of 10 too low toprevent recombination.
During much of the TMI-2 accident, a large
volume of mixed vapor and gas existed in the reactor coolant system (RCS). Water vapor can also be
decomposed by radiation. However, the molecularyield is extremely low, and the only effect is usually
the production of H and OH radicals. These radicals recombine to water in the presence of radiation. I mpurities might increase the decomposition,
but no major hydrogen or oxygen production fromradiolysis of water vapor would be expected in the
TMI-2 accident.
The net result of all these factors is that probably
li ttle hydrogen or oxygen was produced by radiolysis within the reactor coolant system. Some
oxygen might have been produced during periods ofboiling. The amount so produced cannot be precisely calculated.
Some decomposition might be possible in thewater that flowed out of the PORV into the reactor
sump. This water was exposed to high linear energy transfer (LET) radiation from entrained fission
products and actinides and was exposed to thecontainment atmosphere. The containment always
had more oxygen than hydrogen. Oxygen is alsoRadiolysis

Radiation absorbed in water causes it to disintegrate into its constituents-hydrogen and oxygen.
Many complex reactions are involved, but the net
result is
H + OHH 2O + radiation
and

H+H-.H 2
H 0
OH + OH
2
2

The hydrogen peroxide finally decomposes into oxygen and water. Reverse reactions, or recombination, are
and

H +OH-• H 20+H
H2 2 +H-• H2O+OH

6

H + OH -* H 2 O

If the radiation is in the form of heavy alpha particles, there are high local concentrations of the radicals H and OH, and the production of H 2 and H 2 O 2
is favored. On the other hand, if the radiation issparsely absorbed, as with gamma rays or slow
neutrons, the radicals are dispersed so widely that
production of hydrogen and oxygen is not favored.
I n addition to the ionization density, the waterchemistry influences whether decomposition or
recombination governs. The most important chemical regulators
are dissolved hydrogen and oxy200.201
gen.
If only hydrogen is in the water (above al ow threshold concentration), recombination is much
more rapid than decomposition, and no net hydrogen or oxygen is produced. If both are present withhydrogen predominating, the production of H 2 andH202 rises to a peak and then quickly declines
essentially to zero. If hydrogen and oxygen areboth present in about equal concentrations, both willcontinue to be produced as long as the radiation isabsorbed.
Pressurized water reactors are operated with
dissolved hydrogen to promote recombination.
Even if this were not so, the metal-water reactions
produce hydrogen, thus increasing the hydrogenconcentration in water. Furthermore, before clad
rupture, the radiation was mostly gamma rays,
which do not favor decomposition; after clad rupturesome fission products were released, but very extensive prior hydrogen production would have inhibited decomposition.
These conditions are not necessarily true if boili ng occurs. The rising steam bubbles scavenge therecombinationismolecular
products,
and

529

207

more soluble than hydrogen. Both factors combined to make the sump water oxygen rich, which
would have enhanced radiolytic decomposition.
However, the concentration of radionuclides wasl ow, and dissolved nitrogen and NaOH inhibit
decomposition; therefore radiolytic hydrogen wasprobably not a major addition to the very large
amount released from metal-water reactions.
The radiolytic reactions are far from simple.
Yields are complicated functions of the LET characteristics of the radiation, and recombination is acomplicated function of water chemistry and state.
Estimates of hydrogen and oxygen formation in the
TMI-2 accident could be inaccurate and inconsistentunless based on experiments conducted under very
similar conditions. Estimates of the maximum andminimum reasonable yields can be made, but itshould be understood that these are only estimates.

to 280 kg.
The lower estimate of the President's
Commission technical staff would have given about
350 kg in containment and, hence, about 100 kg in
the RCS. The maximum production according to
the President's Commission technical staff, which isconsidered less likely, would give an RCS content of
270 kg.
These estimates assume that little hydrogen was
produced during later depressurization. This premi se is believed likely. Even if some of the core was
uncovered again, the rods exposed already would
have been at least partially oxidized, and further oxidation would have been slow.
The estimated "most likely" amount remaining in
the RCS, 100 kg, includes the amount in solution(about 26 kg at 1000 psi and 280°F) as well as thatin a bubble (about 74 kg). At a pressure of 1000
psia and 280°F (typical of conditions during theseveral days following the accident) this measure3
would be 645 ft . If about 1.6 pound moles of fission
gases and 3.2 pound moles of helium are added tothis, the total of all noncondensible gases in the
bubble is 684 ft 3 at 1000 psia and 280°F (29000 ft 3
at 273 kg and 1 atm pressure [STP]).
The largest amount considered for the RCS, 270kg, would give 244 kg in the bubble, for a total
volume of 2166 ft 3 at 1000 psia and 280°F (92 000ft3 at STP).
Bubble size calculations extrapolated back to 16
hours give a volume of 1470 ft 3 at 1000 psia. If the" most likely" hydrogen estimate is correct, thisvolume would be about 44% hydrogen; theremainder could be any other gas, mostly steam.
For example, a 786-ft 3 bubble of steam in a "hotspot" within the damaged core would be possible.
The maximum estimate of 270 kg is impossible if
the bubble size calculations in the next section are
correct. This estimate lends credence to the belief
that the smaller quantity is more reasonable.
Based on the "most likely" quantities, the hydrogen accounting is then as follows:

Hydrogen Accounting

A number of estimates of the amount of hydrogen produced by the metal-water reaction havebeen made. For example, Picklesimer made an early estimateof 220 to 260 kg of hydrogen in the first205
3 hours. 206Cole estimated 350 kg in the sameti me frame.
A later estimate by Cole was basedon more realistic calculations and indicated207
that 450kg at 6.5 hours probably was produced.
This
calculation includes less than 10 kg from oxidation ofstainless steel. The President's Commission technical staff estimated that from 434 to 620 kg prob205. A calculation made for thisably was produced
study (Section II.C.2.b) produced 330 to 410 kg in
the first few hours; this is consistent with a total
production of 450.
The calculation of Cole also includes the partitioningof hydrogen between the RCS and contain207
ment.
This partitioning is important in accounting
for the removal of hydrogen. Because Cole's estimate is within the bounds of Picklesimer's, 205 it will
be used as a starting point for the analysis.
Cole estimated that at 6.5 hours, 250 kg of hydrogen was in the RCS and 200 kg was in the containment. In later depressurization, between 7.5 and14 hours, about an additional 100 kg is believed tohave been added to the containment. At the time ofhydrogen burn, 150 kg might have been in the RCS
and 300 kg in the containment. The calculated
amount burned,
based on the peak overpressure,205
was 267 kg.
Cole estimatedthat 330 to 360 kg
207
existed at the time of burn.
Measurement of thehydrogen concentration on March 31 indicatedabout 80 kg at that time; therefore the amount consumed according to Cole's estimate would be 250

Produced
Released to containment
BurnedRemaining in containment
Remaining in RCS at 16 hours
I n solution at 16 hours
I n bubble at 16 hours
Calculation of Bubble Size

450 kg
350 kg
270 kg
80 kg
100 kg
26 kg
74 kg

The bubble size was calculated during the courseof cooldown and bubble removal by Metropolitan
Edison and Babcock & Wilcox. The same physical530

principle-the compliance of a liquid containing a
gas bubble-was used by each organization. Afterthe accident, Sandia carried out an independent investigation 207 at the request of the TMI Special Inquiry Group. The results of the latter study, as given
i n Figures 11-33 and 11-34, show that the bubble wasabout 1470 ft 3 at 2:00 p.m. on March 28 and wascompletely gone by 6:00 p.m. on April 1.
Although each organization has used the same
basic principle, the equations appear different because different simplifying assumptions have beenused.
The Met Ed formula 208 i s the simplest. It neglects

the compressibility and thermal expansion of waterand the solubility of hydrogen. These simplifications
lead to a consistent 300 ft 3 overprediction of the
bubble size at 875 psi.
209
The B&W formulai ncludes these effects but
neglects changes in vapor mass in the pressurizer
and the effect of the hemispherical lower head of
the pressurizer and does not consider the partialpressure of water vapor. The net result is generally
about 5% underprediction of bubble size.
The Sandia formula 207 i ncludes all of these terms
but neglects the effect of leakage during bubble size
experiments (the compliance of the steel vessel and

FIGURE 11-33. Total Hydrogen in RCS

531

change of density because of temperature change
during experiments). The effect of the last two terms
has been evaluated and is known to be small. Thel eakage effect has not yet been evaluated but isalso expected to be small.
Each bubble experiment was performed by subjecting the RCS to a known change in pressure anddeducing the associated change in volume. From
this change the compliance of the liquid gas system
was calculated, and hence the size of the bubble.
The size of the bubble decreases with increased

pressure for two reasons: because of compressionof the gas, and because more of the gas goes into
solution at the higher pressure. The latter effectwas neglected by Met Ed.
Even if an accurate formula is used that includes
all the physical effects, the inherent inaccuracy ofthe measuring system would make an accurate
prediction difficult. One needs to measure smallchanges in volume that correspond to smallchanges in pressure in a very large system by using
i nstruments that are not of laboratory quality.

FIGURE 11-34. Bubble Volume at 875 psia532

taken to be the intercept with the horizontal axis in
Figure 11-33. The data show that the bubble had
disappeared between 3:00 and 9:00 p.m. on April 1.
The removal of hydrogen was accomplished bothby letdown and by pressurizer venting. It is notpossible to estimate accurately the amount removedby each. However, from the fact that the hydrogeni n the containment atmosphere increased by only amodest amount during venting, it can be assumed
that venting was not the principal removal mechanism.
The removal rate by letdown isError Analysis

An error analysis of the Sandia formula has been
carried out. The errors in bubble size are dependent on the conditions of the experiment and on thesize of the bubble. Conditions for most of the bubble size experiments were approximately as follows:
RCS pressure
RCS temperature
Pressurizer level
Makeup tank level
Makeup tank temperature
RCS pressure
RCS temperature
Pressurizer level
Makeup tank level
Solubility

1 000 psi
280° F250 i n45 i n81 ° F12.2 ft3 /psi error
1.58 ft 3 /°F error
97.3 ft3 /in error
1 81.4 ft 3 /in error
4.43 ft 3 /percent error

dn H = 1 dm H
dt
MH dt

1
dm w (N AR - NAM ),MW dt

where dn/dt is the molar letdown rate, moles per
minute; M is molecular weight; and dm/dt is themass letdown rate.
N is the mole fraction of hydrogen in solution,and the subscripts H and w refer to hydrogen andwater and R and M refer to RCS and makeup tankconditions. The mole fraction in solution is, byHenry's law,

Errors in each of the measured quantities could
be as great as 2% of full range. 210 However, data
are normally more accurate than this, and 2% ofeach reading is considered more likely. An error of
10% in solubility is considered reasonable. Then thepossible total errors are:Error due to RCS pressure error
Error due to RCS temperature error
Error due to pressurizer level
Error due to makeup tank level
Error due to solubility=

NA = PA/K= 244 ft=
9 ft3
= 486 ft3
= 163 ft3
3
= 44 ft
3

where PA i s the partial pressure of hydrogen in thegas and K i s the Henry's law constant. For RCS
conditions K = 9.3 x 105 and for makeup tankconditions K = 11 x 10 5 . 2 These values are for

300°F and 75°F, the nearest tabulated points to
280°F and 80°F. The partial pressure of water vapor
is taken to be equal to the saturation pressure at
the indicated temperature. This condition is notstrictly accurate but is within a few percent. The
partial pressures of hydrogen are 933 psia and 39.6
psia at total pressures of 1000 psia and 40 psia for
the RCS and makeup tank.
With these values, let-4
down removes 9.64X,0 moles of hydrogen permole water. Note that Dalton's law must hold for a
bubble of mixed gases. If a separate bubble contains pure steam, Dalton's law cannot be applied tothe total.
The letdown rate as given in postaccident notes
was about 30 gallons per minute, except for times
when the letdown cooler was plugged. An averagerate might have been about 25 gallons per minute.
This rate is a mole rate of 10.64 pound moles of water per minute or 0.0103 pound moles of hydrogen
per minute, referred to RCS conditons, for the 94
hours of bubble removal that would have removed
52.6 kg.
Leakage is estimated to be 5 to 6 gallons per
minute. It is assumed that all leakage is due to reac-

All errors would probably not occur simultaneously and would not normally all have the samesign. Note, however, that the largest error-that
due to pressurizer level error-is nearly as large as
the bubble, and several of the errors are large fractions of the bubble size. This clearly explains thegreat variability in bubble size estimates.
Removal of the Hydrogen Bubble

Except for changes in dissolved hydrogen due tochanges in RCS pressure and temperatures, degassing at a constant rate of letdown would give a
constant rate of bubble shrinkage. Figure 11-33
shows the results of bubble calculation with the
Sandia formula, along with a least squares fit for removal rate. Also shown in Figure 11-33 is a removal
rate calculated by B&W and a one standard deviation error band about the Sandia fit. Figure 11-34
shows the same data, except that the ordinate is total hydrogen in the RCS-in the bubble and dissolved in the coolant. The time of removal can be533

the information was not applicable to a pressurizedwater reactor and certainly did not apply to the situation at TMI-2 in which the coolant had a large
amount of hydrogen in solution. Some scientists
who were questioned were unable to give definitive
answers promptly.
Notes taken at the time at the NRC emergency
center, including those by Mattson, do not indicatethat anyone disagreed with the possibility of ahydrogen-oxygen explosion. Among those queriedon the effects and probability of explosion was
B&W. The only note found to indicate mild disagreement is the record of a conversation with B&W to
the effect that B&W "feels that H2 recombination istaking place under gamma flux." Notes indicatingthat other experts basically agreed with the estimates of oxygen production exist. On April 1, theword from B&W was that B&W officially "thinks not
flammable."
The opinion was almost universal that the bubble
would be explosive, either very soon or in a matterof some days.
Late in the day of March 31, and especially on
April 1, other data began to be received that contradicted the belief that the bubble contained oxygen. In the meantime, however, other scientists had
been asked about the possibility of an explosion,and still others were delivering opinions on thedamaging effects of explosions. It was difficult tosort out the facts in the confusing melange of differi ng opinions.
I n view of the disagreement by the experts, thefollowing summary was prepared on April 1:

for building conditions, where the partial pressure ofhydrogen is so low that it would be considerednegligible in comparison with RCS conditions. The
molar removal rate is then 0.001 moles hydrogen
per mole water, and 5 gallons per minute (again referred to RCS conditions) will remove 10.5 kg in 94
hours. Much of the leakage actually eventually goesto the letdown system. The difference in hydrogenscavenging rates is negligible.
The amount remaining (74-52.6-10.5), or 10.9 kg,
could have been removed by venting of the pressuri zer. This venting would cause only a 0.2% increasei n containment hydrogen content, which explains
why a marked increase in hydrogen content due toventing was not observed. Leakage should havecaused an additional 0.2% increase in containmenthydrogen content.
The amounts removed by using the "most likely"
original amount are:
Letdown
Leakage
Venting
Totals52.6 kg (71%)
10.5 kg (14%)
10.9 kg (15%)
74kg (100%)

No exotic or improbable mechanisms need to be invoked to explain the postulated disappearance.

The Hazard of the Hydrogen Bubble
The initial concern expressed on March 29 wasthat the bubble was growing because of radiolysisof the water in the reactor to produce hydrogen.
Later interest focused upon the likelihood of oxygen
formation and the hazard of an explosion within thereactor.

Flammability limit
02 production rate
Current 02 concentration
Detonation limit

Oxygen Content

5% 02 in pure H2
1 % per day
5%
12% 02 in pure H2

Emergency center notes for April 1 show that information was increasingly being received statingthat no oxygen was being produced. On April 2 virtually all incoming information stated that no oxygen
existed.
A wide cross section of experts was involved:
NRC staff, National laboratories, NRC contractors,
Department of Energy laboratories, the academic
community, and reactor manufacturers. 213 At someti me on April 1, the weight of opinion was that oxygen was probably not present. Even then, however,
explosion and structural experts, who had not yet
been advised of the latest findings, continued to give
opinions on the hazard of explosions.

Assurance had been given as early as March 29
by a B&W scientist that no oxygen problem existed.
This information was given to T. Novak but apparently did not reach the NRC officials to informthe public until much later.
On March 30 and 31, Roger Mattson requested
both the Office of Research and the Division of Systems Safety of NRR to determine the possibility andconsequences of a hydrogen explosion in the reactor. The responses are summarized in Refs. 211 and212. The early information given to Mattson was
based on experiences from a boiling water reactor
and from the advanced test reactor (ATR); hence,534

pound moles on March 28 did not damage the containment. Therefore, the burning of 270 poundmoles or less on March 31 likewise would not damage the containment.

Explosive Hazard in Reactor Vessel

A number of computations were made of the effect that a hydrogen detonation would have on thereactor vessel assuming that an explosive mixture
existed (which was highly improbable). These calculations, of which those of Ref. 214 are typical, generally showed that major damage to the reactor
vessel was unlikely, although some showed that thestrength of the upper head might be marginal. Generally, specialists in explosive damage would be unable to predict the effects on the basis of such calculations without experiments. Less sophisticatedanalyses-many of which had assumed a
stoichiometric mixture-gave rise to excessive fears
for the safety of the reactor vessel.
Of equal interest is whether fragments of thereactor vessel could have been propelled with sufficient velocity to breach the containment. Specialists
now generally are agreed that this is so improbablethat it can be virtually ruled out, especially because
any explosive fracture would be highly unlikely.
Because no possibility existed of an explosive
mixture being formed, the whole question isacademic, and it can be concluded that no explosive
hazard was present.
Considering the lack of unanimity on March 31,
the decision to consider whether the bubble waspotentially explosive was correct. In the face of contradictory opinions, it is proper to give consideration
to the worst case.

Findings

The most likely estimate for hydrogen productioni s 450 kg, equivalent to oxidation of approximately
50% of the cladding. It is possible that the amountproduced could have been as great as 520 kg. A
total gas volume of 1470 ft 3 was probably present in
the RCS at 8:00 p.m. on March 28. The fraction ofhydrogen in this bubble or bubbles could have been
40% to 100%. The hydrogen was removed from the
bubble by letdown, leakage, and venting; no unusualmechanisms need to be hypothesized to accountfor bubble removal.
The variability in estimates of bubble size camefrom the different methods of computation that wereused by different organizations and from the inherent inaccuracy in the method of measurement.
The bubble disappeared about 6:00 p.m. on April 1.
Little or no oxygen was present in the bubble anda very low probability of explosion existed. The incorrect perception of an explosion hazard stemmed
from contradiction among supposed experts. This
perception was known or should have been known
to be false by the afternoon of April 1.
A flammable mixture in containment due torelease of all the hydrogen would have been possible but very unlikely. Even if it had occurred, thecontainment would not have been damaged.

Explosive Hazard in Containment

A more realistic hazard was the possibility ofsudden depressurization, with release of the hydrogen from the RCS to the containment. This depressurization was unlikely but possible. If the entire inventory of hydrogen had been added to the containment, an explosive mixture might have been formed.
Analysis of the containment atmosphere on
March 31 showed 1.7% H 15.7% 0 2 , and 82.6% N 2
2'for one sample, and 1.7% H 2 , 16.5% 0 2, and 81.8% N 2
for another. At a temperature of 80°F and pressureof 14.3 psia, the latter would be 86.1 pound moles
H 2 , 835.9 pound moles 0 2 , and 4144 pound moles
N2 . The addition of all the hydrogen in the RCS100 kg or 110 pound moles-would raise the hydrogen concentration to 3.8%. This elevation is still
below the flammable limit. However, if the entire
bubble was hydrogen, an addition of 185 poundmoles would occur. This addition would give a hydrogen concentration of 5.2%, which could be
flammable. However, the burning of about 290e. How Close to a Meltdown?
The extent of damage to the reactor core at 3
and 4 hours after the start of the accident was esti mated and discussed in Section II.C.2.b. The esti mated damage at 3 hours consisted of embrittled
Zircaloy fuel cladding down to about 8 feet from thebottom of the core, with a "debris bed" above consisting of fuel pellet fragments, Zircaloy oxide shells,
fractured Zircaloy cladding with an oxide layer on
the outer surface, and frozen masses of liquefied
fuel (UO2 dissolved in the Zircaloy metal-Zircaloy
dioxide eutectic liquid).
The damage produced later, shortly before 4hours, lowered the depth of embrittlement and thedebris bed, and may have produced additionalamounts of liquefied fuel in the debris bed, whichthen ran down the subchannels between neighbori ng rods to reach depths of about 1 foot from the535

be reached about 3 to 3 % feet down the fuel rod, if
the water is boiled down to 3 feet from the bottomof the fuel stack in the fuel rod, and liquefied fuelcould be formed to the midplane of the core.
Thus, up to approximately one-half of the fuel inthe core could have been in liquid form about 50
minutes after the reactor coolant pumps were shut
down if the PORV block valve had not been closed
when it was. The liquid fuel most likely would haveflowed or slumped onto the stubs of fuel rods
remaining, adding significant amounts of heat tothem and causing more fuel to become liquid. However, some of the liquid fuel probably would have
dropped into the water pool below, increasing thegeneration of steam. Whether the additional steam
generated could have produced enough cooling toreverse the meltdown would depend, at least in part,on whether a steam eruption could be produced todisrupt the melting core, thereby improving heattransfer.
With continued water loss, it seems more likelythat there would have been, sooner or later, somesteam generation rate and refluxing beyond which
the steam flow was too low to provide cooling, anda core meltdown would have occurred. This condition could have been reached at almost any time
between about 50 minutes and about 70 minutes
after the reactor coolant pumps were shut down at 1hour 40 minutes (5:40 a.m.), depending on the actual rate of coolant loss from the core.
It can thus be concluded that the reactor wasprobably within about 30 to 40 minutes of having asubstantial fraction of the fuel liquefied or molten( which could then have resulted in an irreversible
core heatup and meltdown) at the time of the PORV
block valve closure at 2 hours 20 minutes (6:20
a.m. on March 28,1979).
No reasonable estimate can be made at this time
as to how close the core came to a meltdown in thesecond period because too little is known about thecondition of the core after 3 hours 30 minutes.
However, if the makeup flow had not been increased at about 4 hours, the core could have again
heated up as the water level dropped and the flowof steam in the core decreased, given the fact that
the PORV block valve was opened at the intervals it
was.

bottom of the fuel in the fuel rods. Despite thisamount of damage, a core meltdown, as normallyconsidered, did not occur. However, it almost occurred twice.
The first time was in the first heatup between 2
and 3 hours (6:00 and 7:00 a.m.), and was probably
stopped by the closure of the PORV block valve
and the operation of reactor coolant pump 2B. The
second was in the second period of damage at 3
hours 45 minutes and was probably stopped as aresult of the core rearrangement and the initiation of
maximum HPI flow at 3 hours 56 minutes.
I n the following discussion, it is assumed that the
PORV block valve was not closed at 2 hours 20
minutes; i.e., the first "close call" is allowed toproceed. The amount of information that provides
certain evidence about the condition of the core at 3
hours 30 minutes is so small that a discussion of
the second "close call" is considered fruitless.
When the PORV block valve was closed at 2hours 20 minutes, not only was the loss of coolant
from the reactor system stopped but the increasingpressurization raised the boiling point of the coolant.
This rise produced an initial decrease in steam flow
as the coolant heated up and was followed by a significant increase in steam flow in the damaged core,
as a given amount of decay heat from the submerged part of the fuel rods could evaporate agreater amount of steam, by the inverse ratio of theheats of evaporation at the two pressures. The
difference is not small, the heat of evaporation being
between 20% and 21% less for a system pressure of
2200 psi (compared with about 700 psi). Such ani ncrease in steam flow rate in the later stages of theheatup could have had a significant effect on limiting
peak temperatures reached.
Even though the system contained a large
amount of hydrogen (a noncondensible gas), the local boiling temperature for the coolant was determined by the system pressure, not the partial pressure of steam in the vapor space. The surge of water accompanying the start of reactor coolant pump
2B at 6:54 a.m. both thermally shocked the embrittied core and reduced the fuel temperatures.
If the PORV block valve had not been closed at 2hours 20 minutes, the continued loss of water fromthe PORV would have lowered the level of water inthe core. The flow of steam would have decreased
as the length of fuel rod submerged to generate it
was decreased. The decreased flow of steam
would have allowed faster heatup of the exposedparts of the fuel rods and higher temperatures.
TMIBOIL computer code calculations reported in
Section II.C.2.b indicate that temperatures greaterthan the melting point of U0 2 (about 5200°F) would

Phenomena and Consequences Had a Meltdown
Accident Occurred at TMI-2

One conclusion of the Special Inquiry Group isthat the accident at TMI-2 may have been approaching a core meltdown accident. In a more
technically accurate sense, the TMI-2 accident pro536

gression was such that a substantial fraction of thefuel was near the temperature required for formationof fuel-clad eutectic material, so that a loss of coolable fuel geometry was very possible. Because ofthis proximity to such an accident, a discussion ispresented here of the accident progression assumi ng there had been a meltdown. The physical progression of the fuel, related events within the reactor building such as pressure increases and hydrogen combustion, and the timing associated withvarious events are described.
Briefly, the following discussion indicates that hada core meltdown occurred in TMI-2, the consequences would likely not have been catastrophic.
The reactor building probably would have survived
the accident, and the large majority of the radioactive material released from the fuel in the accident
would probably have been retained within the reactor building and not released to the surrounding environment.
Present knowledge about the physical phenomena discussed in this section is subject to considerable uncertainty. Although important meltdown accident research is under way in the United Statesand Europe, much study is still needed in the areasof, for example, fission product release from fuel,l arge scale fuel melting and liquefaction, fuel-wateri nteractions, and fuel-concrete interactions.
We believe that had a meltdown accident occurred at TMI-2, the likely path followed would nothave led to disaster; however, considerable additional research into meltdown accident phenomenai s needed to reduce the uncertainties associatedwith these phenomena and to provide a better basis
upon which to consider such accidents.
This discussion of a meltdown accident progression begins at roughly 2 hours into an accident likethat described in Section ILD as "Alternative Accident Sequence 6." This accident follows thecourse of the TMI-2 accident up until the time of
PORV block valve closure at 2.3 hours. At thispoint, it is assumed that the block valve is not
closed, so that the loss of coolant continues. Calculations discussed in Section II.D.2g g indicate that
this alternative sequence could have led to melting(or liquefying) of a substantial fraction of the fuel.
The conclusions discussed on the extent of coredamage in TMI-2 suggest that recovery can occur
from a partially molten condition in the core. However, after a certain fraction of the fuel becomesliquefied or molten, measures to prevent additional
melting would not succeed. That is, intervention by
the operating crew to increase flow of water into thecore (if possible) could be expected to stop the accident progression up to a certain point; beyond that537

(indeterminable) point, full scale melting of the core
would likely occur despite attempts to provide cooli ng. Therefore, beyond this particular point, a "meltdown accident" would occur. Present knowledge ofthe phenomena of large scale fuel melting or
li quefaction is not sufficient to estimate this point of"no return." For the purposes of the following discussion of a meltdown accident progression, thecore condition resulting from the accident sequence
postulated in Section ILD is assumed to have degraded beyond this point.
Figure 11-35 displays the progression of a meltdown accident in terms of specific, importantphenomena, showing parameters that can potentiall y affect the consequences of the accident. The
various parameters and their importance are discussed as follows.
Fuel Melting and Slumping

As the amount of fuel reaching eutectic formation
or melting temperature increases, the core would
experience changes in geometry. In regions whereliquefied or molten fuel has formed, such fuel might
begin to run down the fuel pins, refreezing upon
traveling into cooler areas. 215 Depending on theamount of water and the temperature gradients inthe core, refreezing can occur near or relatively far
from the place of liquefaction or melting. With available data on fuel melting phenomena, it is not possible to determine definitively the method by which
the fuel would slump; i.e., whether the molten fuelwould "drip" into lower regions or would initiallyslump into a large mass (or masses) and collapse en
masse.
Because of the extreme temperature gradients
experienced during such fuel melting (which would
allow the liquid or molten fuel to refreeze near the
point of liquefaction), the collection of a large quantity of molten material, with the subsequent collapse
i nto the lower regions, would seem to be the more
li kely alternative. This collection and collapse of al arge mass of molten fuel corresponds to the upperchoice in the core slumping mode column in Figure
11-35; therefore the most likely accident path would
follow this upper route.
Table 11-58 indicates that for the particular accident discussed, the time required to result in corecollapse into the lower head would be about 1 hour
after the beginning of core uncovering, so that about
3 hours would have elapsed from the time of the initiating event to collapse of the core.
In this time period, the reactor building atmosphere would contain increasing levels of steam, hydrogen, and fission products. Steam productionFIGURE 11-35. Events in the Progression of a Meltdown Accident
538

TABLE 11-58. Timing of a meltdown accident

Event

would, with time, also reduce the amount of material
in the atmosphere.

Time, minutes
Case A`

Case B"

Start core uncovery

1 01

101

Start core melt

133

133

Core collapse into head

1 65

165

Head failure

1 90

1 67

Start concrete attack

1 90

Collapse of the Core into the Lower Vessel Headlnvessel Steam ExplosionAsasubstantial
fractionofthefuel-Zircaloy-structural steel mixture (called in thejargon of this arcane field "corium") becomes molten
or liquefied, the dripping or collapse of this material
i nto the lower head of the reactor vessel can occur.
Because some water probably would remain in thel ower head during the heatup of the core, interaction
between the corium and the water is possible. Thisi nteraction could be as relatively innocuous as additional steam generation if the fuel mixture were to
drip slowly into the water or could result in a highly
energetic steam explosion if a large mass of molten
corium were to interact rapidly and coherently withthe residual water.
For the gradual (dripping) core slumping mode,
the interaction between the corium and the water
would probably not be severe. Individual small
amounts falling into the water would cause somesteam generation, and the mixture would bequenched (at least partially) in the process. With
continued corium dripping, evaporation of all of thewater in the lower head might eventually occur.
After this time the remelted fuel would come directly
i nto contact with the steel of the reactor vessel, withthe result likely to be failure of the vessel.
For the case of large scale core collapse, the potential damage to the vessel would be more serious.
The steam generation rate would be significantly
greater, with some possibility of a highly energetic
steam explosion. Research on the phenomena ofsuch interactions has been under way to assess
their likelihood and consequences. 219,220 Thesestudies suggest that the most likely outcome ofsuch a large scale collapse would be rapid steam
generation, lacking the coherence needed for amore serious steam explosion.
In situations such as during the TMI-2 accident,
when the postulated meltdown would have occurredwith elevated RCS pressures (i.e., when the breaksize is not sufficient to allow RCS depressurization
to the reactor building pressure), experimental andanalytical evidence indicates that steam explosions
are improbable. 220,221,222 Thus steam explosionsof the magnitude of those postulated in the reactor
safety study,223 which were suggested as having
the potential for causing reactor building failure, areconsidered highly unlikely.
An additional effect that is possible in the eventof an invessel steam explosion is the release of ad-

220'Case A: no metal-water reaction in the bottom head,
and"Caseno debris
particulationin reactor
B: 100%metal-water
reactioncavity.
in the bottom head,and debris particulation in reactor cavity are assumed.

would result from the evaporation of water remaini ng in the lower regions of the core and, to someextent, the water in the lower vessel head. In the situation when reactor building engineered safety
features (ESFs) are operating, Figure 11-36 indicatesa negligible pressure increase during this time
period. In the case of failure of the reactor building
ESFs, reactor building pressure would increase
slowly, rising to a pressure of about 30 psi (absolute) at the end of this period.
Hydrogen production in significant quantities begins as the core uncovers, heats up, and melts. As
Figure 11-36 indicates, some of this hydrogen would
escape through the "break" in the reactor coolant
system (RCS), which in this case is the stuck-open
PORV. Upon failure of the lower vessel head, hydrogen not as yet released to the reactor building
atmosphere would escape. Furthermore, in thisti me period the first substantial amount of fission
product release from the fuel would occur. Chemical species of relatively high volatility represent the
majority of the radioactive materials released; thesei nclude primarily the noble gases (e.g., xenon andkrypton), halogens (e.g., iodine), and some alkaline
metals (e.g., cesium).217 While some fraction of thel atter elements may deposit on (relatively) cold surfaces within the RCS,218 or be retained in water(possibly) present in it, significant amounts of allthese elements might nonetheless escape into thereactor building atmosphere. These releases would
be essentially completed by the time of vessel
failure. Operation of the reactor building ESFs
(especially the spray system) could be expected toreduce amounts of radioactive material in the buildi ng atmosphere. Natural deposition processes

539

FIGURE 11-36. Reactor Building Response

ditional fission products. Such an explosion would
subject the molten fuel to a highly oxidizing environment, so that release of relatively low volatility elements (most notably ruthenium) could be expect-

Retention of the Molten Corium in the Lower Vessel
Head
As the corium falls and collects in the lower
vessel head, it could take two forms: a rubble bed
with fragmented pieces of varying size or a molten
pool of fuel, Zircaloy, and steel. The form actuallytaken depends on the amount of water in the lower
head and the way in which the molten material falls
i nto the head (i.e., dripping of small amounts or coll apsing of large amounts).
I n the situation where corium is presumed to drip
i n relatively small amounts into the lower head,some quenching and fragmentation could be expected. While water remains in the lower head, arubble bed could be formed. The ability of such a
rubble bed to cool and its effect on the underlying

224

I n Figure 11-35 the column labeled "vessel steam
explosion" indicates two possibilities: experiencing
or not experiencing a steam explosion as the molten
corium falls into the water in the lower head of thereactor vessel. Because of the significant difference
i n consequences, this distinction is based on having
or not having a steam explosion of sufficient magnitude to cause reactor building failure. The most
likely path of a postulated meltdown accident resulting from the TMI-2 accident is thus the lower path(no steam explosion), shown as the dashed line in
Figure 11-35.
540

vessel steel are matters of considerable uncertainty.
Experimental work dealing with the ability of rubble
beds to cool in liquidsodium provides some insight225
i nto this question,
but a definitive answer is notavailable. Further, eventual evaporation of the water
could be expected to result in remelting of the cork
um. The subsequent effects on the vessel steel
make it relatively unlikely that vessel integrity would
be maintained.
I n the circumstance where a large amount of molten corium is presumed to collapse into the lower
vessel head in a short time, the potential forquenching, fragmenting, and substantial cooling of
the material is less. Some temporary quenching
and fragmenting of the fuel-Zircaloy-steel mixture
would likely occur; however, with the evaporation of
the residual water and the collection of a large
amount of corium in the lower head, remelting of the
mixture could be expected. Under these circumstances, the lower vessel head would likely fail.
I n an accident such as that at TMI-2, where high
RCS pressures were maintained, the mechanicall oading applied to the lower head due to this pressure would compound the thermal loadings imposedby the molten material, making structural failure of
the lower vessel head essentially certain. For thisreason, the "most likely" path shown in Figure 11-35
i ndicates that retention of the fuel-Zircaloy-steel
mixture in the lower vessel head would not occur.
The time elapsing before failure of the reactor
vessel depends on the extent of metal-water reaction occurring as the molten core falls into the water
i n the lower head. If all of the remaining Zircaloy isassumed to react at this time, the additional energy
releases increases the loading on the head, so that
failure could occur within a few minutes. If no additional metal-water reaction occurs at this time, thisadditional energy is not released, so head failure
could take somewhat longer, i.e., about 25 minutes( see Table 11-58).

The consequences of a corium-water interaction
can vary depending on the method of interaction
between the two materials and the extent of fragmentation that may occur; therefore a spectrum of
results can occur.
At one end of the spectrum is the case of coreflood tank discharge on top of the corium mixture in
the cavity. In this instance, fragmentation could be
expected to be relatively minor. The water on the
top of the corium could be evaporated by film boili ng, while penetration of the base mat is under way
beneath the corium.
I n the middle of the spectrum, the corium-wateri nteraction would result in the quenching and fragmentation of the corium into pieces of intermediate
size. This condition then could result in rapid steam
generation and a significant increase in reactor
building pressure. Some time would be required forremelting of the mixture, so that penetration of thebase mat could be delayed somewhat.
At the extreme end of the spectrum of possible
events, the quenching of the mixture could cause
fragmentation of such magnitude that a steam explosion could result. Under these circumstances,
quenching and fragmentation of the corium into verysmall particles and very rapid generation of steam
would occur, resulting in a large pressure pulse in
the reactor building. Possibly the quenched andfragmented mixture would not reheat sufficiently toachieve melting temperatures, but it is also possiblethat it would remelt and begin penetration of theconcrete base mat.
The most likely path of the accident progression
at this juncture would be the intermediate case discussed. That is, quenching and fragmentation of thecorium mixture into intermediate size particles would
be expected, with the resultant pressure increase ofi ntermediate magnitude in the reactor building. Because the more severe case of a steam explosion
requires a more substantial (and thus less likely)
fragmentation of the corium, the most likely accident
progression shown in Figure 11-35 follows the choice
path of no incavity steam explosion.
I n Figure 11-36, reactor building pressure resulting
from minimal fragmentation and fragmentation intoroughly 2-inch diameter fragments are shown; pressures just after the collapse into the cavity are indicated as about 31 and 65 psia, respectively. Neitherof the pressures by itself would be expected toresult in reactor building failure.

Collapse of the Corium Mixture into the Reactor
CavityWith the failure of the reactor vessel lower head,the corium mixture (containing by now additional
molten steel) would fall into the reactor cavity. At
this time, corium interaction with water would bepossible, either resulting from the corium falling into
water collected in the cavity or from the dischargeof core flood tank water onto the top of the corium.
The latter would be possible in some types of meltdown accidents (like that presumed here) when
RCS pressures do not decrease below thedischarge setpoint of the tanks until failure of thelower head occurs.

Hydrogen Burning at the Time of Vessel Failure

The consideration of hydrogen burning is included here because it is at the time of vessel failurethat reactor building integrity would be potentially541

most threatened. A combination of effects occurring in this time period would have some potential toseriously challenge the reactor building. To do this,most of the Zircaloy in the core would have had tobe chemically reduced, and large amounts of hydrogen produced. The hydrogen released to the reactor building before vessel failure would have toremain unburned until this time. Significant fragmentation of the corium mixture as it interacts withwater in the reactor cavity would also be required,
so that substantial steam generation would occur.
Figure 11-36 shows the calculated reactor building
response to two particular combinations of hydrogen burning and steam generation. Case A in the
figure represents a lower bound to the combined effects; that is, no metal-water reaction is presumed
to occur as the core collapses into the lower vessel
head, and no significant fragmentation of the corium
mixture is assumed as it falls into the reactor cavity.
Case B represents an upper bound for combined
effects of these phenomena. Total reaction of theZircaloy is assumed, as is significant fragmentationof the corium as it falls into the reactor cavity.
I n Case A, steam pressures would increase toabout 30 psia at time of vessel failure. If concurrent
burning of all the hydrogen released to that time
also occurred, as indicated by the dashed verticalli nes, building pressures would increase to about 75
psia. Because the building failure pressure is expected to be about 135 psia, 216 building failure at
the time of vessel failure would be unlikely for Casevery small particles would occur. Fragmentation
i nto larger particles, which is more likely, would
reduce the resulting pressure increase because ofhydrogen burning; as such, building failure would be
unlikely. For this reason, the "most likely" pathshown in Figure 11-35 indicates that hydrogen burni ng of sufficient magnitude to cause overpressurization failure of the reactor building would not be expected.
Availability of Reactor Building Engineered Safety
FeaturesThroughout the course of this postulated meltdown accident, steam, fission products, hydrogen,noncondensible gases, and other materials would be
released to the reactor building atmosphere. The
capability of the building to withstand these insults
depends on the functioning of the reactor building
engineered safety features (ESFs): the reactor
building spray system and the reactor building air
cooling system. The former injects chemicallytreated water into the building atmosphere, provides
some cooling capability at early times, and removes
radioactive material from the atmosphere. The latter
uses fans to force the building atmosphere acrossthus provides
coils containing chilled water, and226
both short and long term cooling.
Figure 11-36 indicates that the operation or failureof the reactor building ESFs does not significantly
affect the likelihood of building failure in the period
up to and including the time of vessel failure. However, in the longer term, failure of the building air
cooling system could lead to failure of the buildingby overpressurization. For the particular accident
discussed, failure of the building coolers is predicted
to result in building failure about 1 1/2 to 2 days after
the beginning of the accident (presuming no restoration of building cooling is possible). Naturaldeposition processes could be expected to reduce
the amount of radioactive material in the building atmosphere over such long time periods, so that along term overpressurization would be expected toresult in greatly reduced consequences comparedwith building failure early in the accident. The differing outcomes from having or not having the reactor
building ESFs are therefore shown in Figure 11-35 todemonstrate the effect that the features can haveon the integrity of the reactor building and theresulting consequences of the accident. During thefirst day of the TMI-2 accident, these safety
features were known to have automatically actuated227
and operated successfully;
as such the "mostlikely" accident path in Figure 11-35 indicates that thefeatures would be available.

A.

I n Case B, the calculated reactor building pressure increase would be more severe. Building pressure would increase to about 60 psia because of
rapid steam generation. Burning of the large
amount of hydrogen released up to that time could
cause an additional increase of up to 100 psi. Thus,
if these events were to occur concurrently, thebuilding could fail.
Because the severity of the pressure increase
calculated for Case B is primarily due to hydrogenburning, the likelihood of experiencing such a burn
must be addressed. As noted, Case B is based on
the reaction of all the Zircaloy in the core. The calculations indicate that about 40% of the Zircaloy
would have reacted prior to collapse of the core into
the lower head, the remaining 60% reacting during
the corium-water interaction in the lower vessel
head. 216 To react this amount of Zircaloy in thelower head, fragmentation of the corium into verysmall particles (about 10 mils or 0.010 inches in diameter) is required?* Although the size of fragmentsthat actually would result from such an interaction is
uncertain, it is unlikely that fragmentation into such542

produced during base mat penetration, so that accumulation of unburned hydrogen after the penetration begins would, under certain circumstances, be
unlikely.
As the corium-concrete interaction continues, thedecomposition of additional concrete would result infurther noncondensible gas generation and dilutionof the corium mixture. The combined effect of the
reduction in the corium power density (caused by
the dilution effect), the expenditure of energy to
decompose the concrete and other energy losses(such as radiative and convective cooling) would
result in a gradual cooling of the corium mixture.
Thus, as the interaction continues, the rate of basemat penetration and the mixture temperature would
decrease. This effect is apparent in Figure 11-37,
which shows that as time progresses the rate ofpenetration would gradually decrease.
The timing associated with base mat penetration
is indicated in Table 11-58. Initial penetration could
begin almost immediately after collapse of the corium into the reactor cavity if no significant quenching
and fragmenting occurs. If quenching occurs, delays in initial penetration on the order of 1 hour are
possible. Initial penetration would be relatively slow
i n either case, as Figure 11-37 shows. This initialslowness results from the relatively low temperatures of the corium; within 1 to 2 hours, internal
heating of the mixture could bring it to temperatures
where decomposition of the concrete is more rapid.
The possibility of the corium mixture penetrating
through the entire depth of the base mat is clearly
dependent on the rate of cooling of the mixture. For
the particular case of the TMI-2 base mat, solidification of the corium mixture would be likely (but notensured) before complete penetration occurs. For

Reactor Building Base Mat Penetration

As discussed, failure of the reactor vessel would
allow the molten corium mixture to fall into the reactor cavity and any water present in it. Temporary
quenching and cooling of the corium mixture by thewater might be expected; however, eventual remelti ng of the mixture seems likely upon evaporation of
the water (and if no continuous supply of water isavailable to provide cooling). Thus, at this point, interaction between the molten corium and the concrete of the reactor building base mat would be expected to begin.
As the concrete beneath the corium would begin
to rise in temperature, decomposition of its material
also would begin. This decomposition would resulti n the generation of noncondensible gases like carbon dioxide, water vapor, and other materials thatflow around and through the corium mixture. Within
the corium itself, the water vapor and carbon dioxi de would be chemically reduced, oxidizing materials
such as steel and the fission product tellurium(enhancing its potential for escaping into the reactor
building atmosphere) and releasing hydrogen andcarbon monoxide gas into the reactor building atmosphere. Other former constituents of the concretesuch as calcium and silicon would also enter the corium mixture, diluting it and altering its chemicalcomposition. The released hydrogen would mix
with other noncondensible gases released from theconcrete and cause pressure increases and possible additional hydrogen combustion in the reactor
building atmosphere. This situation is shown in Figure 11-36 by the long term, gradual increase in the
total amount of hydrogen released to the reactor
the building pressure. Experimentalbuilding and228
suggeststhat hydrogen burns as it isevidence

FIGURE 11-37. Penetration of the Reactor Building Base Mat (Timing Related to Case A
in Figure 11-36)
543

this reason, the most likely path shown in Figure II35 indicates that complete penetration of the reactor building base mat would not have occurred.
I n the particular case of TMI-2, the bottom of thebase mat is directly in contact with bedrock. If thecorium mixture were to penetrate the base matcompletely, it would then begin penetration of the
bedrock, where solidification would be a virtual certainty. This bedrock could also act as an effective
block against transport of radioactive material, mitigating possible releases of this material into the surrounding environment.

544

REFERENCES AND NOTES
1Met Ed, "Final Safety Analysis Report, Three Mile
Island Nuclear Station-Unit 2," Vol. 4, Fig. 5.1-5, Docket
50-320.
2
1d., Vol. 1, at 1.3-4.
31d., Vol. 5, at 5.1-9.
4
Duke Power Company, "Final Safety Analysis Report
Oconee Nuclear Station, Units 1, 2, and 3," p. 1-9, Docket
50-269/270/287.
5
Id. at 4-41.
6
Southern California Edison Company, "Final Safety
Analysis Report, San Onofre Nuclear Generating Station,
Units 2 and 3," p. 1.3-2, Docket 50-361/362.
7
Id. at 5.1-5.
8
Florida Power and Light Company, "Final Safety
Analysis Report, St. Lucie Plant," p. 1.3-2. Docket 50355/389.
9
Id. at 5.5-8.
10Virginia Electric Power Company, "Final Safety
Analysis Report, Surry Power Stations, Units 1 and 2," p.
1.3-2, Docket 50-280/281.
11
Id. at 4.1.3-5.
12Tennessee Valley Authority, "Final Safety Analysis
Report, Sequoyah Nuclear Plant," p. 1.2-3, Docket 50327/328.
13

14. at 5.5-52.
NRC, "Staff Report on the Generic Assessment ofFeedwater Transients in Pressurized Water Reactors
Designed by the Babcock and Wilcox Company,"
NUREG-0560,
Sec. 3.0, May 1979.
15
Memorandum from J. T. Wilise, B&W, to R. L. Reed,et al., "Loss of Pressurizer Level Indication," March 9,
1979.
14

valve by Combustion Engineering to ACRS, dated May 10,
1979.
27
Letter (and attached document) from T. M. Anderson, Westinghouse, to Denwood Ross, NRC, Subject:
Westinghouse Operating History with PORVs, dated May
1, 1979.
28
President's Commission on the Accident at Three
Mile Island, "Technical Staff Report on Pilot-Operated
Relief Valve (PORV) Design and Performance," October
1979,
at 25.
29
J. P. Lapaille, R. Galletly, T. Cecchi, "Technical
Report on Beznau Unit One Incident of August 20, 1974:
TG-1 Trip/Reactor Trip/Safety Injection Actuation," Westinghouse Electric Corporation, Brussells, Belgium, September 1974.

NRC, "Reactor Safety Study: An Assessment of
Accident Risks in U.S. Commercial Nuclear Power Plants,"
Main Report, WASH-1400 (NUREG-75/014), October
1975, at 63.
31NRC, "Standard Review Plan," NUREG-75/087,
November
1975, at 7A-20.
32
NRC, "Staff Discussion of Twelve Additional Issues,"
NUREG-0153,
December 1976, at 22-1 to 22-7.
33
Letter from W. Tacy, Jr., Dresser Industries, to J.
Durr, NRC/TMI SIG, Subject: Dresser Industries PORV
Model
31533VX-30, dated November 16, 1979.
34
Karrasch dep. at 20-21.
35 NRC, "TM!-2 Lessons Learned Task Force Status
Report and Short-Term Recommendations," NUREG0578, July 1979, at 7.
30

36Met Ed, "Final Safety Analysis Report, Three Mile
Island Nuclear Station-Unit 2," Vol. 6, p. 7.7-1 to 7.7-2,
Docket 50-320.

16 Calculated from data presented on p. 5.1-10 of the

37Electric Power Research Institute, "Analysis of Three
Mile Island-Unit 2 Accident," NSAC-1, Appendix RCPCS,
July 1979.

Met Ed "Final Safety Analysis Report, Three Mile Island
Nuclear
Station-Unit 2," Docket 50-320.
17
Duke Power Company, "Final Safety Analysis Report,
San Onofre Nuclear Station, Units 1, 2, and 3," p. 4-39,
Docket 50-269/270/287.

3

sBabcock & Wilcox Company, "Anticipated Transients without SCRAM," BAW 10099, Rev. 1, May 1977, at
4-1 to 4-6.
39 NRC, "Investigation into the March 28, 1979 Three
Mile Island Accident by the Office of Inspection and
Enforcement,"
NUREG-0600, August 1979, at 3-6.
40
Letter (and attached documents) from G. F.
Trowbridge; Shaw, Pittman, Potts, and Trowbridge; to E.
G. Case, NRC, Subject: TMI Staff Interviews, dated May
7, 1979, Zewe interview at 5-6.
41
NRC, "Investigation into the March 29, 1979 Three
Mile Island Accident by the Office of Inspection and
Enforcement," NUREG-0600, Sec. 4.4, August 1979.
42 Hearing before the Committee on Government
Operations, U.S. Senate, 94th Cong. 2nd Sess. (Dec. 13,
1976) at 690-691.
43 NRC, "Staff Report on the Generic Assessment ofFeedwater Transients in Pressurized Water Reactors
Designed by the Babcock and Wilcox Company,"
NUREG-0560, Sec. 2.0, May 1979.

18 Baltimore Gas and Electric Company, "Final Safety

Analysis Report, Calvert Cliffs Nuclear Power Plant, Units
1 and 2," Table 1-1, Docket 50-317/318.
19
Id. at 4-11.
20
Florida Power and Light Company, "Final Safety
Analysis Report, St. Lucie Plant," p. 5.5-4, Docket 50335/389.
21 Virginia Electric Power Company, "Final Safety
Analysis Report, Surry Power Station, Units 1 and 2," p.
4.1.3-8, Docket 50-280/281.
22Tennessee Valley Authority, "Final Safety Analysis
Report, Sequoyah Nuclear Plant," p. 5.5-45, Docket 50327/328.
23
Frederick dep. (July 23, 1979) at 183-184,187 (Pres.
Com.).
24Calculated from data presented in the NRC "Operati ng Units Status Report," NUREG-0020, Vol. 3, No. 9.
September
1979.
25
Advisory Committee on Reactor Safeguards (ACRS)
Meeting Transcripts (April 16, 1979) at 228-229.
26 Presentation on Operating Procedures of the PORV44

NRC Hearing Before the Advisory Committee on
Reactor Safeguards Transcripts (Feb. 1, 1977) at 126-154,(Feb. 10, 1977) at 120.
45
Memorandum (and attached documents) from H. R.

545

Enforcement," NUREG-0600, Secs. 1.2.3, 1.2.4, August
1979.
65
NRC, "TMI-2 Lessons Learned Task Force Status
Report and Short-Term Recommendations," NUREG0578, Sec. 2.1.4.
66!d., Appendix A, Sec. 2.1.4.
87
Id. at 8.
68
Met Ed, "Final Safety Analysis Report, Three Mile
Island Nuclear Station-Unit 2," Vol. 5, Table 6.2-1.
69
NRC, "TMI-2 Lessons Learned Task Force Status
Report and Short-Term Recommendations," NUREG0578, Sec. 2.1.5c.
70Transcript of SIG meeting with NRR Radiological
Assessment Branch at 146-147.
71
NRC, "TMI-2 Lessons Learned Task Force Status
Report and Short-Term Recommendations," NUREG0578
at 9.
72
Faust, Frederick, Scheimann, and Zewe dep. at120-124.
73
Memorandum from H. Denton, NRR, to Hendrie, etal., NRC, "Response to Questions Raised by Congressman Udall," October 4,1979.
74
NRC, "Investigation into the March 28, 1979 Three
Mile Island Accident by the Office of Inspection and
Enforcement," NUREG-0600, Sec. 4.3, August 1979.
75
NRC, "Staff Discussion of Fifteen Technical Issues
Listed in Attachment to November 3, 1976 Memorandum
from Director, NRR to NRR Staff." NUREG-0138,
November 1976, at 4-5.
76
NRC, "TMI-2 Lessons Learned Task Force Status
Report and Short-Term Recommendations," NUREG0578
at 18.
77
NRC, "Response of the NRC Staff to the Licensing
Board Question about the Applicability of Items
Addressed in NUREG-0138 and 0153 to this Plant," Three
Mile Island Nuclear Station, Unit 2.
78
Hanauer dep. at 70-81.
79
Hearing before the Committee on Government
Operations, U.S. Senate, 94th Cong. 2nd Sess. (Dec. 13,
1976) at 260-262, 322-329, 515.
80
Memorandum from C. Kelley, NRC, to Commissioners, NRC, "Hearings Held by the President's Commission
on the Accident at Three Mile Island," July 24,1979.
81Memorandum from N. Moseley, NRC, to V. Stello,
NRC, "Emergency Operating Procedures Governing SIS
Reset at Operating PWR's-Memorandum dated June 28,
1978," March 19, 1979.

Denton, NRC, to Commissioners, "Interim Report on Sensitivity Studies of the B&W Reactor Design," Enclosure C,
October 25, 1979.
46
NRC, "TMI-2 Lessons Learned Task Force Status
Report and Short-Term Recommendations," NUREG0578, Sec. 2.1.1, July 1979.
47
Metropolitan Edison Company," TMI-2 Emergency
2202-1.3-Lossof
Reactor
Procedures
No.
Coolant/Reactor Coolant System Pressure," Sec. 3.0,
Rev. 11, October 6,1978.
48
Babcock and Wilcox Company, "Site Problem
Report No. 372: SFRCS Trip/Reactor Trip/Coolant Spill,
Davis Besse-1, Toledo Edison," SPR No. 372, October 4,
1977.
49
General Public Utilities, "Technical Data Report:
Three Mile Island Unit 2, Accident Transient Modeling
Analysis," Project No. 0014C, August 1979.
50
Westinghouse Electric Corporation, "Report on
Small Break Accidents for Westinghouse NSSS Systems," WCAP-9601, Sec. 5.2, June 1979.
51
NRC, "Investigation into the March 28, 1979 Three
Mile Island Accident by the Office of Inspection and
Enforcement" NUREG-0600, Sec. 2.15.4, August 1979.
52 Letter and attacheddocuments from G. F.
Trowbridge; Shaw, Pittman, Potts, and Trowbridge; to E.
G. Case, NRC, Subject: TMI Staff Interviews, dated May
7,1979,Faust interview (Met Ed) at 5.
53
Met Ed, "TMI-2 Emergency Procedures 2202-1.3Loss of Reactor Coolant/Reactor Coolant System Pressure," Sec. 2.2.4, Rev. 11, October 6,1978.
54
NRC, "Investigation into the March 28, 1979 Three
Mile Island Accident by Office of Inspection and Enforcement," NUREG-0600, Sec. 4.5, August 1979.
55
NRC, "Generic Assessment of Delayed Reactor
Coolant Pump Trip during Small Break Loss of Coolant
Accidents in Pressurized Water Reactors," NUREG-0623,
November 1979, at 1.
56
Babcock & Wilcox Company, "Evaluation of Transient Behavior and Small Reactor Coolant System Breaks
i n the 177 Fuel Assembly Plant," Appendix 1, May 1979.
57
Faust, Frederick, Scheimann, and Zewe dep. at
113-114.
58
NRC, "Investigation into the March 28, 1979 Three
Mile Island Accident by the Office of Inspection and
Enforcement," NUREG-0600 at 1A-38.
59
C. Michaelson, "Decay Heat Removal During a Very
Small Break LOCA for a B&W 205-Fuel-Assembly PWR,"
Sec. 3.0, January 1978.
80
President's Commission on the Accident at Three
Mile Island, "Technical Staff Analysis Report on Thermal
Hydraulics," October 1979, at 9-12.
61
NRC, "Generic Assessment of Delayed Reactor
Coolant Pump Trip during Small Break Loss of Coolant
Accidents in Pressurized Water Reactors," NUREG-0623,
November 1979, at A-3.
62
NRC, "Investigation into the March 28, 1979 Three
Mile Island Accident by the Office of Inspection and
Enforcement," NUREG-0600, August 1979, at 1-1-5.
B 3Letter from V. Stello, NRC, to R. C. Arnold, Met Ed,
Subject: Investigation Report Number 50-320/79-10,
dated October 25,1979, Appendix A, at 4.
64
NRC, "Investigation into the March 28, 1979 Three
Mile Island Accident by the Office of Inspection and

82

NRC, "Staff Discussion of Fifteen Technical Issues
Listed in Attachment to November 3, 1976 Memorandum
from Director, NRR to NRR Staff," NUREG-0138,
November 1976, at 4-1 to 4-11.

83NRC Hearing before the Advisory Committee on

Reactor Safeguards (Dec. 3,1976) at 32-80.
84

Memorandum from W. R. Butler, NRC, to D. G.
Eisenhut, NRC, "Review of IE Inspections of Operating
PWRs Related to the Followup Actions Identified in
NUREG-0138 Issue No. 4, Loss of Offsite Power Subsequent to Manual Safety Injection Reset Following a
LOCA," December 29,1977.
85
Memorandum from W. R. Butler, NRC, to D. G.
Eisenhut, NRC, "Resolution of Certain Issues Concerning
Loss of Off site Power Subsequent to Manual Safety546

112Faust, Frederick, Scheimann, and Zewe dep. at 114.
113Memorandum from R. C. DeYoung, NRC, to L. V.
Gossick, NRC, "Potential 10 CFR Part 21 Violations by
B&W," Enclosure 9, September 10, 1979.
114NRC, "Investigation into the March 28, 1979 Three
Mile Island Accident by the Office of Inspection and
Enforcement," NUREG-0600, Sec. 1.3.2.3, August 1979.
115Letter from V. Stello, NRC, to R. C. Arnold, Met Ed,
Subject: I nvestigation Report Number 50-320/79-10,
dated October 25, 1979, at 3.
'*Met Ed, "Final Safety Analysis Report, Three Mile
Island Nuclear Station-Unit 2," Vol. 9, Sec. 15.1.8.
117Met Ed Specification 2555-1.5, "Condensate Polishing Plant," Amendment No. 1, at 11-12.
118 Met Ed Calibration Data Sheets, TMI-2, Instrument
Nos: WT-PS-7410, 7412, 7414, 7416, 7418, 7420, 7422,
and 7424.
119 Met Ed photographs of MTX 24.2 drawings depicting electrical system tested.
120 Met Ed MTX 24.6, Condensate Polishing System
Functional Test.
121Photographs of Condensate Polisher Cabinets 1
through 8 with disconnected wiring.
122 Burns & Roe Field Questionnaire No. 1577, dated
February 19, 1977, with attached Engineering Change
Memo, Serial No. 5-4562.
123TMI-2 Work Requests Nos: 0027, 0028, 0036,
0037, 0039, 0172, 0173, 0249, 0282, 0335, 0204, 0436,
0468, 0478, 0488, 490, 495, 496, 500, 602, 730, 890,
956, 957, 1053, 1076, 2151, and 1296.
124Met Ed MTX 24.6, Condensate Polishing System
Functional Test.
125Memorandum from M. J. Ross, Met Ed, to G. P.
Miller and J. L. Seelinger, Met Ed, "Water in the Instrument Air Lines at the Condensate Polisher Control Paneland Regeneration Skid Resulting in a Loss of Feedwater
Condition in Unit No. 2 on October 19, 1977," November
14, 1977.
126GPU Startup Problem Report, MTX 25, dated
November 3,1977.
127Met Ed, pages from the condensate polisher
operating log for the period May 12, 1978.
128Memorandum from W. H. Zewe, Met Ed, to J. Seelinger, "Water in Service and Instrument Air," May 15,
1978.
129Memorandum from J. Seelinger, Met Ed, to J. Brummer, GPU, "Water in IA," May 16,1978.
13OTMI-2 Reactor Trip Report, dated November 3,
1978.
1mTMi-2 Operating Procedure 2106-2.2, "Condensate
Polishing System," Rev. 9, para. 4.1.4, December 21,1978.
132TMI-2, The Condensate Polisher Operator's Log
Book for the Period March 27-28,1979, at 383.
133NRC, "Investigation into the March 28, 1979 Three
Mile Island Accident by the Office of Inspection and
Enforcement," NUREG-0600, Appendix I-A, item 4,August 1979.
134k1. at 1-2-4 and 5.
135TMI-2, Differential Pressure Recorder 89, SC-0401,
March 28, 1979, File No. 62-0070-404-89-00, Reel
OPCP-2-818.
136NRC, "Investigation into the March 28,1979 Three

I njection Signal Reset Following a LOCA (NUREG-0138,
I ssue No. 4)," April 18, 1978.
86Memorandum from E. Marinos, NRC, to B. C.
Rusche, NRC, "Resolution of Technical Issues," November
19, 1976.
87NRC, "Investigation into the March 28, 1979 Three
Mile Island Accident by Office of Inspection and Enforcement," NUREG-0600, Sec. 4.18, August 1979.
58Zewe interview (Met Ed) at 9.
89Faust interview (Met Ed) at 5.
90TMI-2 Technical Specifications, Appendix "A" toLicense No. DPR-73, Sec. 3.5.2.
91 NRC, "Investigation into the March 28, 1979 Three
Mile Island Accident by Office of Inspection and Enforcement," NUREG-0600, August 1979, at 1-4-77.
92Id. at 1-4-76.
93Faust interview (Met Ed) at 1.
94Frederick interview (Met Ed) at 1.
95Met Ed, "Final Safety Analysis Report, Three MileI sland Nuclear Station-Unit 2," Vol. 4 at 6.2-24.
96 NRC, "Investigation into the March 28, 1979 Three
Mile Island Accident by Office of Inspection and Enforcement," NUREG-0600, Sec. 4.17, August 1979.
97 Faust, Frederick, Scheimann, and Zewe dep. at 241.
9814. at 247.
99NRC, "Staff Discussion of Fifteen Technical Issues
Listed in Attachment to November 3, 1976 Memorandum
from Director, NRR Staff," NUREG-0138, November 1976,
at 4-1 through 4-11.
100Hearing before the Committee on Government
Operations, U.S. Senate, 94th Cong., 2nd Sess. (Dec. 13,
1976) at 260-262.
101Met Ed, "TMI-2 Emergency Procedure 2202-1.3Loss of Reactor Coolant/Reactor Coolant System Pressure, Sec. 3.4, Rev. 11, October 6,1979.
102Faust, Frederick, Scheimann, and Zewe dep. at 99.
103Memorandum from R. C. DeYoung, NRC, to L. V.
Gossick, NRC, "Potential 10 CFR Part 21 Violations by
B&W," Enclosure 1, September 10, 1979.
104Met Ed, "TMI-2 Emergency Procedure 2202-1.3Loss of Reactor Coolant/Reactor Coolant System Pressure, Sec. B, Rev. 11, October 6, 1978.
105Memorandum from H. Denton, NRR, to Hendrie, etal., NRC, "Response to Questions Raised by Congressman Udall," October 4,1979.
106Letter from J. H. Taylor, B&W to R. J. Mattson, NRC,
Subject: Operating Procedure Guidelines for Small
Breaks, dated May 5, 1979.
107 Memorandum from H. Denton, NRR, to NRC Commissioners, "Interim Report on Sensitivity Studies of the
B&W Reactor Design," Enclosure C, October 25, 1979.
"Memorandum from R. C. DeYoung, NRC, to L. V.
Gossick, NRC, "Potential 10 CFR Part 21 Violations by
B&W," Enclosure 1, September 10, 1979.
109Met Ed, "TMI-2 Emergency Procedure 2202-1.3Loss of Reactor Coolant/Reactor Coolant System Pressure, Sec. B, Rev. 11, October 6, 1978.
11 °Faust, Frederick, Scheimann, and Zewe dep. at 113.
111Memorandum from R. C. DeYoung, NRC, to L. V.
Gossick, NRC, "Potential 10 CFR Part 21 Violations by
B&W," Enclosure 6, September 10, 1979.
547

*'Note on Timing Problems-Time marks on most of
the strip charts can be placed with no more than about±3 minutes accuracy, even though sudden changes in
the recorded parameter were fitted to similar changes inother parameters to ±1 minute or better. Better matchi ng is not possible, since the accuracy of the chart drives
i s not known, while "fits" between neighboring "accurate
event" time points may be several feet apart on charts
having nominal speeds of 4 to 8 inches per hour. In addition, the same signal from one sensing instrument
recorded on two separate data acquisition systems wasin one case displaced approximately 63 seconds at thestart of the accident (03:59:33 a.m. and 04:00:36 a.m.)
and approximately 2 minutes about 10 hours later(02:36:20 p.m. and 02:38:14 p.m.-both values extrapolated). This means that not only were the internal clocksof the two data acquisition systems indicating different
ti mes but they also had different rates. These data arecontained in channel 390 of the utility typer and channel
MUX-2 of the reactimeter. They are plotted in Color
Plate IV for times after 02:30 p.m. The signal calibrations
and setting accuracies of the strip chart recording instruments on March 28, 1979, are not known exactly, but theresults of the most recent calibration have been summarized in Section II.C.1.d. The errors may be as large as 5%,
as the wide-range chart for the reactor coolant systempressure records a pressure of 490 to 495 psig at 13 •hours 28 minutes and channel 398 of the utility typer
reports a pressure of 445 psig at that time. Also, thewide-range reactor coolant pressure chart indicates apressure of 2200 psig at 10 hours 13 minutes while thereactimeter reports a pressure of 2145 psig at that time.
162TMI Control Room Logs March 28, 1979 (NRC Reel
OPS-2-801.2068).
1 3Mehler dep., October 11, 1979, at 5-9.
164TM1 Plant Strip Charts: By name-OTSG and Primary System Temperatures, March 21, 1979 to April 4,
1979, SC-0043 Recorder 10 (NRC Reel OPCP-2-803).
165Letter from G. F. Trowbridge; Shaw, Pittman, Potts,
and Trowbridge; to E. Case, NRC, Subject: TMI Staff
Interviews, dated May 7,1979, Zewe interview at 6, 8.
166Faust interview (IE) April 21,1979, Tape 36 at 4-7.
167Chwastyk dep., Oct. 11, 1979, at 38-41.
168 Letter from G. F. Trowbridge; Shaw, Pittman, Potts,
and Trowbridge; to E. Case, NRC, Subject: TMI Staff
Interviews, dated May 7,1979, Zewe interview at 6.
169Met Ed, TMI-2 Final Safety Analysis Report (FSAR),
Table 9.3.
170NRC, "Investigation into the March 28, 1979, Three
Mile Island Accident" by the Office of Inspection and
Enforcement, NUREG-0600 August 1979, at 1-4-20.
171These 52 instrumentation tubes are reasonably
representative of the 177 fuel assemblies in the core, andthe fraction of them to which events are happening
should be multiplied by 177/52 to estimate the behavior
i n the entire core.
172NRC, "NRC Special Inquiry, TMI-2: Accident Deli neation," NUREG CR-1239 (Sandia Laboratories, SAN
80-0094), January 1980.
173Electrical Power Research Institute, "Analysis ofThree Mile Island-Unit 2 Accident," NSAC-1, July 1979,
Appendix CI.
1741. Porter interview, May 21, 1979 (tape 237) at 17-21.

Mile Island Accident by Office of Inspection and Enforcement," NUREG-0600, Appendix I-A, item 14, August 1979.
737Id. at 4.1.1-4.1.2.
Faust, Frederick, Scheimann, and Zewe dep. at
170-171.
139Letter from G. F. Trowbridge; Shaw, Pittman, Potts,
and Trowbridge; to E. Case, NRC, Subject: TMI Staff
Interviews, dated May 7, 1979, Scheimann interview at 5.
14o1d., Zewe interview at 3.
141Met Ed, "Final Safety Analysis Report, Three Mile
Island Nuclear Station-Unit 2," Sec. 10.4.7.
142EIectric Power Research Institute, Nuclear Safety
Analysis Center, "Analysis of Three Mile Island-Unit 2
Accident," NSAC-1, Appendix C/FDW, July 1979.
143NRC, "Investigation into the March 28, 1979 Three
Mile Island Accident by the Office of Inspection and
Enforcement," NUREG-0600, August 1979, at 4.1.1.
Letter from G. F. Trowbridge; Shaw, Pittman, Potts,
and Trowbridge; to E. Case, NRC, Subject: TMI Staff
I nterviews, dated May 7, 1979, Zewe interview at 3.
145 NRC, "Investigation into the March 28, 1979 Three
Mile Island Accident by the Office of Inspection and
Enforcement," NUREG-0600, Sec. 4.1.3., August 1979.
146!d. at IA-6.
147Letter from G. F. Trowbridge; Shaw, Pittman, Potts,
and Trowbridge; to E. Case, NRC, Subject: TMI Staff
I nterviews, dated May 7,1979, Faust interview at 8.
148Id., Zewe interview at 2.
149Electric Power Research Institute, "Nuclear Safety
Analysis Center, Analysis of Three Mile Island-Unit 2
Accident," NSAC-1, Appendix STEAM DUMP, July 1979.
150Met Ed, "Final Safety Analysis Report, Three Mile
Island Nuclear Station Unit 2," at Sec. 7.0, Docket 50320.
151IEEE Standard No. 279-1968.
152NRC, "Three Mile Island Unit 2 Technical Specifications," NUREG-0432,1978.
153Met Ed, "Three Mile Island Nuclear Station Unit 2
Surveillance Procedure 2302-R28," July 1978.
154Power Reactor Development Company, Enrico
Fermi Atomic Power Plant, "Report on the Fuel Melting
Incident in the Enrico Fermi Atomic Power Plant on
October 5,1966," December 15,1968.
155Atomic Power Development Associates, Inc.,"Design and Capabilities of the Malfunction Detection
Analyzer Installed on the Enrico Fermi Fast Breeder
Reactor," July 1969.
156Electric Power Research Institute, "On-Line Power
Plant Alarm and Disturbance Analysis System," EPRINP-613, Project 891, Interim Report, February 1978.
157NRC, "Instrumentation for Light-Water-Cooled
Nuclear Power Plants to Assess Plant Conditions Duringand Following an Accident," Reg. Guide 1.97, Rev. 2. (Proposed).
158Zewe, Scheimann, Frederick, and Faust interview(IE) (April 3, 1979) Tape 128 at 17.
159Faust interview (IE) (March 30, 1979) Tape 145 at
13.
160American National Standard, "Functional Requirements for Post Accident Monitoring Capability for theControl Room Operator of a Nuclear Power Generating
Station," ANS-4.5 (Draft), September 1979.
548

175

Id. at 18-21.
Electrical Power Research Institute, Nuclear Safety
Analysis Center, (EPRI), Palo Alto, Calif., research in progress.
177
TMI Plant Strip Charts, Self-Powered Neutron
Detector (SPND) Data, March 28, 1979, SC-0037,
Recorder 23.
178
R. 0. Wooten, R. S. Denning, and P. Cybu!skis, Battelle Columbus Laboratories, "Analysis of the Three MileI sland Accident and Alternative Sequences," NRC Report
NUREG/CR-1219, December 19,1979.
179See Appendix 11-10.

Atomenergie, Studsvik Sweden, February 1978 (in Swedish).

176

195

Letter from D. E. Bennett, Sandia Laboratories, to J.
Murphy, NRC (PAS), Subject: Sandia-ORIGEN code calculations, dated April 4, 1979.
88
t NRC, "Investigation into the March 28, 1979 Three
Mile Island Accident by the Office of Inspection and
Enforcement," NUREG-0600, August 1979.
197
Letter from Harold R. Denton (NRR) to Vincent L.
Johnson,September 28, 1979.
198
Letter from J. T. Collins (TMI-2 support) to J. Y. Lee(TMI-2 support), "Preliminary Analysis Results of TMI-2
Containment Building Water Samples," August 31, 1979.
199
J. A. Auxier et al., "Report of the Task Group on
Health Physics and Dosimetry to President's Commission
on the Accident of Three Mile Island," October 1979, at
139-148.
200
C. J. Hochanadel, "Effects of Cobalt Gamma Radiation on Water and Aqueous Solutions," J. Phys. Chem.
56:587-594,1952.
201
R. G. Sowden, "Radiolytic Problems in Water Reactor,"202
J. Nucl. Mater. 8:81-101,1963.
J. R. Honekamp, S. Gordon, K. H. Schmidt, and D.
J. Malloy, "An Analysis of the Hydrogen Bubble Concerns in the Three-Mile Island Unit-2 Reactor Vessel"undated, contribution to President's Commission Technical Staff Analysis Report on Chemistry.
2o3p.
Cohen, "Oxygen Generation and Gas Composition of Bubble," June 24, 1979, contribution to President's
Commission Technical Staff Analysis Report on Chemist ry.
204
Letter from Harold A. Schwarz, Brookhaven
National Laboratory, to Robert J. Budnitz, NRC, with
attachment, "Radiation Chemistry of the Three Mile River[sic] Accident," dated April 24,1979.
205
M. L. Picklesimer, "Bounding Estimates of Damage
to Zircaloy Fuel Cladding in the TMI-2 Core at Three
Hours After the Start of the Accident, March 28, 1979,"
Memorandum for File, NRC, June 1979.
206
R. K. Cole, Generation of Hydrogen During the First
Three Hours of the Three Mile Island Accident,
NUREG/CR-0913, (Sandia Laboratories, SAND 79-1357)
July 1979.
207
Letter (with attachments) from R. K. Cole, Sandia
Laboratories, to -M. Picklesimer, NRC-TMI-SIG, dated
October 15, 1979.
208
Met Ed, "Bubble Size Calculations," various dates.
209
Letter from James H. Taylor, Manager of Licensing,
B&W, to John Bickel, ACRS, Subject: "TMI-2 Incident,
Gas Bubble Volume Estimate," dated July 20, 1979.
210
Met Ed, "Final Safety Analysis Report, Three MileI sland
Nuclear Station-Unit 2," Chap. 7.
211
Memorandum for Files, T. E. Murley, "Record of
Actions, Three Mile Island Accident, March 28-April 6,"
NRC (RES), June 1979.
212
Appendix 111. 4, " Chronology of TMI-2 Hydrogen
Bubble Concerns."
213
Notes made of the time and later recollections indicate that the organizations contacted included several
groups within NRC, GE, Westinghouse, Bettis, KAPL, SAI,
B&W, ORNL, EG&G, INEL, Battelle, Sandia, AVCO, IBM,
Mobil Oil, Lawrence Berkeley Laboratory, BNL, Picatinny
Arsenal, Columbia University, and Exxon Research.

°

Electrical Power Research Institute, "Analysis ofThree Mile Island Unit No. 2 Accident," NSAC-1, July
1979.
181
Pres. Comm. "Technical Staff Analysis Report on
Core Damage," October 1979.
182
R. 0. Meyer, calculation of Zircaloy oxidation fromhydrogen burned.
183
S. Hagan, et al., Projekt 4241, "Experimentalle
Undersuchung dew Abschmenisphize van U0 2 Zircaloy
Brennelemeuten bei versagender Not Kuhlung," Projekt
Nukleare Sicherheit Halbjahresbericht, 1977/2 Kfk 2600,
pp. 416-428.
18

184
Memorandum from M. L. Picklesimer, NRC, to File,"Bounding Estimates of Damage to Zircaloy Fuel Rod
Cladding in the TMI-2 Core at Three Hours After the Startof the Accident, March 28,1979," June 22,1979.
Memorandum from G. P. Marino and J. M. Marks,
NRC, to File, "Calculation of Fuel Rod Temperatures
Reached in the Three Mile Island-2 Incident," October 25,
1979.
1 86
NRC, "Investigation into the March 28, 1979 Three
Mile Island-2 Accident by the Office of Inspection and
Enforcement," NUREG-0600, August 1979.
187
A. P. Malinauskas, R. A. Lorenz, J. A. Collins, "Fission Product Release from Defected LWR Fuel Rods," 7thWater Reactor Safety Information Meeting, November
5-9,1979.
18
M. L. Picklesimer, "Bounding Estimates of Damage
to Zircaloy Fuel Rod Cladding in the TMI-2 Core at Three
Hours after the Start of the Accident, on March 28,1979,"
Memorandum for file, NRC, June 1979.
189
D. M. Haaland, "Release of Radioactivity from theCore," Chapter 7 of Core-Meltdown Experimental Review,
SAND 74-0382, Sandia Laboratories, Albuquerque, N.M.,
August 1975.
190
H. Albrecht, V. Matschoss, H. Wild, Experimental
I nvestigations of LWR-Core Material Release at Temperature Ranging from 1500 to 2800"C, 7th Water Reactor
Safety Information Meeting, November 5-9,1979.
191
NRC, "Reactor Safety Study," Appendix VII, WASH1400 (NUREG-75/014), October 1975.
192
y. B. Katayama and J. E. Mendel, "Leaching of Irradiated LWR Fuel Pellets in Deionized Water, Sea Brine,
and Typical Ground Water," ANS Trans, 27:447,
Nov.-Dec. 1977.
193
Y. B. Katayama, Leaching of Irradiated LWR Fuel
Pellets in Deionized and Typical Ground Water, BNWL2057, Battelle Northwest Laboratories, Richland, Washi ngton, July 1976.
194
E. B. Eklund and R. Forsyth, Lackning av bestraalad
U02-braens (Leaching of irradiated U0 2 fuel), TPM-B, AB

549

Some of these organizations were contacted only about
isolated facets of the problem.

Aluminum-Water System," ANL/RAS/LWR 79-2, April
1979.
221
H. Kottowski, et al., "Importance of the Coolant
I mpact on the Violence of the Vapor Explosion," 4th CSNI
Specialist Meeting on Fuel-Coolant Interactions in Nuclear
Reactor
Safety, April 1979.
222
NRC, "Preliminary Analysis of the Containment
Failure Probability by Steam Explosions Following a
Hypothetical Core Meltdown in a LWR" (by Sandia
Laboratories),
NUREG/CR-1104, (in press).
223
NRC, "Reactor Safety Study: An Assessment of
Accident Risks in U.S. Commercial Nuclear Power Plants,"
Wash-1400 (NUREG-75/014), October 1975, Appendix
VII, 224
Sec. 1.2.
1d., Appendix VII, Sec. 1.4.
225
NRC, "Post-Accident Heat Removal: Debris Bed
Experiments D-2 and D-3" (by Sandia Laboratories),
NUREG/CR-0421, November 1978.
226
Met Ed, "Final Safety Analysis Report (FSAR),
Three Mile Island Nuclear Station, Unit 2," Sec. 6.2.2.
227
NCR, "Investigation into the March 28, 1979 Three
Mile Island Accident by the Office of Inspection and
Enforcement," NUREG-0600, August 1979, at 1-4-47.
228
NRC, "Sustained Molten Steel/Concrete Interactions Tests" (by Sandia Laboratories), NUREG/CR-0166,
June 1978.

214
P. Cybulskis, R. G. Jung and B. D. Trott, "Hydrogen
Explosion Analysis," attachment to letter from Richard S.
Denning, Battelle Columbus Laboratories, to Mark Cunningham,
NRC (PAS), dated May 22,1979.
215
Projekt Nucleare Sicherheit, "Experimentalle Undersuchung der Abschmelzphise van U0 2 u-ZircaloyBrennelemeuten bei versa gender Not Kuhlung,"
Halbjahresbericht (semiannual report), 1977/2 kfk 2600
pp. 416-428.
2* NRC, "Analysis of the Three Mile Island Accident
and Alternative Sequences" (by Battelle Columbus
Laboratories), NUREG/CR-1219 (in press), Sec. 6.0.
217
NRC, "Reactor Safety Study: An Assessment of
Accident Risks in U.S. Commercial Nuclear Power Plants,"
WASH-1400 (NUREG-75/014), October 1975, Appendix
VII, Sec. 1.2.
218
NRC, "TRAP-MELT Users Manual" (by Battelle
Columbus Laboratories), NUREG/CR-0632, February
1979.
719
NRC, "Molten Core/Water Contact Analysis for Fuel
Melt Accidents" (by Sandia Laboratories), NUREG/CR0391(SAND 77-1842), February 1979.
220
Argonne National Laboratories, "An Experimental
Study of Combined Physical-Chemical Explosions in an

550

D ALTERNATIVEACCIDENT SEQUENCES
In this section, a number of accident sequences
are discussed that are somewhat different from theactual TMI-2 accident progression. These alternative sequences have been established andevaluated to address particular questions that arise
from the Special Inquiry Group's (and other groups')
i nvestigations of the accident. None of these alternative sequences actually happened, but some ofthem could have, and others have much less probability of occurring. Each alternative has been
evaluated here to provide insights into reactor performance and safety.
The section "Amelioration of Fuel Damage"discusses methods by which damage to the fuelcould have been ameliorated and some reasons forthe lack of success of the anticipated procedures.
The "Analysis of Alternative Accident Sequences"section describes analyses performed that address
specific questions concerning the effect of certain
operator actions (or inactions) or equipment failures.
This section addresses a number of "what if" questions such as, what if the operators had not reduced
the high pressure injection system flow? Or, what if
the pilot-operated relief valve (PORV) block valve
had not been closed when it was? Only a few ofthe many possible "what ifs" have been evaluated.
We have selected alternatives to analyze that we
believe provide the greatest insights.

1. AMELIORATION OF FUEL DAMAGE
The integrity of the TMI-2 core was threatened
primarily during the first 16 hours of the accident.
The majority of the damage was done between 2
and 4 hours into the accident; the remainder of the
16 hours was then spent in attempts to recover fromthis damage. As discussed in Section II.C.2, the actual time of the final refilling of the core region is apoint of controversy. Because of this controversy,
the effectiveness of the various core coolingmethods utilized between 4 and 16 hours also
remains unresolved. However, apparently there aresome methods of cooling that were not used thatwould have been more likely to succeed. These are
discussed in this section.
Early PORV Block Valve Closure

The PORV is located at the top of the pressurizer
and is accompanied by an upstream block valve.
The discharge line temperature downstream of the
PORV (which provides information on the valve
status, stuck-open or closed) was obtained from theplant computer a number of times between the beginning of the accident and when the block valve
was closed at 2.3 hours; the first time was at 25
minutes. Had the block valve been closed at that551

time, the loss of coolant would have stopped before
significant amounts of water were lost. During similar incidents involving stuck-open PORVs (Davis
Besse on September 24, 1977, Oconee 3 on June
13, 1875), block valve closure occurred during
roughly comparable time periods. Because no fueldamage resulted from these similar events, it can bestated reasonably that no fuel damage would haveresulted at TMI-2 had the block valve been closed
at 25 minutes.
Computer analysis has been performed for theSpecial Inquiry Group (SIG) to evaluate further theeffect of block valve closure at 25 minutes. This
analysis, discussed in greater detail in "Alternative
Accident Sequence 5, PORV Block Valve Closure at
25 Minutes," Section Il.D.2.f, also indicates thatvalve closure at 25 minutes would have stopped theaccident
before serious damage to the fuel be2,3
gan.
By the time the operators made subsequent requests for discharge line temperatures, additional
coolant had been lost from the reactor coolant system. After some time period, this loss of coolant
would have become sufficiently great that closure of
the block valve would not, in itself, have reversed
the deteriorating situation. In these cases, the useof the high-pressure injection system in one of themodes discussed below would also have beennecessary.

PORV and safety valves would have been established. In this mode of HPI system use, heat removal from the RCS should have been achieved by theheatup of water as it passed through the RCS.
After depletion of the normal source of water fromthe HPI system (the borated water storage tank), a
flow path from the reactor building emergency sumpby using the water lost out the PORV and safetyvalves could have been established. This method ofcooling was not attempted on the first day of theaccident apparently because of a failure to recognize that a loss-of-coolant accident was occurring.
Use of the HP! System in Conjunction with Reactor
Coolant Pump Operation
Between 100 minutes and 16 hours, all reactor
coolant pumps (RCPs) were off (with two brief exceptions), so that forced flow cooling of the core
was not occurring. Restart of one of these pumps
would have reestablished forced flow cooling to thecore, with heat removal being achieved through theonce-through steam generators (OTSGs). However,attempts to restart an RCP in this time period met
with limited success apparently because of low water inventories and pressures in the RCS. Use of
the HPI system in support of the restart of an RCPmay have provided the needed additional coolant
and pressure. Thus the combination of HPI systemuse and restart of an RCP should have been, andeventually was, successful in cooling down thereactor core.
Between the 4- and 16-hour period, RCS pressure was increased to over 2000 psi twice, once at
about 5 to 6 hours and maintained for over 2 hours
and again at about 14 to 15 hours. During the latter
repressurization, a reactor coolant pump was started, providing the long term, stable method of cooli ng. There is no evidence that attempts to start areactor coolant pump were made during the earlier
repressurization.
The emergency procedure to be followed during
a loss-of-coolant accident due to a small break in
the RCS is to allow the automatically actuated highpressure injection system to operate. For a breaksuch as a stuck-open PORV, the HPI would restore
RCS pressure and coolant inventory and maintaincore cooling. When RCS pressure and pressurizer
l evel are restored to specific levels (as defined in
the emergency procedures), HPI system flow is supposed to be decreased by valve manipulation. This
anticipated procedure apparently was not followed
for a number of reasons. We believe that thesereasons include:

Use of the High-Pressure Injection System

Effective use of the high-pressure injection (HPI)
system would have provided, and eventually did
help provide, the means to cool down the reactor
coolant system (RCS) and the core. Several modesof HPI system use, by itself or in conjunction withother systems, were possible. These include bothof the following modes.
Continuous HP! System Flow at High Flow Rates

The HPI system was automatically actuated anumber of times during the first 16 hours of the accident, as discussed in Section II.C.2. Because of
the continued reliance on pressurizer level instrumentation by the operating crew, the flow rate fromthe system was substantially reduced following
each actuation.
Operation of the HPI system at its full flow rates
would have repressurized the RCS and refilled itwith coolant. With the RCS again filled with water(along with some pockets of noncondensible gas
after 2 to 3 hours into the accident), a flow pathfrom the HPI system into the RCS and out the552

• failure of operators to recognize that the PORV
was stuck open and thus that a loss-of-coolant
accident was occurring;• pressurizer level indication was misleading; and• l ack of understanding by operators on how to recover from such an accident, once recognized.

of system operations and human actions. Variations
i n these parameters are displayed as "branches" inthe event tree; thus, any variation becomes a different branch, or alternative accident sequence, inthe overall event tree.
The progression of the early portion of the TMI-2
accident is shown in Figure 11-38. Four parameters,
all of which were related to human actions, wereidentified as critical to this progression. The fourparameters chosen were:

2. ANALYSIS OF ALTERNATIVE ACCIDENTSEQUENCES• ti ming and method of tripping the reactor coolant

a. Introduction and Summary

pumps;• timing of closure of the PORV or its block valve;• ti ming of initial delivery of emergency feedwater

The analysis of a set of alternative accident sequences has been undertaken as part of the Special
I nquiry Group's work. The purposes of this analysis
are:system flow to the steam generators; and• flow rate delivered from the high pressure injection system.

• to assess specifically the importance of various

For each of these parameters, a number of alternative values were chosen. With respect to the timi ng and method of tripping the two pairs of reactor
coolant pumps, three variations were chosen: (1) total pump trip concurrent with reactor trip, (2) one of
the two pumps in each loop tripped at 73 minutes,
and (3) B-loop pump trip at 73 minutes followed byA-loop pump trip at 100 minutes. Case 1 relates tothe tripping of all four of the reactor coolant pumps
very early in the transient at the time of reactor trip.
Case 2 relates to the possibility of prolonged pump
operation from selective tripping of one pump ineach loop. Case 3 is the base case; that is, the actual timing of pump tripping during the accident.
Four variations in the time of closure of the PORV
or the PORV block valve were defined. Times ofclosure were (1) 13 seconds, (2) 25 minutes, (3) 2.3
hours, and (4) 3.3 hours. Case 1 relates to the normal timing of PORV closure following an interruption
i n flow from the main feedwater system and subsequent reactor trip. Case 2 relates to the timing of
the first operator request for printout of the PORV
discharge line temperature from the utility printer.
Case 3 is the base case; that is, the actual time of
PORV block valve closure. Case 4 adds an additional 1-hour delay in closure of the PORV block
valve beyond that actually experienced.
Three variations in the timing of initial emergency
feedwater (EFW) flow into the steam generators
were analyzed. Times of delivery were (1) 40
seconds, (2) 8 minutes, and (3) 1 hour. Case 1 rel ates to the normal time of EFW flow initiation into
the once-through steam generators (OTSGs), had
the discharge line block valves not been closed.
Case 2 is the base case time of EFW delivery to the
OTSGs. Case 3 relates to a delay in opening of theblock valves to 1 hour rather than 8 minutes.

equipment failures and/or human actions (ori nactions);• to provide additional information on the physicalphenomena occurring during the accident; and• to aid in the assessment of how close this accident was to becoming a "core meltdown" accident.

To assist in the evaluation of certain alternative
accident sequences, computer analyses were performed at the following locations:• MARCH code calculations at Battelle Columbus
Laboratories;• RELAP code calculations at the Idaho National
Engineering Laboratory; and• TRAC code calculations at the Los Alamos
Scientific Laboratory.

The MARCH code is a relatively simplistic codethat models the progression of core meltdown accidents, including reactor coolant system thermalhydraulics, fuel heating, melting, and collapse, containment base mat penetration, and containmentpressure and temperature response. The RELAP
and TRAC codes are more sophisticated thermalhydraulic codes used to analyze design basis accidents, employing multidimensional modeling of
coolant flow (as liquid water, steam, and mixtures)and calculating detailed fuel temperature profiles.
The results of these calculations are discussed in
the following sections. Detailed results may befound in Refs. 2, 3, and 4.
The method by which most of the alternative sequences were determined was through the combination of critical parameters in an "event tree" logic.
Such a tree displays the progression of the early
portion of the accident (the first few hours) in terms
553

FIGURE 11-38. Event Tree for Parameters Criticalto Early Accident Progression

Two variations in the flow rates from the highpressure injection (HPI) pumps were examined.
These cases were (1) full HPI flow rate after actuation, and (2) degraded HPI flow rates. Case 1 rel ates to the functioning of the HPI system without interference to throttle flow rates. Case 2 involves
the base case flow rates as actually experienced
because of operator actions to reduce this flow.
Figure 11-38 displays possible variations in the
progression of events following the TMI-2 accident
i nitiating event (i.e., the interruption of main feedwater flow) resulting from the parametric variations discussed above. From all of the possible accident sequences shown in Figure 11-38, a set of nine sequences was chosen to examine the effects of variations in the four specific parameters. These ninecases are described in the following discussion.
I n addition to the alternative accident sequences
based on the four parameters critical to the earlyprogression of the accident, a number of alternative
sequences related to other specific concerns havebeen addressed.

Alternative Accident Sequence 2

Accident sequence 62 in Figure 11-38 has been
analyzed as alternative accident sequence 2. Twoparameters are varied, so that the high-pressure injection system operates at full flow rates (rather
than throttled back) and the delivery of emergency
feedwater is delayed from the actual 8 minutes until
about 1 hour into the accident. This sequence addresses the capability of the HPI system to provide
adequate core cooling without heat removal throughthe steam generators. Detailed results of theanalysis of this sequence may be found in Section
II. D.2.c.
Alternative Accident Sequence 3

Accident sequence 59 in Figure 11-38 has been
analyzed as alternative accident sequence 3. Only
one parameter is varied, this being the time ofdelivery of emergency feedwater flow. In this sequence, EFW is assumed to be delivered beginningat about 40 seconds, which would have happened if
the EFW discharge line block valves had not beenclosed. This analysis shows the effect of theseblock valves being closed until 8 minutes into theaccident. Detailed results of the analysis of this sequence may be found in Section II.D.2.d.

Base Case Accident Sequence
Accident sequence 61 illustrated in Figure 11-38 is
the sequence of events that actually occurred duri ng the early portion of the TMI-2 accident. This sequence has been studied with the use of various
computer codes to provide a basis to which the alternative accident sequences could be comparedand to assist in the overall understanding of the accident. The MARCH, RELAP, and TRAC codes haveall been used to recreate the base case accident
sequence, with RELAP and TRAC being used toanalyze the time period of 0 to 2 '/2 hours and
MARCH the time period of 0 to 16 hours. Detailed
discussions of these analyses may be found in Refs.
2, 3, and 4.

Alternative Accident Sequence 4

Accident sequence 63 in Figure 11-38 has been
analyzed as alternative accident sequence 4. In thissequence, only the time of opening the EFW systemdischarge line block valves is varied. Delivery of
EFW to the OTSGs is assumed to begin at 1 houri nto the accident, rather than at 8 minutes. This alternative sequence shows the effect of a more prolonged unavailability of emergency feedwater resulting from the prolonged closure of the discharge line
block valves. Detailed results of the analysis for thissequence may be found in Section II.D.2.e.

Alternative Accident Sequence 1

Alternative Accident Sequence 5

Accident sequence 60 in Figure 11-38 has been
analyzed as alternative accident sequence 1. All
parameters remain the same except that the highpressure injection system is allowed to operate at full
flow rates rather than in the degraded mode resulti ng from operator actions to throttle back flow. This
analysis shows the effect of the operator decision
to throttle back the HPI flow. Detailed results of theanalysis of this sequence may be found in Section
II. D.2.b.

Accident sequence 55 in Figure 11-38 has been
analyzed as alternative accident sequence 5. In thissequence, only the time of PORV block valve closure is varied. Time of closure is assumed to be 25
minutes, which is the time when an operator firstqueried the plant computer as to the temperature of
the PORV discharge line. Because the indicatedtemperature was believed by the operating crew tohave been a result of the initial opening of the PORV

556

analysis of this sequence may be found in Section
II. D.2.1.
Alternative sequences related to other specificconcerns are described briefly in the following paragraphs.

and not a continuous steam discharge, the crew did
not close the PORV block valve. This sequenceshows the impact of this failure to understand themeaning of the temperatures and act accordingly.
Detailed results of the analysis of this sequence
may be found in Section 11.13.21

Alternative Accident Sequence 9

Alternative Accident Sequence 6

Alternative accident sequence 9 deals with
events occurring slightly later in the accident thanare shown in Figure 11-38. In this alternative sequence, the PORV block valve is assumed to beclosed at 2 hours 18 minutes (as it actually was) but
Further, reactor
not reopened at later times.
coolant pump restart at 2 hours 54 minutes andhigh pressure injection actuation at 3 hours 20
minutes are also assumed not to occur. This alternative sequence examines the effect of the possibility that after block valve closure the operating crew,
failing to recognize and cope with the accident, returns to normal operating procedures. Detailed
results of this sequence may be found in Section
II. D.2.j.

Accident sequence 67 in Figure 11-38 has been
analyzed as alternative accident sequence 6. In thissequence, the time of PORV block valve closure isdelayed 1 hour beyond the 2.3 hour time in the actual accident, so that closure would occur at 3.3hours. This sequence assesses the effect of a continued loss of coolant out the PORV and the associated effect on core water level and fuel temperature,
resulting from the operator failing to close the PORV
block valve for an additional hour. Detailed resultsof the analysis of this sequence may be found in
Section II.D.2.g.
Alternative Accident Sequence 7

Accident sequence 38 in Figure 11-38 has been
analyzed as alternative accident sequence 7. In thissequence, only the method of tripping the reactor
coolant pumps is varied. At 73 minutes, one of the
two RCPs is assumed to be tripped in each loop. In
the actual accident, both B-loop pumps were
tripped at 73 minutes and both A-loop pumps at 100
minutes. This alternative method of RCP trip ispreferable for two reasons. First, the operation of
one pump per loop should increase the net positive
suction head (NPSH) available from the outlets ofthe steam generators. Second, this type of operation would prevent the forced pumping of coolant
i nto an idle loop where it would be, in effect, lost interms of cooling capability. The analysis of this sequence will indicate the impact of this variation in
RCP operation. Detailed results of the analysis of
this sequence may be found in Section II.D.2.h.

Alternative Accident Sequence 10

This alternative sequence is similar to alternative
accident sequence 9 discussed above, the one
difference being the allowance for reopening of the
PORV block valve, as was done in the actual accident. In this case, operator intervention to control
RCS pressure is assumed, but other operator actions to cope with an accident (rather than a somewhat unusual shutdown) are assumed not to occur.
Detailed results of this sequence may be found in
Section II.D.2.k.
Alternative Accident Sequence 11

At 16 hours into the accident, one reactor coolant
pump was restarted and forced-flow through thecore reinstated. Alternative accident sequence 11
involves failure of an RCP to be restarted at thistime. This sequence addresses the state of corecooling at 16 hours and the importance of the pumprestart at that specific time. Detailed discussion ofthis sequence may be found in Section II.D.2.1.

Alternative Accident Sequence 8

Accident sequence 15 in Figure 11-38 has been
analyzed as alternative accident sequence 8. In thissequence, all reactor coolant pumps are tripped at
the start of the accident, concurrent with reactor
trip. This sequence in effect eliminates the corecooling resulting from the RCP forced flow during
the first 100 minutes of the accident and thus will
help to assess the contribution of these pumps tothe course of the accident. Detailed results of theAlternative Accident Sequence 12

Alternative accident sequence 12 assumes theloss of offsite alternating current (ac) power in the1
ti me period of 1/2 to 5 /2 hours. Although sequence
12 is less closely related to the actual accident pro-557

gression than alternative sequences 1 through 11, investigation was considered useful because of thepotentially serious consequences of such a power
loss.
During the time period of 'h to 5'h hours, theemergency onsite ac power system (the diesel generators) had been manually disabled by the operati ng crew, so that the onsite system would not havestarted automatically, as designed, on loss of offsite
power. Restoration of the onsite system would
have required manual action in the diesel-generator
building. Thus, had a loss of offsite power occurredi n this time period, a total loss of ac power would
have been experienced until either the onsite ac
power supply was started in the diesel-generator
building or the offsite power system restored. Thei mplications of this alternative accident sequence
are discussed in Section II.D.2.m.

Analysis Results

The results of the alternative accident sequences
are summarized in Table 11-59. These results can begeneralized to indicate the importance of certain
operator actions during the first few hours of theaccident. The following insights are noteworthy.

• Operator actions that substantially reduced flow•••

Alternative Accident Sequence 13•

Alternative accident sequence 13 is also related
to a loss of offsite power. In this sequence, the time
period of interest is March 30 through April 1 (thethird through fifth days). In this period, core cooling
was being maintained by the operation of one reactor coolant pump. Concern existed that a loss ofoffsite power would cause the loss of the RCP andthus might compromise the capability to maintainadequate cooling. Detailed discussion of this sequence may be found in Section II.D.2.n.

from the high-pressure injection system wereclearly the primary cause of the fuel damage sustained.
Failure by the operators to recognize the significance of the PORV discharge line temperature
readings was an additional highly significant contributor to the severity of fuel damage.
If the PORV block valve had not been closed at
the time it was, substantial fuel melting would
li kely have occurred within an hour.
The trip of a single reactor coolant pump in eachl oop at 73 minutes might have prevented highfuel temperatures and minimized fuel damage.
The delay in delivery of emergency feedwater tothe steam generators until 8 minutes had no appreciable effect on the accident progression.

b. Alternative Accident Sequence 1: HighPressure Injection System Allowed to Operate
at Full Flow Rates
At approximately 2 minutes into the accident, thehigh-pressure injection (HPI) system was automatically actuated on a low reactor coolant system( RCS) pressure signal, resulting in the flow of approximately 1000 gallons of water per minute into
the RCS. Within 2 to 3 minutes, the operators had
substantially reduced the flow from the HPI system
to the degree that the amount of water lost out thestuck-open PORV was greater than that supplied by
the HPI system. Throughout the first 16 hours of theaccident, the HPI system was automatically actuated a number of times; each time the high flow rates
from the system were subsequently reduced by theoperators.
I n this alternative accident sequence, the highpressure injection system is assumed to haveoperated at full capacity from the initial actuation.
Other events such as the delay of 8 minutes indelivery of the emergency feedwater are assumed
to remain the same.
The results of the RELAP 3 and MARCH 2 calculations both indicate that the use of the HPI system in
TMI-2 at full capacity would have prevented theoverheating of the fuel and the resulting release ofradioactive material. These analyses show that theAlternative Accident Sequence 14

Alternative accident sequence 14 examines thepotential for recriticality (the reinitiation of the nuclear chain reaction) in the TMI-2 core during andafter the time of the accident. Of concern here are
the possible effects of the changes in coregeometry resulting from fracturing of the fuel insome regions and possible distortion or destructionof some control rods. This sequence is addressed
i n Section II.D.2.o.
Alternative Accident Sequence 15

Alternative accident sequence 15 evaluates theeffect of reactor building design. Specifically, consideration has been given to the possibility of an accident such as that at TMI-2 occurring in a pressuri zed water reactor with a different reactor building
design. Of particular interest was the ice condenser
type used at some pressurized water reactors
designed by Westinghouse. Discussion of thisevaluation may be found in Section II.D.2.p.
558

TABLE 11-59. Description of alternative accident sequences and results
Accident Sequence

Parameter Analyzed

Base Case-Reactor coolant pumps tripped at73-100 min-Emergency feedwater deliveredat 8 min-PORV block valve closed at 2.3 h-High-pressure injection system
i n "degraded" mode (throttled
back from full flow)

Alternative Sequence 1 (Section II.D.2.b)-High-pressure injection system allowed
to operate at full flow rates
Alternative Sequence 2 (Section II.D.2.c)-High-pressure injection systemallowed to operate at full flow
rates, and-Emergency feedwater delivery to
OTSGs at 1 h
Alternative Sequence 3 (Section II.D.2.d)-Emergency feedwater delivery to
OTSGs at about 40 s
Alternative Sequence 4 (Section II.D.2.e)-Emergency feedwater delivery to
OTSGs at about 1 h
Alternative Sequence 5 (Section II.D.2.f)-Closure of the PORV block valve
at 25 min

Alternative Sequence 6 (Section II.D.2.g)-Closure of the PORV block valve
at 3.3 hAlternative Sequence 7 (Section II.D.2.h)-One reactor coolant pump per loop
shutdown at 73 min
Alternative Sequence 8 (Section 11.0.2.1)-All reactor coolant pumps shut
down at time of reactor trip

Computer Code Used
RELAP
TRAC
MARCH
( Ref. 3)( Ref. 4)( Ref. 2)x

Effect of operator decision to substantiallythrottle back HPI flowx

X

Results

X

X

Core continuously
cooled-no fuel damage

Capability of HPI system
to cool core without heatremoval from OTSGsxx

Core continuously
cooled-no fuel damage

Effect of closure of
EFW block valves until
8 minutesx

X

Little significant
change from base case

Effect of a more prol onged closure of the
EFW block valves

X

X

Definitive conclusions
not possiblexCore continuously
cooled-no fuel damagex

Substantial fuel melti ng could result

Effect of operator error
i s not closing the block
valve after the first checkof PORV discharge line
temperaturex

Effect of a more prolonged
operator error before closureof the block valve
Effect of method of shutting
down RCPs, i.e., both B loop
pumps first, then A loop
pumps 28 min laterx

Effect of cooling provided
by forced flow from the RCPsx

Core continuously cooled-no fuel damagexxDefinitive conclusions notpossibleTABLE 11-59. Description of alternative accident sequences and results
Accident Sequence
Alternative Sequence 9 (Section II.D.2.j)-PORV block valve not reopened after
2.3 h, no reactor coolant pumprestart at 2.9 h, no high pressure injection actuation at 3.3 h

Alternative Sequence 10 (Section II.D.2.k)-No reactor coolant pump restart after
2.3 h, no high pressure injection
actuation at 3.3 h
Alternative Sequence 11 (Section 11.2.0.1)-No reactor coolant pump restartat 16 hAlternative Sequence 12 (Section II.D.2.m)-Loss of otfsite ac power at
Y2 to 5 h

Alternative Sequence 13 (Section II.D.2.n)-Loss of oftsite ac power during
March 30 to April 1 (third to
fifth days)

Alternative Sequence 14 (Section II.D.2.o)-Recriticality
Alternative Sequence 15 (Section II.D.2.p)-Effect of containment design

Parameter Analyzed

Computer Code Used
RELAP
TRAC
MARCH
( Ref. 3)(Ref. 4)
( Ref. 2)

Results

Effect of operator actions
to cope with LOCA after 2.3 hx

Substantial fuelmelting could result

Effect of operator
actions to cope with
LOCA after 2.3 hx

Substantial fuelmelting could result

Effect of timing of the pumprestartx

Definitive conclusions not possible

Effect of crew decision
to negate emergency ac
power actuation systemxOperator action to restore diesels required
within about 15 min
to prevent substantial
fuel melting

Effect of loss of forced
flow from the one operating
reactor coolant pump

Options available toprevent further coredamageRecriticality resulting fromfuel and control rod damage

Recriticality potential
minimalDesign characteristics of various
containment typesx

Some containment
designs might havebeen severely
damagedalthough some differences in the early progressionof the accident result from this variation in delivery
time, the progression beyond about 80 minutes isessentially the same (see Figure 11-40). Since fueldamage did not occur until later than 80 minutes,
the delay of 8 minutes in initial delivery of emergency feedwater does not appear to have significantly
affected the overall course of this accident. However, since the lack of heat removal through the steam
generators apparently had some influence on the initial pressurizer increase off scale and its remaining
off scale, the lack of EFW for 8 minutes did, tosome degree, influence the decisions of the operating staff. In this sense, closure of the EFW block
valves did contribute to the accident progression.

reactor coolant system would have remained
essentially full and cool throughout the incident.
On the basis of the analysis performed for thisalternative accident sequence, we find that thethaoperating crew's decision to redueA
flow fromthe HPI system was a major contributor to theseverity of this accident.
c. Alternative Accident Sequence 2: HPI
System Operated at Full Flow Rates andEmergency Feedwater Delivered at 1 HourI n this alternative sequence, the effect of HPI flow
analyzed in alternative accident sequence 1 is compounded with the effect of a human error in prol onging the failure to open the emergency feedwater(EFW) system discharge line block valves. In theactual accident, these block valves were opened at
approximately 8 minutes. In this alternative sequence, opening of these valves is delayed until 1
hour. This sequence in effect analyzes the capability of the HPI system to cool the core in the absenceof heat removal through the steam generators.
The TRAC4 and MARCH2 analyses of this alternative accident sequence are in general agreement;
both indicate that fuel temperatures remain significantly lower than those achieved during the actual
accident. Figure 11-39 shows this difference in temperature based on the TRAC calculations.
The analysis of this alternative accident sequence indicates that, for the HPI system design in
TMI-2, adequate core cooling would have beenachieved by the use of the system at full capacity,even in the absence of heat removal through thesteam generators (i.e., without the use of the EFW
system).

e. Alternative Accident Sequence 4: EFW
Delivered at 1 Hour, HPI System in DegradedMode
In alternative accident sequence 4, it has been
assumed that the closure of the EFW discharge line
block valves was not corrected until about 1 hour
into the accident, rather than 8 minutes. This sequence indicates the effect of a more prolonged
failure by the operator to discover the block valve
closure.
Analysis of this alternative accident sequence42
has been performed using the TRAC and MARCH
codes. In this instance, the two code calculations
differ in their results. The TRAC results indicate that
this assumed delay in emergency feedwater somewhat changes the accident progression during thefirst hour but that after 1 hour the accident assumes
characteristics essentially like those of the actual
accident. The MARCH results indicate a substantially greater repressurization of the reactor coolant
system in this alternative case, to the degree that
the RCS safety valves open and remain open forsome period of time. This results in a larger loss ofwater from the RCS and a shorter time before initial
uncovery of the core. MARCH then predicts thatli quefaction of fuel begins at about 70 minutes into
the accident, with a large fraction of the core molten
by about 100 minutes. The differing results of thetwo code calculations appear to result from differences in assumptions regarding the quality of thefluid (steam, steam-water mixture, or liquid water)l eaving through the stuck-open PORV and the extent of heating of the coolant by the reactor coolant
pumps during the period of flow degradation. Because of the significant uncertainties in the data obtained on the actual accident progression and be-

d. Alternative Accident Sequence 3: EFW
Delivered at 40 Seconds
In alternative accident sequence 3, it has been
assumed that the emergency feedwater systemdischarge line block valves were not closed, so that
EFW could have been delivered as designed atabout 40 seconds into the accident. The comparison of the results of this sequence to those of thebase case shows the effect of the 8-minute delay inthe initial delivery of EFW to the steam generators.
Analysis of this alternative accident sequence
has been performed using the TRAC 4 and MARCH 2
codes. The results of these analyses indicate that,561

FIGURE II-39. Comparison of Base Case to Alternative Sequence 2 (EFW Delay Until 1
Hour; Full HPI Flow) (Ref. 4)

cause of the limited time available for the Special Inquiry Group's analysis, definitive resolution of thesedifferences has not been possible.
One should note, however, that it would seemli kely that the repressurization of the RCS andopening of the safety valves predicted by MARCH
would be sufficiently unusual to expect operator intervention. Actions to reduce RCS pressure below
the safety valve setpoint would reduce the massloss from these valves, so that the significantly
shorter time to core uncovering predicted by
MARCH would be somewhat tempered.
It therefore appears that a delay of 1 hour inemergency feedwater delivery to the steam genera-

tors could have produced somewhat worse consequences than those actually experienced in the
TMI-2 accident. However, the magnitude of the increase in consequences cannot be determined at
this time.
f. Alternative Accident Sequence 5: PORV
Block Valve Closure at 25 Minutes
I n this alternative sequence, it has been assumed
that closure of the PORV block valve occurred at
approximately 25 minutes. At this time in the ac562

FIGURE 11-40. Comparison of Base Case to Alternative Sequence 3 (EFW on at 40
Seconds) (Ref. 4)

cident, the staff in the control room first requested
from the computer the PORV discharge line temperature. This sequence has been compared to thebase case in order to assess the effect had there
been closure of the PORV block valve at this earlytime.
The analysis of this sequence was performed using the RELAP3 and MARCH2 codes. The results ofthese analyses indicate that the temperature in thecore does not become sufficiently high to produce
damage to the fuel. With the flow rates from thehigh-pressure injection system as they are believed
to be in the accident, recovery to normal conditions
i n the reactor coolant system would have taken
roughly 90 minutes. Thus, had the PORV block
valve been closed at 25 minutes, we find that theevent would have produced no significant consequences to the plant.

delayed by 1 additional hour; therefore closure occurs at about 3.3 hours into the accident. The subsequent course of the accident in the time period
between 2.3 and 3.3 hours has been evaluated using the MARCH 2 code so that the importance of thetiming of the operator action to close the block
valve can be better understood.
The MARCH code analysis indicates that the accident progression after 2.3 hours is particularly affected by the makeup flow; it is also dependent on
emergency feedwater flow and the availability of thecore flood tanks (CFT). In the actual accident,
emergency feedwater flow to the one operable
steam generator (steam generator A) was stopped(or significantly reduced) just before the time of
PORV block valve closure at 2.3 hours. 5 After this,steam generator heat transfer was decreased,
resulting in higher RCS pressures. Also, the availability of the core flood tanks is uncertain because ofoperator actions prior to 2.3 hours. It appears that
the CFT isolation valves were closed early in theaccident; therefore the possibility exists that thetanks would not have operated if RCS pressure decreased below their setpoints.
The best estimate MARCH calculation of the alternative sequence indicates that, because of theg. Alternative Accident Sequence 6: PORV
Block Valve Closure at 3.3 Hours
I n this alternative accident sequence, the time ofclosure of the PORV block valve is assumed to be563

l ack of emergency feedwater after about 2 hours,
RCS pressures do not decrease after this time (withthe PORV block valve remaining open) but begin aslow increase. Because the pressure level requiredfor core flood tank discharge is not reached, waterfrom these tanks is considered not to be available.
Based on the MARCH results shown in Figure II41, it appears likely that the failure to close the
PORV block valve until 3.3 hours would have resulted in a substantial fraction of the fuel achieving temperatures where fuel-clad eutectic formation, i.e.,
fuel liquefaction, would occur. Thus, it appears that
the TMI-2 accident could have been within an hourof becoming what is called in general terms a core
meltdown accident. It should be noted that the likely consequences of such a meltdown would notnecessarily be catastrophic because of the likely
ability of the reactor building to maintain its integrity
and retain a great majority of the radioactive material released during the accident. Discussion of thephysical events expected to occur in such a meltdown accident may be found in greater detail in
Section II.C.
h. Alternative Accident Sequence 7: One
Reactor Coolant Pump Per Loop Tripped at 73
MinutesIn this alternative sequence, the method of tripping the reactor coolant pumps has been varied

from that in the actual sequence. During the accident, both pumps in the B loop were tripped atabout 73 minutes, with both A-loop pumps tripped
27 minutes later. In tripping both B-loop pumps
first, the water subsequently available to the A-loop
pumps may have been reduced. In this alternative
sequence, one pump per loop is assumed to betripped at 73 minutes, potentially increasing the water subsequently available to the two runningpumps. This may result in prolonged cooling of thecore and delayed core uncovering.
Analysis of this sequence has been performed
3
using the RELAP computer code. The results indicate that the fluid density at the suction of the reactor coolant pumps remains higher than in the actual
accident. As may be seen in Figure 11-42, the fluid
density at the A-loop pump suction is calculated to
be about 5 pounds per cubic foot at the time of tripof these pumps in the actual accident (about 100
minutes). In contrast, this density is not achieved in
the alternative sequence until roughly 135 minutes.
Also obtained in the RELAP calculations is thecore inlet mass flow rate, shown in Figure 11-43.
This figure indicates that in the alternative sequencecase the inlet flow rates decrease at a slower rate
than in the actual accident and remain almost constant after the trip of the first two reactor coolant
pumps.
The calculated pump suction fluid densities andcore inlet flow rates discussed above suggest that
relatively good flow could have been sustained until

FIGURE II-41. Effect of Delay in PORV Block Valve Closure Until 3.3 Hours (Ref. 2)564

the time of block valve closure (at about 138
minutes) if the alternative method of pump trip had
been used. Because reactor coolant pump flow of
this magnitude would have likely prevented high fueltemperatures, fuel damage might not have occurred
had one pump been tripped in each loop rather thanboth pumps in one loop.
We note that, as part of its analysis of the issueof tripping the reactor coolant pumps during small
break loss-of-coolant accidents (LOCAs), Combustion Engineering has been examining the effects oi ,running one pump in each loop. Initial indications
are that this method may provide an acceptable alternative method to requiring the trip of all pumps. 6
Further, such an alternative method may help toresolve problems associated with the identificationof small-break LOCAs visa-vis non-LOCA transients. We believe that the analysis of this alternative accident sequence lends credence to the
Combustion Engineering analysis and that additional
consideration of this method of pump trip in all
types of PWRs has distinct merit.

flow of water provided by the pumps during the actual accident was a positive factor in keeping coretemperatures relatively low. However, this same
flow was forcing liquid water into the pressurizer
and out the PORV, increasing the mass loss out of
the reactor coolant system. This analysis indicatesthe relative significance of these competing effects.
Analysis of this alternative sequence has been
undertaken using the MARCH, 2 RELAP, 3 and TRAC
codes. 4 The conclusions reached by the three calculations differ somewhat, with RELAP and MARCH
suggesting a somewhat less severe accident andTRAC suggesting a worse accident than the actual
TMI-2 accident. The source of these differences
appears to be the modeling of the mass flow out thestuck-open PORV. Depending on the calculated
quality (steam, liquid water, or a mixture) of the exiting fluid, the mass loss from the reactor coolant
system can vary significantly. This uncertainty inmodeling, coupled with the significant uncertainties
in the RCS mass balance during the accident,
results in the differing results obtained by the three
analyses. Thus, TRAC calculations indicate thatcore uncovering could have occurred significantly
earlier, and the RELAP and MARCH calculations indicate some additional delay in the beginning ofcore uncovering.
The significant dependence of the code resultson the break-flow model used suggests that moregeneral conclusions regarding the desirability ofreactor coolant pump trip concurrent with reactor
trip should be approached with great care. Ourconcerns regarding the long term resolution of thisi. Alternative Accident Sequence 8: All
Reactor Coolant Pumps Tripped Concurrently
with Reactor Trip
I n this alternative sequence, the reactor coolant
pumps are assumed to have been tripped at theti me of reactor trip; i.e., about 8 seconds into theaccident. This has two effects. First, the forced

FIGURE 1I-41-Continued

565

FIGURE 11-42. Effect of Pump Trips on Fluid Density in the A-I Loop Pump (Ref. 3)

FIGURE 11-43. Effect of Pump Trips on Core Inlet Mass Flow Rate (Ref. 3)566

issue are further discussed in Section II.C.1.b, in thesubsection entitled "Reactor Coolant Pump Control."k. Alternative Accident Sequence 10: No
Reactor Coolant Pump Restart at 2.9 Hours,
No HPI Actuation at 3.3 Hours

j. Alternative Accident Sequence 9: PORV
Block Valve Remains Closed After 2.3 Hours,
No Reactor Coolant Pump Restart at 2.9
Hours, No High-Pressure Injection Actuation at
3.3 Hours

This alternative sequence is similar to alternative
sequence 9 except that we assume operator openi ng and closing of the PORV block valve, as wasdone in the first 4 to 5 hours of the actual accident.
Analysis using the MARCH code was performed toevaluate the outcome of this sequence. 2
The general progression of this alternative sequence is similar to that of alternative sequence 9.
However, because of the opening of the PORV
block valve, mass loss from the RCS occurs somewhat more rapidly, resulting in a shorter time to thebeginning of core uncovering. By about 5 hours into
this accident progression, about 55% to 60% of thecore has melted. Therefore, with this assumed
course of events, the complete meltdown of thecore is again likely.

In this sequence, it has been assumed that after
the PORV block valve was closed at 2.3 hours, noreopening of the block valve occurred and no attempts were made to start a reactor coolant pumpat 2.9 hours or actuate high pressure injection at
3.3 hours. Rather, it has been assumed that theoperating crew acted as if a somewhat unusual
cooldown following a reactor trip were occurring,rather than an accident. Calculations have been
performed with the MARCH code to assess the2consequences of this alternative sequence.
With closure of the PORV block valve at 2.3
hours (138 minutes), normal makeup flow (at about
90 gallons per minute) begins to refill the reactor
vessel. By about 185 minutes much of the core is
re-covered with water. However, because of theclosed block valve and the combination of hydrogenblockage of the steam generators and relatively
i neffective use of the cooling capability of the steam
generator secondary coolant, little heat transferfrom the RCS is being accomplished. For this reason, the RCS pressure increases to the safety valve
setpoint and mass loss from the RCS begins to occur. Water level in the core subsequently begins todrop again.
Assuming no further corrective actions, a substantial fraction of the core (about 45%) has melted
by about 5 hours into the accident. Thus, given theconditions assumed here (i.e., no operator intervention after PORV block valve closure), the eventual
complete meltdown of the core is likely.
One should note that the pressurization of the
RCS to the safety valve setpoint predicted for thisalternative sequence would be a clear signal to theoperating crew that a normal cooldown was not occurring. Subsequent intervention to increase heatremoval through the steam generators or to reopen
the PORV block valve might then be expected, potentially mitigating the severity of core damage. Theli kelihood of experiencing the eventual complete
melting of the core is thus predicated to some degree on the (unpredictable) extent of crew intervention.

I. Alternative Accident Sequence 11: No
Reactor Coolant Pump Restart at 16 Hours
I n this sequence, it has been assumed that it was
not possible to restart a reactor coolant pump at 16
hours. In the actual accident one reactor coolant
pump was started at that time and forced cooling of
the core reestablished. This analysis assesses thestate of core cooling at 16 hours; i.e., whether actions had begun to repressurize the RCS by increasing high-pressure injection flow to cool thecore effectively or whether core conditions were
continuing to deteriorate. Consideration of this alternative sequence has been undertaken as part of
the MARCH re-creation of the first 16 hours of theaccident? the additional insights being obtained
from other evaluations of this time period by theSpecial Inquiry Group staff.
Neither the MARCH analysis nor the work bymembers of the Special Inquiry Group provides conclusive answers to the question of concern (seeSection II.C.2). The trends in hot-leg temperaturesappear to indicate that some cooldown of the RCS
was occurring as a result of the RCS repressurization beginning at about 14 hours and before the restart of the reactor coolant pump at 16 hours. However, this apparent decrease in the hot-leg temperatures is not necessarily an indication of decreasingfuel temperatures. Information from incore thermocouples and self-powered neutron detectors indicate that a substantial region of the core remained
very hot in this time period, with quenching of some567

regions occurring as the reactor coolant pump was
restarted. However, no clear trend in quenching ofregions is apparent before start of the pump. For
this reason, one cannot conclude definitively thatthe core was (or was not) cooling down in this time
period. As such, whether or not reactor coolant
pump restart at 16 hours was a critical event cannot
be determined conclusively.
m. Alternative Accident Sequence 12: Loss of
Offsite Power at ',,12 to 5 1 Hours
In this alternative sequence, a less directly related, less likely event has been postulated. Between
about 4:30 and 9:30 a.m. of the first day (March28), the emergency onsite ac power system (diesel
generators) was disabled by the operating crew insuch a way that, had offsite power been lost, all ac
power would have been temporarily lost. Such al oss of offsite power was unlikely during this time
period; however, the resulting loss of all ac power
would have seriously affected an already severe
situation.
MARCH analysis has been performed to assess
the time required of a significant fraction of the fuel2This
to reach eutectic-formation temperatures.
analysis indicates that, in the event of a total loss ofac power beginning at about 2 hours, some fuelwould reach such temperatures in about 24
minutes. The majority of the fuel is predicted toreach these temperatures within about 54 minutes
after the loss of ac power.
The onset of such high fuel temperatures could
be prevented by the restoration of an ac powersource. When questioned about the time required
torestore the diesel generators to operation, operators from TMI-2 estimated this to require about 5
minutes. 8 Therefore, we find it likely that a loss of
all ac power during the early portion of the accident
could have been compensated for by prompt operator action before fuel eutectic formation occurred.

such as the pressurizer heaters and the PORV
block valve.
The loss of offsite power postulated here would
have had varying degrees of impact on the systems
potentially available for core cooling. Table 11-60
shows the possible system options and the associated impacts of a loss of offsite power. We believethat the most reasonable option would be the use of
the high-pressure injection system. Natural circulation cooling may have been a viable option; however, loss of RCS pressure control and the presenceof some hydrogen in the RCS may have inhibited
this option. Further, the lack of forced flow in partsof the damaged core region may have resulted in localized higher temperatures following the loss ofoffsite power. The use of the low-pressure injection
system would not have been possible because of
the inability to depressurize the RCS by using only
the PORV and its block valve.
Restoration of offsite power would of course
have increased the number of options available tothe operating crew. Restart of a reactor coolant
pump, as well as the use of low-pressure injection
system, would have been possible.
Analysis using the MARCH code indicates that
had a total loss of core cooling occurred on March
31 (the fourth day), at least 20 hours would have
had to elapse before fuel temperatures would have2
reached those needed for eutectic formation. With
this amount of time available for restoration ofoffsite power or the actuation of the HPI system, it
appears likely that core cooling could have been restored without further core damage. For this reason, we find that the loss of offsite power on March
30 to April 1 would not have been a serious probl em.
o. Alternative Accident Sequence 14:
Recriticality
This alternative accident sequence assesses thepotential for recriticality (the reinitiation of the nuclear chain reaction) after the accident. Because
the high fuel temperatures experienced early in theaccident distorted the core geometry and damaged
control rods, we have evaluated possible core reactivity changes.
A number of analyses of criticality potential were9
performed after the accident by the NRC staff and
1c
These analyses conby Babcock & Wilcox.
sidered degrees of fuel damage ranging from essentially no geometric distortion to a substantially coll apsed core. In general, no credit was given inn. Alternative Accident Sequence 13: Loss of
Offsite Power During March 30 to April 1
In this alternative sequence, it has been assumed
that a loss of offsite power occurred during the time
period of March 30 through April 1 (the third throughfifth days). In this period, core cooling was being
maintained by the operation of one reactor coolant
pump. A loss of offsite power during this time would
have shut down this pump and other equipment

568

TABLE 11-60. Possible systems options to mitigate a postulated
l oss of offsite power on March 30-April 1
SystemEffect of Loss of Offsite Power( 2) Natural circulation

Loss of RCS pressure control
may prevent natural circulation(1) High-pressure injection systemNone( 3) Low-pressure injection systemwith depressurization caused
by PORV block valve opening
these analyses for control rod or burnable neutron
poison material; dissolved boron was the only
presumed poison in the core. The results of thesecalculations indicate that subcriticality could bemaintained with boron concentrations of 1500 parts
per million (ppm) for an essentially undisturbed coreand range up to about 3500 ppm for a fully damaged core in its most susceptible configuration.
For the core configuration suggested in Section
II. C.2 as now thought to exist in the TMI-2 vessel,
the criticality calculations indicate that boron concentrations in the range of 150010to 2200 ppm is required to maintain subcriticality. Since no credit isgiven for contra! : od and burnable poison material, it
is likely that these estimates are conservative; i.e., amore realistic requirement for boron concentration
would be somewhat less.
Reactor coolant samples taken on April 7 indicated that the coolant was being maintained at approxi mately 2200 ppm, 10 suggesting that the potential
for recriticality was not a serious concern. Subsequent to the analysis, the boron concentration wasi ncreased to over 3000 ppm to provide an evengreater margin of subcriticality.
The possibility of an inadvertent dilution of the
RCS could have caused the possible return of thecore to criticality and caused additional problems in
the recovery process. However, since such a dilution would have to go undetected for some time toresult in recriticality, it seems reasonable that
operator detection and correction would be likely
prior to the return to criticality.

No power to PORV block valve

from what actually exists at TMI-2; this then indicates the relative vulnerability of different containment designs to this type of accident.
The principal threat to the TMI-2 containment occurred at about 1:50 p.m. on the first day (March28), when a hydrogen deflagration resulted in a 28
psig pressure spike." Subsequent analysis of thisevent indicates that uncertainty exists with respect
to the amount of hydrogen burned in the deflagration and the volume in the reactor building within
which the burn occurred. Depending on the type ofdata used (e.g., shape of the pressure pulse, oxygen
depletion in the reactor building), estimates of theamount of hydrogenburned range from about 550
2,12
to 1000 pounds(see Section II.C.2 for additional
discussion). Seemingly conflicting data also exist
regarding the region within which the deflagration
occurred. Some data suggest that the burn occurred in a relatively small section in the building (al ocal burn), while other data suggest that it occurred
throughout the building (a global burn). The assessment of hydrogen burning presented here reflects
these uncertainties, so that definitive conclusions on
the capability of certain building designs are notpossible.
Table 11-61 shows typical design characteristics
for the variety of containment buildings used in largecommercial reactors in this country. This indicatesthat the containment buildings grouped under the
category of "large free volume" have volumes anddesign pressures comparable to that of TMI-2.
Such designs would not be seriously threatened bya hydrogen deflagration such as that experienced
during the TMI-2 accident-just as the TMI-2 containment was not threatened.
The data in Table 11-61 suggest that the variouspressure suppression types of containment building
are more susceptible to damage from a hydrogendeflagration of the magnitude experienced at TMI-2.
For this reason, each type of pressure suppression
containment will be discussed below.

p. Alternative Accident Sequence 15: Effectof Containment Design
Consideration has been given in this section to
the effect of various containment designs on thecourse of the accident. Specifically, it has been
postulated that the containment design was different

569

TABLE 11-61. Typical containment design parameters
Containment Type

Large Dry Containment
Prestressed ConcreteFree Standing Steel
Subatmospheric,Reinforced Concrete
Spherical Steel Shell
Pressure Suppression
I ce Condenser
BWR Mark I
BWR Mark II
BWR Mark III

Example Plant

Free Volume (ft 3 )TMI-2 1 3
14
St. Lucie

2 x 102.5 x 1066

Surry
Perkins 1 7

1.8 x 106 15
3.3 x 106

Sequoyah
Peach Bottom 20
21
Zimmer
21
Grand Gulf

1.2 x 106 1 8
2.8 x 10 5
3.9 x 10 5
1.7 x 106

Design Pressure (psig)
60
44

45 1 647

12 1 956
55
15stressed concrete rather than the steel of the Mark I.
Because of the lack of an inerted atmosphere, theMark II would be somewhat more vulnerable to hydrogen burning. Because no specific analysis isavailable on this containment design, we cannot
conclude whether or not a hydrogen deflagration of
the magnitude of that in TMI-2 would have caused
containment failure.
The BWR Mark III containment is the largest of
the BWR containments, being roughly comparable infree volume, design pressure, and construction to
the analyzed ice condenser design. This comparability in design characteristics suggests that theMark III containment would respond in a manner
similar to that predicted for the ice condenser; that
is, a global deflagration of 550 pounds of hydrogen,which may have occurred in TMI-2, could cause thefailure of a Mark III containment. As was discussed
for the case of the ice condenser design, resolutionof this issue awaits the examination of the TMI-2
reactor building.
Since the time of the TMI-2 accident, the NRC
Lessons Learned Task Force has included as oneof its short term recommendations the need for thei nerting of all BWR Mark I and Mark II contain23
Consideration of a similar requirement forments.
the ice condenser and Mark III containments was included in the final report of that task force as part of24
This recommendation
its Recommendation 10.
calls for the use of the rulemaking process to consider the inclusion in the licensing process of "certain design features for mitigating accidents that are25
not provided by the set of design basis events."
Our analysis and conclusions here support theserecommendations of the Lessons Learned Task
Force.

Analysis of the capability of one ice condenser
containment design to withstand pressure loadings
due to hydrogen burning has been performed atBattelle Columbus Laboratories (BCL), using the
MARCH code. 2 This analysis indicates that, if 550
to 1000 pounds of hydrogen were burned globally inan ice condenser containment, failure of the building
would be likely. If the TMI-2 burn was local, a simil ar event in an ice condenser would be much lessli kely to fail the building. Further, if a comparable
concentration of hydrogen were burned in an ice
condenser, building failure would be much less likel y. Resolution of the question of local versus global
burning may be obtained when the TMI-2 reactor
building is reentered (expected in the spring of1980) and examinations conducted.
The BWR Mark I containment is of relatively highdesign pressure but of very small free volume, suggesting that this design could also be vulnerable tohydrogen burning. However, the majority of plants
with Mark I containments have been required to inert the containment atmosphere by replacing the air
with nitrogen, so that the potential for hydrogenburning is not of concern. Analysis of the possible
vulnerability of a noninerted Mark I containment tohydrogen burning was performed by Battelle
Columbus Laboratories for the reactor safety
study. 22 This analysis indicates that, because of
the combination of high design pressure andstrength of the steel Mark I containment and the limited oxygen within the building available for combustion, it is possible that this containment could withstand the burning of large amounts of hydrogen.
The BWR Mark II containment design is characterized by a somewhat larger free volume than theMark I and a design pressure comparable to theMark I design. The Mark II is constructed of pre-570

REFERENCES AND NOTES
1
NRC, "Staff Report on the Generic Assessment ofFeedwater Transients in Pressurized Water Reactors
Designed by the Babcock and Wilcox Company,"
NUREG-0560, May 1979, at 3-14.

12
President's Commission on the Accident at Three
Mile Island, "Technical Staff Analysis Report on Chemistry," October 1979, at 18.
13
Met Ed, "Final Safety Analysis Report (FSAR), Three
Mile Island Nuclear Station-Unit 2," Vol. 1, Sec. 1.3-11.
14
Florida Power and Light Company, "Final Safety
Analysis Report (FSAR), St. Lucie Plant," at 1.3-7.
15
Virginia Electric Power Company, "Final Safety
Analysis Report (FSAR), Surry Power Station, Units 1 and
2," at 14.5.2.1-3.
18
Id. at 5.4-1.
17Duke Power Company, "Preliminary Safety Analysis
Report (PSAR), Perkins Nuclear Station, Units 1, 2, and 3,"
Table 1.3-1.
1
BTennessee Valley Authority, "Final Safety Analysis
Report (FSAR), Sequoyah Nuclear Plant," at 6.2-111.
19/d. at 6.2-3.
20
Philadelphia Electric Company, "Final Safety
Analysis Report (FSAR), Peach Bottom Atomic Power
Station," Table 1.7.4.
21
Mississippi Power & Light Company, "Final Safety
Analysis Report (FSAR), Grand Gulf Nuclear Station,"
Table 1.3-4.
22
NRC, "Reactor Safety Study: An Assessment of
Accident Risks in U.S. Commercial Nuclear Power Plants,"
WASH-1400 (NUREG-75/014), Appendix VIII, October
1975,
at VIII-155.
23
NRC, "TMI-2 Lessons Learned Task Force Status
Report and Short-Term Recommendations," NUREG0578, July 1979, at A-20.
24
NRC, "TMI-2 Lessons Learned Task Force Final
Report," NUREG-0585, October 1979, at 3-6.
25k1 at 3-1.

2
Battelle Columbus Laboratories, NRC, "Analysis of
the Three Mile Island Accident and Alternative
Sequences," NUREG/CR-1219.
3

EG&G Idaho, Inc., "TMI Sensitivity Calculations,"
December 1979.

4
Los Alamos Scientific Laboratory, "Preliminary Calculations Related to the Accident at Three Mile Island," LAUR-79-2425, December 1979.

NRC, "Investigation of the March 28, 1979 Three Mile
Island Accident by the Office of Inspection and Enforcement," NUREG-0600, at IA-40, August 1979.
5

NRC, "Generic Assessment of Delayed Reactor
Coolant Pump Trip During Small Break Loss-of Coolant
Accidents in Pressurized Water Reactors," NUREG-0623,
November 1979, at 28.
67
NRC, "Investigation of the March 28, 1979 Three Mile
Island Accident by the Office of Inspection and Enforcement," NUREG-0600, August 1979, at 1-4-74.
8

Faust, Frederick, Scheimann, and Zewe dep. at

248.

Memorandum from C. R. Marotta, NRC/NMSS, to K.
Kniel, NRC/NRR, Subject: Recriticality Potential for TMI-2
Core, dated May 14,1979.
9'°NRC, "Evaluation of Long Term Post Accident Core
Cooling of Three Mile Island, Unit 2," NUREG-0557, Sec.
6.8., May 1979.

NRC, "Investigation of the March 28, 1979 Three Mile
Island Accident by the Office of Inspection and Enforcement," NUREG-0600, August 1979, at 1-4-47.
11571

E HUMAN FACTORS
2. HUMAN FACTORS AND THE TMI-2
ACCIDENT

1. INTRODUCTION
From the earliest accounts of the events at Three
Mile Island Station (TMI) on March 28, 1979, it wasapparent that actions or inactions by the control
room operators were an integral part of the accident
sequence. It was equally apparent during early investigative efforts by the Special Inquiry Group (SIG)
and others1 ' 2 that many underlying factors were
present that actually or potentially precluded theoperators from preventing or ameliorating the accident. Accordingly, the objective of this analysis
has been to establish the nature and degree of
operator "error" and gain an indepth understandingof all pertinent factors.
Because of the lack of personnel within the NRC,
with the proper background and experience to conduct a human factors investigation, the SIG acquired
outside assistance from the Essex Corporation.
The report here draws extensively upon theEssex Corporation work but includes inputs derived
from other SIG activities. The report is organized
i nto the following sections:" Human factors" is an interdisciplinary approachto optimizing human performance in man-machine
systems. It includes application of principles relating
to psychology, physiology, instrumentation, control
and workspace design, personnel selection, andpersonnel training. When discussing the causes of
the TMI-2 accident, several factors within theseprinciples can be singled out as directly contributing
to the accident. Others can be identified as possible contributors to the general confusion of theoperators, confusion that impaired their ability toanalyze the problem and take corrective actions.
Although the critical condition of the plant continued for some 16 hours, 3 i nvestigation into the humanfactors aspects focused on the first 150 minutes of
the accident. This limitation was chosen because oftime and resource constraints on the SIG, as well as
the fact that the major operator decisions affecting
the accident occurred during that period.

1. I ntroduction
2. Human Factors and the TMI-2 Accident
3. Control Room Design
4. Emergency Procedures
5. Operator Selection and Training
6. Human Factors Precursors
7. Recommendations

Two situations clearly had a significant impact on
the accident. First, the operators failed to recognizethat the pilot-operated relief valve (PORV) on thereactor pressurizer had not automatically closed, as
it is designed to do, in the course of recovery from areactor trip. Consequently, the operators did not
close the PORV block valve for more than 2 hours

Significant Operator "Errors"573

terminated the accident well before any core damage occurred.
The failure of the operators to recognize andrespond to the second symptom, elevated reactor
coolant drain tank temperature and pressure, also
was compounded by human engineering and design
factors: inadequate and poorly placed instrumentation and the preaccident history of a leaking PORV
or code safety valve.
Water discharged from the pressurizer throughthe PORV eventually collects in the reactor coolant
drain tank (RCDT). Thus, if the PORV fails open, thetemperature, pressure, and water level in the RCDT
are expected to increase. However, at TMI-2, oneof the code safety valves (or possibly the PORV)
that also drains into the RCDT had been leaking
since the fall of 1978 and had been scheduled for
repair during the next reactor shutdown. 9 For thisreason, elevated temperature, pressure, and level in
the RCDT were not unusual observations. About
once every shift, operators had been forced to9pump the accumulated water from the RCDT.
Moreover, the instrumentation for RCDT conditions and the corresponding alarms are behind thecontrol panel and cannot be read unless the operator leaves his normal operating area in front of thecontrol panel and walks about 50 feet (see Figure11-47). To further compound the problem, the RCDT
instrumentation on the back panel only gives instantaneous information. It does not record the parameters that indicate the previous conditions and thereby indicate trends in the RCDT temperature, level,and pressure. Consequently, when the operator
went to check the RCDT status, he had difficulty telling whether the RCDT conditions were a result ofan expected single opening and closing of the
PORV at the beginning of the accident or whether
they were a result of an unexpected longer, continuous leak from a stuck-open PORV.
In fact, in the period from 10 to 15 minutes into
the accident, one operator did check the RCDT and
noted that it was full. 10 After the RCDT rupture disk
had failed (at about 15 minutes), the shift supervisor
from Unit 1 checked the panel and noted that thetank was empty." This occurrence was immediately
followed by an increase in reactor building pressure
and the sounding of an associated alarm. The shift
supervisor consulted with the control room operators and correctly concluded that the RCDT rupture
disk had failed. However, they incorrectly concluded that the RCDT had been nearly full of water fromthe previously leaking PORV or code safety valve
and that the subsequent momentary opening of the
PORV (at the time of reactor trip) had added enoughafter the accident began, and the resulting water
loss caused significant damage to the reactor. 4
The second significant and more fundamental action was operator throttling (curtailment) of the highpressure injection (HPI) of water into the reactor
coolant system. Had the HPI been allowed tooperate automatically as intended, the reactor core
would have remained covered, and serious coredamage would have been prevented. 4
Failure to Isolate the PORVAs part of their training, the operators memorize
the immediate actions and symptoms in the plant's
emergency procedures and use them as a basis fordiagnosing and responding to emergencies. Failure
to close the PORV block valve can be attributed to
failure to recognize and respond to the symptoms
described in the plant's emergency procedure forpressurizer system failure. 5 According to this procedure, the operator must recognize the following
conditions:
1. that the PORV valve has failed to close;
2. the elevated reactor coolant drain tank pressure
and temperature; and3. the elevated PORV pipe discharge temperature
above the 200°F alarm setpoint.

For each condition, there is a logical human factors
explanation of why the operators failed to takecorrective action.
The initial failure to notice the open PORV can betraced to a misleading instrument that indicates thevalve's position-a single red PORV status indicatorli ght. This light is on when an electrical signal issent to open the PORV, and it is off when the signal
is terminated. The light does not, as may be inferred from its label as shown in Figure 11-44, i ndicate the actual position of the PORV.s Consequently, about 13 seconds into the accident, when the
PORV indicator light went out, the operator believed
the valve had actually closed. In fact, it had stuck
open. Originally, the TMI-2 control room designcontained no indicator light. Following a March 29,
1978 trip where the PORV had failed open, 8 the lightand labeling were installed.
A valve indicator system that directly sensed theopen and closed positions of the valve, i.e., microswitch on relief valve stem, probably would nothave incorrectly indicated valve closure. With suchan indication system, the operators would have noticed the open valve indication (or lack of closed indication), closed the block valve much earlier, and574

FIGURE 11-44. PORV Indicator Light and Controls

water to overfill the tank, causing its emergency
12 13
rupture disk to break, ' and result in the tank indicating empty, i.e., the reading was off scale low(below 60 inches).
If the RCDT monitoring instrumentation had beenrecorded, the operators may have noticed the timetrend of RCDT parameters and correctly realizedthat the PORV was stuck open when they investigated RCDT conditions. On the other hand, had thei nstrumentation been located within view of theoperators, it is more likely they would have noticed
the increasing water level.
The third symptom was the elevated temperatureof the discharge pipe from the PORV. Contrary toprocedure, the TMI-2 plant had been operating witha leaking valve that had been causing high PORV
discharge temperature (180°F) for several months.
Consequently, the TMI-2 operators were misled
i nto believing that the rise in temperature in the
discharge line following the reactor trip was caused
by a combination of high temperatures before theaccident and a momentary opening of the PORV.
Furthermore, the situation leading the operators tothis conclusion was compounded by their incorrect
expectation that the highest possible temperature in
the discharge line as a result of an open PORV waswell over 300° F. 14 I n fact, because of the throttling
action of the PORV relief valve, the maximum
achievable temperature was closer to 300°F. The
operators were unaware of this fact; it is not explained in their emergency operating procedures,and it apparently was not learned in their training.
After the accident began, the operators monitored the discharge line temperature and twice
15
misread a 285°F temperature as being only 235°F.
After almost 2'/2 hours, the oncoming shift supervisor noticed that the PORV discharge temperature
was 229°F, about 25°F hotter than the code safety
discharge temperature. He correctly interpreted the17reading and the PORV block valve was closed,
thereby isolating the malfunctioning PORV.

1640 psig) and reduced the water flow to the reactor. For most of the first 1'/2 hours, the net flowrate was reduced from about 1000 gallons per
minute to only about 25 gallons per minute. 17
Technical analysis indicates that if such severe
throttling had not occurred, core damage probably
would have been avoided. 18
The factors that led the operators to take this action include improper training, lack of instrumentation, inadequate procedures, poor operating practices, and fundamental misunderstanding of reactor
thermal hydraulics by the operators.
The operators' basic mistake was failing torecognize that the reactor was experiencing a small
loss-of-coolant accident (LOCA) that could lead tocore uncovery and overheating. This mistake wasfurther compounded by their inability to realize thatthe existing low-pressure condition in the reactor
would lead to boiling reactor coolant that had thepotential for uncovering the core. Consequently,
they turned off the automatic safety device (HR)even though the low-pressure condition that had activated it was persisting.
The TMI-2 plant did not have instrumentation for
directly measuring water inventory or water level.
Thus, for operators to realize a LOCA was occurring, they had to recognize and properly diagnose
LOCA symptoms that include decreasing pressurizer level, decreasing reactor coolant system pressure, increasing reactor building pressure, increasi ng reactor building temperature, and water accumul ating in the reactor building sump.
The TMI-2 operators were faced with all but thefirst of these symptoms. The question is, why thendid they fail to diagnose the LOCA property? Oneanswer lies in the fact that TMI-2 operator training
and written emergency procedures relied on a
misconception that water level in the pressurizer
would serve as a true indication of total volume ofwater in the reactor coolant system.
Subsequent analysis reveals that for the TMI-2
type LOCA, the belief that high pressurizer level signifies that the reactor vessel is full of water is notcorrect. Although this fact was known in some segments of the industry, the information had not been
incorporated in the TMI-2 operator training or emergency procedures. Thus, the operators mistakenly
throttled HR in an attempt to maintain pressurizer
level within the normal range. 19 For example, theemergency procedure for a LOCA contains two alternative sections, each of which warns the operators to look for a combination of low reactor pressure and low pressurizer level . 20 At TMI-2, reactor
pressure did fall, but pressurizer level increased.
The operators did not observe the symptoms appli-

Throttling of High-Pressure Injection

Manual throttling or curtailment of the flow of emergency core cooling water into the reactor coolant
system was a second significant operator actionthat caused the core damage. This action is significant because it involved not only an inability to diagnose the specific leak point but an inability to understand that a leak was occurring at all.
At approximately 2 minutes into the accident,
operators took manual control of the automatic highpressure injection (HR) system (which had started
automatically when RCS pressure dropped below
576

cable to this written procedure and naturally did not
follow the prescribed corrective actions.
Lacking unambiguous written emergency procedures, operators instead followed other dictatesof their training and procedures, which were in our
opinion an ill-considered fix to a basic engineering
problem of pressurizer level sensitivity.
The TMI-2 pressurizer is not large enough tomaintain proper level and reactor coolant pressure
following turbine trips and other transients that frequently occur. Consequently, to avoid excessive
drops in the pressurizer level and pressure, theoperators immediately start an additional high pressure injection pump and increase high pressure injection flow until proper pressurizer level and pressure are restored. Thus during the accident when
the pressurizer level came back up, the operators
were conditioned to reduce the high pressure injection flow and apparently ignored the fact that highpressure injection flow had been initiated automatically because of low reactor coolant system pressure. The operators waited until the pressurizer
was nearly full before they throttled the high pressure injection flow to prevent filling the pressurizer
solid with water, which their training and experience
had taught them to avoid. These events all happened in the first few minutes when there was little
time to think and the operators were simply followi ng their normal operating procedures.
As the accident progressed, the reactor coolant
system pressure continued to drop. The operators
knew that the RCS pressure was abnormally low
and that other LOCA symptoms were present, butthey did not make the correct diagnosis or takecorrective action. At 38 minutes after the reactor
trip, the containment sump filled with water and theoperators stopped the sump pumps, attributing thisLOCA symptom also to the initial opening of the
PORV.
I n addition to these actions, the operators del ayed following written procedures requiring them todeclare a site emergency when high containmentpressure and temperature symptoms were present.
The operators also failed to either understand orreact to the basic design concept of a pressurizedwater reactor-that it is imperative to keep thepressure high to prevent the hot reactor coolant
water from boiling and potentially uncovering the
core.
These actions could be attributed to "operator
error," as was done in NUREG-0600. 9 However,our view is that the overall system of operator traini ng, procedures, control room design, and maintenance is the major problem-a view that has become more evident as this study has progressed.

Other Factors Contributing to the Accident

Other human factors had strong potential forcontributing to the general confusion of the operators and impaired their ability to respond correctly
to the problems.
The Essex Corporation's study describes
several such factors. The confusion of the first hour
was compounded by the discovery that the emergency feedwater block valves were closed.
Although technical analysis suggests that closure ofthese valves did not directly influence the severity of
the accident, 22 discovery of their closure after 8
minutes and the resultant diversion of operator attention to feedwater problems may have diverted
the operators from analysis of and reaction to more
23
fundamental factors contributing to the accident.
The failure to discover closure of emergency
feedwater valves earlier can be directly attributed toseveral human engineering control room factors.
1. Adequate quality control of valve lineup andproper procedures could have led the operators
to discover the closed valves sooner.
2. The control room did not contain any direct indication of flow status. Thus, it was necessary toeither notice the valve position lights or checksteam generator level to determine whether there
was adequate feedwater flow.
3. The indicator lights that tell the operator whether
or not the emergency feedwater block valves areclosed may have been hidden by one of the outof-service tags that cluttered the control panel(Figure 11-45).
4. The feedwater control panel is not laid out in a
logical fashion. For example, control locations do
not mimic actual valve and pump positions in theplant. In fact, the control and display placementon the emergency feedwater panel is inconsistent(Figure 11-46). The absence of any logical panel
layout forced operators to rely on memory or
random search to locate a particular control.
This panel layout problem also existed elsewherein the control room and increased operator workl oad and the probability for mistakes, particularly
during emergency situations.
Another condition that contributed to the confusion in the control room was the alarm system that
hampered the operators during the early stages of
the accident. The control room contains more than
750 alarms. These alarms are not prioritized, andmany are difficult to read from normal operator positions. During thefirst few minutes, more than 100
24
alarms went off.
577

FIGURE 11-45. EFW Block Valve Controls and Indicator Lights Showing Caution Tags

578

FIGURE 11-46. EFW Control Station Showing Block Valve (11A and B) and Control
Valve (12A and B) Layout

57 9mation is at their disposal, including their knowledgeof what has happened in the plant in the recent pastand during their involvement with the system. The
function of training is to provide the ability to integrate displayed information to arrive at an understanding of present events and required actions independently of what has happened in the recent
past. The training provided to the TMI operators
was obviously deficient in this regard.
The importance of operator set in the TMI-2 incident is also evident from the fact that several conclusions, including the determination that the PORV
was open, were reached by personnel who were
new to the problem, did not have the recent experience with the plant, and were able to assess available information on its own merits without reference
to prior influences.
The Essex Corporation found that the influenceof psychological stress as a determinant in the TMI
accident was difficult to evaluate on the basis ofavailable data. 29 The operators were under increasing stress over the course of the accident;
however, inappropriate actions or inactions can be
attributed only indirectly to stress.

This problem with the alarm systems prompted
one operator, a year before the accident, to write:

The alarm system in the control room is so poorly
designed that it contributed little in the analysis of acasualty. The other operators and myself haveseveral suggestions on how to improve our alarmwe
candiscussthemsystem-perhaps
sometime-preferably before
the system as it is25
causes severe problems.

When the accident occurred, the control room alarmsystem had not been significantly changed.
The Essex Corporation found other examples ofpoor control room design that contributed to confusion.
These situations include poor lighting,numerous examples of illogical panel layout, confusi ng use of indicator color coding, and situations
where operator ability to read26meters and observei ndicator lights were impaired.
Furthermore, the Essex report found that several
operator errors were caused or influenced by expectancy or set. 27 Set is a psychological constructdefined as a temporary, but often recurrent, condition of individuals that orients them toward certain
i nformation and events rather than others and increases the likelihood of certain responses overothers. The influence of set in the TMI accident isevident in the tendency to evaluate indications ofpresent plant status in terms of events or conditions
occurring in the recent past. For example, the highexhaust pipe temperature of the PORV was notconsidered excessive because the safety valve had
been leaking for some time.
Operators also seemed conditioned to expect
problems in the secondary system and not in the
primary system because of their experience withboth systems. In addition, testimony of plant personnel indicates that high-pressure injection initiation was not unexpected because it had occurred
before. Rapid cooldown events and normal reactor
trips had conditioned the operators to take immediate actions (manually start an HPI pump and isolate
letdown) and to key on pressurizer level as the main
reactor coolant system parameter to be controlled.
For the previous rapid cooldown events, the HPI
system was stopped without
harmful effects after
28
Thus, it was naturalpressurizer level recovered.
during the accident that the operators would havethrottled HPI to avoid increasing pressurizer level tothe point that they would have solid conditions indicated. Such expectancies, combined with the slow
response of the system, obscured the real problems.
Development of these erroneous expectancies,
however, does not reflect on the operators themselves but on their training. In the absence of adequate training, operators must use whatever infor-

Summary and Conclusions

A description of the problems facing the operators was expressed a year before the accident. A
TMI operator, addressing problems experienced
during an April 23, 1978, reactor trip, stated in al etter to his supervisor:

I feel that the mechanical failures, poor systemdesigns and the improperly prepared control systems were very much more the major cause of thisi ncident than was operator action. Although traini ng is always essential and welcome-nothing westudy or learn to practice could have prepared us
for this unfortunate chain of events.... You mightwell remember this is only the tip of the iceberg andthe best operator in the world can't compensate formultiple casualties which areby
25 complicatedmechanical and control failures.

Our analysis has documented that many of theoperator actions can be attributed not only to thepoor quality of instrument displays and inadequate
control room design but also to improper operator
training and inadequate emergency procedures. We
believe that the system that permitted these deficiencies must share a large part of the responsibility
for the operator actions at TMI-2.
The Essex Corporation Study reached a similar
conclusion.

The overall conclusions are: (1) operators did commit a number of errors which certainly had a contributory if not causal influence in the events of the580

accident; and (2) these errors resulted from grossly
inadequate control room design, procedures, andtraining rather than from3oinherent deficiencies on
the part of the operators.

Another industry standard that exhibited a concern for human engineering was IEEE standard 603"Criteria for Safe Systems for Nuclear Power Generating Stations" 5 This standard applied to othersafety systems besides the ECCS and suggested
that the display instrumentation provided for the
manually initiated protective actions required for asafety system should be considered part of thesafety system; furthermore, that design should
minimize the possibility of anomalous indications
that could be confusing to the operator. However,unlike IEEE-279, this standard was not required forthe control room design and was not cited in the
TMI-2 PSAR.
In addition to these standards, Section 7.4 of theTMI-2 PSAR outlines the general philosophy to be
used in designing the TMI-2 control room. Similar tothe standards just described, this general design
philosophy contains only a vague and general reference to the man-machine interface problem.
Section 7.4 states that all controls and instruments be located in one room. This room was to be
designed so that one operator would suffice during
normal operations. During "other than normal
steady state operating conditions," other operators
were to be available to assist the control operator.
This section also contains general prescriptions forthe shape of the control room; the relative placement of various systems; a brief description of an
audible alarm system; requirements to allow occupancy during abnormal conditions such as fire protection, radiation shielding, and ventilation; provisions related to evacuation of the control room; andprovisions for auxiliary control stations.
The final portion of Section 7.4 provides a typicalexample of the general nature of the specifications
provided in the PSAR and the limited extent towhich they addressed the human engineering problems. Section 7.4.7 "Safety Features" states inpart:

3. CONTROL ROOM DESIGN
a. Requirements and Criteria
The AEC (NRC) review and approval of the application for a construction permit, submitted by Met
Ed for TMI-2 in April 1968, was completed, and theTMI-2 construction permit (CP) was issued on November 4, 1969. At the time of the CP review, thecriteria most relevant to control room design were
found in the proposed Appendix A to 10 C.F.R. Part50, "General Design Criteria for Nuclear Power
Plants Construction Permits." 32 Typical examples ofthese criteria indicate that Federal regulations forcontrol rooms were vague, lacked specificity, andcontained little, if any, indication of concern for human engineering issues associated with the interface between operators and the control room. For
example, criterion 12 32 requires that "instrumentation and controls shall be provided as required tomonitor and maintain variables within prescribed
operating ranges." Another example is criterion 11,
which states in part:
The facility shall be provided with a control roomfrom which actions to maintain safe
32 operational
status of the plant can be controlled.

Although these criteria were only proposed by
the AEC at the time, they were published with thenotation that they "would not add any new requirements, but are intended to describe more clearlypresent Commission requirements.... " 32 Thus theywere, in effect, AEC requirements. In addition tothese Federal regulations, the industry also
developed standards that could have affected thehuman engineering of the TMI-2 control
room. One
Was
example cited in the TMI-2 PSAR33
IEEE standard 279, 34 which required that:

The primary objectives in the control room layout
are to provide the necessary controls to start,
operate, and shut down the nuclear unit with sufficient information display and alarm monitoring to insure safe and reliable operation under normal andaccident conditions. Special emphasis will be given
to maintaining control integrity during accident conditions. The layout of the engineered safety
features section of the control board will be
designed to minimize the time required for theoperator to evaluate the system performance under
accident conditions. Any deviations from predetermined conditions will be alarmed so that the operator may take corrective action using the controls
3
provided on the control panel. g

If the protective action of some part of the system
has been bypassed or deliberately rendered inoperative for any purpose this fact shallbe continu33
ously indicated in the control room.

The thrust of this standard was to provide an effective means of warning operators of an inoperative
system. However, this standard applied only to thereactor protection system (a system for rapidly
shutting down the reactor in the event safety limits
are exceeded) and not to other safety systems suchas the emergency core cooling system (ECCS).

From 1970 to 1978, the number of requirements
and guidance related to control room design in581

cess to the operational control panels, including instrumentation displays and alarms, in order to beable to initiate prompt corrective action whennecessary, on receipt of any indication (instrument
42
movement or alarm) of a changing condition.

creased significantly within both the AEC-NRC andthe nuclear industry. As shown in the Essex report, 21 a large number of these criteria were related
to human engineering. Although these requirements
and guidelines provided more substance than previously existed, the majority of these criteria still
suffer from the same deficiency identified previously.
That is, they were too vague and too general to require the direct application of human engineering
technology that had been extensively developed
and used as requirements in other fields. 37
During this time period, the NRC issued various
documents containing recommended practices or
guidance in safety matters. These included reactor
technology memoranda followed by safety guides
and then regulatory guides. In 1975, the NRC consolidated its criteria in a standard review plan 38
aimed at providing guidance to its technical staff
who review and approve applications for nuclear
powerplant licenses.
The more substantive of these criteria pertaining
to human factors considerations include the followi ng:

and that:

The operator at the controls should not normallyleave the area where continuous attention (including visual surveillance of safety-related annunciators and instrumentation) can be given to reactor
operating conditions and where he has access to
the reactor controls. For example, the operator
should not routinely enter areas behind control
panels42where plant performance cannot be monitored.

Analysis of the control room at TMI-2 and operator actions performed during the early stages of theaccident clearly suggest, for example, that the TMI2 unit was not designed so that operators would
have an unobstructed view of instrumentation
displays and alarms. Furthermore, operators had toenter the area behind reactor controls to observe
the reactor drain tank instrumentation critical to anassessment of the accident.
The Essex Corporation conducted a detailed review of these regulations, regulatory guides, and thestandard review plan, and found no examples of criteria written with a clear intent to include human engineering considerations in the licensing and regulatory system.
The expansion in guidance related to human factors from pre-1970 to pre-1978 that was experienced by the AEC-NRC also occurred in the codesand standards of the nuclear industry. The Essex
Corporation found that a significant number of industry standards relating to human factors weredeveloped during this time. As in the other cases
discussed, however, few of these standards were
thought to be important by those at whom they
were aimed. The standards were too vague to require effectively the application of human engineeri ng in the design process. They were narrowly
drawn guidelines addressing a specific component
or group of components and did not adequately address the man-machine system interface problems.
The most significant industry guidelines in exi stence during the operating license review of TMI-2
are found in IEEE standard 566, "Recommended
Practice for the Design of Displays and Control Facilities for Central Control Rooms of Nuclear Power
Generating Stations." 43 This standard contains guidance directly related to human engineering, but theEssex Corporation's review of it found serious deficiencies. The Essex Corporation noted that thestandard was incomplete and that it did not include• Requirement of IEEE-279 that bypasses be indi-cated was expanded in Regulatory Guide 1.47
"Bypassed and Inoperable Status Indication for
Nuclear Power Plant Safety Systems," 39 to include safety systems.
• Regulatory Guide 1.97, "Instrumentation for Light
Water Cooled Nuclear Power Plants to Assess
Plant Conditions During and Following an Accident," 40 i ncluded a provision for analysis ofwhat instruments are required. This provision
could have conceivably given rise to a requirement for a task analysis. That is, a description ofwhat functions need to be done, initially on atime-line basis, and what aids (including instrumentation)areneededto optimize
theman-machine relationship. However, the regulatory guide was not interpreted by the NRC orthe41
industry to cover the use of a task analysis.
• Regulatory Guide 1.114, "Guidance on Being
Operator at the Controls of a Nuclear Power
Plant, "42 also provides insight into NRC regulatory attempts to address the man-machine interface. The basic thrust of this regulatory guide isto place the responsibility for safe operation of
the plant on the control room operator. It assumes that the control room is properly configured and the operator will be provided all the aids
needed to perform his job.
For example, the guide states:

The operator at the controls of a nuclear power
plant should have an unobstructed view of and ac582

guidance on the use of some very important humanfactors tool s such as:• analysis of the tasks operators must perform;• the use of existing human engineering

standards; 37• control and display layout conventions; and• alarm placement rules.

The Essex Corporation concluded that the generalizations, ambiguities, and oversights of IEEE 566
result in little more than an admonishment that thedesigner consider the operator, with little
guidance
45
on just how to prevent operator error.
Nearly all of the industry standards were publi shed after the application for the operating license
for TMI-2 had been submitted to the NRC in 1974.
Thus, none of the more recent standards were applied to the TMI-2 design except as deemed necessary by the NRC or the utility to address significant
safety issues.
Conformance of TMI-2 to Human Factors Criteria
and Standards

As noted previously, the TMI-2 design was foundby the AEC to meet the applicable criteria prior toi ssuance of the construction permit in 1968. Furthermore, the design development by the utility and its
contractors and the review of this design by the
AEC were conducted with essentially no human engineering considerations. Thus, NRC found that
TMI-2 satisfied the existing criteria even though areview of the current design today by human engineering specialists against these limited criteria
would find serious deficiencies.
When a nuclear powerplant application is received by the NRC for an operating license, thepractice has been to require conformance of thedesign to the criteria specified at the time the construction permit is issued and to address the necessity for meeting subsequent criteria on a case-bycase basis. The necessity to conform to post-CP
criteria is determined by the NRC and the industry
on the basis of a perceived level of safety improvement that can be achieved by such conformance.
Given the absence of any human engineering expertise on the NRC staff, it is not surprising that the
NRC had no perception that human factors criteria
could improve safety.
I n summary, we found a lack of substantive human factors criteria and guidance both within the
NRC (AEC) and the nuclear industry, and more important, a lack of appreciation for the importance ofhuman factors to the safe operation of nuclear
powerplants. Furthermore, the personnel resources583

to employ human factors techniques that would be
required to implement even the existing criteria did
not exist within the NRC and were limited within the
nuclear industry.
b. The TMI-2 Control Room
General Layout

At the TMI-2 nuclear powerplant, the control stations, switches, and indicators necessary to startup, operate, and shut down the nuclear unit are located in one control room. Controls for certain auxili ary systems are located at remote control stations.
As can be seen from Figure 11-47 and the photograph in Figure 11-48, the TMI-2 control room is spacious and contains a large number of instruments,
controls, and alarms. The control room consoles
are arranged in a U-shaped pattern with vertical
panels following the same pattern behind the consoles, separated by a passage aisle. The operator's
desk is located in front of the U-shaped console
and panel arrangement. These figures show thefloor plan and layout of the control room and give an
idea of its size.
According to the TMI-2 Final Safety Analysis Report (FSAR), 46 the control room was to be designed
so that one man could supervise operation of theunit during normal steady-state conditions. During
abnormal operating conditions, additional operators
are expected to be available for assistance. The
control room is arranged to include the operating
consoles, which house frequently used controls andi ndicators, as well as start-up and emergency controls and indicators. The FSAR also notes that thecontrols and indicators were to be located in a logical arrangement, accessible, and readily visible tothe operator. Recorders and radiation monitoring
equipment, infrequently used control switches,remaining indicators, temperature recorders, annunciators, and reactor building isolation valves position
i ndicators are mounted on the vertical panels behindthe consoles. Table 11-62 lists the descriptions of
the panels that were most important during the
March 28, 1979, accident.
Visible and audible alarm units are incorporated
i nto the control room to warn the operator of unsafe
or abnormal conditions. The control room was supposedly designed so that information readouts contain all the indications required by the operator formonitoring conditions in the reactor, reactor coolant
system, containment, and safety-related processsystems
46 throughout all operating conditions of theplant.

FIGURE 11-48. TMI Control Room (Postaccident)

printer. When the parameter again comes within
acceptable limits, another notation is typed. The
alarm printer also makes a record of starting, stopping, or tripping of major equipment.
The computer alarm printout is capable of typing
only one line about every 4 seconds. Consequently,
i n situations where alarms are initiated rapidly, theprinter is unable to keep up and the alarm printout isdelayed. An operator can bring the printout up to
real time, but only at the cost of clearing all alarms
awaiting printout from the computer memory. At
one point during the accident, the alarm printer was
more than 2 hours behind.
The utility printer provides output on request.
The value or condition of any monitored parametercan be requested. Special subroutines allow theoperator to request output values in specific preprogrammed groups called Operator Special Summaries or to trend output values in preprogrammed
groups called Operator Group Trends.
The computer is also programmed to record automatically all changes in state of a predesignatedgroup of parameters called Sequence of Events inputs. These event inputs are stored in the computer and can be printed on request. The sequence isPlant Computer
The plant computer system is used for monitoringalarms, plant performance, logging data, and performing simple calculations and is located near thecenter of the control room on console one. Thissystem uses a Bailey 855 computer which is linked
to a smaller NOVA computer. The NOVA computer
was added to the original design to provide morecapacity for monitoring the balance-of-plant conditions.
The computer has two output modes-an alarm
printer and a utility printer. Both printers are automatic typewriters, and if either fails, its output is
automatically transferred to the other. A small
cathode ray tube display duplicates the output ofthe printers or can be used for independent display.
For all monitored parameters that have an alarmfunction, the alarm printer automatically prints analarm message when the parameter has gone into
an alarm condition. The computer also samples
each parameter, such as temperature, pressure, andlevel, and compares the reading to a preset alarm
value. If the reading is outside acceptable limits, anotation to that effect is typed out on the alarm
585

TABLE 11-62. TMI-2 control room key panel descriptions
Panel
2
3
4,5,6
7
8
8a
10

12

13
14

15

Computer console.

Description

Reactor coolant makeup and purification system and the control
room equipment related to the safety features actuation system.
Controllers, recorders, and indicators necessary for control andsupervision of the reactor power output, feedwater, condensate,steam generators, and turbine generator.
I ndicates a fire in the unit and the automatic steps being taken
to control it.
Annunciators and indicators for status of the various nuclear andconventional cooling systems of the unit.
Reactor coolant drain tank controls, indicators, and alarms.

Records temperatures of major equipment, reactor vent valves,control rod drives, and self-powered neutron detectors; eachtemperature monitored is alarmed if the temperature exceeds apreset limit.
Station radiation monitoring equipment and recorders, including
equipment required to annunciate and indicate the status ofequipment and interlocks intended to prevent any release to theenvironment that exceeds preset limits.
Status of the engineered safety features panel.

I ndividual control rod positions, fault lights, and inserted andwithdrawn limit lights.
Graphic panel that shows the position of all reactor building isol ation valves.
'Panel numbers refer to those shown in Figure 11-47.
gency situation. However, the TMI-2 computer was
not programmed to establish a hierarchy of criticalparameters to be monitored in the event of an emergency. Thus, during the March 28, 1979, accident
the large number of unimportant alarms and theresulting backlog made the computer nearly uselessas a diagnostic tool.

started by any one of the Sequence of Events inputs changing state and continues until called up by
the operator.
The plant computer provides the operator with anefficient means of keeping logs and showing trends
on a large number of plant parameters under normal
The computer was notoperating conditions.
designed to accommodate the operator's dataneeds during an accident situation. Using the computer in an accident situation requires that theoperator leave his control panels to request computer output; it takes the computer several seconds
to supply the requested output, and as noted, theautomatic alarm printout can be several minutes oreven hours behind real time. All of these factors
tend to limit the computer's usefulness in an accident situation. If properly designed and programmed, the computer could provide information
useful for diagnosing and responding to an emer-

TMI-2 Control Room Design Evaluation

The likelihood of operator errors can be reducedby the systematic integration of human factors engineering into the planning and design of a plant. To
determine the extent to which TMI-2 was designed
to prevent or minimize operator errors, the Essex
Corporation evaluated the TMI-2 control room andcompared it with human factors engineering criteria
and guidelines generally applied in other industries.
The following discussion of human engineering as-586

pects of the TMI-2 control room design has been
divided into categories that reflect different aspectsof the design.36They summarize the findings of theEssex report.
Workstation Design

A fundamental tenet of human factors engineering is that workstation design should facilitate
operator performance and reduce the probability ofoperator error. To accomplish this, controls anddisplays should be logically organized according tofunction or sequence or in relation to the systemthey control (i.e., mimic). Furthermore, controls
should be placed to minimize the operator's needfor reaching and to shorten the visual span between
the operator and the instruments the operator must
read, thus reducing time to locate and manipulate
specific controls or displays. 47
The Essex Corporation found that little, if any, attention was paid to this aspect of workstation layout. Apparently no analysis was made of the tasks
that must be performed at the various TMI-2 workstations or the capabilities and limitations of theoperators performing such tasks. The following deficiencies are indicative of their findings: 48• In many cases, workstation design appears toreaching requirements. The levels of excessive
reach requirements were defined by using the stature of the fifth percentile male (street clothes) as abasis.
They found that 18 chart recorders, 10 control
stations (10 switches) and 31 switches (most withfrequent use) required a reach of 10 to 14 inches
greater than that of the fifth percentile male standing
erect, requiring him to bend
over the panel to actu48
ate the control or switch.
Control and Display Design

Poor selection of controls and displays can impede the performance of tasks assigned to a particular workstation. The Essex Corporation evaluationof the TMI-2 control room identified several such
deficiencies in the control and display design at
TMI-2.49 Examples include the following:• Controls were selected without regard for the re-•maximize visual scan, reach, and walking requirements.

- RC pump seal pressure is on panel 10, andseal temperature is on panel 8, but thepump controls are on panel 4.
-Makeup control is on panel 3, but makeup
flow indication is displayed on panel 8. See
Figure 11-49.

•• Controls and displays are not logically or consistently sequenced.

- Pressurizer heater controls are sequenced
from right to left rather than from left toright. See Figure II-50.
- Pressurizer narrow range indicators are B,
A instead of A, B••

• I ndicator lights are inconsistently placed above,
beside, or below their associated controls. See
Figure 11-51.

Reaching over benchboards to actuate switches or
to manipulate recorders not only obscures thedisplays under the reaching operator but also increases the risk that the operator will unintentionallyactuate a switch. Frequently, it prevents the operator from monitoring important displays during switch
operation. 48
The Essex Corporation examined the benchboards and the attached vertical panels in TMI-2 forlationship between size and performance. As aconsequence, many controls (e.g., "j-handle"
switches) are unnecessarily large and require extensive panel space.
Displays were selected without concern for thei nformation processing requirements of theoperator. As a result, rarely used or noncriticaldisplays (e.g., electrical displays on panel 6) areunnecessarily large and prominent in theworkspace, whereas critical displays (e.g., pressurizer level) are smaller and less easily seen.
Bulbs are difficult to change in pushbutton-legend
light control indicators-in some cases resulting
i n shorting out of switches. (Note: Control room
operators stated that the process is so unmanageable that they generally wait until theplant is shut down before attempting to replaceburned out bulbs.)
Auditory displays associated with annunciators
are not prioritized to assist the operator indiscriminating critical alarms.
Controls having common operating modes (i.e.,
automatic and manual) are not designed so thatmode selection is consistent between controls.
In some cases, controls having similar functions
are turned clockwise to place the system inmanual, and in others, counterclockwise. See
Figure 11-50.

Displays

A critical design requirement for the nuclear
powerplant control room is the effective display ofi nformation to the operator. This requirement ismost pronounced during emergency conditions
587

FIGURE 11-49. Visual Scan Necessary for Operator (on Left) Controlling Makeup To
Monitor Makeup Flow (Operator on Right)
where prompt, accurate diagnosis of a problem may
be critical. To perform tasks effectively, the operator must have immediate access to information regarding all system parameters reflecting plantstatus; the information must be easily seen andread, well organized, and unambiguous.
The Essex Corporation found that "the design of
the TMI-2 control room evidences a patent disregard for the information processing requirements of
the operator." 50 The following serves to underscorethe magnitude of this problem: 51-There is no displayed indication that thereactor coolant system has reachedsaturation conditions.

* Displays are incorrectly located, both withrespect to their associated controls as well as
the operator's optimal field of view.
- RC pump vibration-eccentricity indicators
and alarms are on the back of panel 10, approximately 20 feet from the RC pump controls on panel 4.
- ESF indicator board on panel 13 consists of
16 rows of indicator lights. Due to placement and organization of this panel, a 6foot-tall operator can see only eight rows ofli ghts from his normal operating position.
See Figure 11-52.
- RCDT instrumentation is located on panel
8A, which is completely outside the main
operating area. See Figure 11-47.

. In some cases, the status of critical parametersmust be inferred from changes in associatedparameters.

- There is no displayed indication of emergency feedwater flow.
- There is no displayed indication of flow
through the pressurizer relief . valve
discharge line.
588

FIGURE 11-50. Pressurizer Heater Control**

Note the right to left sequence and inconsistency of control movement to auto and manual.

• I nformation is inadequate and/or ambiguous,

i ncreasing the time required to ascertain their
meaning. See Figure 11-53 for an example of one
alarm panel out of some 20 of similar size.
• Extinguished lights are used as positive indicationof system status (e.g., PORV seated).
• Displays on several panels were evaluatedagainst standard human engineering display criteria. Some 89 deficiencies were found inevaluating three systems on panel 4.

making precise determination of plant status difficult or impossible.

- Strip charts are overloaded, in some cases
displaying up to 72 separate channels on
the same chart.
- Critical controls have no obvious indicationof being in manual (e.g., when the pressuri zer spray valve is set to manual, the handle
i s "up" (out), but the point is at "AUTO").

• The annunciator system, which includes over 750

Parallax

annunciator lights (some of which are outside themain operating area, e.g., RCDT panel), is poorly
organized both in terms of grouping and relationship of alarms to associated subsystems. In addition, critical alarms have not been color codedor otherwise prioritized to permit immediate identification. In many cases, legends are excessively wordy or contain inconsistent abbreviations,

In the TMI-2 control room, moving-pointer andarc-scale vertical indicators are used extensively.
Unless these indicators are viewed on a line passing
through the pointer and perpendicular to the scale
plate, parallax problems will occur. This parallax
problem will produce a difference between the actual and the perceived indicator reading. With vertical589

FIGURE 11-51. Relationship of Makeup Pump Controls and Indicator Lights

590

1. INDICATION BELOW THIS LINE CANNOT BE SEEN BY A 6 FT.
OPERATOR STANDING AT THE ESF OPERATING STATION

2. INDICATION BELOW THIS LINE CANNOT BE SEEN BY A 6 FT. OPERATORFROM THE CLOSEST POSITION IN FRONT OF THE CONTROL CONSOLESFIGURE 11-52. ESF Station Indicator Boardi ndicators, parallax error will occur when the indicator is placed too low on the panel.
Aside from placing the vertical indicator on thepanel so it can be read easily, parallax can be
minimized by using a mirrored backing so that theoperator will know that his reading is accurate when
the pointer is lined up with its scaled image.
The parallax survey conducted by the Essex
Corporation identified 115 vertical meters in the primary area above the eye level of the fifth52percentile
male, none of which had mirrored scales.

behind the benchboard contain about 1900 displays,i ncluding indicator lights. Depending on their mounti ng height, displays on the vertical panels can be
obscured by the vertical portion of the front benchboard from viewing by an operator standing at thebenchboard. 51
The Essex Corporation found a large number ofdisplays below the line of sight of a fifth percentile
male standing at the benchboard and looking directly at the vertical
panel. Specifically, the following
51
were obscured.
470 indicator lights
24 legend switches
3 control display units
3 vertical indicators

Obscured Displays

In its evaluation of the control room at TMI-2, theEssex Corporation found that the vertical panels
591

FIGURE 11-53. Typical TMI-2 Alarm Panelments and significantly affects operator performance. To ensure efficient, accurate operator performance, labeling must be consistent in location
with respect to associated controls and displays;
characters must be of adequate size to be readeasily from the operator's normal operating position(for normal 28-inch viewing distance, 1/8-inch characters should be used); coding and abbreviations
must be consistent throughout the system; and labels should be graduated in size.
Labeling used in the TMI-2 control room wasjudged by the Essex Corporation to be inadequate
i n a number of areas, including the following: 54

1 strip chart
1 dial1 counter
Viewing Distance

Although the Essex Corporation did not have theopportunity to conduct a thorough analysis ofdisplay viewing distance, indications are that the
TMI-2 control panel presents many opportunities for
misreading displays. For example, at least 250 meters are located on vertical panels that must be
viewed from a minimum reading distance
53 of about
10 1/2 feet from the primary benchboard.

• Labeling on back panels is difficult or impossible
to read from main operating positions.
• Labels are inconsistently placed in relation totheir associated controls and displays; 34% of thel abels were located above associated components and 55% were located below.

Labeling

Labeling, although actually a subset of information display, has unique characteristics and require592

• Labels do not always correspond to their associated indicator lights (e.g., diesel fire pump labeling
contradicts its indicator lights).
• Labels and markings on several panels were
evaluated against standard human engineering
criteria. Some 62 deficiencies were found inevaluating three systems on panel 4.

i mmediately available to the operator because ofl ocation, and the operators were burdened with
unnecessary information.
The control room panel design at TMI-2 violates
a number of human engineering principles resulti ng in excessive operator motion, workload, error
probability, and response time.

Labeling is often treated as an adjunct to control
panel design, rather than as an important communications link necessary for the efficient and reliable
operation of the plant.

c. Control Rooms at Other Plants
Evaluation of Specific Plants

To assess the adequacy of the application of human factors principles to control room (CR) design
i n the nuclear industry and to compare these CR s
with the TMI-2 CR, the Essex Corporation studied
two additional plants. 58 The plants chosen for thei nvestigation were Calvert Cliffs 1 and Oconee 3.
Both of the plants are pressurized water reactors ofapproximately the same power output and the same
vintage as TMI-2. However, these plants had different architect-engineers, and utilities, and the
management philosophy utilized in the CR design
was different from that employed at TMI-2. At
TMI-2, the CR layout was the responsibility of asenior engineer on the staff of the architectengineer and all decisions were made by him. On
the other hand, Calvert Cliffs 1 and Oconee 3 were
designed by a management and operator team. Nochanges were made to the CR or indicator arrangement without approval by the management andoperator team after all had an opportunity to criticize the change. Furthermore, these59two CRs weredeveloped with the aid of mockups.
The comparison between TMI-2 and the othertwo plants included a human factors assessment offeatures, such as reach and visibility, and the placement and readability of meters and indicators in thecontrol rooms.
The ability of the control room operators to reachcontrols easily and see displays from operational
distance is basic to reliable and timely performance.
The reach survey of the control room indicated thatCalvert Cliffs was better than the other two. It had
fewer switches and controls beyond the reach of
the fifth percentile male standing at the control
boards. Oconee was the worst offender, havingsome 22 recorders and 113 switches and controls
beyond 10-inch reach of the fifth percentile male. In
the TMI-2 control room, 18 recorders and 41
switches were beyond the 10-inch measurement. 60
The parallax survey of the three plants focusedon vertical meters in the primary area above the eyel evel of the fifth percentile male. Oconee was better

Color Coding

The Essex Corporation noted that human engineering criteria, developed by the military andaerospace industry, is at odds with the color coding
practices evidenced at TMI-2. The design of theTMI-2 control room sharply reduced the value ofcolor coding to the operator. The number of meani ngs associated with each color as well as the number of colored lights "combine to produce considerable 55
ambiguity in the man-machine communication
link."
The color coding deficiencies notedby the Essex
56
Corporation include the following:• Many different meanings were given to eachcolor: for red, 14 titles; for green, 11; and foramber, 11.
• Annunciators, when alarming, intend to draw attention to the window of interest. TMI-2 uses
flashing white on a white background. Contrast
i s particularly bad if several lights around thealarming window are on.
• The "Christmas tree" effect in the control room is
overwhelming to the observer and must be distracting and, at times, confusing to the operator.
The number of lights make it virtually impossible
to determine with confidence, the status of any
switch or system from across the control room,
particularly if the component is benchboard
mounted.
The Essex Corporation conclusions concerning
the control room design are summarized as follows: 57• The TMI-2 control room was designed and built

without an appreciation of the needs and limitations of the operator, particularly during emergency situations.
• In the absence of a detailed analysis of information required by the operators, some criticalparameters were not displayed, some were not593

than the other two, having only one indicator above
the limit, while Calvert Cliffs had 75 indicators above
the level; however, to minimize the parallax problem,
all had mirrored scales and 25 of these had limit
switches. TMI-2 had 115 vertical indicators above
the eye level, 61
none of which had mirrored scales orli mit switches.
Depending on their mounting height, displays on
the vertical panels can be obscured by the vertical
position portion of the benchboard from viewing by
an operator standing at the bench. To determine
the degree to which displays are obscured, those
displays were counted that were below the sight ofa fifth percentile male standing at the benchboard
looking directly at the vertical panels were counted.
Calvert Cliffs and Oconee were better than TMI-2 inthis regard. Calvert Cliffs had no obscured displays,
and Oconee had only two obscured indicator lights.
In the TMI-2 control room, there were 470 indicatorlights obscured, as well
as a number of other62
switches and indicators.
It seems clear that the TMI-2 design gives insufficient attention to the requirements for reach andvisibility. Under normal conditions, operators areli kely to compensate for design inadequacies suchas these. However, under pressure, the operators
may take risks with reaching and display reading
because of time constraints that could compound
the problem.
The three plants were also compared for theadequacy of the aids, such as labels, color coding,and procedures, provided for the CR operator andfor the means to display the procedures provided toassist the operator in running the plant.
The Essex Corporation survey of CR labelingfound significant and comparable deficiencies at all
three plants. 63 For example, labels were left offsome components, not attached in any consistentorder, and so poorly planned that 34% to 65% of
the panel components needed backfits.
In evaluating the color code practice, it was foundthat all three plants attached several meanings toeach color used. 64 I n fact, the operator in manycases would have to know the specific component
being observed to know how to interpret the color,and in many instances the colors have contradictory
meanings.
A summary of the results of the Essex color survey are shown in Table II-63. 64 As can be seen,
the TMI-2 control room attached more meaning toeach color than do either of the other two plants.
I n summary, the Essex Corporation's limited
review of the features that aid the operator in reliability and timely performance showed Calvert Cliffs 1
and Oconee 3 to be superior in human engineering

TABLE 11-63. Number of different meanings
given to each color

Calvert Cliffs
Oconee-3
TMI-2

Red

Green

Amber

4

3

4

6

14

4

11

5

11

to TMI-2. Despite their good features, however,Oconee 3 and Calvert Cliffs 1 had some shortcomi ngs and a detailed analysis would no doubt uncovermore.
Evaluation of Additional Plants

I n light of the advancement in human factors in
the aerospace industry at the time that 'the threeplants were being designed, it appears that none
took advantage of the technology available. The
li mitation of the Essex Corporation study to the two
additional nuclear powerplants does not permit aconclusive decision as to the state of nuclear
powerplant control rooms in general. Therefore, we
65reviewed the EPRI study of five additional powerplants and the Sandia Laboratories analysis of theZion nuclear powerplant. 66 In November 1976, theElectric Power Research Institute (EPRI) published a
65
of a 16-month study of fivereport, EPRI NP-309,
nuclear powerplants. EPRI had contracted with the
Lockheed Missiles and Space Company, Inc., ofSunnyvale, Calif., to conduct the study and write thereport. The intent of the study was to uncover general problem areas where human factors guidelines
could profitably be applied to the next generation of
nuclear powerplants. A secondary objective was to
identify problems within existing powerplants whereminor modifications at low cost would upgrade thequality of the man-machine interface. A review ofthis study allows a better evaluation of the TMI-2
control room design in comparison with the state of
the art in the nuclear industry and permits a better
evaluation of the nuclear powerplant CR design in
general.
The EPRI study made the following findings:. Insufficient attention was paid to the abilities andli mitations of the operator in developing the control room configuration. Serious difficulty in theplants' normal and emergency operations resulted from the poor positioning of controls and instruments on back or remote panels requiring theoperators to leave their primary operating sta594

tions to use these controls or monitor these instruments. In addition, the study found that fourof the five plants were inadequate because ofglare and reflections on instruments. 67• I n general, the control board designs were toolarge, requiring too great a visual and control
span for the operators, and were not optimized
for minimum manning. Control boards had arraysof identical components that were not discrimi nated into clearly identified panels and subpanels
containing related elements. Closely related controls and displays were often widely separated.
Although some mimicking was provided by thedesigner, there usually was not enough to satisfy
the operators so that some attempt was made tomodify panels with tape to superimpose mimicl ogic. 88• Although no data on the physical dimensions oftypical control room operators were available, theplacement of instruments was too high or too low
for convenience. This problem was predominanton the back panels and peripheral consoles.
Footstools and ladders were often required topermit theoperators to reach these controls and69
displays.
Placement of controls made them susceptible
to accidental actuation. Adjacent controls having
identical appearance, shape, and texture but different functions can cause inadvertent actuation.
Placement of some controls makes them susceptible to accidental contact by operators and visitors to the control room. 70• Meters currently utilized in nuclear powerplants
have tremendous potential for human factors improvements. The most common problems observed in the five plants examined were improperscale markings in association with scale
numerals; selection of scale numeral progressions that were difficult to interpret; parallax
problems resulting from placing the meters above
or below eye level; meters that fail with thepointer reading in the normal operating band of
the scale; and glare and reflection from overhead
illumination.
The most serious problem observed in all of
the plants was the lack of meter coding to enable
the operator to readily differentiate between normal, marginal, and out-of-limits segments of the71
meter scale.
• Each of the five control rooms had an annunciator warning system consisting of a horizontal
band of hundreds of indicators spanning the uppermost segment of the control board. This system was too complex and had become a catchall for a wide variety of qualitative indicators,

which compounded the difficulty to diagnose malfunctions. When emergencies occurred, thel arge number of indicators illuminated, in concert
with blaring horns, startling the operators andoverloading their sensory mechanisms rather
72
than shedding light on the problems at hand.
• I ndicator reliability is a problem in nuclear powerplant control displays. There were a surprisingnumber of burned-out single-lamp indicators at
any given time. The replacement of these lamps
was difficult and presented problems for theoperator. There are examples in the plants ofnegative indicators (the absence of73
indication toconvey information to the operator).
• The control room designs underutilize coding
techniques that could help the operator discern
plant status and prevent misidentification of control elements. Color codes have not been appliedsystematically, and code meanings vary frompanel to panel. Present coding of indicators tells
the operator whether a valve is closed or open
but does not convey any information as towhetherthe valve should or should not be74
closed.
• Labels were not placed consistently above or
below the panel elements being identified, which
could result in misidentification of the panel element. Some labels were obscured by adjacentcontrol levers. The best indication of labelinginadequacies is the extensive handmade labelingthat operators add to the consoles to clarify
i dentificationof given controls or their opera75
tion.
The NRC contracted with the Sandia Laboratories to conduct a study of the Zion nuclear powerplant. 66 The scope of the study was limited to thehuman factors problems associated with engineered
safety panels in the control room and associatedprocedures for coping with a LOCA. The Sandia report was published as NUREG-76-6503 in October
1975.
Sandia Laboratories reported that in the Zion situation, as in other nuclear powerplants we havevisited, little attention was paid by the designers to
the human engineering practices that have maximized reliable human performance in other complex
76
systems.
The report lists the following design
features that deviate from sound engineering prac77
tices and are regarded as likely to cause errors:• poor layout of controls and displays;• poor and inconsistent color coding;• too many annunciators,595• The procedure was not complete in several re-• too many exceptions to the go-no-go coding
scheme for rapid assessment of monitor panel
status;• labeling that provides little or no location aid;
• misleading labeling due to violation of populational
stereotypes; and• i nsufficient labeling of valves.

gards:- It failed to define a leak or rupture that iswithin the capability of system operation.
-It lists symptoms but does not address diagnostic procedures and tests.
- It indicates that the control room operator( CRO) should monitor liquid levels, reactor
building parameters, and safety feature flow
rates, but does not indicate acceptable andnonacceptable values.

It can be seen that the design problems existing at
the Zion plant are similar to those discussed in theEssex Corporation report on TMI-2.

• The procedure has several content coverage
problems, notably:

Summary- Step 2.2.2 under A ("close MU-V376 letdown isolation valve and start the backup
MU pump if required") does not discuss
how to determine if required.
- Section 3.2.5 (A) states that continued
operation depends on the capability tomaintain pressurizer level and reactor
coolant system (RCS) pressure above the1640 psig safety injection actuation setpoint. The procedure completely ignores
the situation where level is maintained well
above its low level alarm point while pressure is below 1640 psig, the situation thatwas present from 2 minutes after the accident initiation through the 150-minutepoint.

A broader base of investigation might be needed
to compare TMI-2 with the state of the art in the nuclear industry in the late 1960s. From the limited
study by the Essex Corporation of three plants, theEPRI study of five plants, and the Sandia study ofZion, it can be concluded that the TMI-2 control
room is representative of contemporary nuclear
powerplants and that there are serious human factor problems throughout the nuclear industry.
4. EMERGENCY PROCEDURES
Introduction• Problems with procedure clarity and concise-

The actions of TMI-2 operators during the accident suggest that emergency procedures were ofli ttle use for diagnosing the problem being faced orfor deciding on the appropriate corrective actions.
This is not surprising since, as the analysis in Section II.E.2 suggests, the written emergency procedures for TMI-2 had serious deficiencies. We did
not perform a detailed analysis of all the TMI-2 emergency procedures. We did, through our contract
with the Essex Corporation, perform an evaluationof one procedure, 2202-1.3 "Loss of Reactor
Coolant/Reactor Coolant System Pressure." 78
Essex also performed an assessment of the impactthat procedures had on the accident and of Met
Ed's process for developing and updating procedures. The discussion that follows draws substantially from the Essex review.
We feel that one of the two emergency procedures that were most relevant to the situation at
TMI-2
was
2203-1.3"Lossof
ReactorCoolant/Reactor Coolant System Pressure." The
Essex Corporation evaluation of this emergency
procedure from a human factors engineering standpoint revealed a number of deficiencies including: 78

ness:-Too many subjective statements are used
i n symptoms, such as "becoming stable
after short period of time."- It is not clear if all symptoms must bepresent, or only some subset, or only oneof the symptoms to diagnose the problem.
- Section 2.2.2.1 of Section B states that the
CRO dedicated to recognizing a LOCA
must accomplish four steps within 2
minutes. Step four states that MU pumpdischarge cross connect valves must be
opened within 5 minutes of the LOCH. It is
not clear how a step taking 5 minutes mustbe accomplished within 2 minutes.

• Problems with procedure consistency include:- Nomenclature used in the procedure isconsistently different from panel nomenclature, control and display labels, and annunciator designators.
- The procedure itself is not internally consistent at times in identifying valves to be596

monitored and at other times in omitting
such valves.

emergency-emergency procedures, training insimilar situations, and knowledge of the plant operation and status. The operator must detect and isolate the problem by diagnosis. The Essex Corporation pointed out that the operator cannot depend
entirely on his knowledge of the plant or his training
to make the diagnosis or to determine what action isnecessary to isolate the problem. He must rely on
the emergency procedures. 81 For this reason heneeds accurate and readily accessible proceduresto supplement his knowledge and training. They
should provide him with criteria and steps to be taken in formulating hypotheses concerning what ishappening in the plant and in testing the hypotheses
using displayed data and test sequences.
The underlying questions are: Were there procedures available to cope with the situation at TMI
on the morning of March 28, 1979, and did procedures or lack of procedures have an impact on
the accident. We believe that the procedures weregrossly deficient in assisting the operator in diagnosing problems with the feedwater system, theemergency feedwater system, and OTSG level
responses when emergency feedwater pumps wereactivated. The procedures were of no help in diagnosing the PORV failure, nor did they provide guidance in analyzing the situation of pressurizer leveli ncreasing while RC pressure decreased. Furthermore, the procedures gave no guidance regarding
overriding the automatically initiated HPI, when totrip the RC pumps while temperature and level arehigh and pressure is low,82and when and how to establish natural circulation.

. Problems with correctness of procedure:- Section B symptoms are not correct.
Symptoms for leak or rupture include "rapid
continuing decrease of pressurizer level."• Problems with compliance with ANSI N18.7:- The procedure includes the reactions
designated for emergency procedures but
totally ignores the sections required forprocedures in general, such as the statement of applicability: prerequisites, precautions, limitations and actions, and acceptance criteria.

The Essex Corporation also found that the emergency procedures fail to identify in clear and concise terms what decisions are required of theoperator, what information is needed by the operator to make the decision, what actions need to betaken to implement the decisions, and how theoperator verifies the correctness of his decision andactions. 79
The Essex Corporation evaluation of the use ofprocedures addressed the following:• accessibility of procedures,• management of the update of procedures, and• use of procedures as job performance aids.

Procedures should be written to allow easy identification of which procedure should be followed. The
emergency procedures at TMI-2 were not easily accessible. There was no organized listing or catalog
of symptoms that would help the operator determine
which procedure to apply. The operator is forced torely on memory. While this approach may be acceptable during normal operations for single-fault situations, the Essex Corporation maintains, and weagree, that it fails miserably in multiple-failure conditions, as was the case at TMI-2 on March 28,
1979. 80
There was no formal method for getting operator
i nput to update the procedures at TMI-2. Since thepurpose of procedures is to aid the operators incontrolling the powerplant during normal and emergency operations, the Essex Corporation felt that amechanism is needed to identify the need for procedure change, to include operator input in thechange process, to complete the required change,
and to obtain operator evaluation of the changed
81
procedure.
I n an emergency situation the operator has only
three aids available to enable him to cope with the

5. OPERATOR SELECTION AND TRAINING
Regulations and Requirements

The statutory requirements for licensing operators of nuclear powerplants are contained in Section
107, "Operators' Licenses" of the Atomic Energy Act
of 1954, which states:
The Commission shalla. prescribe uniform conditions for licensing individuals as operators of any of the various classesof ... facilities licensed in this Act;b. determine the qualifications of such individuals;c. issue licenses to such individuals in such form
as the Commission may prescribe; andd. suspend such licenses for violations of any provision of this Act or any rule or regulation issued
thereunder whenever the Commission deems
such action desirable.

That Act also defines the term "operator" as "anyi ndividual who manipulates the controls of a utiliza597

tion or production facility," which includes nuclear
power reactors. Although "controls" is not defined in the Atomic Energy Act, the term is defined
i n the Commission regulations as meaning "apparatus and mechanisms the manipulation of which
directly affect the reactivity or power level of the85
reactor."
The Commission has implemented thisstatutory requirement in Part 55 "Operators'
Licenses" of its regulations. Part 55 establishes theprocedures and criteria for the NRC's issuance of
two types of licenses,86one for "operator" and one
for "senior operators."
The NRC has also issued regulatory guides thatprovide details concerning the methods that are acceptable to the NRC staff for satisfying the specificrequirements in Part 55. 87 These regulatory guides
i n turn refer to other NRC documents (NUREGs)
that provide further guidance on the informationneeded by the NRC staff for its review and evaluation of applications for licenses. 88 These guides
also refer to relevant national standards developed
under the aegis of the American National Standards
Institute (ANSI), which serves as a clearinghouse tocoordinate the workof standards development in89
the private sector.
Part 55 requires an applicant to pass a written
examination and operating test "to determine that
he has learned to operate, and in the case of asenior operator, to operate and to direct thelicensed activities of licensed operators in a competent and safe manner." 90 The guidelines that apply to experience and education are contained in
ANSI-N18.1, which specifies that licensed operators
have a high school diploma or the equivalent. Twoyears of powerplant experience are specified forreactor operators and 4 years for senior reactor
operators. Under this industry standard, operators
must possess a high degree of manual dexterity andmature judgment. There are no requirements, however, that operators possess any other aptitudes,
such as problem solving or spatial orientation capabilities.
Additional requirements for operator license application are set forth in broad terms in 10 C.F.R.
50.11. Generally, the physical condition and general
health of the applicant must not be such that could"cause operational errors endangering public healthand safety" or that could "cause impaired judgment
or motor coordination. " 91 These requirements areelaborated on
92 in Regulatory Guide 1.134 and ANSI
N546-1976.
The 10 C.F.R. 55.33 requires that each licensed
operator demonstrate his continued competence
every 2 years to have his license renewed. The
NRC accepts certification that an operator has sati sfactorily completed an approved requalification
598

training program as evidence of such competence inlieu of reexamination. Appendix A of 10 C.F.R. 55
presents requirements for operator requalification
93
training.
NRC Examinations
After accepting an application, the NRC staff (oran NRC consultant) prepares, administers, andgrades the operator license written examinations
and oral operating examinations to test theapplicant's understanding of the design of the reactor for which the applicant seeks an operator
license and the applicant's familiarity with its controls and operating procedures. 94
The regulations indicate the general topical content of the written examination for operators and the
supplemental topics for the senior operator examination that covers in greater depth areas such as
95
reactor theory and operating characteristics.
Similarly, the regulations give topical guidance forthe operating 96
tests for both an operator and asenior operator.
The scope of the 8-hour written examination isoutlined in 10 C.F.R. 55.21 and NUREG-0094,
Chapter IV and covers the following seven topics:
1. principles of reactor operation,
2. features of facility design,
3. general operating characteristics,
4. instrumentation and control,
5. safety and emergency systems,
6. standard and emergency operatingprocedures,
7. radiation control and safety.

An individual passes the written examination if hereceives an overall grade of 70%. A grade of lessthan 70% in a given category is not grounds for
failure if it is compensated by a grade higher than
70% in another category.
Candidates for the senior reactor operator's
license must, in addition to passing this 8-hour written examination, pass a 5-hour written examination,
the scope of which is outlined in 10 C.F.R. 55.22
and NUREG-0094, Chapter IV. This examination
covers the following five topics:
1. reactor theory,
2. radioactive material handling, disposal, and hazards,
3. specific operating characteristics,
4. fuel handling and core parameters,
5. administrative procedures, conditions, and limitations.

I n addition to these written examinations, the NRC
staff or its consultants administer a 4- to 6-houroral examination as required by 10 C.F.R. 55. 97 The
scope of the examination is described in NUREG0094, Chapter VIII.
The scope of the operating examination for theapplicant for a senior reactor operator's license will
be generally the same as that for operators. However, the senior operator candidates are required todemonstrate a higher degree of competence,
knowledge, and understanding than that required ofreactor operators. 98 The oral examination is conducted at the applicant's plant, primarily in the control room where the applicant is asked to point out
and explain the function and use of plant instrumentation and controls. The test includes hypotheticalaccident scenarios and mock manipulation of controls. 99 If the applicant has not been to a simulator,
he is required to demonstrate his capability by actually manipulating
the controls of the reactor during a
100startup.
However, most applicants have had
simulator training and the examiners do not usuallywitness the applicants' manipulating the controls of
the plant.
The applicant is examined on proper use of normal, abnormal, and emergency procedures and his
knowledge of plant technical specifications, administrative procedures, and emergency plans. During atour of the plant, the applicant's knowledge of radiological practices
and monitoring equipment are also99
evaluated.
Throughout the oral examination, the applicant's
knowledge and understanding are subjectively
evaluated by the NRC examiner and are noted on
101
an examination summary report, NRC form 157.
No objective measures are used. If in the judgmentof the examiner, an applicant performs unsatisfactorily on any facet of the oral examination, the examiner documents the performance in the comments
section of the summary report. This report is thenreviewed by NRC's Operating Licensing Branch.
Three "unsatisfactory" grades (U's) or six "marginal"
grades102(M's) out of approximately 70 constitutes a
failure.
The licensing examinations are made up, admini stered and graded by NRC employees (NRR's
Operator Licensing Branch) or their consultants who
are usually employees of national laboratories anduniversity professors who work with research reactors. The staff and the consultants are not required
to have a current or expired operator's license.
Furthermore, there is no training program to qualify
NRC examiners or any requirement that they maintain an expertise in the areas covered in the examinations.
Unless specifically requested, neither the applicant nor the utility receive copies of the examination
summary report. Consequently, the weak points

cited during an examination are not necessarily told
either to the operator or his management. R. Zechman of TMI's training staff has stated that he knewof only three cases where TMI operator examination
papers were obtained by his department. 103 These
three were obtained through FOIA requests.
Operator Training Program

As noted earlier, in addition to passing the NRC's
written and oral examinations, an operator license
applicant must demonstrate he "has learned tooperate 104
the controls in a competent and safemanner."This requirement is normally fulfilled by certification from the utility that the applicant has completed
a utility-administered training program. The training
program for TMI-2 is carried out by the Met Ed
training department, which relies partially on training
services offered by Babcock & Wilcox. The program Met Ed developed was divided into twophases:"cold training" and "hot training"corresponding to periods before and after reactor
criticality. For both of these programs the normal
progression of personnel involves gaining experience as an unlicensed auxiliary operator for about
1 % to 2 years before applying and being accepted
i nto the licensed operator training program.
In addition to providing the necessary training for
new operator license applicants, the utility's training
program must also meet regulatory requirementsfor105
the operator requalification program.
This portionof the program, as its name suggests, is focused on
training operators who must renew their licenses
every 2 years. The TMI-2 cold training program106
was described in the TMI-2 FSAR,
which was reviewed and approved by the NRC staff. The program was geared for Unit 1 auxiliary operators who
had applied to become Unit 2 operators, and involved candidate participation in:

1. approximately 200 hours of formal classroom
training in areas such as abnormal occurrences,
plant modifications, major operational evolutions,emergency procedures, radiation control, andsafety;2. one week of training at Penn State University's
research reactor which included core physics
and detector experiments and assured that eachcandidate participated in 10 reactor startups;
3. one month of practical onshift observation experience at the TMI-1 control room;
4. an 8-week simulator training course at B&W (100hours simulator operation, 170 hours classroom
i nstruction, 40 hours simulated NRC examination
and review);599

5. classroom training course on TMI-2 NSSS,
secondary system and balance of plant systems(160 hours);
6. nuclear theory review course (60 hours);
7. advanced systems, procedure, and nuclear
theory training (about 8 weeks).

The cold training program also had the provisions
for operators who were licensed on TMI-1 to become licensed senior reactor operators for TMI-2.
Their program included a utility administered unit
differences course, which stressed the difference
between the Unit 1 and Unit
2 NSSS, secondary and107
balance-of-plant systems.
Subsequent to reactor criticality on March 28,
1978, Met Ed developed its hot training program forproviding replacement reactor operators and senior
reactor operators. This program is geared to provide the same technical training as the "cold" program but since the reactor had become operational,i t relied more heavily on the utilities' reactor andl ess on B&W with its reactor simulator.
Replacement candidates for control room operators are chosen from the ranks of the experienced
auxiliary operators. The operators are required tocomplete a 9-month formal training program coveri ng the same general material and fundamental program that was outlined for training the initial TMI-2
staff. The program includes normal and emergency
operating procedures, system operation, simulator
training, and classroom training on topics such asreactor theory and health physics. This program isadministered primarily by the TMI training staff, witha short simulator training course at B&W's Lynchburg facility. 108 As part of the operator's license
application, Met Ed provides certification of theapplicant's successful completion of the replacement training program. This certification, however,does not contain information on how well the candidate performed in the training program.
Replacement candidates for senior reactor
operators licenses are filled by more experienced
personnel. In 1977, senior reactor operator candidates who were licensed on Unit 1 were required tocomplete a training course on Unit 2 systems,
technical specifications, and procedures, with emphasis on the differences between Unit 1 and Unit 2,
as well as to attend a short simulator training course
at B&W's Lynchburg facility.
I n July 1977, the TMI training department requested that the NRC's Operator Licensing Branch(OLB) grant senior reactor operators' licenses valid
for Unit 2 to senior reactor operators who wereli censed on Unit 1 and who had successfully completed a "differences" course. Agreement wasreached between NRC-OLB and TMI that the oral

walk-through examination would be waived. However, NRC-OLB required the TMI training department to make up and administer a "differences examination" to demonstrate operator proficiency on
Unit 2. 109 The NRC performed an audit review ofthe examination of 12 candidates who took thecross-licensing examination; 11 passed and were
granted senior reactor operator licenses for Unit
2 110
The NRC did not approve TMI-2's hot training or
replacement operator program. In fact, firm detailsof this program were never submitted to NRC. Instead, Met Ed submits a synopsis of the replacement operator's training background and experiencealong with the operator's license application. NRC
approval of the program is essentially performed ona case-by-case basis without any prior NRC review.
TMI Requalification Program

The TMI requalification training program extends
over the 2-year duration of each operator's license.
It is administered by the utility's training department
with the use of external training resources. As
described
in the TMI-2 FSAR, the program in111
cludes:

1. Operational review lectures (60 hours per year,
including films and videotapes) and self-study ofthe following items: reportable occurrences; unit
modifications; operating history and problems;
procedure changes; abnormal and emergency
procedure review; technical specifications; major
operational evolutions (such as refueling); applicable NRC regulations, 10 C.F.R.; and fundamentals and system review. (These lectures may be
given on shift by shift foremen and shift supervisors instead of by the training department.) Additional preplanned lectures are provided in areasin which an operator's annual written examinations indicate that strengthening of the operator's
knowledge is necessary in any area that NRC's
written examination covers.
2. On-the-job training where each licensed operator
manipulates the reactor controls or the B&W
simulator controls to effect reactivity changes on
10 occasions during the 2-year requalification
program. In addition, to ensure diversity ofoperator performance, operators may be assignedtosurveillance
testing,
makeup-purification system operation, decay
heat removal system, feedwater system operation, and reactor cooling system.
3. The licensed operators undergo annual written
examinations to identify areas that are covered in
NRC's written examinations for which retraining
600

The TMI staff used B&W's 8-week cold license
simulator certification training course, which was
conducted at B&W's Lynchburg simulator training
facility. Certification by B&W of the simulator traini ng and mock examination results were forwarded
by Met Ed to NRC with the applications for operator
li censing examination. The TMI operators also took
1- or 2-week simulator courses as a refresher in
preparation for cross-licensing senior reactor
operator examinations and operator requalification.
Met Ed also purchased an 8-hour B&W videotape
series illustrating the performanceof the integrated
103
control system during transients.
Met Ed also hired the services of the General
Physics Corporation to give operator license candidates mock NRC oral examinations several weeks
prior to the actual NRC examinations. NRC was not
apprised of the results of those examinations. 114

and upgrading are required. These examinations
are made up, administered, and graded by the
TMI training department; NRC's OLB performs
only an audit review. An overall written examination grade of 70% is passing. Grades under 70%
require that the operator be relieved of hislicensed duties until he successfully completes anaccelerated retraining program. Any operator
scoring less than 80% in any category is required
to attend fundamentals and systems review lectures on that subject.
I n addition, the licensed operators undergo annual oral examination given and graded by the
TMI training staff. The examination covers
operator actions during abnormal and emergency
conditions, response to transients, instrumentation signal interpretation, procedure modifications,
technical specifications, and emergency plans.
An unsatisfactory evaluation on the annual oral
examination requires discussions of deficiencies
between the operator and supervisory personnel
and administration of a second examination. Unsatisfactory performance on the second examination results in the operator being relieved of
responsibilities until he successfully completes anaccelerated requalification program.

Evaluation of Training

One important objective of a good training program is to provide operators with the skills and theknowledge to deal with emergency situations likethose that occurred at TMI-2 on March 28, 1979. In
order to understand how well TMI's training program
met this objective, the Essex Corporation analyzed
six TMI-2 emergency procedures relevant to theaccident. This analysis identified tasks or actions
that operators must perform to respond correctly toemergency conditions that should ,form the basis ofa well designed emergency training program. Fiftythree such emergency tasks or actions were identified. Twenty-three of these require the operator tohave and use diagnostic skills. The other tasks require memorizing procedural skills for following sequences of activity and control skills involving motor
and perceptual capabilities. The significant need for
diagnostic skills during emergencies is further underscored by the discussion in Section II.E.2 of thisreport on the significant deficiencies in the ability of
the TMI operators to diagnose the difficulties experienced in the plant.
Essential features of diagnostic skill training are
the ability to reproduce symptoms of a fault condition in training and to challenge the operator todetect and isolate the problem based on his understanding of what is happening in the plant. Suchtraining for control room operators can utilize lectures, study of nuclear engineering, and practice in
responding to emergencies. Practice can be accomplished either through simulated emergencies at
a training facility (simulator) or through experiencefrom repeated emergency situations in an operating
plant. Obviously, the latter is of little use in training

B&W Training Program
As previously mentioned, the TMI training program relies in part on training services offered by
B&W. The following list outlines the basic elementsof the program offered by B&W: r2

1. basic nuclear theory, lectures and operation at
vendors' training reactor (not simulator) (3months) at Lynchburg or with B&W personnel atutility site;
2. nuclear powerplant observation (2 months) at a
B&W-type plant;
3. reactor simulator training, including mock NRC
written and oral examinations (2 months), at
Lynch burg;
4. design details of the specific plants (1 month) at
Lynchburg or with B&W personnel at utility site;
5. on-the-job experience at plant during testing aswell as writing operating and test procedures (10months) as a B&W resident at utility site.
The TMI-2 PSAR noted that the Met Ed training
department would consider using B&W's assistancei n the basic nuclear theory portion of the cold
license training program. r3 However, Met Ed staff
and the services of NUS Corporation were used
i nstead.

601

applicants for CRO licenses for nuclear powerplants
because of the practical limitation on what can bedone at an operating plant.
The educational backgrounds of most of theTMI-2 operators, and the operators on shift themorning of the accident were no exception, are limi ted to completion of high school. This fact suggests that heavy emphasis on lectures and classroom study may not be the most effective means ofteaching diagnostic skills. Similarly, the Essex Corporation concluded that diagnostic training of nuclear powerplant operators can best be accomplished by the use of a simulator that accurately
reproduces the system response and format of thei nformation available
in the operator's own plant
115
control room.
The simulator need not, however,accurately reflect the control room's physicalcharacteristics. Thus, the B&W Lynchburg simulator shown in Figure 11-54 could serve as an effective
training tool for diagnostic skill acquisition eventhough it does not physically represent the TMI-2
panel configuration.
The Essex Corporation found that only 6% of the
TMI operator training
program was devoted to simu116
l ator training.
They also found, however, thateven this time was not used effectively to provide
diagnostic skills. Most of the time was used to give
simple demonstration of plant response. Little or no
simulator time was used to practice control techniques, procedure sequences, or fault identificationand isolation, any of which would improve theoperator's diagnostic skills.
Simulators can also be used to develop procedural and control skills and for evaluating and improving procedures. Because all of these uses require a high degree of similarity between the simulator and the plant's real control room, the B&W simulator was of little value in this training area.
As previously noted, another method of acquiring
skills is through on-the-job training in the reactor facili ty itself. On-the-job training can be an excellent
followup training approach because of the high fidelity of the control room configuration, system
response, and procedures to those that the operator will face. Essex found, however, that the operators' formal on-the-job training
accounted for about
117
10% of the total training time.
Furthermore, sinceon-the-job training is conducted during normal
operation with few transients, it was of little direct
benefit in dealing with accident situations. The
TMI-2 FSAR requires that an operator have experienced certain specified events during the 2-year
term of his license for requalification. Specifically,
he must participate in a minimum of 10 reactivity

manipulations that are judged to demonstrate skill
117
and familiarity with reactivity control systems.
The Essex Corporation did not directly measure theactual operator skills for manipulating reactivity controls. The overall evaluation of the deficiencies insimulator and on-the-job training, however, led tothe conclusion that the TMI training program did notensure adequate development of their skills. 118
The crew on duty at the time of the accident had
spent an average of about 85% of their training timein classroom instruction. 119 This training time wasspent either attending training sessions during a
training shift or studying for several hours on shift.
To determine the scope, accuracy, and clarity ofthese lessons, Essex evaluated the lesson plan andl ecture outline for a number of reactor systems.
This evaluation compared the plans and lectureswith the 53 emergency tasks or objectives identified
by the review of emergency procedures. Twelve of
those objectives were related to the feedwater system, yet none was addressed in the lecture outline.
I n addition, Essex found that the general format andorganization of the lesson outline was seriously
l acking and concluded that, even though the authorof the outline may have been familiar with the feedwater system, the author did not display any expertise in presenting training material to enhance
operator interest and retention. A similar evaluationof the lecture outline for the reactor coolant systemyielded identical results. Not one of the 20 training
objectives identified todeal with the RCS was ad12
dressed in the outlin. v
An important aspect of any training program isthe effectiveness of the training evaluation methods.
With a good set of measures to establish operator
performance capability, the training program can beevaluated, as well as the effectiveness of the operators. Although Met Ed has developed a number oftests and quizzes to measure the effectiveness ofthe operator,
the Essex Corporation found the tests
121
deficient.
The emergency training objectives identified fromemergency procedures were not reflected in the examination. The operators did not get feedback on
their own strengths and weaknesses. Also, the examinations did not measure the operators' ability todiagnose a transient, control the plant, follow procedures, or anticipate responses. The only required
measure of operator capability is the NRC licensing
examination. Essex's review of these examinations
concluded that on average, each examination
covered only 1 or 2 of the 53 emergency training
objectives they had identified from the emergency
procedures. The Essex Corporation study conclud-602

FIGURE 11-54. B&W Simulator -Showing Instructors Console
ed that the NRC examinations provide a poor assessment of the operator's ability to use emergency
procedures. 121
On the basis of its evaluation of the TMI training
program, Essex concluded that 122
the program was
deficient in the following respects:

2. Too little simulation was provided and where it
was used it was misused.
3. It failed to provide the operators with the skills
they needed in the accident; e.g., skills indeveloping a hypothesis and acquisition of feedback data to verify the hypothesis.
4. It failed to provide for measurement of operator
capability.
5. It provided no instruction for the instructors on
how to reinforce lesson objectives or how to assist trainees in understanding the system.

1. It was not directed at the skills and knowledge
required of the operators to satisfy job requirements.

603

6. It took an archaic approach to learning, in that noapplications of instructional technology were included in the program.
7. It was not closely associated with procedures
used by the operators, and no guidance was provided in what to do if procedures do not apply.
8. It did not provide for formal updating and upgradi ng of training methods, materials, and content.
9. It failed to establish in the crew the readinessnecessary for effective and efficient performance.
These conclusions were aptly summarized by Essex
as follows:

Operators were exposed to training material but
they certainly were not trained. They were exposed to simulators for the purpose of developing
plant operation skills, but they were not skilled in
the important skill areas of diagnosing hypothesis
formation and control technique. They weredeluged with detail yet they did not understandwhat was happening. The accident at TMI-2 on123
the28th of March 1979, reflects a training disaster.
The overall problem with the TMI training is thesame problem with information display in the TMI-2
control room application of an approach whichinundates the operator with information and requires him to
124expend the effort to determine what ismeaningful.

127

79% to a high of 91% with an average of 83.5%.
This compares favorably with a passing grade of128
and an industrywide average of about
70%
80% . 129

Before the accident all of the operators had completed training courses that met NRC requalification
requirements, and all were slated to take a 1-weeksimulator course at B&W's Lynchburg facility on
April 9, 1979. Each operator had received simulator
training totaling 5 to 9 weeks. Three of them had aweek's training at Penn State University's research
reactor.l30
All four operators had high school diplomas andtwo had completed about a year of college coursework. This educational background is similar to industrywide experience where 50% of the CROs and
80% of the SROs have formal education beyond
high 131school but most have not graduated from coll ege.
Comparison with the Nuclear Navy

The most striking difference between the backgrounds and experience of the four operators who
were on duty at TMI-2 and those of most reactor
operators is their U.S. Nuclear Navy experience.
Each of these licensed operators had more than 5
years of experience in the U.S. Nuclear Navy for a
combined total of 26 years. This is considerably
higher than the industry average of 2.5 and 4.4
years of noncommercial (mostly Navy) nuclear reac131
tor experience of CROs and SROs, respectively.
Each had graduated from the Navy's 6-month basic
enlisted nuclear power school and the 6-month program at a Nuclear Power Prototype School. Their
specialty positions in the Navy included an electroncommunicaic technician, an electrician, an interior
132
Although wetions technician, and a machinist.
have not inspected confidential Navy records onthese operators, we have found no evidence thatwould indicate that they did not perform satisfactoril y in the Navy.
The Navy nuclear power program is generally
considered to be highly successful with a reputation133
for having well-trained and disciplined operators.
Since operator actions at Three Mile Island led tothe severe core damage, some have suggested thattraining and discipline similar to that used in the
Navy should be adopted in the commercial nuclear
plant program.
The significant differences in Navy nuclear propulsion plants and civilian nuclear powerplants,
however, suggest that personnel who may be highly
qualified to operate the Navy plants may not be themost qualified to operate large complex civilian nu-

Manning Levels and Operator Qualifications

The NRC regulations require that a licensed control room operator (CRO) or senior operator (SRO)
be present at the controls at all times during plant
operation 125 This requirement is implemented
126
through the TMI-2 technical specifications,which
require that one SRO and two CROs be on shiftduring reactor operations.
Under most circumstances, no more than one licensed operator
needs to be in the control room. The NRC requirements allow, however, for the utility to have only one
li censed operator
on site (in the control room) for
126
short periods.
Although the size and combined experience ofthe shift of two licensed operators and two senior
operators on duty when the accident occurred wasconsiderably larger than the minimum required by
the NRC, the difficulty experienced by this shift in
responding to the accident raises serious questions
about the adequacy of the minimum NRC manningrequirements.
We found that the licensed operators on duty at
TMI-2 at the time of the accident met or exceeded
all NRC requirements with respect to background,training, and qualifications. All four of these operators performed reasonably well on the NRC licensing examination. Their grades ranged from a low of604

clear powerplants. The Navy nuclear plants aredesigned to accommodate expected transients
without the need for immediate operator actions or
automatic system responses. The plants rely on inherent system stability rather than automatic or
manual activation of complex control systems
to134
control the plant during most transients.
In addition, there has been a significant effort to simplify
system design to give confidence in theability of135
operators to operate the plant properly.
The implication here is subtle but significant. The
designers of commercial plants have assumed thatthe operators are only a backup to the automatic
control. They expect operator action only if the automatic systems fail to perform properly and then
only to the extent needed to correct the immediateproblem. In addition, the commercial system isharder to understand and operators often have toreact to unexpected operation of automatic systems. This includes intervening in the operation of
automatic controls that are otherwise operating as
designed. Rapid manual operator action is often
necessary. Examples are the need to reset andthrottle HPI to prevent pump runout, and the rapid
actions required to prevent excessively low pressurizer level following a trip. The complexity of civili an nuclear plants is associated with some safetyadvantages, however. Much of this complexity
stems from the presence of more safety systems.
In addition, the typical commercial reactor control
room, with its multitude of alarms and indicators
provides significant automated warnings of insipient
problems and status changes. Navy reactors rely
more heavily upon operator surveillance for suchwarning.
Navy nuclear facilities typically require about 10
trained operators at all times with 4 on duty in thecontrol room. The operators are enlisted personnel
who have been trained to operate specific portionsof the plant. The plant shift also contains more experienced roving watch personnel who have abetter understanding of the entire plant operationand help to supervise individual operators. All ofthese personnel are directly supervised by the engineering officer of the watch (EOOW), a commissioned officer who is a graduate engineer and who
has received special training at the undergraduate
and graduate level in the fields necessary to support
nuclear operations. The EOOW also has had specialized training to ensure his capability to supervise
operators and plant operations
under normal and
136,137
emergency situations.
The EOOW is stationed in the control room directly overseeing theplant operators of the main control panels. Allchanges in plant status, responses to abnormal
605

conditions, requests to do maintenance, etc., areapproved and discussed with the EOOW.
A number of elements of this structure are
relevant. The EOOW is not an operator, he does
not operate equipment (although he was required to
do so at every watch station to become qualified)138 He is a supervisor and an integrator of theentire plant operation. In contrast, the enlisted
operators' responsibilities are for only a specificsection of the plant1 38 "139 Within each section they
have responsibility for operating, monitoring, following procedures, and taking actions as directed by
the EOOW.
I n contrast to the Navy, the NRC requires only
three licensed operators on site during operations ofcommercial reactors. Only one of these must be in
the control room. There are additional unlicensed
auxiliary operators on shift who perform many of theplant operations outside the control room. 126 The
senior reactor operator is given the responsibility ofsupervising plant operations and the licensed
operators in the control room. His training and qualifications, while more stringent than those for thereactor operators, are not comparable to those required for the engineering officer of the watch in the
U.S. Navy. Senior reactor operators are promoted
from the ranks of reactor operators primarily on thebasis of having demonstrated competent performance and passing a more rigorous examination. In
many ways, the SROs have been given the responsibility of the EOOW without the benefit of an engineering degree or the specialized supervisory
training received by EOOWs. In addition, they aresupervising generalists in plant operations rather
than specialists with assignments to specific partsof the plant.
The training and selection of personnel are alsosignificantly different in the Navy and in the civilian
programs. Navy programs have a highly organizedsystem of selection, training, qualification, continuing
training, and examination of its personnel. This system includes detailed selection criteria and screeni ng, and formal training programs using trained andskilled instructors with formally approved training
course materials. All facets of the program are frequently reviewed, audited, and inspected by trainedand experienced personnel . 140 Before assignmentof personnel to operating ships, they must complete
rigorous academic and practical training programs.
Each person must complete a 6-month classroom
course (equivalent
141 to 50 semester hours of classroom instruction)
and a 6-month training course
142
at an operating land-based prototype reactor
todemonstrate their fitness for duty onboard ship andto prepare them for such duty. 137 These prototypes

may be compared to nuclear powerplant simulators,
although, unlike commercial simulators, they arefunctioning nuclear reactors that closely resemble
powerplants onboard ships.
Once an operator arrives onboard ship, theoperator must completely requalify on the engineering plant of the particular ship. This includes written, oral, and practical examinations administeredby the ship's personnel
at each level of the qualifi143
cation program.
In addition, the crew is examined annually by anindependent examining team. This examination( operational reactors safeguards examination) emphasizes both individual knowledge as well as theability of entire watch sections to function during
actual, self-initiated casualty situations. 144,145 Al arge part of the examination covers diagnosis ofproblems, since the operators are not 145
warned ofcasualty drills before they are initiated.
Crews
that have significant weak areas are required totake immediate corrective action and to report suchaction to headquarters. Failure of the examination
will result in extensive retraining, requalification, andreexamination, until it is determined that145the crew
meets acceptable levels of performance.
I n every area described above concerning theNavy nuclear program, the civilian nuclear program
appears to fall short. There are no standardized
performance criteria and guidelines, and there is no
systematic meaningful review of training programs.
Simulators, which are the only available means of
training operators in actual plant emergency operation, are not required to be used in an effective
manner (they are used more as a demonstration
device than as a tool to develop proficiency in diagnosing and coping with accidents).
I n comparing related but dissimilar situations,care must be exercised in drawing unqualified conclusions.
Because of the design differences
between Naval and commercial reactors, we believe
i t would be inappropriate to incorporate all aspectsof the Navy system into the civilian program.

dresses those precursors relating specifically to thehuman factors application in control room design,operator training, emergency procedures, and thei ssue of the man-machine interface. This discussion and analysis documents the fact that, before
the accident, the NRC and the industry had been
alerted to the human factors problems, many ofwhich existed at TMI-2.
"Evaluation of Incidents of Primary Coolant Releasefrom Operating Boiling Water Reactors," WASH1260

In May 1972, the Atomic Energy Commission
ap146
pointed a seven-member study group
under theauspices of the Office of Operations Evaluation to
conduct an evaluation of incidents involving theunintentional discharge of significant release ofreactor coolant from the primary coolant system ofoperating nuclear powerplants. Of 50 reported
inadvertent releases or leakages, the study group
identified and studied eight that involved significant
releases. On October 30, 1972, the AEC publishedthe study group report WASH-1260.
The study group made many findings and recommendations, several of which dealt with control
room design, manning of the control room, operator
training, operating procedures, and feedback ofoperational experience.
The study group found that insufficient consideration had been given to displaying informationon control panels and to the location of controls in
relation to each other, particularly when only one
operator is required in the control room during
operation. 147 The group recommended that the industry develop control panel and control roomdesign standards or guides that address the humanengineering aspects of reactor operation during abnormal operating occurrences. 148
The report also discussed the need for further
consideration, during the control room designphase, for the instrumentation and controls and theirlayout, taking into consideration the number ofoperators, the information required by them to rapi dly diagnose and take proper corrective action in
response to unusual occurrences, and other humanengineering aspects of plant control systemdesign. 149 The study group made specific recommendations addressing the instrumentation needed
to provide the operator with the information essential to reaching proper operating decisions
during150
transients and postulated accidents.
The NRC regulations require only one licensed
operator to be on duty in the control room during
operation. In view of the fact that more than one

6. HUMAN FACTORS PRECURSORSI ntroduction

Before March 28, 1979, accident precursors, inthe form of reports of reactor instances, Congressional testimony, and correspondence, contained
warnings that an accident of the type that occurredat TMI-2 could happen. Section LC of this reportaddresses precursors relating to the design andfunction of the TMI-2 reactor. This section ad606

li censed operator was on duty in each of the eight
i nstances, the study group found that the number of
personnel in the control room was not a factor. The
study group recommended, however, that a guide
be developed to assist in evaluating the number ofreactor operators needed to cope with anticipatedtransients. They listed the criteria to be taken into
account in determining the size of the control room
staff. They further recommended that utilities ofcurrently operating plants and applicants for new
plants should be required to evaluate their control
room manning needs based on the these criteria.
It was found that the training and experience ofthe reactor operators in the eight incidents studied
appeared to be151
adequate and met the AEC guides
and standards
They also found, however, thatthe transients studied tended to be aggravated andprolonged by operator actions. The study group feltthat one of the causes
for this could have been in152
sufficient training.
It was recommended that the licensees and applicants should, to the extent practicable, use simulations to train and evaluate operator performanceand verify the adequacy of operating procedures.
Simulators should also be utilized to evaluate operator performance andadequacy of training during
153
operator licensing.
Additionally, the report contained a recommendation that licensees and applicants for licenses be required to submit plans and schedules for training oftechnicians and repairmen engaged in the testing
and maintenanceof safety related systems and154
components.
During the incidents studied, a number of deviations from operating procedures
and technical155
specifications were experienced.
The report indicated that operating procedures were either incomplete or deficient for coping with anticipatedtransients, and although some improvements 156
hadbeen made, further improvements were needed.
The report indicated that there was insufficienti nformation available to determine whether incident
reports were disseminated to facilities in a timely
manner or whether corrective action had been taken or planned to minimize the probability of recurrencein the plant where the transient oc157
curred.
The study group made a number of recommendations regarding reporting and dissemination ofoperating experience. It recommended that a system be developed and implemented to fully informli censees of incidents and unusual occurrences. It
further recommended that an incident reporting
guide be developed by the AEC, and enumerated
specific information to be reported. l 58 Finally, it

recommended that regulatory policies and procedures be revised to identify more clearly the
responsibility for review, decision making, investigation and documentation 159
with respect to incidents
and unusual occurrences.
On November 28, 1972, the director of regulation,
in a memorandum to three directors, indicated thatthe recommendations of WASH-1260 are to be implemented
by the appropriate regulatory director160
ates.
Some actions were taken to implement therecommendations of WASH-1260, including the following:
1. The NRC contracted with Sandia Laboratories to
conduct a study of human factors
problems of161
the Zion nuclear powerplant.
This will be discussed in a later portion of this section.
2. The AEC interacted with industry to develop in43
dustry standards for control room displays.
However, to date these standards have not beenendorsed by the NRC.
3. Incident and abnormal occurrence reporting requirements underwent evolutionary changes regarding reporting times and information requirements; however, the details and mechanism forutili ty review of events at other facilities do notappear to have been addressed by the NRC regulations. Furthermore, circumstances surroundi ng the handling of the 1977 incident of the Davis
Besse plant indicate the existingprocess fell
162
short of the recommendation.
4. Regarding information available to the operator ata nuclear powerplant during and subsequent to atransient or accident, the NRC has written Regul atory Guide 1.97 "Instrumentation to Follow the
Course of an Accident." However, as of March
28, 1979, this standard had not been fully implemented in either old plants or those undergoingli censing review.
5. Reactor simulators have found widespread use.
However, the recommendations of WASH-1260 in
the area of simulators have not been implemented; i.e., the NRC has virtually no requirements regarding simulators. They are not used to evaluate reactor operators' performance; they are notgenerally used to verify operating proceduresfor163
coping with anticipated transients;
the NRC
examiners seldom observe and evaluate operators on the simulator for their licensing examination and receive only scant information regarding
specific operators' performance. Furthermore,
the licensees do not use the simulator as a basis
for modifying operating procedures or for607

evaluating the need for operator training or retraining.

relatively low and took issue with the statement thatthe human error that has occurred "has seriously
jeopardized plant and public safety" because the"engineered safety features, redundant systems andcontainment design features have always, singly
and in combination,
165been available to protect plantand public safety."
BH&M testified that improvements in control roomdesign were one method of reducing the likelihoodof human error. They noted the complexity of nuclear powerplant control rooms, the differences incontrol room layout throughout the industry and theutilization of mirror images in common control rooms
for two nuclear units. They also maintained that"standardization of control rooms is a vital elementof safety...."The NRC response supported standardization in
general but claimed that standardization of control
rooms and controls and displays had not been
demonstrated to186
have a significant impact on operator performance
The NRC testimony also pointed to studies sponsored by the NRC and industry toevaluate control room design and indicated that theIEEE was developing a standard guide for designand control facilities for control rooms. 167
In discussing control room design, the NRC stated that due to the automatic initiation of the engineered safety features, the consequences of an
accident are mitigated and the only functions of theoperator are to ensure that these systems function
properly and to initiate any action that failed to occur. It therefore concluded that "the control roomdesign arrangement or operator-process interface
i s not as critical (or vital) to safety as may be inferred from the February 18, 1976 testimony." 167
The NRC did, however, recognize the importanceof human engineering principles, control roomdesign standardization, and optional arrangement ofdesign to minimize the probability of human error.lsa
BH&M testified that providing up-to-date simulators and more frequent training of operators is
another method of reducing the likelihood of humanerror. Specifically, they indicated that the present
simulators were outdated and did not represent thecontrol philosophy that has evolved over the last 10
years. Additionally, they questioned the ability ofthe operator to remember the accident procedures
through time without very frequent update, indicatingthat retraining periods are too infrequent to keep theoperator aware of169
his special procedures under accident conditions.
I n response, the NRC disagreed with the contention that the simulators are outdated for training
programs, pointing out that the design philosophy
for data display and plant control for operating
plants and those in the operating licensing stage of

Human Performance March 13,1975, Memorandum
from Hanauer to Commissioner Gilinsky

On March 13, 1975, Dr. Stephen H. Hanauer,
Technical Advisor to the Executive Director forOperations of the NRC, initiated a memorandum toCommissioner Gilinsky to which he attached his
views on important technical reactor safety issues
facing the Commission and reactor safety policy issues.
I n his list of technical reactor safety issues,
Hanauer addressed the subject of human performance, stating:Present designs do not make adequate provision
for the limitations of people. Means must be foundto improve the performance of the people on whom
we depend and to improve the design of equipment
so that it is less dependent on humanperformances .... The relative roles of humanoperation and automation (both with and without
on-line computers) should be clarified. Criteria areneeded regarding allowable computerized safetyrelated functions and computer hardware andsoftware requirements for safety-related applications.

At the time of the TMI-2 accident, no substantive
action had been taken by the NRC as a result of thismemorandum addressing the human performancei ssue. No criteria have been developed by the NRC
regarding the roles of human operation and automation or computer aids for the operator.
Hearings Before the Joint Committee on Atomic
Energy, Congress of the United States, February 18,
23, and 24, and March 2 and 4, 1976

Three former General Electric employees, Dale G.
Bridenbaugh, Richard B. Hubbard, and Gregory C.
Minor (BH&M), testified before the Joint Committee
on Atomic Energy. They cited numerous examplesof human factors deficiencies in the nuclear poweri ndustry. They pointed out examples of incidents
resulting from human error that could have resulted
i n major accidents. To minimize these errors, they
made specific recommendations in the area of control room design, the availability of up-to-date simulators and their utilization for more frequent trainingof control room operators, the adequacy of operational and maintenance procedures, and the trainingof operators to use these procedures. The NRC, on
March 2, 1976, testified before the Joint Committee
i n response to the testimony of BH&M.
The NRC concluded that nuclear reactors aredesigned to keep the likelihood of operator errors
608

review are very similar to the design philosophy ofexisting nuclear powerplant simulators. 170
The NRC pointed out that there was no requirement for simulator training, and if simulators areused, the operator is also trained at the plant for
which he seeks his license. The NRC testified thatit ensures that transition from simulator to plant has
been made by the trainee through examination at
the facility for which the individual seeks alicense .171
The NRC agreed that it is unrealistic to expect
the operator to remember details of accident procedures over a long period of time. In 1973, the
NRC promulgated an amendment to 10 C.F.R. 55 byadding Appendix A, "Requalification Programs forLicensed Operators of Production and Utilization
Facilities." This program requires periodic review of
all abnormal and emergency procedures. The NRC
has not conducted any tests, nor are they aware of
any tests by others to determine how long an
operator is able to retain procedural details. 172
BH&M further testified, "Most human errors inreactor plants result from one of two causes:
i nadequate procedures or insufficient knowledge ofexisting procedures." t73 They recommended that
the NRC review operational and maintenance procedures to ensure adequacy of both scope andcontent and that it step up its surveillance of training
processes to ensure that the174
procedures are fully
understood and implemented.
The NRC responded that guidance in the
preparation of procedures is provided to the applicant in Regulatory Guide 1.33 which incorporates industry standards. It pointed out that the utility plans
are reviewed to assure compliance with this guideand that NRC inspectors conduct an audit of the detailed procedures to assure their completeness prior
to the issuance of an operating license. 175 Review
and approval of procedures and amendments thereto is conducted by 176
utility management according to
the NRC testimony.
The NRC testified that training programs are reviewed to ensure that all personnel receive satisfactory training on all procedures appropriate to theirrespective job classification and responsibility. Additionally, the requalification program includes lectures on procedures, annual written examinations
which include a section on procedures, requirements for licensed individuals to review procedurechanges, and an evaluation by supervisors oflicensed individuals
to ensure proficiency in plant
176
procedures.
In reviewing the foregoing testimony, we believe that it provides a useful insight into the NRC's
attitude towards human factors and nuclear reactor
safety. In essence, the NRC staff's response is that

operators are well trained, there have been no serious accidents, and that automated systems can bedepended upon to assure plant and public safety.
Other than the fact that there were ongoing studies
in the area of human factors application to control
room design, the NRC did not develop programs
responsive to the BH&M recommendations because
the agency maintained human error was not adanger to safe operation of nuclear powerplants.
Although the NRC stated that it would implement
the recommendations resulting from the aforementioned studies, virtually none of these recommendations for improvement in control room design,operator training and procedure improvement has
been implemented by regulations as of March 28,
1979.
"Preliminary Human Factors Analysis of Zion
Nuclear Power Plant," NUREG 76-6503, October
1975
The NRC contracted with the Sandia Laboratories to conduct a study of the Zion nuclear plant.
The scope of this study was limited to the humanfactors problems associated with engineered safety
panels in the control room and associated procedures for coping with a LOCA.
The Sandia report66
was published in October 1975.
The report contained a number of significant conclusions and recommendations for human factors
improvements in the Zion plant that are equally applicable to other nuclear powerplants. It was foundthat the control panels and other man-machine interfaces deviated from accepted human engineering
standards and increased the probability of humanerror. Improvement in human performance could beachieved by relatively minor and inexpensivechanges to the control room, practicing for emergencies, and changes in format and content of written procedures. The report concluded that industrywide standards covering all aspects of human reli ability could serve to materially improve the impact
of human performance on system availability and177
safety.
The study found that the major human engineeri ng problems fell into seven major areas:• poor layout of controls and displays,• poor and inconsistent color philosophy,• too many annunciators,• too many exceptions to the go-no-go coding

scheme employed for rapid assessment of monitor panel status,• labeling that provides little or no location aid tocontrols and displays,609

• misleading labeling due to violation of population
sterotypes, and• i nsufficient labeling on valves. 178

The report also pointed out that the human factors problems uncovered in the study were notpeculiar to the Zion nuclear powerplant. Previous
visits to other plants by the same investigators revealed similar human factors problems in eachplant. 179
The report contained the following four recommendations for consideration by the NRC:

1. Investigate the need for additional human factors
data, and develop, on an exploratory basis, amethod for acquiring the necessary information.
Part of the study should be the determination ofwhat level of information is needed. Whateverlevel of human error data collection system isdeemed necessary, the suggested study should
include the procedures and data forms for collecting human performance information.
2. Develop the procedures and format for incorporating human performance information (asdetermined in item 1 above) into the NPRDS.
3. Perform a complete human factors analysis at
the Zion Plant (that is, expand the present preli minary analysis) to:a. Identify all major error-likely situations related to the safeguards systems.
b. Estimate the relative likelihood of humanerrors and associated recovery factors
for those errors identified as important by
the reliability models.
c. Provide recommendations (based on theabove) for improving human reliability at
the Zion (and similar) plant(s) and fordesign of future plants.
d. Develop a procedure for a human factors
analysis of nuclear powerplants which
could be used during all phases of designand development to improve human reliability consistent with other systems engineering requirements.
4. Upon satisfactory completion of item 3 above,
develop industrywide standards for human engineering of equipment, written procedures,operating methods, and onsite training and practice provisions in nuclear powerplants to insure
the highest levels of human reliability consistent
with other system requirements.

expedite our efforts. Programs are underway tosystematize human error analysis and human error
data evaluations through contracts, including thatwith Dr. Swain at Sandia Laboratory. If the resultsof these programs or actual experience with operati ng reactors indicate situations in which equipment
design or operator interfaces should be improved,
we will, in accordance with our statutory responsibilities and our implementing review procedures, require changes to the design or operation of theplants as required."
To date, virtually none of the report's recommendations have been implemented. It should be notedthat even though the 1975 Sandia report on the Zion
plant found that minor inexpensive improvements
would enhance plant safety and operations, to ourknowledge not one has been implemented, and asof March 28, 1979, none had been planned for implementation.
"Plan for Research to Improve the Safety of Light
Water Nuclear Power Plants," NUREG-0438

On April 12, 1978, the NRC made its first annual
report to Congress on its recommendations forresearch on improving the safety of light water nuclear powerplants. Among the recommendations
was one dealing with improved inplant accident
response.
The research recommendation covered operator
response during an accident situation, information
available to the operator on plant status, operator
training and procedures, and human response understress conditions.
It was proposed that the
research include not only operators in the control
room, but also personnel involved in the testing andmaintenance of the plant. It was pointed out thatanalyses have shown components may be left in an
unavailable state by test and maintenance personnel
through carelessness, improper training, use of im181
proper procedures or failure to follow procedures.
The proposed research would encompass computerized processing of data, control room layout
and data presentation, and attention to human factors in the design of annunciators, warning lights,
and display panels.
This research project was assigned a high priority by the NRC report because of its high potential
for risk reduction and its low cost. The report proposed a project to review studies completed and inprocess on the following
topics to establish the182
need for further research:

We found that the human factors problems identified in this study are similar to those identified inother studies that predate the TMI-2 accident andthose found in subsequent studies by Essex Corporation. On August 24, 1976, the Chairman of the
NRC, Marcus A. Rowden, wrote to the Honorable
Virginia H. Knauer, Special Assistant to the
President for Consumer Affairs. In his letter Chairman Rowden stated in part, "We believe that humanerror analyses must not be neglected and indeed a
special research review group on human error assessments has been established to coordinate and• human errors in testing and maintenance;• monitoring and diagnostic systems to assist theoperator under accident conditions;610• operating and emergency procedures forresponding to accident situations;• i mproved use of simulators in studying operator
response to accident situations and for related
training;• man-machine interface, information presentation,
pattern recognition, control room design, and automatic controls for safety systems; and• human initiation of accidents.

Other Precursors

I n addition to the precursors discussed previousl y, others should be mentioned. The Electric Power
Research Institute (EPRI) has sponsored a numberof research projects to evaluate the application ofhuman factors in control room design. One suchreport, EPRI NP-309, 65 describes a study conducted by the Lockheed Missiles and Space Company,
I nc. of Sunnyvale, Calif. Lockheed evaluated five recently operational nuclear powerplants using humanengineering expertiseand standards developed in184
other industries.
The report discusses various deficiencies foundi n the five plants. The findings are typical of thosei n the precursors discussed earlier. These include
lack of attention to control room design, poor
designs of individual control panels, inappropriate
placement of instruments and controls, unreliable indicators and use of negative indications, complexityof the annunciator-warning systems, underuse ofproven coding techniques, and inconsistencies in labeling.
The EPRI report concluded that:

This research project was scheduled to begin inearly FY 1980. The TMI-2 accident reinforced theneed for high priority and resulted in accelerating
the project initiation to the end of FY 1979.
We note that the purpose of this research project
was to identify new areas for research in humanfactors while ignoring the large body of information
being utilized by other industries that could bereadily adaptable to the nuclear powerplant industry.

"1978 Review and Evaluation of the Nuclear
Regulatory Commission Safety Research Program,"
NUREG-0496

As a first priority, a detailed set of applicable humanfactors standards must be developed andi ndustry-wide
acceptanceshouldbepromoted .... In addition to a comprehensive set ofstandards, a need is perceived for human factors
engineering design guides specific to the needs ofthe nuclear power industry.* 5

In December 1978, the Advisory Committee on
Reactor Safeguards sent to the Congress its
183
evaluation of the NRC safety research program.
This evaluation recommended that research be conducted on a high priority basis in the area of the
man-machine interface. Such research would include an examination of the potential for and consequences of human errors. Furthermore, the ACRS
recommended exploration of computer-controlled
automation in the control room and that control
room equipment emphasize diagnostic informationthat would simplify decisionmaking. The ACRS indicated that, along with development of advanced
computers and graphic displays for the control
room by industry, independent NRC research isnecessary; i.e., research to support the "licensing
review" of the advanced control room designs andto develop criteria, guides, and standards. The
ACRS also recommended that the NRC conduct a
more systematic review and evaluation of operational experiences at U.S. and foreign nuclear powerplants.
Analysis of the TMI-2 accident, in our opinion,
has highlighted the importance of the application ofhuman factors principles to control room design,operator training, and procedures. Although additional research in this area may be justified, the time
has come to write standards and modify existingand new powerplant control room design, procedures, and training programs.

Another study "Human Engineering of Nuclear
Power Plant Control Rooms and its Effects on
Operator Performance," prepared for the NRC by
the Aerospace Corporation of El Segundo, Calif.,
was published during February 1977 as Aerospace
Report No. ATR-77(2815)-1. The Aerospace Corporation evaluated the effects of human engineering
on operator performance in the control room. It
specifically examined what Aerospace considered
to be the three general groups of factors that influence operator performance 186
in fulfilling their responsibilities in the control room:• control room and control system design,• operator characteristics, and• j ob performance guides.

In conducting i ts study,
the Aerospace
Corporation's study group visited 10 facilities containing
18 control rooms and 3 control room simula187
torsAs a result of its study, the Aerospace Corporation made three recommendations to NRC:

1. Development of a regulatory guide to provide
directions to the utilities in human engineering ofcontrol rooms; the guide should be designed to611

encourage an increased rate of incorporation ofadvanced control and display concepts.
2. A thorough analysis of LER data on personnel errors to establish meaningful cross-correlation of
results of plant status in relation to licensing at
the time of the accident, operational power levels,
equipment and control elements involved,
event
l 9
significance, radioactivity release, etc. s
3. A detailed study of the programmed malfunctions
provided in the software routines of current simul ators to determine whether they "have thecapability ... to provide student operators with thel evel of training needed to minimize operator errors under conditions of severe stress." It was
further recommended that the study evaluate the"effectiveness of operator training in severe accidents on a simulator which does not realisticallymodel the control board layout of the plant for
which the operator is to be licensed (or relicensed). " 1903.

4.

We found that virtually no action had been takenby the NRC to implement these recommendations.
7. RECOMMENDATIONS

Our investigation found that operator actions andi nactions had significant impact on the course of theTMI-2 accident. Actions that adversely affected thecourse of the accident should not be simply viewed
as operator error. Facets of control room design,
emergency procedures, operator training, and previous operator experience and practices had a significant impact on the operator's response to the accident. When viewed from a human factors perspective, this impact may have effectively precluded
the operator from preventing or ameliorating the accident.
Thus, we conclude that the integration of humanfactors principles and disciplines into all facets ofthe design, construction, operation, maintenance,
testing, and regulation of nuclear powerplants will
significantly improve nuclear safety. Within thiscontext, the following recommendations should be
i mplemented:
1.

2.

5.

6.

7.

The NRC should develop an interdisciplinary
human factors capability. The organizational
unit should be placed at a sufficiently high level within the NRC to ensure its impact
throughout the NRC.
The NRC should require the development andimplementation of formal human factors programs by utilities, vendors, and architectengineer organizations.
These programs

8.

9.

612

should ensure the application of human factors principles to all aspects of plant design,
construction, and operation including plantmaintenance, health physics protection, andradioactive waste handling.
The NRC should promulgate detailed regulations requiring the application of human factors principles to design of new nuclear
powerplant control rooms.
The NRC should initiate a program of control
room enhancement. This program shouldhave near term and long term goals. In thenear term, the NRC should conduct an onsite
human factors evaluation of control rooms inoperating plants and plants for which operati ng licenses are imminent. This evaluation
should be staffed by experienced human factors personnel. Where human engineering deficiencies i n accident-related i nformation
display are found, expeditious corrections
should be required. On a long term basis, the
NRC should conduct an indepth evaluation of
nuclear powerplant control rooms to determine the adequacy of the man-machine interface. On the basis of this evaluation, the NRC
should require modifications in those control
rooms that NRC determines necessary to ensure adequate safety.
Additional diagnostic operational aids, such as
logic trees or disturbance analyzers, should be
required in all control rooms. To expedite thisrecommendation, it may not be necessary initially to apply safety criteria such as redundancy to hardware additions.
The NRC should certify and approve operator
training facilities, training instructors, and training curricula. The NRC should evaluate theoverall training programs periodically.
The NRC should require increased emphasison diagnostic, hypothesis testing, and accident response training of control room operators. Such training should include simulator
operations that reflect the operating characteristics of the control room for which theoperators are licensed or for which licensing issought.
Analysis and research should be performed todetermine operator responsibilities and actions during normal and abnormal conditions.
The results of this analysis should be used asa basis for determining operator selection andtraining criteria, manning levels, and procedural
format and content.
Until recommendation 8 can be implemented,
the NRC should require that all hot operations

10.

11.

shifts be manned by a minimum of one SRO,
two CROs, and one additional individual withdemonstrated and tested capabilities in abnormal system diagnosis. Two of these individuals
should be required in the plant control room at
all times. Less than this minimum should not beallowed at any time during hot operation.
The NRC should require powerplant operations supervisors and management personnel
to be trained in investigation techniques andreporting methods for events involving humanbehavior.
The NRC should conduct an immediate reviewof the emergency procedures of all operating

12.

13.

613

plants to identify and correct problems associated with symptoms identification, technicalaccuracy, and systems compatibility.
The NRC should develop improved methods
for measuring operator performance and theeffectiveness of training programs in meeting
training objectives. These methods should use
written examinations, oral examination in theoperators' plant, and assessments of performance on simulators reflecting normal and abnormal plant conditions.
The NRC should consider the licensing of auxili ary operators and testing and maintenancepersonnel for specific plants.

REFERENCES AND NOTES

NRC, Investigation into the March 28, 1979 Three Mile
Island Accident by the Office of Inspection and Enforcement, NUREG-0600, August 1979.
2
Report of the President's Commission on the
Accident at Three Mile Island, "The Need for Change; The
Legacy of TMI," October 1979.
3
Sec. II.C, Plant Behavior and Core Damage, Subsec.
II.C.2.
4
Sec. 11.13, Alternative Accident Sequences, Subsec.
II.D.1.
5
Three Mile Island Nuclear Station Unit 2 Emergency
Procedures 2202-1.5, Pressurizer System Failure, Rev. 3,
September 29,1978.
8
This design is a specific violation of accepted humanfactors principles as contained in Mil-Std-1472B, para.
5.2.2.1.5.
7
Bryan interview (IE), Tape 278, at 12.
8Sec. I.C Precursor Events, Subsec. I.C.15.
9NRC, "Investigation into the March 28, 1979 Three
Mile Island Accident by the Office of Inspection and
Enforcement," NUREG-0600, August 1979, at 1-1-3.
10Bryan interview PE), Tape 278, at 6.
11
Bryan interview (IE), Tape 198, at 25-28.
12Faust, Frederick, Scheimann, and Zewe dep. at
154-155.
13Oversight Hearings Before a Task Force of the Subcommittee on Energy and the Environment of the Committee on Interior and Insular Affairs, House of Representatives, 96th Congress, 1st Sess. 96-8, Part I (May 9, 10,
11, and15, 1979) at 170.
14
Chwastyk
dep. at 71-72.
15
Sec. II.A, Appendix: Tabular Chronology, 24 minutes
58 seconds.
16Sec. II.A, Appendix: Tabular Chronology, 2 hours 18
minutes.
17
NRC, "Investigation into the March 28, 1979 Three
Mile Island Accident by the Office of Inspection and
Enforcement," NUREG-0600, Sec. 4.3, August 1979.
18Sec. II.D.
19
Pres. Com. Hearing (May 30, 1979) at 194.
20
Three Mile Island Nuclear Station Unit 2, Emergency
Procedure 2202-1.3, Loss of Reactor Coolant/Reactor
Coolant System Pressure.
21The Essex Corp., "Human Factors Evaluation of Control Room Design and Operator Performance at Three
Mile Island-2," NUREG/CR-1270, Vol. 1: Final Report,
December
1979.
22Sec. II.D.
23See Faust, Frederick, Scheimann, and Zewe dep. at
124.
24Hearings Before Committee on Interior and Insular
Affairs, Task Force on Three Mile Island (May 11, 1979,
10:00 a.m.) at 43.
25
Letter from E. Frederick to J. Seelinger, TMI-2
Superintendent for Technical Support, April 1978.
26
The Essex Corp., "Human Factors Evaluation ofControl Room Design and Operator Performance at Three
Mile Island-2," NUREG/CR-1270, Vol. 1: Final Report,
December 1979, at 25.
1

27

28

II.C.1.

Id. at 23.

Sec. II.C, Plant Behavior and Core Damage, Subsec.

29The Essex Corp., "Human Factors Evaluation ofControl Room Design and Operator Performance at Three
Mile Island-2," NUREG/CR-1270, Vol. 1: Final Report,
December 1979, at 24.
30
Id. at 27.
31
NRC, "Program Summary Report," NUREG-0380,
Vol.323, No. 5, May 1979, at 3-2.
Proposed Amendment to 10 C.F.R. Part 50, "Licensi ng of Production and Utilization Facilities," to add Appendix A, "General Design Criteria for Nuclear Power Plant
Construction Permits," (32 Fed. Reg. 10213) July 11, 1967.
pp. 10213-10216.
33Met Ed, "Preliminary Safety Analysis Report (PSAR),
Three
Mile Island Nuclear Station-Unit 2."34
1 nstitute of Electrical and Electronic Engineers, Inc.,"Proposed IEEE Criteria for Nuclear Power Plant Protective35Systems," IEEE 279, August 1968.
l nstitute of Electrical and Electronic Engineers, Inc.,"Trial Use Standard Criteria for Safety Systems for
Nuclear Power Generating Stations," IEEE Standard
603-1977.
36Met Ed, "Preliminary Safety Analysis Report (PSAR),
Three
Mile Island Nuclear Station-Unit 2," Vol. 3, Sec. 7.4.
37
For example: U.S. Military Standard 1472B, Human
Engineering Requirements for Military Systems, Equipment and Facilities, December 31, 1974. This standard
i ncludes detailed design guidelines, principles, andrequirements.
38
NRC, "Standard Review Plan for the Review of
Safety Analysis Reports for Nuclear Power Plants, LWR
Edition," NUREG-75-087, September 1975.
39Regulatory Guide 1.47, "Bypassed and Inoperable
Status Indication for Nuclear Power Plant Safety Systems," May 1973.
40
Regulatory Guide 1.97, "Instrumentation for Light
Water Cooled Nuclear Power Plants to Assess Plant Conditions During and Following an Accident," Rev. 1, August
1977.
41
Military Specification "Human Engineering Requirements for Military Systems, Equipment and Facilities," MIL
H-46855, para. 3.2.1.3, May 2,1972.
42
Regulatory Guide 1.114, "Guidance on Being Operator
at the Controls of a Nuclear Power Plant," Rev. 1, Nov.
1976.
43
1nstitute of Electrical and Electronics Engineers, Inc.,"IEEE Recommended Practice for the Design of Display
and Control Facilities for Central Control Rooms of
Nuclear Power Generating Stations," IEEE Standard
566-1977, July 1977.
"The Essex Corp., "Human Factors Evaluation ofControl Room Design and Operator Performance at Three
Mile Island-2," NUREG/CR-1270, Vol. 1: Final Report,
December 1979, at 116-118.
45
14. at 118.
46Met Ed, "Fini46afety Analysis Report (FSAR), Three
Mile Island Nuclear Station-Unit 2," Vol. 6, Secs. 7.4,
7.5.1.2, 7.5.2.

614

88

10 C.F.R. Part 55, 28 FR 3197, April 3,1963.
Examples are: Regulatory Guide 1.8, "Personnel
Selection and Training," and Regulatory Guide 1.134," Medical Evaluation of Nuclear Power Plant Personnel
Requiring Operating Licenses."88
See NUREG-0094, "NRC Operator Licensing
Guide-A Guide for the Licensing of Facility Operators
Including Senior Operator," July 1976. This document
provides guidance on details such as the logistics ofscheduling and administering examinations, topical content of examinations, and copies of pertinent NRC forms.
89
For example, Regulatory Guide 1.8 refers to ANSI
18.1-1971, "Selection and Training of Nuclear Power Plant
Personnel," as providing an acceptable basis for theselection and training of nuclear powerplant personnel
except for the position of supervisor-radiation protection.
Also, Regulatory Guide 1.134 refers to ANSI N546-1976," Medical Certification and Monitoring of Personnel Requiri ng Operator Licenses for Nuclear Power Plant," for use
by an examining physician in determining whether anapplicant is medically qualified.
90
10 C.F.R. Sec. 55.11(b).
91
10 C.F.R. Sec. 55.11(a).
92
Regulatory Guide 1.134 "Medical Evaluation of
Nuclear Power Plant Personnel Requiring Operating
Licenses," Rev. 1, March 1979.
93
Appendix A to Part 55, "Requalification Programs forLicensed Operators of Production and Utilization Facilities," was effective in 1973 at the same time requalification program requirement for utilities was established in
10 C.F.R. Sec. 50.54.
94
10 C.F.R. Sec. 55.20.
95
10 C.F.R. Sec. 55.21 and 55.22.
98
10 C.F.R. Sec. 55.23. The Commission may admini ster a simulated operating test prior to the initial criticalityof the reactor upon a showing by the utility involved ofi mmediate need for the applicant's (for an operator
li cense) service and of the applicant's qualifications, 10
C.F.R. Sec. 55.25.
97
10 C.F.R. 55.11(b).
98 NRC, "NRC Operator Licensing Guide-A Guide forthe Licensing of Facility Operators, Including Senior
Operators," NUREG-0094 (Rev. 1 of WASH-1094), Sec.
IX, July 1976.
99
ld. at Sec. VIII.
100
Id. at Appendix F.
1 1° Id. at Appendix G.
102
NRC Public Meeting, "Briefing on Procedures for
Qualifying Reactor Operators," April 20,1979, at 65.
103
Summary of Telephone Conversation Between H.
Ornstein, NRC/SIG, and R. Zechman, TMI Training Staff,
December 13,1979.
104
10 C.F.R. 55.10(a).
105
10 C.F.R. Part 55, Appendix A.
106
Met Ed, "Final Safety Analysis Report (FSAR), Three
Mile Island Nuclear Station-Unit 2," Vol. 9, Sec. 13.2.
107
Id. at Sec. 13-2.1.1.1.d.
1°8A 1- or 2-week simulator course encompassing 40
hours per week, half of which is devoted to classroom
work and the other half to actual simulator work.
"Letter from Miller, Met Ed, to Collins, NRC, dated
July 5,1977.

The Essex Corp., "Human Factors Evaluation ofControl Room Design and Operator Performance at Three
Mile Island-2," NUREG/CR-1270, Vol. 1: Final Report,
December 1979, at 35.
at 35-37.
49
Id. at 37-39.
50
Id. at 40.
51
Id. at 40, 42.
47

87

48Id.

52

53

Id. at 38, 40.

Id. at 43.
The Essex Corp., "Human Factors Evaluation ofControl Room Design and Operator Performance at Three
Mile Island-2," NUREG/CR-1270, Vol. 1: Final Report,
December 1979, at 43-46.
54

55

Id. at 48.
Id. at 47.
57
Id. at v-vi.
58
Id. at 31.
59
14 at 62.
80
14. at 37.
81
Id. at 40.
62
Id. at 42.
83
Id. at 43-46.
64
0. at 47.
85Lockheed Missiles & Space Co. Inc., "Human Factors Review of Nuclear Power Plant Control Room
Design," EPRI NP-309 (Research Project 501), November
1976.
66
A. D. Swain, Sandia Laboratories, "Preliminary
Human Factors Analysis of Zion Nuclear Power Plant,"
76-6503, October 1975.
67
Lockheed Missiles & Space Co. Inc., "Human Factors Review of Nuclear Power Plant Control Room
Design," EPRI NP-309 (Research Project 501), November
1976.
88
Id. at 1-6 to 1-11.
89
Id. at 1-12.
70
14. at 1-12 and 1-13.
71
Id. at 1-13 to 1-16.
at 1-18.
73
Id. at 1-13.
at 1-20.
at 1-21.
76
A. D. Swain, Sandia Laboratories, "Preliminary
Human Factors Analysis of Zion Nuclear Power Plant,"
76-6503, October 1975, at 13.
at 6-7.
78
The Essex Corp., "Human Factors Evaluation ofControl Room Design and Operator Performance at Three
Mile Island-2," NUREG/CR-1270, Vol. 1: Final Report,
December 1979, at 72.
7
"A d.
74.
8
ofd. at 77-78.
81
Id. at 78.
at 79.
83
42 U.S.C. Sec. 2137.
84
Sec. 11(r) of the Atomic Energy 4t of 1954, 42
U.S.C. 2014 o.
85
10 C.F.R. 55.4(f).
58

721.

74Ad.

75Ad.

77Id.

82kY2

615

' * Letter from Miller, Met Ed, to Collins, NRC, dated
September 7,1977.
"Met Ed, "Final Safety Analysis Report (FSAR), Three
Mile Island Nuclear Station-Unit 2," Vol. 9, Secs.
13.2.2-13.2.2.4.
112
Enclosure (B&W Cold Licensing Training Program)to Memorandum from Elliot, B&W, to Collins, NRC, March
14,1977.
'3Met Ed, "Preliminary Safety Analysis Report (PSAR),
Three Mile Island Nuclear Station-Unit 2," Vol. 3, Sec.
12.2.1.
n4This conclusion was reached upon examination of
TMI operator license applications and supporting documents; confirmed in a telephone conversation, NRC-SIG(Omstein) to NRC-OLB, (P. Collins), December 18,1979.
'5The Essex Corp., "Human Factors Evaluation ofControl Room Design and Operator Performance at Three
Mile Island-2, NUREG/CR-1270, Vol. 1: Final Report," at83, December 1979.
'*Id. at 90.
117Id. at 92.
'Bid. at 91.
'9Id. at 93.
120
Id. at 94.
21
Id.
at 95.
'
122Id. at 97-98.
123
14. at 99.
124Id
96.
. at
125
10 C.F.R. 50.54(k).
12ernree Mile Island Nuclear Station Unit 2, Technical
Specifications, Appendix A to License No. DPR-73,
NUREG-0432, Sec. 6.2.2. February 8,1978.
127Operator Examination Scores were obtained from
NRR-OLB's files.
128
NRC Public Meeting, "Briefing on Procedures for
Qualifying Reactor Operators," April 20,1979, at 52.
129Id. at 67, 78.
13O
Records of operators training courses wereobtained from NRR-OLB's files (license applications).
131 NRR Information Report (Denton) to Commissioners"A Statistical Profile of Licensed Operators and Senior
Operators and a Statistical Profile of Commercial Airline
Pilots and Merchant Marine Engineering Personnel,"
SECY 330A, dated May 9, 1979.
132

Records of operators experience were obtained
from NRR-OLB's files (license applications).
133
Naval nuclear powered ships have accumulated
over 1800 reactor-years of operation since the USS Nautilus first put to sea in 1955, as compared with more than
460 reactor-years accumulated in land-based nuclear
powerplants (NRC, "Program Summary Report" Vol. 3,
No. 7, July 20, 1979). Admiral Rickover indicated that
there has never been an accident or any significant
release of radioactivity that has had a significant effect on
the environment during that time. (Ref. 134 at 2).
134

Statement of Admiral H. G. Rickover, USN Director,
Naval Nuclear Propulsion Program Before the Subcommittee on Research and Production of the Committee on
Science and Technology, U.S. House of Representatives,
May 24,1979, at 14.
M

id. at 15.

Id. at 28-30, 43, 56.
NRR I nformation Report to the Commission, "Comparison of the Navy/Industry Training and Requalifications
Program," SECY-79-3300, July 5,1979, at 3.
138 Id. at
4.
139
Statement of Admiral H. G. Rickover, USN Director,
Naval Nuclear Propulsion Program, before the Subcommittee on Research and Production of the Committee on
Science and Technology, U.S. House of Representatives,
May 24,1979, at 87.
fold. at 81-84.
141
Id. at 42.
142/d. at 53.
1 13' 14. at 85-88.
' 44!d. at at 93-95.
145/d. at 105-107.
148
U.S. Atomic Energy Commission, "Evaluation of
Incidents of Primary Coolant Release From Boiling Water
Reactors," WASH-1260, October 1972, at 1.1.
147
Id. at 43.
14%. at 44.
149
Id. at 29.
150
14. at 43.
151
Id. at 28.
152
14. at 28.
1 53/4. at 43.
154
14. at 42.
1 55
14. at 28.
156
ld. at 43.
157
Id. at 44.
158
ld. at 45.
M
id. at 46.
160
Memorandum from L. M. Muntzing, NRC, to F. E.
Kruesi, J. F. O'Leary, and L. Rogers, "Implementation of
Recommendations of the Regulatory Study Group,"
November 28, 1972.
161
A. D. Swain, Sandia Laboratories, "Preliminary
Human Factors Analysis of Zion Nuclear Power Plant,"
76-6503, October 1976.
1 2
s Sec. I. C, Precut sor Events.
13
Lind dep. at 59-66 (Pres. Com.).
184
Attachment "Important Technical Reactor Safety
I ssues Facing the Commission Now or in the Future," toMemorandum from S. H. Hanauer, Technical Advisor
EDO, NRC to Commissioner Gilinsky, NRC, Subject:
Technical Issues, dated March 13,1975, at 2
165
Investigation of Charges Relating to Nuclear Reactor
Safety Hearings Before the Joint Committee on Atomic
Energy, 94th Cong., 2nd Sess. (February 18, 23, and 24,
and March 2 and 4, 1976), Vol. 1: Hearings and Appendixes 1-11, at 913.
1°ld. at 929.
187
14. at 930.
18
14. at 930-931.
189
Id. at 555.
17°14. at 933-934.
171
Id. at 935.
172
Id. at 936.
173
14. at 555.
136
137

616

174. at 556.

Id. at 937.
178
14. at 938.
1
rrA. D. Swain, Sandia Laboratories, "Preliminary
Human Factors Analysis of Zion Nuclear Power Plant,"
76-6503, October 1975, at 3.
1781. at 6-7.
179
Id. at 1.
'Bold.
at 10.
' 81NRC, "Plan for Research to Improve the Safety ofLight-Water Nuclear Power Plants-Report to theCongress of the United States of America," NUREG0438,
April 1978, at 23.
'8214. at 42.
183
Advisory Committee on Reactor Safeguards, NRC,
"1978 Review and Evaluation of the Nuclear Regulatory
175

Commission Safety Research Program. A Report to theCongress of the United States of America," MUFEG0496, December 1978.
184
Lockheed Missiles and Space Co., Inc., "Human
Factors Review of Nuclear Power Plant Control Room
Design," EPRI NP-309 (Research Project 501), November
1976.
185
Id. at 1-28.
1
BTThe Aerospace Corporation, "Human Engineering of
Nuclear Power Plant Control Rooms and its Effects on
Operator Performance." ATR-77 (2815)-1, February
1977,
at 1-1.
187
14. at 1-7.
Mid. at 7-13.
189
Id. at 7-14.
19
oId. at 7-15.

F ENVIRONMENTAL AND
SOCIOECONOMICI MPACTS
1. INTRODUCTION

The study has several components that are used inthis section. Most of the information on evacuation
behavior, individual costs, and concerns and attitudes are from a telephone survey conducted byMountain West in the vicinity of TMI in late July andearly August 1979. A randomized quota sample of1500 households within 55 miles of TMI was used.
The quota's size was greater for households closest
to TMI. Additional information on the accident's effects on individuals was developed in a number of
personal interviews with area residents conductedby investigators from Mountain West Research, Inc.
The report of the Task Group on Behavioral Effects
to the President's Commission on the Accident atThree Mile Island was a major information source on
mental health and psychological stress. Other studies concerned with mental health and psychological stress currently in progress were also reviewed,
and discussions have been held with officials of thePennsylvania Department of Health and staff
members of the Hershey Medical Center.
I nformation on the economic effects on various
sectors of the local economy has been collected byseveral agencies of the Commonwealth of Pennsylvania as part of the State's analysis of the accident.
The overall effort is being coordinated by the OfficeThis section addresses the social and economic
effects and the effects on aquatic biota and fisheriesof the Three Mile Island accident. The sequence of
events during the accident is described in otherparts of the report. The purpose of this section is
to explore response to the accident and the resulti ng economic, social, and associated effects-both
immediate and continuing-on the public, local
government, and institutions. Although a number ofstudies dealing with these various aspects of theaccident are continuing, the data and informationcompiled to date are sufficient to draw general conclusions with considerable confidence.
The sources of information provided herein areseveral. In the social and economic areas, most of
the information was developed or obtained within
the framework of an NRC-sponsored study of thel ocal and regional, social and economic effects of
the TMI accident. This study, conducted by Mountain West Research, Inc. of Tempe, Ariz., and coordinated with the Commonwealth of Pennsylvania
through the Office of Policy and Planning, was commissioned immediately after the accident and isscheduled to be completed in the summer of 1980.

619

of Policy and Planning. Additional information on theeconomic effects was compiled by Mountain West
Research, Inc. through interviews with members of
the business community.
Information on the accident's governmental andinstitutional effects was obtained from several
sources. The primary source of information was local government officials, including those in civil defense, through interviews by Mountain West
Research, Inc. Supplementary information was obtained from documentation developed on emergency preparedness by the President's Commission,
the Federal Emergency Management Agency(FEMA), and the NRC Special Inquiry Group. Care
has been taken to differentiate clearly between actual observed effects and effects believed by the
public to have occurred but that have not actually
been documented.

counties, cities, boroughs, and townships. Independent school districts typically are not contiguouswith municipalities. Dauphin County has 23 townships, 1 city, 16 incorporated boroughs, and 10 independent school districts. Within 20 miles of TMI,
there are 6 counties and more than 90 municipalities.
The economic base of the region is diversified.
Agriculture, manufacturing, recreation-tourism, andState and Federal Governments all contribute to theTheregion's strong economic performance.
manufacturing sector continues to be the dominantpart of the economic base of the area. Unemployment rates have been lower than both State andNational rates.

2. BACKGROUND

The character of the information available to the
public on the accident was a major determinant ofevacuation behavior and the public's perception ofdanger from TMI-2. To a considerable extent, information available through the media was confusing
and frequently conflicting. Met Ed, the basic sourceof information on the status of the plant, quickly lost
credibility. The NRC was a source of contradictoryand, upon several occasions, alarming information.
Whereas the local media tended to be restrained
and nonspeculative in its coverage of the accident,
the national media and the media outside the area
tended to be more speculative. Such speculative
accounts of the accident were fed back to local
residents by more distant friends and relatives. A
number of aspects of the public information environment,
especiallythoserelatingtotheutility-Federal-State interface with the media, were
described in Section III.D, "Information Provided to
the News Media."
Several local media events not elsewhere
covered were significant in forming the public's perception of possible danger from the accident. The
first public broadcast of the accident was aired byradio station WKBO at 8:25 a.m., Wednesday,
March 28.1 Following up on evidence that something was wrong at TMI, the station broadcast Met
Ed's assurances that there was no danger to thegeneral public.
The second media event not previously covered
was a Thursday afternoon Harrisburg radio station
broadcast of an interview with Dr. Ernest
Sternglass, of the University of Pittsburgh, whorecommended evacuation of pregnant women andpreschool children. 2 This interview was used in the

3. I NFORMATION FLOW DURING THE
EMERGENCY

The Three Mile Island Nuclear Power Station occupies a site consisting of Three Mile Island and adjacent islands in the Susquehanna River, approximately 10 miles southeast of Harrisburg, Pa. Three
Mile Island is located in Londonderry Township, thesouthernmost township of Dauphin County (Figure
11-55). York County is across the river to the westof TMI, and Lancaster County is immediately to thesouth on the east side of the river. The nearest population concentrations are in the boroughs ofGoldsboro (population 576) 1.25 miles to the east inYork County; Royalton (1975 population 1131) 2
miles to the north; and Middletown (1975 population
9877) 3 miles to the north. The Harrisburg International Airport is about 3 miles upriver from TMI.
A high percentage of the land in the region eitheri s in agricultural use or is woodland. Population ismostly concentrated in the cities and boroughs.
Housing developments in townships, which tend to
be more rural, have absorbed much of the population growth in the area as well as some of the outmigration from Harrisburg. The two largest concentrations of population within 15 miles of the TMI
center are in the cities of Harrisburg in Dauphin
County (1975 population 58 274) and York in YorkCounty (population more than 50 000). The heaviest concentration of population is to the north andnorthwest of TMI, centering on Harrisburg. Population is estimated to be 38 000 within 5 miles of TMI,
165 000 within 10 miles, and 636 000 within 20
miles.
Local government is basically decentralized.
General administrative responsibilities reside in
620

FIGURE 11-55. Map of Area
621

station's hourly newscast.
A comment on
Sternglass's statement by the station's disc jockey
gave listeners the impression it was an official order
for women and children to leave the area. 3 By thisti me, rumors of evacuation were growing.
The number of calls received by local authorities
from area citizens, radio stations, and civil defense
officials indicated strong outside reinforcement ofl ocal anxieties by rumors from more distant family
and friends who were themselves responding to aconsiderable amount of speculative news. In
response to the Sternglass interview, a representative of the Pennsylvania Department of Health wenton the air to assure the public that evacuation was
not necessary. Aware of increasing public alarm,
Governor Thornburgh held a press conference at
5:15 p.m. Thursday to assure the public there wasno cause for alarm, no danger to public health, andno reason to disrupt daily routines.
On Friday, March 30, in the early morning, confusion over the release of radioactive gases and the
NBC's advice to evacuate resulted in the Pennsylvania Emergency Management Agency (PEMA) informing the civil defense director of Dauphin County
that an official order to evacuate a 5-mile areaaround the plant was probably imminent. 4 The Dauphin County director put fire departments within a
10-mile zone on standby and advised all school districts to keep students inside and buses ready tomove. He then went on a local radio station to inform the public of the possibility of evacuation andto give basic information on where to go and what
to take. It was emphasized that the broadcast wasa warning, not an order to evacuate. Telephoneservice in the Harrisburg area immediately
deteriorated because of the large number of incoming calls in response to the announcement. Morethan six times the usual number of calls were placedfollowing the radio message. 5 At 10:46 a.m., PEMA
informed the local media that a general evacuation
was not imminent.
A survey of the TMI-area population by theMichigan State University Department of Geography
shortly after the accident provides information on
the source and time of initial information received by
the public. 6 The survey area covered a 25-mile radius from TMI, the most intense sampling being near
the plant. Of the total sample, 35% of all respondents first heard of the accident on Wednesday
morning, 62% had heard by Wednesday night, andall had heard by Friday (Figure 11-56). In spite of thewide news coverage, 17% did not hear of the accident until Friday. The survey also showed thatthose residents close to TMI, with the greatest supposed risk, did not hear of the accident as early as

FIGURE 11-56. Cumulative Percent of Local Population
Who Received Information on Accident,
by Daymore distant residents. Twenty-four percent of the
respondents within 15 miles of TMI did not know of
the accident until Friday, compared with 9% of the
respondents beyond 15 miles (Figure 11-57). A
slightly smaller percentage of respondents within 6
miles of TMI first received the news on Wednesday
and on Thursday, compared with respondents
residing over 15 miles away. Initial sources of information were the following: radio (56%), friends andfamily (26%), television (14%), and newspaper (3%)(Figure 11-58).

4. PUBLIC RESPONSES

Data in this section, unless otherwise cited, arefrom the NRC-TMI telephone survey conductedunder contract by Mountain West Research, Inc.
Many of these data have previously been reported
i n greater detail.
622

FIGURE 11-58. Initial Sources of Information, by Percent of Population Sampled

623

a. Evacuation
Local interest in news of the accident was undoubtedly high on Wednesday and Thursday, but
news from TMI was generally reassuring, and as arule the public went about business as usual. Concern on the part of some residents, however, washigh. Of the households covered in the NRC telephone survey, 7% reported at least one member
evacuating on Wednesday, and another 7% reported evacuating on Thursday.
During the emergency period, there was no evacuation order issued. An evacuation advisory by
the Governor on Friday concerned only pregnant
women and preschool children within 5 miles of TMI:
approximately 4200 individuals in nearly 2800
households. This target group, however, accounts
for only about 3% of evacuees within 15 miles of
TMI. An estimated 20% of this group did not evacuate. Within 15 miles of TMI, however, about 144 000
individuals (almost 39% of the population) in about
The advisory
50000 households evacuated.
covered 1% of the population and involved less than
2% of the households within 15 miles.
The percentage of the population that evacuateddecreased with increased distance from TMI (Figure
11-59). The percentage of individuals evacuated bydistance was 60% within 5 miles, 44% within 5 to 10
miles, and 32% within 10 to 15 miles. (The 60% estimate for the 5-mile radius is consistent with the 5mile census conducted by the Pennsylvania Department of Health.) The percentage of individuals evacuated and households affected by evacuation decreased significantly beyond 15 miles. The percentage of households having at least one evacuee was
64% within 5 miles, 48% within 5 to 10 miles, and
32% within 10 to 15 miles. A much higher proportionof pregnant women and of children under 6 years ofage evacuated at each distance (Figure 11-60) compared with the proportion evacuated of the general
population. The proportion evacuated of the general
population decreased significantly over the 15-mileradius. The percentage of pregnant women andchildren under 6 years of age who evacuated was
83% within 5 miles, 70% within 5 to 10 miles, and
55% within 10 to 15 miles.
Although there was a declining percentage of individuals and households affected by the accident
as distance from TMI increased, the absolute
number of individuals and households that evacuated within 15 miles increased with distance. The total
estimated number of individuals who evacuated is
21000 within 5 miles, 56 000 within 5 to 10 miles,and 67 000 within 10 to 15 miles (Figure 11-61).

A substantial number of additional persons weredirectly affected because they remained at homeduring the emergency after other household
members had evacuated. It is estimated that an additional 18000 persons within 15 miles of the station
were affected in this way. The percentage of thetotal population affected by having households
separated during a stressful time was 9% in the
0-5-mile ring, 5% in the 5-10-mile ring, and 4% in
the 10-15-mile ring (Figure 11-62).
Evacuations began at a slow pace and accelerated to a peak on Friday, March 30, when more thanhalf of the total evacuees moved away from theirhouseholds. There was a decline after Friday, but
evacuations continued until April 10. The major outflow of evacuees, by percentage of the total, was asfollows.
Date

March 28-29
March 30
March 31
April 1
April 2-10

Evacuees Departing

14
51
18
11
6

Return of the evacuees to their households began before the evacuations were completed; 15%
had returned by Sunday night, April 1, 1979. The returns, by percentage of the total evacuees, accumul ated as follows.
Date

April 1
April 4
April 8
April 30

Evacuees Returned

15
54
80
99

The median distance traveled by evacuees fromthe 15-mile area was 100 miles; 23% evacuated nofarther than 45 miles, and 52% evacuated 90 miles
or more. Persons living closer to TMI tended totravel shorter distances than those living farther
from the plant. Thirty-four percent of evacuees
from within 5 miles of TMI evacuated 45 miles orl ess; the corresponding rate for those from the
5-10-mile ring was 24%, and for the 10-15-mile ring
19%.
Evacuees stayed in all parts of the country, but
the largest number (72%) remained in Pennsylvania.
Pennsylvania was followed by other States nearby:
New Jersey (6.6%), Maryland (5.8%), and Virginia(3.8%). Other more distant destinations included
California, Oklahoma, and Florida. In all, 21 Statesreceived evacuees (Figure U-63).

624

FIGURE 11-59. Percent of Persons Sampled Who Evacuated625

FIGURE 11-60. Percent of Pregnant Women and Preschool Children Sampled Who
Evacuated, by Distance From TMI

FIGURE 11-61. Estimated Number and Percent ofPopulation Evacuated, by Distance
From TMI

626

FIGURE 11-62. Percent of Individuals Sampled Who Experienced Separation ofHouseholds, by Distance From TMI

FIGURE 11-63. Distribution of Evacuees, by Percent of Total

627

The majority of persons (78%) evacuated to thehome of a friend or relative. Hotels or motels were
the destination of only 15% of the evacuees.
The following reasons for evacuation were offered by respondents to the survey.
ReasonPercentage of
Respondents

Situation seemed dangerous
Information on thesituation confusing
Wished to avoid theconfusion or danger of aforced evacuation
To protect children
Pressure from outside
the family
Previously planned trip

91

some members evacuated and others did not Together, these three reasons suggest that households where everyone stayed placed greater confidence in authority than households which evacuated Although the ability to leave their jobs was aconsideration for this group, it was not the overriding concern that it was for nonevacuees in households where some persons evacuated (Figure f-64).
When asked if a particular piece of informationi nfluenced their decisions to evacuate, respondents
gave a variety of answers. Evacuees gave the following reasons most frequently.

83

Information
Influencing
Decision

76
61

Hydrogen bubble
Conflicting reports
Governor's advice toevacuate
Threat of forced
evacuation
News bulletins
Urging by family member
No particular information

28
5

Confusing information influenced a higher percentage (89%) of respondents within the 5-10-milering in their decision to evacuate than it did evacuees from within 5 miles (74%) or from 10-15 miles(81%). In both the 5-10-mile and 10-15-mile rings,
78% of respondents said they wanted to avoid theconfusion or dangers of a forced evacuation,
whereas 65% within 5 miles gave this reason. Other reasons indicated for evacuation were more
evenly distributed in responses from the three distance categories.
The reasons for deciding not to evacuate werecompared for two categories of respondents:
members of households in which some persons
evacuated, and those in which no one evacuated.
Clear differences in the reasons for not evacuatingwere apparent in the two groups. Although households in which some evacuated and some did not
were very sensitive to the danger of the situation(only 14% "saw no danger"), the primary reasons
they remained behind were that they were unable toleave their jobs (64%) or would have left only if they
had received an evacuation order (52%). Many(45%) felt that whatever happened was in God's
hands; 34% were concerned about looters (Figure
11-64).
The households where none evacuated exhibiteda quite different pattern. The overriding reason
given for staying was that they were waiting for an
evacuation order (71%), followed by the feeling thatwhatever happened was in God's hands (65%). The
third reason for staying was that they saw nodanger (36%), which was mentioned two and onehalf times as frequently by households in which no
one evacuated, compared with households where

Percentage of Respondents(two coded for respondents
citing two or more)
30
19
14
14
9
6
25

Only 14% considered the Governor's advice toevacuate as critical in their decision to do so. Newsof the hydrogen bubble, however, was thought to be
critical in the evacuation decision of 30% of evacuees. This percentage accounts essentially for allof the evacuees after Friday, March 30.
Specific questions about communication of theGovernor's advice to evacuate were asked inhouseholds with pregnant women or with children
younger than 6 (98% of the respondents in suchhouseholds were aware of the Governor's advice).
Most respondents heard the statement virtually assoon as it was given: about two-thirds of the sample
heard it on TV or radio; about 11% heard fromfriends; and the rest heard in some other way.
Two-thirds said they were told neither to listen to a
specific radio or TV station for additional information
nor that they would be transported to an evacuation
center. However, two-thirds of the respondents
were aware where they could expect to be evacuated. Only one-fourth said they were told who would
be responsible for conducting the evacuation.
All respondents were asked about expected notification procedures in case of a general evacuation. Radio (62%) and TV (56%) were seen as theprimary means of notification. Respondents wereasked additional questions about persons they expected would be responsible for emergency services. A majority of respondents (64%) felt that an
628

FIGURE 11-64. Respondents' Reasons for Not Evacuating, by Percent

62 9

emergency group would be responsible for theirfood and shelter during an emergency but that they
themselves would be responsible for their transportation (66%).

extremely useful. The print media ranked behind allradio and TV. Comments offered by respondentssuggested that poor scores for information received
from friends and relatives resulted because this information was perceived as rumor rather than fact.
When asked of their overall satisfaction with theway they were given information during the emergency, half the respondents were either very satisfied (12%) or mostly satisfied (37%), and the otherhalf were either very dissatisfied (22%) or mostly
dissatisfied (29%). Generally, those farther from TMI
were more likely to be satisfied with the information
they received than were those closer to TMI. Those
who were most likely to be dissatisfied were pregnant women (71%) and students (75%). Also, evacuees were more likely to be dissatisfied (64%) thanwere those who did not evacuate (47%).

b. Credibility of Information

The Governor of Pennsylvania and the NRC werecited as the most useful sources of information during the emergency period (Figure 11-65). Fifty-sevenpercent of the informants rated information fromeach of these sources as useful or extremely useful.
Only 11% of the respondents found information fromMet Ed to be useful or extremely useful. Sixty percent of the respondents found Met Ed information
totally useless. Respondents within (compared withthose beyond) 15 miles of TMI were more likely to
say that the information given by the Governor andthe NRC was extremely useful.
During the emergency period, respondents foundlocal TV and radio to be the most useful media
forms (Figure 11-66). Sixty-seven percent of the
respondents found each of these forms useful orextremely useful. Less than 10% found them totallyuseless. National network TV was slightly less useful, with 55% of respondents answering useful orc. Levels of Public Concern During Emergency
PeriodConsiderable attention has been focused on thenature and extent of psychological distress resulting
from the accident at TMI. The NRC-TMI survey
provides a perspective on the levels of concern
within the affected population (Figure 11-67). At the

FIGURE 11-65. Respondents' Evaluation of Information Sources, by Percent of
Respondents
630

FIGURE 11-66. Respondents' Evaluation of News Media, by Percent of Respondents

FIGURE 11-67. Public Assessment of TMI Accident as a
Threat to Family Safety631

ti me of the accident, 48% of respondents believedthat the situation at TMI was a "very serious" threat
to family safety; 19% believed the threat was "serious." The perception of threat was clearly related
to the distance from the Three Mile Island station.
Within the 5-, 10-, and 15-mile rings, there was little
difference in the percentage of respondents seeing
the accident as a "very serious" threat (slightly lessthan 50% overall). In the 15 to 25 mile ring, however, those seeing a "very serious" threat fell to 28%.
Beyond 25 miles, roughly 20% of respondents perceived a "very serious" threat. Pregnant women
were much more likely than average (64%) to view
the accident as a "very serious" threat. Evacuees(63%) were nearly twice as likely as nonevacuees(38%) to perceive a "very serious" threat at TMI.
Despite the high degree of perceived threat of
TMI to family safety during the accident period, mosti ndividuals did not tend to be very upset. Twentytwo percent were extremely upset, and 29% were
not at all upset. Essentially, there was an even split
among those quite upset, somewhat upset, and a Little upset. Seventy-two percent of pregnant women
were extremely or quite upset, however. Distance
was a consideration in the degree of distress experienced. Households within 15 miles of TMI weretwice as likely as those beyond 15 miles to have atl east one member who was quite or extremely
upset. Those households in which no one evacuated were more than twice as likely as evacuatinghouseholds to have no member upset.
Noteworthy studies dealing with the psychological effects of the accident on the population surrounding TMI have been or are being supported by
the Pennsylvania Department of Health, the Hershey
Medical Center, and the President's Commission on
the Accident at Three Mile Island. Some of thesestudies are multiyear; others have not yet been reported; and those that are now available have, inmost cases, been completed by the President's
Commission's Task Group on Behavioral Effects
and reported in the group's staff analysis report. 8
The Task Group on Behavioral Effects expanded
upon the sample survey studies undertaken by
several researchers from colleges and universities
near the TMI site. These surveys employed measures of psychological effects with small samples of
the general population or high risk groups such as
mothers of preschool children. Because studies ofthe behavioral effects on workers had not been initiated, the task group undertook such studies. It
was found that the accident increased stress andhad a strong demoralizing effect on the population in
the vicinity of TMI, especially on teenagers andmothers of preschool children. These ill effects di-minished rapidly in the months following the accident for all groups other than TMI workers, buthigher than normal distrust of authorities involved
with TMI continued. Workers involved at TMI, however, showed high trust in the utility.
Asked whether anyone in the household had
considered moving because of the accident, 19% of
the respondents said "yes." Within 5 miles, 30%
answered "yes." Affirmative answers were given
more frequently in the north and the west. Those
who had considered moving were likely to be
younger and more highly educated than those who
had not. Evacuees were more than three times as
likely to say they had considered moving as
nonevacuees (33% versus 9%). Among those who
had considered moving, 22% had definitely decided
to move (4% of total households). This percentage,extended to the total population, implies that a totalof 5100 households within 15 miles of the plant had
decided to move.
Preliminary tabulations of the population census
conducted by the State Department of Health within
5 miles of TMI identified 147 households as having
moved between April 1, 1979 and the end of July of
the same year. This figure is about 1% of the esti mated total number of households in the 5-milearea. Only 29% of moved households that had
been contacted by late August 1979 indicated that
their move was motivated by the accident; therefore, less than three-tenths of 1% of the households
within 5 miles are estimated to have moved by theend of July because of the accident. It is likely thatat least seven-tenths of the movement was normal
turnover.
d. Continuing Effects
Continuing disruption from the TMI accident of individuals within the region appears to be slight. No
damage to public or private facilities and no loss oflife or injury was incurred. At the time of the
NRC-TMI survey in July and August, however, there
was continuing concern about the safety of TMI and
the effects the accident would have on the local
economy. The NRC-TMI survey identified a small
percentage of respondents who believed that theirhouseholds were continuing to experience effects of
the accident (12% of the households that evacuated
and 4% of those that did not). The most frequently
mentioned effects were higher electric bills, reduced
real estate values, and declines in business. A small
group of respondents (3%) had considered changing
jobs as a result of the accident, and about half ofthese were taking definite steps to do so. Evacuees632

radioactive emissions. Figure 11-70 compares thepostaccident level of concern about radioactive emi ssions with both preaccident concerns and thoseduring the emergency period. Four months after theaccident, the level of concern about emissions was
slightly less than during the accident, but muchhigher than before the accident. Forty-one percent
of respondents were still very concerned about emi ssions. Those persons either very concerned orsomewhat concerned decreased only from 86%
during the accident to 75% 4 months later. Evacuees were more likely to be concerned thannonevacuees about emissions before, during, andafter the accident. Both during and after the accident, respondents within 15 miles of TMI expressed greater concern with emissions than thosefarther than 15 miles away.

considered changing jobs more frequently (6.4%)
than nonevacuees (1.5%), but were no more likely tohave taken definite steps toward that end. Ninety
percent of the respondents said that their normal
daily activities were unchanged by the accident.
Those living 0-5 miles to the west of the plant weremore likely to say that there was substantial change
in their day-to-day activities. Changes most frequently mentioned were that TMI was always in theback of their minds (6%) and that they avoided thearea (2%). Evacuees were more likely than nonevacuees to report at least a minimal disruption.
A majority of the respondents said that the economy of the area will be hurt by the accident (60%)
rather than helped (6%) or not affected (34%) (Figure 11-68). Those residents within 15 miles of TMI
were more likely to respond that the area will behurt by the accident than those farther away. Evacuees were more likely to think that the area's
economy will be hurt and less likely than nonevacuees to think that there will be no effect.
Continuing concerns with the economic effects of
TMI on the area were related, at least in part, to thecontinuing concern with the safety of the Three Mile
Island station (Figure 11-69). Twenty-two percent ofrespondents said TMI continued to be a very serious threat to their families, and 19% thought it continued to be a serious threat. On the other hand,
28% said it was not a threat. Concern about thesafety of TMI is closely related to the perception of

5. ECONOMIC EFFECTS
a. Background
The immediate and continuing effects of the TMI
accident on the local economy have been well documented by various departments within the State
Government of Pennsylvania. These studies havebeen coordinated by the Office of Policy and Planning and the data have been combined with additional field investigations by Mountain West
Research, Inc.9 Although there was short term andlocalized economic disruption, the overall economic
effects are apparently of little consequence.
b. Emergency Period
Disruption to local commerce and industry was
generally
moderateandshort lived.
Fewbusinesses shut down completely, but those closer
to TMI generally suffered from loss of customers orloss of workers due to evacuation. Emergency
period economic effects on residents within 15 milesof TMI have been completed from data gathered in
the NRC telephone survey. These economic effects
consist of income losses (or gains) plus extraordinary expenses uncompensated by insurance. The
survey estimated that within 15 miles, 34000 evacuees lost 141000 person-days of work. Of theevacuees who lost work, 19000 also lost pay. The
median pay loss for this group was $110, although
the mean loss was $271. Eleven percent of the
respondents reported losing more than $500. Additionally, 8000 nonevacuees are estimated to havelost income because of loss of work. Only 7% of

FIGURE 11-68. Public Assessment of the Economic
Effects of the TMI Accident.
633

FIGURE 11-69. Public Assessment of TMI as a Continuing Threat to the Area.

634

FIGURE 11-70. Respondent's Concern about TMI Radioactive Emissions.
sistent with these findings. As of August 10, 1979,
the Department of Insurance reported a total of$1298 325 in private claims paid within 20 miles of
TMI. When the approximately $1.2 million of insurance payments is subtracted from income loss
and accident-related expenses, short term economic costs borne by households within 15 miles of TMI
are about $18 million.
Assuming that the mean household income of$17 000 found in the survey holds for each of thethree rings, expenses as a percentage of evacuees'
annual household income were 1.4% for 0 to 5 miles,
1.5% for 5 to 10 miles, and 2.0% for 10 to 15 miles.
Averaged over all households within 15 miles, expenses amounted to a little less than 1% of annual
household income (Figure 11-72).
The effects of the accident on local business andeconomy are based to a considerable extent on theevacuation of workers and customers and the threatof enforced evacuation and to a limited extent on
concern for radiological protection of product.
Although detailed data on daily developments are
not available, it appears that for those businesses
within approximately 5 miles of TMI, activity was
down only slightly on Thursday, March 29, and that
disruption began with the increasing concern overnonevacuating households reported extraordinary
expenses during the emergency period, and about
8% reported a loss of family income. For those
suffering losses, median extra expense was $51 andmedian income loss was $142. Nearly all evacuatinghouseholds, however, experienced extra (out-ofpocket) expenses associated with the evacuation.
Median household extra expense for evacuees was$100, but the mean, at $198, was nearly twice as
high. Total costs per evacuating household increased with distance from TMI: $247 for 0 to 5
miles, $259 for 5 to 10 miles, and $342 for 10 to 15
miles (Figure 11-71). This is probably related to thefinding that evacuees farther from TMI traveled
farther than persons living closer to the site.
Table 11-64 summarizes the economic costs of
the accident at TMI for households within 15 miles.
The table shows that income loss contributed toabout half of the short term economic costs suffered by households. The other half was due toevacuation costs and other accident-related expenses. Data from the NRC-TMI telephone survey
i ndicate that households within 15 miles had received a total of $1215000 in insurance compensation at the time of the survey. Data collected by thePennsylvania Department of Insurance are con-

635

TABLE 11-64. Economic costs of the accident at TMI for households in the 15 mile ring
Cost
Costs for evacuees
Pay loss (or gain)
Evacuation costs
Other expenses

Other income loss (or gain)

I nsurance payments to evacuees
Total costs net of insurance
Costs for non evacuees
I ncome loss (or gain)
Other expenses

Total costs for non evacuees
Total costs net of insurancecompensation (evacuees andnon evacuees)

0 - 5 Mile Ring$

5 - 10 Mile Ring

10- 1 5 Mile Ring

Total for 15 Mile Ring

726000.

$1861000.

$1270000,$ 3857000.

108000.

75000.

763000.

946000.

1 719000.

34000.

2990000.
600000.

4119000.
2162000.

8828000.

2796000.

643000.
$1 944000

424000.
$5102000.

148000.
$8166000.

1 215000.
$15212000.

1 40000.
29000.

1 043000.
1 22000.

1 412000.
255000.

2595000.
406000.

169000.

1 1 65000.

1 667000.

3001 000.

$2113000.

$6267000.

$9833000.

$18213000.

Source: C. B. Flynn, "Three Mile Island Telephone Survey: Preliminary Report on Procedures and Findings," U.S. Nuclear Regulatory Commission. 1979.

FIGURE II-71. Costs Per Evacuating Household, by Distance from TMI

FIGURE 11-72. Percent of Annual Income Lost Per Evacuating Household, by Distance from TMI.

637

the prospect of evacuation at midday. Preoccupation of the local population with developments concerning the accident diverted workers' and customers' attention from their normal routines. Increasi ng numbers of employees left their places of work
on Friday afternoon. Most apparently did so withthe concurrence of their employers. The only large
employer known to have shut down operations was
Freuhauf Corporation, located 3 miles north of TMI.
(The plant was closed Monday, April 3, throughWednesday, April 5.) When the plant reopened on
Thursday, the work force was near normal. Otherl arge firms in the area remained open and attempted
to maintain production in spite of substantial absenteeism. Most firms did not discourage absenteeism
but had a policy of no work, no pay. Some firms
paid those who were covered by the Governor's
advisory, but not others. A few firms continued to
pay all those employees who evacuated.
Many firms had to contend with evacuation
preparations and materials protection. Some firms
had production methods such as food processing,which could neither be easily shut down nor left
unattended. A forced evacuation would have been
costly to these firms in damaged equipment andl oss of goods in process. Business interruption
claims filed with nuclear insurers show that wages
paid to absent workers were uncommon. More than
three-quarters of the claims have been for loss ofsales. A few claims were for interruption or loss of
production and for expenses in preparing for evacuation or in product testing.
Large demands for cash to be used in evacuation
were anticipated by banks. As an example, thel argest bank in Middletown, the Commonwealth National Bank, requested employees to work their regular hours and overtime to service their customers
and help reduce a stressful situation. The bank held
the deposits of a large proportion of the town's
residents.
The role played by Hershey Park is anotherdramatic example of involvement of the businesssector in evacuation response. The Hershey Park
Arena is a subsidiary of Herco, the corporation thatowns the Hershey Park complex and Hershey Chocolate Company. Shortly after 9:00 a.m. on Friday,
March 30, the Derry Township police requested thatthe sports arena be designated an evacuation
center. The manager was informed that as many as
14000 persons might arrive. Preparations to receive evacuees were completed by 11:00 a.m. thesame day. Cots and blankets were brought fromnearby Indiantown Gap Military Reservation in theafternoon. A communications center and press
room were set up. While the Red Cross admin-

i stered the management and direct care of evacuees, the Hershey Park management attended tofacilities and logistics. The fast and effective establi shment of this evacuation center was due to thefacility's design and the management's experience
i n servicing large crowds. Although initially as manyas 14000 evacuees were anticipated, the maximum
number of people at Hershey Park at one time wasabout 180. A total of 800 people may have stayed
there at some time during the emergency period.
After it became known that nuclear insurers weremaking cash payments to those covered by theGovernor's advisory, there was a substantial decrease in the number of evacuees at the arena.
When the possible evacuation area was extended to a 20-mile radius, arena management began
developing a plan for evacuation of the center, completing the plan by Sunday morning. It was estimated that everyone could be moved within 15 to 30
minutes. Given 1 hour, it would have been possible
to move the materials from the shelter, including
food and equipment, in the tractor trailers standingby.
I ncome and employment losses within the region
have been estimated from the Pennsylvania Department of Commerce studies as well as from the NRC
telephone survey. Estimated lost employment forfirms within 20 miles of TMI, from the State study, is1.25 million person-hours for both evacuees andnonevacuees in the 1-week period following the accident. This estimate is reasonably consistent withthe 1.13 million lost person-hours of evacuees living
within 15 miles of TMI, as calculated from the
NRC-TMI telephone survey. Therefore, approximately 8.5% of employment was lost during theweek within 20 miles. This is about one-tenth of 1%
of annual employment for the area. Employment
loss does not necessarily lead either to income or
to production loss. Some employees continued tobe paid despite absence from work. The same industries' production can be sustained on a short run
basis despite a reduction in work force. Also, compensatory increases in output through higher production rates possibly occurred in some firms after
the evacuation period.
Both the State business firm and the NRC household telephone survey estimates of personal income
losses are also consistent. The State studies indicate about $7.0 million in wages lost. The NRC
study indicates that, within the 15-mile area, evacuees lost $3.9 million in wages and $2.8 million in
nonwage income. Additionally, nonevacuees lost
$2.6 million in wage and nonwage income. Total income loss estimated from the NRC-TMI survey is,therefore, $9.3 million. This represents about
638

Other fresh agricultural products were similarly
affected. Noticeable effects on sales of agricultural
products were largely limited to the week immediately following the accident and appeared to havebeen gone by the end of the week. A survey offull-time farmers within 25 miles of TMI conductedby the Pennsylvania Department of Agriculture
showed the emergency period economic impacts on
farmers not to be serious. Within 10 miles of TMI,
9% reported some loss; over the 25-mile area, only
4% reported any loss.
The accident did have an immediate impact on
the tourist industry during April. Ten major lodging
and convention centers surveyed reported losses ofnearly $2 million in gross sales. These losses included the cancellation of a major trade showscheduled for the Pennsylvania Farm Show Building
i n Harrisburg, as well as cancellation of otherconferences and individual reservations. Extrapol ated to the total tourist industry, the loss may havebeen $4 to $5 million. Although there was a majorinterruption in the convention business for lodging
and restaurant facilities, this was partially offset by
the influx of transient workers connected with TMI.
Disruption to the local economy during the emergency period was generally moderate and short
lived. A large part of the disruption that did occur isdirectly attributable to the loss of workers and customers who were evacuated. In monetary terms,
the net loss of personal income was about threetenths of 1% of the annual level. In terms of grossarea product, this would be about 0.5% of the annual level.

three-tenths of 1% of annual personal income in thearea.
I n the State surveys of manufacturing and nonmanufacturing firms, each was asked the value of
production (or business) lost during the first week
after the TMI accident. Manufacturing lost an esti mated total of $7.7 million in gross output. This
figure overestimates the real loss, however, because it includes the value of purchased inputs thatwere still available for use. A gross state productfor Pennsylvania in 1977 of $11 per person-hour in
manufacturing, compared with an estimated $41 loss
per person-hour for the manufacturing survey, suggests overstatement of actual losses by a factor of
3 to 4. In addition, some percentage of lost production can be made up with little or no additional expenditure of resources. The extent to which there
has been compensating output is unknown.
Manufacturing firms lost business valued at $106.1
million during the first week after the accident.
Much of this was due to lost sales to those who
evacuated and those who postponed purchases in
the atmosphere of uncertainty. Again, this is an esti mate of gross business volume, and greatly
overestimates the real economic loss. Most inventory was carried over for later sale, and some purchases were only delayed rather than completely
foregone.
Following the accident there was concern thatcertain sectors of the local economy were particularly vulnerable to the effects of the accident. Farmers, processors, consumers, and industrial users of
the area's agricultural products raised concerns
about potential radiological contamination. A testing
and monitoring program (principally of milk) initiatedon Thursday, March 29, by the Pennsylvania
Department of Agriculture uniformly failed to showlevels of radiation that would be of any concern.
Potential concentrations of iodine-131 in milk received the most attention. The highest reading
found in any sample was 29 picocuries per liter,
which is very low compared with the State's standard of 8300 pCi/L and the 12000-pCi/L level atwhich the Food and Drug Administration becomes
concerned about protecting the public's health. Local industrial concerns were careful to segregate,
test, and monitor the use of locally produced milk,
but there were several instances of canceled orders
by out-of-State dairies for Pennsylvania milk. Onel arge dairy serving Harrisburg reported an 18% decline in sales the first week and a 15% decline thesecond week after the accident. This dairy advertised that they did not use milk from farmers within
10 miles of TMI and had disposed of milk produced
within this area.

c. Postemergency Period
There is little or no evidence of continuing direct
negative effects of the accident on the economic
base of the area surrounding TMI. A small proportion of manufacturing firms (9.8%) and of nonmanufacturing firms (4.1%) reported in the Department of Commerce study a perceived short term effect in their product. It is likely that these percentages would be now greatly diminished, as they
were quite low when collected shortly after the accident. The Pennsylvania Department of Agriculture
concluded in its study of impacts, reported in August, that it did not appear that there had been apermanent decrease in sales or a resistance to thebuying of agricultural commodities produced or processed in the TMI vicinity. A travel industrysponsored survey of potential travelers to Pennsylvania conducted April 26 through April 30 indicatedonly 2% of the respondents would avoid traveling to639

Pennsylvania because of concern over the TMI accident. If there has been any continuing effect on
tourism at all, it would be nearly impossible toseparate from other more important adverse factors
last summer, especially a polio outbreak in Lancaster County, gasoline shortages, and bad weekend
weather.
Case activity of the Small Business Administration (SBA) and the Bureau of Employment Security(BES) supports the contention that there has been
little or no measurable impact on the area's economy. SBA reported that only 15 firms, mostly retailers or service-related businesses, had applied fora total of $423000 in loans. These loans were forshort term impacts suffered immediately after theaccident. As a comparison, 35000 loans weremade as a result of Hurricane Agnes in 1972 and1500 loans were made as a result of Hurricane
Eloise in 1975. BES case experience also supports
the conclusion of no continuing economic dislocation. A total of 704 initial claims (95% made during
the first week of April) were filed in the Harrisburg,
Lancaster, Lebanon, and York offices for TMIrelated reasons. Very few of the claims continued
beyond the end of April.
Surveys of area residents identified a concern
with adverse effects of TMI on local real estatevalues. Currently, evidence indicates that, if TMI
has had an effect on real estate, it has not been
substantial. The local real estate industry maintains
that the market has not been affected, citing thecontinuing rise in sales prices. Monthly data on listi ngs, sales, and settlements over the period
1977-1979 show a noticeable dip in April and a return to normal since then. The Pennsylvania
Department of Community Affairs has completed
data comparing certain characteristics of property
sales within 5 miles of TMI relative to the samecharacteristics for the entire Central Penn Multilist
area. Although the comparative analysis appears toshow a slight effect of TMI within 5 miles, the movement, with one exception, is within the experience ofthe past 2 '/2 years. The one exception is a considerable relative increase in the average number ofdays property was on the market. Because thedata only extend through the second quarter of1979 (April through June), nothing can be concluded
about any basic changes in the local market.
The area's image as a place to work and live
among possible recruits to the area does not appear to have suffered. A survey of the personnel
directors of 11 large firms was made to determine if
there was any resistance from out-of-region potential recruits or any unusual turnover among existing
employees. Only in one instance was there thought

to be any turnover (4 or 5 employees out of 1200)
because of TMI. The personnel directors could notcite a single instance in which resistance to the area
affected a potential job recruit. Of course, there isconsiderable opportunity to find a residence atsome distance from TMI; therefore, this indicator
would not support any conclusion about potential
redistribution within the area.
There is little evidence of continuing economic effects of the accident. All sectors of the local economy appear to have quickly recovered from whatever
disruption was experienced. If there has been any
i nfluence on the real estate market close to TMI, it
has not yet become apparent.
6. EFFECTS ON LOCAL GOVERNMENT AND
I NSTITUTIONS
a. Background

The primary consequence of the accident on local government and institutions was the burden
placed upon them to develop coordinated evacuation plans under great time pressure and in a climate of sparse and confusing information concerni ng the accident and its potential danger to the publi c. An additional burden was placed upon local authorities who were sought by local residents as asource of information and advice.
b. Emergency Period
Government operations at all levels were severel y affected during the emergency period. Much of
the attention of State, county, and municipal governments in south central Pennsylvania was directed toemergency management. At the same time, essential services had to be maintained. Nevertheless,State employees working in the Harrisburg area
were exposed to the same evacuation pressures as
the rest of the population. The State granted 21938
hours of administrative leave at a cost of $161257
from March 30 through April 9, 1979.
The complexity of local jurisdictional responsibilities was an important consideration in local emergency management. Dauphin County includes 20municipalities (cities, boroughs, and townships)
within 20 miles of TMI; York County includes 45
municipalities. Fewer municipalities were involved in
Lancaster, Cumberland, Lebanon, and Perry Counties. Several authorities played a role in each municipality, although one individual usually serves as
the civil defense liaison. The individual, who is pro640

timeliness and quality of information were no less a
problem for local officials than for responsible par• at higher levels of government. Communications appear to have been particularly difficult for officials on the west side of the river. News briefings• briefings for public officials were held in Middletown, a considerable commute for west shore officials anxious about fulfilling their responsibilities inthe emergency.
Much of the emergency planning burden placedon local governments was due to the expandingzone of possible evacuation. Early in the accident(before Friday, March 30) officials were operating
within the framework of the 5-mile evacuation plan
previously developed for TMI. The degree to which
details were initially worked out appears to havevaried considerably among communities. The population of the west shore within 5 miles of TMI wasless than on the east shore where responsibilities
were spread out and thus required a degree of
coordination among authorities. Initial evacuation
details included evacuation routes, staging points formass transportation, procurement of school buses
to transport those without other means, and evacuation centers. Officials within 5 miles reviewed theirevacuation plans, and some made attempts to brief
citizens on what actions they might be expected totake.
After being forced on Friday to revise 5-mile evacuation plans to 10 miles, county and local officials
were told that night to extend their planning range
to 20 miles. Within 3 days, evacuation planningchanged from the direct concern of 3 counties and
11 municipalities with existing plans to the directconcern of 6 counties and about 90 municipalities,
i ncluding the cities of Harrisburg, York, andLebanon. An additional 26 counties were involved
as host counties for the evacuees. Information was
not collected to determine what demands, if any,
were put upon municipal officials beyond 10 miles.
Once revised evacuation plans were prepared(some communities had their individual plans and instructions to citizens completed on Sunday, April 2),
firefighters in several communities distributed
mimeographed instruction sheets or went door todoor giving oral instructions. In other communities,
i nstructions were given over loudspeakers.
The Pennsylvania Department of Community Affairs conducted a survey of TMI-related expenses
i ncurred by county and local governments within 20
miles of TMI. Based on the response of 68 units,
out-of-pocket costs were generally found to bemodest. In the six municipalities nearest TMI, expenditures were less than $10000 each. These
dollar expenditures considerably underestimate theposed by the municipality and approved by theGovernor, coordinates with the county director ofcivil defense. Borough mayors and townshipmanagers have responsibility for preserving orderand protecting the public, including control of thepolice department. In the local government, mayors• managers are generally the focal point for the
public. About half of the municipalities in the area
have a police force; the others depend on the State
Police for protection. Most of the area is serviced
by volunteer fire departments and rescue squads
whose territories do not necessarily correspond tomunicipal boundaries and who are independent frommunicipal control. Coordinated dispatch of emergency personnel (police, fire, and rescue) isachieved through county or subcounty communica• centers. School buses, which are under thecontrol of district school superintendents, played an
important role in emergency planning. Consolidated
school districts generally correspond to municipality
lines but are not directly accountable to municipal
authorities.
During the emergency period, local government
officials experienced numerous problems and anxieties in fulfilling their responsibilities. Notification• communication concerning the emergency took
place through prespecified civil defense channels.
Some municipalities did not have an approved civil
defense coordinator. In some communities having acoordinator, communications among officials within
the municipality were not always ideal. At least one
municipality (Royalton), which did not have a coordinator, apparently was never formally notified of theaccident. Notification on Wednesday, March 28,
concentrated on municipalities within 5 miles. No
apparent effort was taken to advise municipal officials at greater distances. In the absence of a formal declaration of emergency by the Governor, theregular municipal authority charged with public safety (rather than the civil defense coordinator)
remained legally in charge. Division of authority andresponsibility was ambiguous. Although the civil defense coordinators had limited authority to take action and to make decisions, all the emergency
preparedness measures from the county level werecoordinated through them. Clarification of responsibilities and good working relationships-both within
i ndividual municipalities and among municipalitiesappeared to be greatly influenced by personalities
and the extent to which individuals had worked together in the past and were comfortable with eachother. In some municipalities, all parties with any
responsibility for public safety worked together in
one location and made decisions jointly. Weakcommunications channels and problems with the641

local resource commitment, however, because of local government dependence upon volunteers or labor for which compensation is not tied to hours
worked. For example, the Londonderry Township
Emergency Operations Center was staffed by 18
volunteers who worked a total of 510 hours withoutlay
The public school system in the vicinity of TMI
faced an especially trying situation. As early as
Thursday, there was concern over the prospect ofan evacuation and the procedures to be followed by
the individual schools. It was assumed that normal
emergency procedures would be followed, such as
those for a snowstorm. At the time of theGovernor's Friday morning press conference, inwhich he advised people to stay indoors, school
districts within 5 miles of TMI were notified to havetheir schools shut down ventilating systems, shut
windows, and allow only indoor recess. Procedures
followed in the Middletown School District are probably representative of other districts. Bus drivers,
crossing guards, and cafeteria staff were notified tostand by. Children were accounted for by checking
absentee lists. Parents and friends began arriving
to pick up children even before the Governor's
12:30 p.m. advisory for pregnant women andpreschool children to evacuate. Varying degrees ofhysteria were experienced in elementary schools.
I n smaller schools, principals were able to patrol thehalls and reassure parents, teachers, and children.
I n larger schools, the anxiety level was apparently
higher because of greater difficulty in handling thelarge number of parents, teachers, and students involved.
The Middletown School District followed normal
emergency procedures; parents were notified of theschools' closings by local radio stations. Official
dismissal began about 12:30 p.m., with buses followi ng their normal routes and making three or four
trips each. All children were gone by 1:30 p.m.
School officials assumed that children would becared for when arriving home, which was not always
the case. Although there apparently was no consideration of leaving the children at school, most
schools do have fallout shelters.
On the west shore, children from Newberry and
Fishing Creek Elementary Schools were evacuatedto another school more than 10 miles from TMI.
Although this action ensured the safety of the children, it did create some panic among a few parents
who had difficulty in locating their children.
Adequate and appropriate emergency planningmust take into consideration the vulnerability of children, parents, and teachers to stress from uncertain
danger. Given the characteristics of any specific642

radiological emergency, one or more protective actions available to the school may be effective. Also,if school buses are fully used to evacuate children,
they will not be available for general evacuation service.
There are no inpatient medical facilities within 5
miles of TMI. Once evacuation planning extended to
20 miles, a number of hospitals were affected andhad to prepare for possible evacuation. The
Hershey Medical Center, the only hospital prepared
to treat for radiological exposure, could be sealed
and pressurized and was to continue in operation.
I n addition to identifying host general care hospitals,
medical planners also had to identify special careneeds and to line up capable host facilities and therequisite special transportation. On Friday and Saturday, hospitals generally began to reduce their
number of patients by receiving only emergency
cases and releasing those recuperating patients
who could be sent home. Although there was someconcern with hospital staff members evacuating with
their families on Friday, the experience of at least
one hospital (Holy Spirit Hospital) was that the staff
absentee rate never exceeded 20% and that many
evacuating staff members returned after ensuring
their families' safety. Hospitals began to resume
normal operations about Wednesday of the followi ng weeks, and by Friday, April 6, most were backto normal.
Nursing homes and homes for the mentally retarded were also included in evacuation planning.
Two nursing homes in Lower Swatara Townshipwere actually evacuated because the administrators
wanted to avoid the confusion of a forced evacuation and because they were short of staff. Several
supervisors of homes for the mentally retarded evacuated their charges in anticipation of a forced
evacuation.

c. Postemergency period
Continuing effects of the accident on local
government, health services, and other institutions
appear to be limited. Perhaps the two mostnoteworthy effects are the stronger emphasis on
emergency plans and emergency management
capabilities, and the interjection of TMI and nuclear
power as sensitive local political issues. Many municipalities have put considerable effort into reviewing
and revising evacuation plans. In such cases, needfor additional volunteer personnel, training, andequipment has been identified. Even though muchof the upgrading of plans and prepardeness can beachieved with volunteer labor, additional communications and other types of equipment will require
additional funding.
Since the accident, several new antinuclear
groups have formed, and the anti-TMI movement
has become a political force to be reckoned with.
Membership of these groups appears to be substantial and broad based within the communities.
Local elected officials are on notice that they will be
opposed politically if they support the restart of TMI.
Pressure has been exerted at the municipal level topass resolutions in oooosition to the reopening of
TMI, and at least one municipality, Lower Swatara
Township, has passed a resolution against its reopening. Opposition to reopen TMI is not universal,
however; a number of local officials see the benefitsof lower cost electricity from TMI as offsetting whatever risks are present. Local governing bodies haveheld meetings to allow citizens to air their views on
TMI. Such strong pressure was put on the Middletown Borough Council that it passed a resolution in
August 1979 opposing the restart of TMI-1. The
Council's intent had been to defer passing a resolution until research findings from the State ofPennsylvania and the President's Commission wereavailable.

b. Thermal and Chemical Discharges
The Commonwealth of Pennsylvania's water
quality certification for TMI, under Section 401 of
Public Law 92-500, contains five criteria about thermal discharges, limiting both absolute discharge
temperatures and temperature differentials between
discharge and ambient river temperature. During
and following the accident, none of the thermal criteria was violated. In fact, the temperature differentials generally were smaller than during most of themonth preceding the accident. Thermal discharges
during and following the accident were also within
the required limits of the NRC environmental technical specifications for TMI.
A number of chemical parameters have been wellmonitored at several points in the river around TMI.
Monitoring of various chemical parameters is required
under both theCommonwealth ofPennsylvania's national pollution discharge elimination system (NPDES) permit and the NRC environmental technical specifications (ETS) program. Data
were also collected by the Pennsylvania Departmentof Environmental Resources. The volumes of industrial wastewater released during March and April
were neither unusual nor significantly different fromthose released during normal operation. Releases
thereafter were lower than normal. Total releases
between March 28 and May 19, 1979 were
7 431490 gallons. Apparently, toxic concentrationsof nonradiological effluents were not released into
the river, and violations of water quality limitations
did not occur.

7. EFFECTS ON AQUATIC BIOTA ANDFISHERIES
a. Backgroundc. Consequences

This account of the chemical and thermal effectsof the TMI-2 accident on aquatic biota and fisheries
i n the surrounding area is based upon an NRC staff
assessment. 1o Very high core coolant temperaturesand releases of liquid industrial wastes into theSusquehanna River occurred during and following
the accident. The study covers March 28, 1979
through July 1979, during which time Unit 1 was in acold shutdown mode. Data used in the study wereobtained from Met Ed, the Commonwealth ofPennsylvania,
theU.S.
Geological
Survey,knowledgeable persons within State and Federal
agencies, and from various other published studiesof the aquatic biology of the Susquehanna River.
Met Ed data were developed in an ongoing operational monitoring program required by the NRC andthe EPA. In addition to these sources, the staff had
available to it the inhouse environmental analysis for
TMI-2 operating impacts completed in 1976.

Biological data collected through July confirmed
the absence of any detectable effects of benthic invertebrates and fish. No unusual conditions of fish
diseases or mortalities were noted in the river foll owing the accident. Significant impacts from thermal and chemical discharges were not expected because they neither exceeded normal operations nor
violated effluent limitations.
Recreational fishing in the river near TMI following
the accident departed from historical trends. Fishi ng effort shifted away from TMI to other areas of
the York Haven Pond. Not only did anglers fishl ess, but they also returned more of their catches
than in previous years. Such alterations probably
were related to the fishermen's knowledge of theoccurrence of the accident and to their awarenessof the liquid releases of industrial wastes to theriver. By July the patterns of recreational fishing643

other than catch retained had returned to nearnormal.

and operation of both TMI-1 and TMI-2-will likely
be the decisive factor in the future strength of realestate close to the plant. Local growth policy concerning development in the immediate vicinity of TMI
will also have an important effect on residents. A
question has been raised in at least one municipality( Newberry Township) as to whether it should encourage growth within 5 miles of the plant.
Despite the findings of the Behavioral Effects
Task Group that the level of distress within the population significantly diminished since the accident,
there is continuing strong concern and anxiety
about the safety of future operation of TMI-1 andTMI-2. This concern has partially manifested itself
in a dramatic increase in the number of local antinuclear groups and in their membership. Prior to theaccident, opposition to TMI included the Three Mile
Island Alert (a Harrisburg-based group) and the Environmental Coalition on Nuclear Power (a statewideorganization), both of which have substantially increased their membership and operating funds
since the accident. Three additional groups haveformed in the immediate area: Persons Against Nuclear Energy (PANE), Concerned Citizens of Londonderry, and the Newberry Township Steering
Committee. Two additional groups to the south,
Anti-Nuclear Group Representing York and theSusquehanna Valley Alliance, are also concerned
about the Peach Bottom Nuclear Powerplant. These
groups are all committed to the permanent closureof TMI as a nuclear station. Their size, broad-based
representation of the community, and commitment
will ensure a high degree of publicity and controversy about the safety of TMI.

8. LONGER TERM SOCIAL AND ECONOMIC
EFFECTSI mmediate emergency period effects of the accident generally were accommodated by the populace. The accident does have the potential, however, to continue to affect their lives in various ways.
Current replacement power costs with both TMI-1
and TMI-2 out of service are about $24 million
monthly. If TMI-1 is restarted, the monthly replacement power costs for TMI-2 will be about $10 million. Customers in the Met Ed and the Penelec service areas are now paying more for electricity thanthey were before the accident. The actual effect on
the cost of electricity is dependent on if and wheneach unit restarts. Price increases could be substantial, and given the energy intensity of industry in
the area, long term net economic effects of thesei ncreases could be important. Local business interests are concerned about the implications for a
spatial redistribution of growth in favor of utility service areas other than Met Ed and Penelec. A studyof manufacturing and nonmanufacturing firms by thePennsylvania Department of Commerce showed astrong influence of electricity price increases on intent of business to remain and to expand in thearea. A hypothesized 10% increase in the price ofelectricity resulted in 22% of those manufacturingfirms considering expansion indicating that theywould not expand, and resulted in 30% reportingthat their plans to remain in the area would be affected. Thirteen percent of nonmanufacturing firms
reported they would not expand, and 33% reported
that their plans to remain in the area would be affected by a 10% increase in the price of electricity.
Sixty-two percent of nonmanufacturing firms reported that their plans to remain would be affected by a
25% increase in the price of electricity. Although it
would be conjectural at this point to assume that
expressions of intent would actually be carried out
by all firms, it is clear that future movements in theprice of electricity will weigh heavily in businesses'
decisions to expand or to relocate.
Evidence to date indicates that, if the accident
has affected the local real estate market, the effecthas been minor. Further studies with more transaction information may, however, be better able to discern any effect. The aftermath of the accident-in
terms of the public's confidence in the decisional
process surrounding the cleanup of TMI-2 and safety conditions established for the possible restart

9. FINDINGS AND RECOMMENDATIONS
The direct social and economic effects of theTMI-2 accident were dramatic in terms of short term
disruption but were mostly transitory. Lasting effects of the accident will be determined within thecontext of the issues of reopening TMI-2 and restarting TMI-1. Environmental effects of thermal andchemical effluents on aquatic biota and water quality
were not detectable. During and following the accident, thermal and chemical effluents remained
within NPDES limitations.
The accident's most significant effect on the people was the evacuation experience. In a climate of
confusing and conflicting information, pressures toevacuate mounted within the population from thefirst day, Wednesday, March 28, 1979. By the timeof the Governor's advisory at 12:30 p.m. on Friday,
well over 14% of those who would evacuate had al644

ready done so. Within 15 miles, an estimated144000 people evacuated (39% of the population).
The rate of evacuation decreased significantly
beyond 15 miles, but instances of evacuation were
found beyond 50 miles. Evacuation rates werehigher closer to TMI; within 5 miles, 60% (21000
persons) of the population evacuated. The absolute
number of evacuees, however, was greater (67000
persons) in the outer (10 to 15 mile) ring. Only 2% of
the total households within 15 miles included individuals within the Governor's advisory (pregnant
women or preschool children within 5 miles of TMI).
A high percentage evacuated in anticipation of bothworsening conditions at TMI-2 and a forced evacuation.
On the average, evacuees traveled a considerable distance, averaging 100 miles; were gone fromhome an average of 5 days; and spent an averageof $300 extra. Many lost work and pay. The total
cost to evacuees (after insurance payments) and to
nonevacuees was more than $18 million. Insurance
payments to evacuees were more than $1.2 million.
Another major result of the accident has been an
i ncreased level of psychological distress within the
population. The level of concern and mental illness
symptoms were high during the emergency period.
Symptoms of mental illness within the population asa whole decreased after the accident, althoughmany individuals, especially mothers of young children, still experience anxiety. The level of concern
about the safety of TMI, although lower than during
the accident, remains high. As a group, evacuees
appear to have greater continuing concerns thannonevacuees.
Direct and immediate economic effects of the accident included interrupted local production and reduced local income and employment. Most losses
occurred in the first week of April. Particularly
vulnerable to the accident were the agricultural andtourism sectors of the economy. Each was significantly affected during the emergency period, butthere are no noticeable continuing effects. No evidence of continuing disruption to economic activity
exists. There is, however, concern within the business community that higher electricity prices andimage problems due to TMI might have a negative
effect on the continued growth and development of
the area.
The institutional effects of the accident, which
continue to be high, have primarily been in the formof increased concern with emergency planning andthe local politicization of. TMI. The poor quality of information available for use by officials in fulfilling
their responsibility for the health and welfare of theirconstituency placed considerable stress on local
645

political and emergency management officials during
the period. Whereas these officials were in a position to be a reassuring influence on the populace,they did not have the necessary information. Since
the accident, there has been continuing concern
with emergency planning at the county and local
levels. Perhaps the most significant longrun effectof the accident is the politicization at the local level
about the future of TMI.
From the above findings, we make the following
recommendations aimed at reducing the socioeconomic impacts resulting from any future accident at a nuclear powerplant.
1. Improved Public Education-The public in the vicinity of nuclear power reactors should be welli nformed about several aspects of reactor operation and malfunctions including the following:• general information about a reactor andhow it works;• the kinds of accidents that might haveoffsite radiological consequences and theirlikelihood of occurrence;• potential health consequences of various
types and levels of radiological release;• basic elements of the emergency preparedness plan for the reactor in question;• offsite protective action that may be required for a range of radiological release
scenarios;• expected benefits and costs of protective
action measures including reduction in radiological exposure and associated health
implications and societal costs in terms ofsocial and economic disruption.
We believe a public well informed on those
topics will be less prone to psychologicaldistress and spontaneous evacuation.

2. Improved Information Flow-Timely, relevant, andunderstandable information about the status of an
accident and likely offsite consequences must be
available to State, county, and local decisionmakers responsible for recommending or implementing offsite protective action. This information
should be adequate for State, county, and local
emergency officials not only for making decisions
on the need for specific protective actions but
also for responding in a knowledgeable manner
to questions from the general public. Also, thei nformation flow to the public should be sufficientfor them basically to reasonably understand thesituation at the plant and the purpose and needfor any protective actions that may be ordered oradvised.

REFERENCES AND NOTES
7'The President's Commission on the Accident at Three
Mile Island, "Report of the Public's Right to Information
Task Force" at 118.
2
The President's Commission on the Accident atThree Mile Island, "Report of the Office of Chief Counsel
on Emergency Response" at 33.
3
The President's Commission on the Accident atThree Mile Island, "Report of the Public's Right to Information Task Force" at 296.
4
Id. at 185.
5
Id. at 186.
6
Stanley D. Brunn, James H. Johnson, Jr., and Donald
J. Zeigler, "Final Report on a Social Survey of Three Mile
Island Area Residents," Department of Geography, Michigan State University, August 1979.

C. B. Flynn, "Three Mile Island Telephone Survey:
Preliminary Report on Procedures and Findings,"
NUREG/CR-1093, prepared for NRC by Mountain West
Research, Inc., October 1979.
8
The President's Commission on the Accident atThree Mile Island, "Technical Staff Analysis Report on
Behavioral Effects."
9C. B. Flynn and J. A. Chalmers, "The Social andEconomic Effects of the Accident at Three Mile Island:
Findings to Date," NUREG/CR-1215, prepared for NRC by
Mountain West Research, Inc., January 1980.
10
C. R. Hickey, Jr. and R. B. Samworth, "NonRadiological Consequences to the Aquatic Biota andFisheries of the Susquehanna River from the 1979
Accident at Three Mile Island Nuclear Station," NUREG0596, November 1979.

646

APPENDIX 11.1
I NTRODUCTION TO
SEQUENCE OF EVENTSThe following sequence of events has been compiled from a number of sources; the NRC report
NUREG-0600,1 the EPRI report NSAC-1,2 the Met
Ed sequence of events,3 various logs, plant computer output, the reactimeter, plant strip charts andoperator interviews (especially those conducted by
GPU on March 30, 1979). Times and events fromother sequences have been checked insofar as
possible from hard data sources such as the alarmand utility printers, reactimeter, and strip charts. An
attempt has been made to reconcile discrepancies
found in other published sequences. Where major

discrepancies have been found they have been signaled in this sequence of events by the symbol ($q.
Some events are not confirmed by hard data. In
such cases, the times as given in the logs or by
operator recollection have been used. It should beunderstood that these times may be subject to wide
error. When events occur in rapid succession, theorder of occurrence has been taken to be that givenby the alarm printer. Because of the alarm sampling
procedure, the order in which events are printed is
not necessarily the order of occurrence.

647

Date

3/28/79

Time
after
initiation
--

Event

Plant status prior to accident:
TMI-1 is shut down for refueling.
TMI-2 is operating at between 9798% of full power. The Integrated
Control System (ICS) was in automatic. Pressurizer heater and spray
controls were in manual. Feedwater
pumps FW-P1A and FW-P1B, condensate pumps CO-P1A and CO-P1B andcondensate booster pumps C0-P2A and
MakeupCO-P2B were in operation.
pump MU-P1B was in service.
Operators were attempting to transfer spent resins from a condensate
polisher to the resin regenerationtank.
In this operation air at 100
psig and demineralized water at approximately 160 psig are used.
Plant parameters as printed by thehourly log typer at 0300:
RCS Pressures:
Loop A = 2165 psig
Loop B = 2148 psig
Flow - 137 million lb/h
Temperatures:
Loop A TH = 606oF
TC = 556-558°F
Loop B TH - 606°F
TC = 557°F
Pressurizer level = 229
inchesMakeup Tank at 77 inches
Makeup Flow = 70 gpm
Steam Generators
Pressure:A = 908 prig
B = 905 psig
Temperature: A - 595oF
B = 594°F
Levels:A - 257 inches
B = 264 inches
Percent of full power - 97.928

Information
available tooperators

Postaccident
calculations
and data

Remarks

References

1,2,3,10

EventNumber

Date

Time
after
initiation

1

3/28/79 -1 s
(0400:36)

2

Event

information
available tooperators

Postaccident
calculations
and data

Remarks

References

Condensate pump CO-P1A tripped.

Annunciator(panel 17)
Status lights(panel 5)
Alarm printer(operating without delay atthis time)

0 s(0400:37)

Feedwater pumps FW-P1A and
FW-P1B tripped.

Check valve in air line It has been postulated 1,2,3,4
to condensate polisher
that the cause of thewas found to be frozen trip was closure ofin the open position.
the polisher outletThis could have adinlet valves because
mitted water to theof water in the concontrol air system.
trol air system. The
Condensate booster
polisher outlet andpumps C0-P2A andinlet valves wereC0-P2B found trippedfound to be closed
after turbine trip.
after the turbine
trip, but tests ofsimilar valves havenot substantiatedthis hypothesis.
Could have tripped on 1,2,3,4
low suction pressure
or trip of condensate
booster pumps.

3

0 s

Annunciator(panels 15 and17)
Pump discharge
meter (panel 5)
Alarm printer(delay--4 s)

Turbine trip.

Annunciators(panels 5 and 17)Meters (panel 5)
Status lights(panel 5)
Alarm printer(delayed)

Normal following trip 1,2,3,4,of feedwater pumps.
5,6

4

0 s

Emergency feedwater pumps EF-P2A,
EF-P2B and EF-PI came on.

5

+1 s

Status lights(panel 4)
Alarm printer(delayed)

Turbine throttle and governor
valves closed.

Meters(panel 5)
Alarm printer(delayed)

Block valves EF-V12A
and EF-V12B wereclosed.

Startup of emergency
feedwater is automaticon loss of main feedwater pumps.

1,2,3,4

One throttle valve did 1,4,11
not show closed.

EventNumber

Date

Time
after
initiation

Event

Information
available tooperators

Postaccident
calculations
and data

Remarks

Pressure in reactor
coolant drain tank
(RCDT) begins toincrease.

References

1,2,3,6

RCS pressure reaches the setpointof the pilot-operated relief valve
PORV opens.
(PORV) RC-R2.
(Setpoint = 2255 psig)

Status light(panel 4)

8 s

Reactor trips on high pressure.
(Setpoint = 2355 psig)

Annunciator(panel 8)
Status light andmeter (panel 14)
Neutron flux
meter (panel 4)88 s

Pressurizer heater banks 1-5
tripped.

Status light(panel 4)9

9 s

Main steam pressure peaks at1070 prig.

Meter (panel 4)
Strip chart(panel 17)

1,2,3,610

9 sConfirmed all rods inserted.

Status lights(panel 4)
Alarm printer(delayed)

1,3,4

11

13 s

Operator
Let down secured.
attempts to start makeup pump
MU-P1A.

Annunciator(panel 8)
Status light(panel 3)
Alarm printer(delayed)
Letdown flow
meter (panel 3)

Pump failed to start.

The switch for the
1,2,3,4
makeup pump must be
held in the start
position for 2.5 s.
Observation of statuslight would have shownthat pump did notstart.
The purpose of
these actions is tominimize pressurizer
transient.

12

13 s

RCS pressure reaches setpoint
for PORV closure (setpoint =2205 psig).

Status light(panel 4)

Valve did not close.

Light "off" indicatessolenoid deenergized.
There is no actual
position indicator.

6

3/28/79 3 s

7Reactimeter indicatespeak pressure of 2346
psig.
Wide range
strip chart shows apeak of 2435 psig.

1,2,3,4,
Reactimeter sampling
rate may be too coarse 5,6
to catch peak. The
code safety valves
may have lifted
momentarily, if thehigher indicatedpressure is correct.
Pressurizer was
evidentally switchedfrom manual toautomatic control.

1,2,3,4

1,2,3,6

EventNumber

Date

Time
after
initiation

Event

Information
available tooperators

Postaccident
calculations
and data

Remarks

References13

3/28/79 13 sCondensate hotwell low level
alarm (21.72 inches).

meter (panel 5)
Alarm printer(delayed)

14

14 s

Pressurizer heater groups 1-5
returned.

Status light(panel 4)
Alarm printer(delayed)

Automatically energized on decreasingpressure.
Setpoints
2105 psig for 1-3 and2120 psig for 4-5,
with pressure
decreasing.

1,2,3,415

14 sEmergency feedwater pumps reachfull discharge pressure.

Meters (panel 4)
Alarm printer(delayed)

Emergency feedwater
valves EF-V11A and
EF-VllB will not open
until OTSGs reach 30
inches.

1,2,3,416

15 s

Pressurizer spray valve closed.

Status light(panel 4)

17

15 s

Pressurizer peaks at 255 inches.

Meter (panel 5)
Strip chart(panel 4)

RCS parameters arenormal.

18

28 s

OTSG A reaches 30 inches.

Meter (panel 4)
Annunciator(panel 17)

3,6
Emergency feedwater
valves EF-V11A and
EF-V11B should begin
to open.
These valvesapparently opened more
slowly than usual;
however, no flow waspossible because theblock valves wereclosed.

19

28 sCondensate hotwell level returned
to normal.

Meter (panel 5)
Alarm printer(delayed)

3,4

20

30 s

High temperature alarms on outlet
temperatures for PORV (239.2°F)
and one code safety valve.

Strip chart(panel 10)
Alarm printer(delayed)

21

30 s

RCS pressure reaches low pressure
trip setpoint (1940 psig).

2,3,4

2,6

Alarms were not considered abnormal, because the PORV had
previously opened.
Reactimeter data.

1,3,6

1,2,3,4

1,2,4,6

EventNumber

Date

Time
after
initiation

Event

Information
available tooperators

Postaccident
calculations
and data

Remarks

References

Both OTSGs alarm low.

Annunciator(panel 17)
Meter (panel 4)
Alarm printer(delayed)

41 sStart makeup pump MU-P1A.
Open
valve MU-V16B to increase makeup
flow.

Annunciator(panel 8)
Status light(panel 3)
Alarm printer(delayed)

Pump was started by a
1,2,3,4
second operator, who
saw that the first atattempt was unsuccessful.
Pumps A and
B are now both
operating.

24

41 a

Open valve DH-5A.

Status lights(panel 8)

Allows makeup to be
drawn from BWST.

1

25

48 a

Pressurizer level reaches minimum
158.5 inches and starts toincrease.

Meter (panel 5)
Strip chart(panel 4)

Minimum level is not
as low as usual forthis transient.

1,2,3,626

1 min

Code safety valve (RC-R1A) outlet
temperature alarms high (204.5oF).

Strip chart(panel 10)
Alarm printer(delayed - 1 min)This does not necessarily indicate thatthe code safety valveslifted; opening of
PORV would also cause
increase in code
safety valve outlet
temperature.

1,2,3,427

1 min,
13 s

Condensate high level alarm.

Meter (panel 5)
Alarm printer(delayed ^-1 min)Condensate hotwelllevel control andother secondary side
problems were constantly occurring,
distracting operators' attention fromthe accident.

2,3,4

28

1 min,18 a

OTSGs reach minimum level on startup range instrumentation(A: 11 inches;
B: 15 inches).

Steam pressure:
Meter (panel 4)
OTSG level:
Meter (panel 4)22

3/28/79 40 s

23

1,4

Hotwell level rejectvalve was later foundto be inoperative.
Instrument air line tolevel controller was
broken.

Indicates dryout.
1,2,3,6Ref. 1 andNo feedwater was
being admitted.
DryRef. 3 times
out indicated by low
are insteam pressure, lowerror.
level, increasing RCS
temperature.
Operator
verified EF-V11A and
B opening.

EventNumber

Date

Time
after
initiation29

3/28/79 1 min,
26 s

30

Event

Information
available tooperators

Postaccident
calculations
and data

Remarks

References

Reactor coolant drain tank (RCDT)temperature reaches 85.50F.

Meter (panel 8A)
Alarm printer(delayed - 1 min)

RCDT temperature was
gradually increasing
as RCS coolant was
released from the
EMOV.

1,2,3,4(Ref. 1time isin error)

1 min,30 s

RCS pressure reaches 1727 paig.

Meter (panel 4)
Strip chart(panel 4)
Alarm printer(delayed -. 1 min)

RCS pressure was decreasing, pressurizer
level was increasing,
RCS temperature wasincreasing.
Pressure
normally trends inthe same direction aslevel and temperature
following feedwatertransient and reactor
trip.

1,4,6
(Ref. 1time isin error)31

2 min,
2 s

ESF actuation.
Makeup pump
MU-P1B trips.
Makeup pump
MU-PlC starts at 2 min 4 s. DH
removal pumps lA and 1B start.

ESF:
Annunciator(panel 13)
Status lights(panels 3 and 13)
MU pumps:
Annunciator(panel 8)
Status lights(panel 3)
DH pumps
Status lights(panels 3 and 13)Meters(panels 3 and 8)
Alarm printer(delayed 2 min)Actuation on low RCS
pressure (setpoint
1600 psig.)
Makeuppumps A and 1C
operating with valves
MU-V16 wide open.

1,2,3,4,5

32

3 min,
13 a

RCDT relief valve opens (120 paig).

Pressure:Meter(panel 8A)

33

3 min,
13 a

ESF emergency injection bypassedby operator.

operator action
Alarm printer(delayed 3 min)

34

3 min,
26 s

RCDT high temperature alarm(127.2°F).

Meter (panel 8A)
Alarm printer(delayed 3 min)Reactimeter--not available to operators.

Reactimeter shows
oscillations, possibly
caused by RCDT safetyvalve lifting
momentarily.

2,3
Bypass leaves all
equipment operating,but generator now
has control.

1,2,3,4

Further indication ofopen PORV.

3,4

EventNumber
35

Date

Time
after
initiation

3/28/79 4 min
30 s(approx.)

Event

Information
available tooperators

Postaccident
calculations
and data

Remarks

References

Operator throttles makeup valves(MU-V16) to reduce injection flow.

Flow meter(panel 8)

1,2,3
Purpose of throttlingis (a) to reduce rateof rise of pressurizer
level (b) to prevent
pump damage as RCS
pressure drops.

36

4 min,
38 s

Operator stops makeup pump
MU-P1C.

Operator action
Annunciator(panel 8)
Status light(panel 3)
Pressurizer
level:
Meter (panel 5)
Strip chart(panel 4)

1,2,3,4Makeup valves MU-V16C
and MU-V16D were fully
closed.
Operator
throttles valves
MU-V16A and M-V16B in
an attempt to control
rising pressurizer
level.

37

4 min,
52 s

Operator starts intermediate closed
cooling pump IC-P-lA.

Annunciator(panel 8)
Status lights(panels 8 and 13)Meters (panel 8)
Alarm printer(delayed 5 min)operator is preparing
to put a second letdown cooler in operation, so that letdown
flow can be increased.
He is attempting torecover control overthe still-increasingpressurizer level.

38

4 min,
58 s

Letdown flow alarms high(Greater than 160 gpm).

Meter (panel 3)

Alarm printer is now
1,2,3,4so severely delayed(Ref. 1that it is of little
time isvalue to operators;
in error)
alarm printer will not
be listed as information available tooperator from now on.

39

5 min,
0 a

Pressurizer level hits peak of
377 inches, momentarily decreases
to 373 inches at 5 min 18 a, andthen begins to increase again.

Meter (panel 5)
Strip chart(panel 4)

1,2,3,640

5 min,
15 s

Start condensate pump CO-PIA.

Annunciator(panel 17)
Status light(panel 5)
Meter (panel 5)

2,3,4

1,2,3,4

EventNumber

Date

Time
after
initiation

41

3/28/79 5 min,
17 a

42

Event

Information
available tooperators

Postaccident
calculations
and data

Remarks

References

Attempt to start condensate booster
pump C0-P2B (trips at 5 min 20 s).

Annunciator(panel 17)
Status light(panel15)
Meter (panel 5)

Cause of trip is apparently low suction
pressure.
Auxiliary
operator has reportedly realigned polisher
correctly for restart.

1,2,3,4

5 min,50 a

RCS pressure reaches minimum(-1350 psig), then begins toincrease.
Temperature reaches
saturation.

Meters andstrip charts(panel 4)

Reaching saturation
temperature means thatsteam voids can formin system; steam isbeing formed rapidly
enough to reverse
pressure decline.

1,3,7

43

5 min,
51 s

Pressurizer level goes offscalehigh (greater than 400 inches).

Meter (panel 5)
Strip chart(panel 4)

44

6 min

RCDT pressure begins erratic,
rapid rise.

Meter (panel 8A)

45

6 min,
24 a

Condensate booster pump C0-P2B
trips after another attempted
start.

Annunciator(panel 17)
Meter (panel 5)
Status light(panel 5)46

6 min,
54 s

Letdown cooler high temperature
alarm (139°F).

Strip chart(panel 10)

This would have isolated letdown flow.

2,3,4

47

6 min,
58 a

Letdown flow decayed to 71 gpm.

Meter (panel 3)

Because of closure of
MU-V 346.

1,2,3,448

7 min,
29 s

Reactor building sump pump
WDL-P1A starts.

Pump outlet was believed aligned to themiscellaneous waste
holdup tank; however,the latter tank's
level does not show
the appropriatechanges.
Pump wasapparently aligned tothe auxiliary building
sump tank, which had ablown rupture disk.

1,2,3,4

1,2,3,6

Reactimeter data(not available tooperators).

Indicative of twophase flow through
PORV.

1,2,3,6

1,2,3,4

information
available tooperators

Postaccident
calculations
and data

Event
Number

Date

Time
after
initiation49

3/28/79

8 min

operator finds emergency feedwater
block valves EF-V12A and EF-V12B
shut and opens them.

Status lights(panel 4)

Clues to blocked
1,2,3,6
feedwater flow:low
OTSG level, low steampressure, high emergency feedwater discharge pressure.
Clues to initiationof flow: drop in discharge pressure, noisefrom loose partsmonitor, increase insteam pressure.

50

8+min

RCS temperatures begin to decrease.

Strip charts(panel 4 andpanel 10)
Meter (panel 4)

Resumption of heattransfer throughsteam generators.

51

8 min,
58 a

Condensate pump CO-PIA trips again.

Annunciator(panel 17)
Meter (panel 5)
Status light(panel 5)

Another recurrence of 1,2,3,4
secondary side problems, apparently unrelated to accident,
but very troublesome
to operators.

52

9 min,
7 s

Intermediate range NIs drop below
scale, source range NIs energized.

53

9 min,
13 a

Condensate booster pump low suction
pressure alarm (14.7 psig).

54

9 min,
23 a

Letdown flow reestablished.

55

9 min,
30 a

Turbine bypass valves placed inmanual.

Operator action

ICS was not responding adequately toincreased steampressure.

56

10 min

RCP high vibration alarm.

Annunciators(panel 8 andpanel 10)
Meter (panel 10)

3
Indication of voids
in system.
Apparently
not recognized.

57

10 min,15 a

Pressurizer level comes back onscale and drops rapidly.

meter (panel 5)
Strip chart(panel 4)58

10 min,19 a

Reactor building sump pump
WDL-P2B starts.

Event

Remarks

References 1

3,6

1,4
See remarks above.

2,3,4
4
1

2,3,6

1,2,3,4

EventNumber

Date

Time
after
initiation

Event

Information
available tooperators

Postaccident
calculations
and data

3/28/79 10 min,24 s
to11 min
43 a

Makeup pump MU-P1A was stopped,
started, stopped, and restarted.

61

10 min,48,sReactor building sump high level
alarm (4.65 feet).

Alarm printer.

62

11 min,24 $Intermediate cooling water temperature from RCDT cooling is off scale( - 225 0 F).

Alarm printer.

63

13 minThe operators are attempting toestablish a 30-inch level in the
OTSCs.

Meter (panel 4)
Strip chart(panel 4)
Strip chart(panel 5)64

13 min,13 aOperators stopped decay heatremoval pumps DA-P1A and B.

Operator action
Status lights(panel 13 andpanel 3)
Meters (panel 8
and panel 13)65

13 min,27 sCondensate booster pump suction
header low pressure alarm clears.

66

14 min,50 s

Reactor coolant pump alarms begin
to be received on pumps 2A and 1B.

59
60

Annunciator(panel 8)
Status light(panel 3)
Meter (panel 3)

Annunciators(panel 8 andpanel 10)
Meter (panel 10)

Remarks

References

After final restart,pump 1A runs throttled
for 3 h 23
min.

1,2,3,4

PORV discharge goes
into RCDT, then out
RCDT relief valve.

1,2,3,4

1,4Operators may havethrottled valves
EF-V11A and B.

1

1,2,3,4

Alarm printer.

2,3,4

Alarm printer.

Many rapidly alter1,2,4
nating "norm/high" or"norm/low" alarms onpump speed, seal leaktank level, backstop
oil flow, etc. These
were probably causedby high vibrationlevels of the RCPs andall associated equipment, but might not
be perceived as such.
The great number of
RCP related alarms wasa major factor in thealarm printer getting
so far behind time.

EventNumber

Date

Time
after
initiation

Event

Information
available tooperators

67

3/28/79 15 min,
27 a

68

15 min,43 aCondensate booster pump low discharge pressure alarm (307 psig).

69

16 min,4 sRestarted condensate pump
CO-P1A.

Operator action
Annunciator(panel 17)
Meter (panel 5)
Status light(panel 5)70

16 min,
30 s

RCS becomes subcooled.

RCS Pressure:
Meter andstrip chart(panel 4)
RCS Temperature:
Meter andstrip chart(panel 4)
Strip chart(panel 10)71

16 min,12 sCondensate booster pump suction low
pressure alarm.

72

19 min,23 s

Reactor building air exhaust ductshows increased radiation level.

Meter (panel 12)
Strip chart(panel 12)73

22 min,17 s

Source range NI was higher than
expected:
the operator manuallytripped the reactor.

Meter (panel 4)74

22 min,44 s

OTSG A low level alarm cleared.

Annunciator(panel 17)

RCDT rupture diaphragm bursts.
RCDT pressure drops suddenly;
reactor building pressure increases 1 psi.

Annunciator(panel 8A)
Meter (panel 8A)

Postaccident
calculations
and data
Reactimeter (notavailable tooperators).

Remarks

References

The drain tank is now 1,2,3,6
completely open to thereactor building atmosphere, and will
overflow.

Alarm printer.

2,3,4
2,3,4

Calculations based onreactimeter temperature data and strip
chart pressure data.

RCS has been nearsaturation or saturated for - 10 min.
For 30 min to 1 hhereafter, the RCS
remains either
slightly subcooled
or saturated.

Alarm printer.

1,6

2,3,4
Probably due to dislodged "crud." Possibly slight crackingof fuel clodding.

Postaccident analysis
Operator was notindicates increase wasaware of reason fordue to voids in coolant increase.
in downcomer.
OTSG B clears 4
min later.

1,2,3

1,2,4

1,4

EventNumber

Date

Time
after
initiation

Event

75

3/28/79 24 min,
58 s

Operator requested PORV and code
safety valve outlet temperatures.
PORV outlet was 285.40F, code
safety outlets were 263.90F and
275.1°F.

76

25 minLetdown cooler high radiation
alarms.

77

25 min,44 s

Emergency feedwater low dischargepressure alarm received.

78

26 min,26 a to27 min,
51 s

The operators request the computer
print RCS temperatures, PORV outlet
temperature, and pressurizer level.

79

26 minStopped steam driven emergency
feedwater pump.

80

28 minOperator closes valves supplying
emergency feedwater to OTSG B.

81

30 min,21 sDiesels manually shut down.

Information
available tooperators

Postaccident
calculations
and data

Utility printerHigh temperatures,
coupled with blown
RCDT rupture disk andincreasing reactor
building pressure,give sufficient indication of PORV being
open.
Note, however,that RCDT parameters
are displayed behindthe control panels.
RB pressure can beread on panel 3.

operator believed
high temperatures
were due to (a) slow
cooldown from theopening at 3 s,and (b) known leakage.

3,8

Analyses indicate thatlittle significant
fuel damage could haveoccurred at this time,
although there is somepossibility of clod
rupture on highpowered fuel rods.

This is probably due
to a "crud burst,"
which would not be
unexpected in atransient event.

3

Operator has apparently shut steam
driven emergency
feedwater pump toslow the rate of riseof water in the steam
generators.

1,2,4

Utility printerOperator action

Remarks

References

1,2,8

Intend to slow rateof rise in level.

1

Auxiliary operator has 1,4been sent to diesels
to shut them down
locally.
Dieselscannot now be started
from control room.

EventNumber

Date

Time
after
initiation

Event

Information
available tooperators

Postaccident
calculations
and data

Remarks

References82

3/28/79 31 min

Operator requests "Sequence ofEvents Review" from computer.

83

32 min,36 s

Incore thermocouple R-10 alarms
offscale high (T greater than
7000F).

84

36 min,8 s

Emergency feedwater pump EF-P2B
stopped by operator.

85

38 min,10 a

Reactor building sump pumps turned
off.

86

40 minOperator checked RCDT pressure
and temperature.

Meters(panel BA)

87

40 minIncreased source range count rate.

Meter and strip
chart (panel 4)

88

44 minOperator requests printout ofpressurizer level indicatordifferential pressures.

Utility printerOperator attempts todetermine if levelindication is correct.
Conclusion:
all instruments agree.

1,8

89

45 minLetdown cooler count rateincreased slowly over an order ofmagnitude.
Peak - 2 x 104 cpm.
(IC-R-1092)

Meter and strip
chart (panel 12)

Increase and recovery
are more indicativeof crud burst than offuel failure.

2,3,8

90

50 minOTSG A level trending downward;
OTSG B level trending upward.

Meters and strip
charts (panel 4)
Strip chart (O.R.)
Channel 591

52 minOperator requests computer printcondenser pressure and emergency
feedwater pump #1 dischargepressure.

Utility typer

92

59 minCondensate High Temperature Alarm.

Utility printer

1,8
1,2,3,4

Alarm printer not received by operator fornearly 30 min.
Meters andstatus lights(panel 4)

Further actions toatop rate of rise of
OTSG levels.
approximately 8300
gallons have been
pumped to auxiliarybuilding.

1,2,3,4

1,2,3,4

3
RCS conditions again
at or approachingsaturation.

Possible voiding
core region.

in

2

1,6

EF-P1 has previously
been shut down.

1,8EventNumber
93

94

Date

Time
after
initiation

3/28/79 59 min

1 h

Event

Polisher inlet and outlet valves
were manually opened.

Plant status:
All RCPs running, makeup
pump HU-P1A operating.
Feeding
OTSG A directly. Feeding OTSG
B via cross-connect.
Hourly log
typer has the following data for
0500:
Reactor Coolant Flow - 103 x 106
lb/hLoop A: TH - 550oF
TC - 546-547oF
Pressure - 1061 psig
Loop B: TH - 550OF
TC - 547oF
Pressure - 1041 psig
1003 psig
Steam Pressure A
B = 1011 psig
Steam Temperature A - 5790F
B - 580OF
Makeup Flow - 102 gpm
The PORV is open (unknown to theoperators).
The RCS is nearsaturation, probably having extensive voids in the core. Coolant
pump operation has become severely
degraded, with reduced flow andhigh vibration.
Difficulties withthe condensate system have plagued
the operators the past hour; thecondition of the RCS appeared outwardly stable, i.e., pressure andtemperature were not changing
rapidly.

Information
available tooperators

Postaccident
calculations
and data

Report frompersonnel atpolisher.

Remarks

References

Still could not estab- 1
lish hotwell level
control--broken airline to reject valve.
Calculated decay
power
32.8 MW

Note that steam temperature is actuallyhigher than hot-leg
temperature; thisshows that cooling at
this time is being
provided by makeup
water, which is being
blown out through the
PORV.

10,12

EventNumber

Date

Time
after
initiation95

3/28/79 1 h,
1 min

96

Event

Information
available tooperators

Postaccident
calculations
and data

Remarks

References

The operator stopped circulationwater pumps CW-P1B, C, D and E(opens atmospheric dump).

Operator action
Meters andStatus lights(panel 17)

1 h,
2 min

Alarms from 1 h 2 min to
1 h 13 min are on theutility printer.

Utility printer

97

1 h,
11 minReactor building air cooling coil B
emergency discharge alarm.

Flow meter(panel 25)

98

1 h,
12 minOperator requests alarm statusof reactor coolant pumps andmotors.

Utility printer

RCP flow is down
357. from normal.

1,8
All pumps show oil
lift pump dischargepressure alarms; IA,
2A, and lB show fullspeed alarms; allpumps show backstop
oil flow alarms; 2A
shows seal leak tanklevel alarms.
These
alarms may not be intrinsically valid, butwere probably causedby severe vibration
conditions.

99

1 h,
13 minOperator stops reactor coolant
pump RC-P2B because of increasing
vibration and decreasing flow andamperage.
Pump RC-P1B is stopped
a few seconds later.

Flow:meter andstrip chart(panel 4)
Vibration:
Annunciators(panel 8 & 10)
Amperage:Meter(panel 4) Statuslight (panel 4)

Coolant has now beenclearly saturated
again since about
1 h after
initiation.

Loop B pumps were
tripped in order tomaintain pressure onpressurizer spray linefrom loop A. Steampressure on B side
began to drop, indicating stagnation.

This is done to permit
use of the power
operated emergency
main steam dump valves(MS-V3A and MS-V3B) to
control main steampressure. The continuing deteriorationof the condensate
system has made anatmospheric dump
necessary.
Alarms are delayed
about 1-1/2 h.

The action causing
this change is taken
at 2 h 39 minafter initiation.

4,8

The fact that thisalarm clears in 30
a indicates thatit may be spurious.

1,3,4

1,2,3,6

EventNumber

Date

Time
after
initiation

Event

Information
available tooperators

Postaccident
calculations
and data

Remarks

References100

3/28/79 1 h,
13 min101

1 h,
15 minBoron concentration measured at
700 ppm.
Source range high(104 cps) and increasing.

B cone: sample
results
Source range:
Meter andstrip chart(panel 4)

102

1 h,
20 minAn increase in the letdown line
radiation monitor was observed.

Strip chart(panel 12)

Increased steadily for 1,9
the next 45 min,then stays offscale
high.

103

1 h,
20 minOperator gets printout of:Pressurizer surge line temperature (514°F)
PORV outlet temperature (283°F)
Code safety outlet temperature (211, 219OF)
Pressurizer spray line temperature (4970F)
Condensate pump outlet pressure(164 psi).

Utility printerThe operators now have 1,2,3,7
adequate information
to deduce that the
PORV is open--(a) No
reduction in outlet
temperature, and (b)PORV outlet 70OF
hotter than code
safety outlets.

104

1 h,
27 minOTSG B was isolated.

Operator action

105

1 h,
30 minIntermediate range and source
range neutron instrumentation
both increase.

Strip chart(panel 4)

106

1 h,
30 minBoron concentration down to400-500 ppm in RCS; activity
4 p Ci/ml (factor of 10 increase).

RCS sample
analysis.

Alarms are lost for 1 h,
24 min. (#)

Low boron concentration may have been due
to dilution of liquidin sample line by condensed steam.
Highcount rate may havebeen caused by voidsin the downcomer.

Assumption of leak insteam generator cannot
be supported by later
information.

Ref. 1 has the time
for this event at
1 h 2 min, with aduration of 2 h
49 min. These times
are obviously wrong.

2,3,4,8Operators fear restart, do not realizethat voids are formingin coolant.
Checkedreactor trip procedures.

1,2,7Operators assume that 1,3,5
low steam pressure andhigh reactor building
pressure are causedby steam leak.
Ref. 2 postulates that 1,2,3,7
increased voiding
makes the downcomer
annulus more transparent.

Analysis indicatesgross fuel failure
improbable at thistime.

increased activity
could be the resultof a crud burst; countlevel recovers.

1

EventNumber

Date

Time
after
initiation107

3/28/79 1 h,
30 min108

Event

information
available tooperators

Secondary side steam flow fromOTSG A increased.

Pressure:Meter(panel 4),
strip chart(panel 17)
Level:
Meters(panel 4),
strip charts(panels 4 & 5)

1 h,
34 minOTSG A boils dry again.

Meters (panel 4)
Strip charts(panels 4 b 5)

109

1 h,
37 minIntermediate range neutron inetrumentation drops off scale; source
range decreases suddenly by afactor of 30.

Meters and strip
charts (panel 4)

110

1 h,
37 minOperator increases flow to OTSG A
in an effort to reestablish level.

Operator action
Meters (panel 4)(EF-V11A)

Postaccident
calculations
and data
Inferred from pressure
and level changes.

Remarks

References

2,6
indicates increased
heat transfer in OTSG
A.
Temperature ofreactor coolant in A
loop has been trending
upward slightly; apparently temperature
difference across OTSG
is now sufficient for
OTSG to remove a significant amount ofheat from RCS. Loop
A cold-leg temperatures decrease next,
because of increased
heat loss.
1,2,3,6

Analysis (Ref. 2) indicates that separation of liquid andvapor probably
occurred.

Flow in A loop may
have now deteriorated
to the point thatvapor is no longer
being circulated.
Loop A flow is 30000
lb/h.
Normal flow is
60000 lb/h.
Flow is now dropping
rapidly.
Will raise level to-50% on operating
range, in an effort
to establish natural
circulation.

2,3

Time
after
initiation

Date

111

3/28/79 1 h,
41 minOperator stopped both Loop A
coolant pumps because of highvibration, decreasing and erratic
flow.

112

1 h,
42 min1 h,
42 minSamples taken from condenser
vacuum pump.
Source range count rate increased
two decades.
Intermediate range
comes on scale and increases one
decade.
Operators commence
emergency boration. (#)

114

1 h,
43 minHot- and cold-leg temperatures begin Meter andto diverge.
The cold-leg temperastrip chartture drops and hot-leg temperature(panel 4)
rises.
Strip chart(panel 10)

115

1 h,
52 minTrying to achieve 50% level on
OTSG A.

Operator action
Meters (panel 4)
Strip charts(panels 4 & 5)

116

1 h,
54 minOperator requests computer print
Sequence of Events Review.
(#)

Utility printer

113

Event

Information
available tooperators

Event
NumberVibration:
Annunciator(panel 8)
Annunciatorand Meter(panel 10)
Flow:
Meter
(panel 4)
Pump operation:
Status lights
and meters(panel 4)

Meters andstrip charts(panel 4)

Postaccident
calculations
and data

Remarks

The pump has been
operating without
adequate suction head.
Further operation
could cause severe
damage.

Primary to secondary
OTSG leak suspected.
No data available to
Increase has been
substantiate either of
postulated (Ref. 2)
conflicting hypotheses. to be due to lower
However, the fact that
downcomer water level
recorded source range
as the core dries out.
and intermediate range This conclusion is(NI-3 and NI-7) follow disputed by Ref.
each other closely
1--believes instrulends credence toment error.
Ref. 2.
After temperatures
exceed the narrow
range indications,average temperatureis the average of thenarrow range limits,rather than the
average of hot- andcold-leg temperatures.

References

1,2,3,6,7

1
1,2,3,7

1,2,3,6,7

1

Review disproves contention of Ref. 3
that makeup pump IC
has been started.

1,8

EventNumber
117

Date

Time
after
initiation

3/28/79 2 h

EventInformation
available tooperators

Plant Status:
Makeup pump MU-P1A
is operating, no reactor coolant
pumps are operating, OTSG A is being
dumped to the atmosphere because ofa general breakdown of the condensate system.
The hourly log
typer shows the following data for
0600:
Reactor coolant temperatures:
Loop A: TH = 558oF
TC (off scale)
Loop B: TH = 528oF
TC (off scale)Pressures:
Loop A = 735 psig
Loop B = 715 psig

Postaccident
calculations
and data

Remarks

Calculated decay
power = 25.7 MW

References

10,12

Makeup flow = 99 gpm
Steam Pressures:A = 685 psig
B = 190 psig
Steam Temperatures:
A = 536oF
B = 532oF
OTSG Levels:
A = 154 inches
B = 79 inches(OTSG B is isolated)
PORV is still open.
Boron sample = 400.
118

2 h,
5 min

OTSG A reaches 50% level.
Throttled back EF-V11A.

Meters (panel 4)
Strip charts(panels 4 & 5)

1,2,6,7119

2 h,
11 minLoop A hot-leg temperature offscalehigh.

Annunciator(panel 8)
Strip charts(panels 4 & 10)
Meter (panel 4)

TAVE will not becorrectly shown.

3,6

120

2 h,
15 minReactor building air sample
particulate radiation monitor goes
offscale high. (HP-R-227)

Annunciator,
meter, and strip
chart (panel 12)

Possibility of grossfuel damage at this
time.

2,3,7

121

2 h,
18 minOperator requests computer printout
of PORV and safety valve outlet
temperatures.
PORV-228.7°F,
safety valves 189.5°F, 194.2°F.

Utility typer

1,2,3,8

EventNumber

Date

Time
after
initiation

Event

Information
available tooperators

Postaccident
calculations
and data

Remarks

References122

3/28/79 2 h,
18 minOperator closes PORV block valve
RC-V2.

Status light(panel 4)

1,2,3

123

2 h,
18 minReactor building temperature andpressure immediately decrease.

1,2,3,7124

Strip chart(panel 3)

2 h,
18 min

RCS pressure begins to increase.

Meter and strip
chart (panel 4)

125

2 h,
24 minReactor building air sample gas
channel monitor increased and went
off scale. (HP-P-227)

3,7

126

Annunciator,
meter, and strip
chart (panel 12)

2 h,
28 minLoop B hot-leg temperature goes
offscale high.

Annunciator(panel 8)
Strip charts(panels 4 & 10)
Meter (panel 4)

127

2 h,
30 minSelf-powered neutron detectors
begin to go off scale.

There is now clear
3,6
evidence of superheating in the hot
legs.
This could haveshown the operatorsthat the core was
beginning to become
uncovered.

Strip charts(panel 14)

7

128

2 h,
34 minAdditional makeup pump started.

Indicative of highcore temperatures.

2

129

2 h,
35 minUnable to determine
which pump.
This
event not substantiated.

Operator begins feeding OTSG B
to 50% level.

130

2 h,
38 minMeters (panel 4)
Strip charts(panels 4 & 5)

Letdown cooler A radiation monitor
went offscale high.
Numerous area
radiation alarms received.

Annunciators,
meters, andstrip charts(panel 12)

Because of block
valve closure. No
physical evidence ofan increase in makeup
flow.

1,2,3,7

1,2,3,6,7

Calculations suggest
possibility of fueldamage at this time.

Letdown sampling
secured due to highradiation.

1,3,7

EventNumberDate

131

3/28/79

Time
after
initiation

Event

Information
available tooperators

Postaccident
calculations
and data

Remarks

Increasing levels ofneutron instrumentation lead operators
to fear restart.

2 h,
40 minEmergency boration started.

132

2 h,
43 minReactor coolant sample taken.
(140 µCi/ml)

133

2 h,
44 minIncore instrumentation panel
monitor goes offscale high.

134

2 h,
44 minMakeup pump stopped.

See event number 128
above. Not substantiated.

135

2 h,
45 minSee Remarks. (#)

Ref. 3 has makeup
pump 1C tripped at
this time.
Ref. 3 hadstart at 1 h 54 min
This contention isdisputed by Ref. 1(which erroneously
states that Ref. 3
has no start time).

136

2 h,
45 minNumerous radiation alarms begin.
(HP-R-225, HP-R-226, HP-R-222)

Panel 12137

2 h,
46 minUnsuccessful attempt to start
reactor coolant pump RC-P1A.

Status lights
and meters(panel 4)

138

2 h,
47 minAlarms back on alarm printer.
Alarm printer brought up to date.

Operator action

References

1,3

1
2,3

Meter and strip
chart (panel 12)

Radiation alarms are
now indicative of extensive fuel damage.

2

3

2,3

Alarms for the period
from 1 h 13 min to
2 h 47 min were
irretrievably lost.

1,2,3,8

EventNumber

Date

Time
after
initiation

Event

Information
available tooperators

Postaccident
calculations
and data

Remarks

References

139

3/28/79 2 h,48 min140

2 h,
48 minStation vent monitor (HP-P-219)
alarmed at 0.3 !Ci/sec--limit
for 1-131.

141

2 h,
52 minUnsuccessful attempt to start
RC-P2A.

Status light andmeters (panel 4)

1,2,3

142

Does not appear on
alarm printer.

2 h,
53 minControl of hotwell level regained.

Alarm printer(delayed several
minutes)
Meter (panel 5)

Broken air line toreject valve was
repaired.

1,2,3,4143

2 h,
53 minUnsuccessful attempt to start
RC-PlB.

Status lights
and meters(panel 4)

144

2 h,
54 minStart RC-P2B.

Status lights
and meters(panel 4)

145

2 h,
54 minPressurizer heater groups 1-5
tripped.

Status lights(panel 4)

146

2 h,
55 minPressurizer spray valve opens.

90% of core T-Cs offscale
high.
Self-powered neutron
detectors indicate readings.

Alarm printer

Readings on SPNDs
2,4
caused by high temperatures.
Flood ofreadings swamps alarm
printer, causing it tolose time again. Core
T-C reading not available to operators.
1

1,2,3

Had to jump-startinterlocks to startpump.
Flow was shown
momentarily and thendropped to near zero.
The pump ran withhigh vibration.

1,2,3,4,6

1,2,3,4Operation of pressur- 6
izer spray is impossible without reactor
coolant pump operation.

Time
after
initiation

Information
available tooperators

Postaccident
calculations
and data

7 incore T-Cs on scale.

Alarm printer(delayed
1/2 hour)

Slug of water from
RC-P2B apparently gavesome cooling.

2 h,
55 min

RCS pressure suddenly increased to2140 psig.

149

2 h,
55 min150

Event
NumberDate

147

3/28/79 2 h,
55 min148

Event

Remarks

References

These readings wereback on scale indicating that they had
just returned from an
offscale condition.

1,3,4

Annunciator(panel 8)
Meter and strip
chart (panel 4)

Slug of water fromcold leg gave rise to
rapid boiling.

1,3,4

HPI reset by increased pressure.

Annunciator(panel 13)
Status lights(panels 3 & 13)

Setpoint 1845 psig.

2,3,4

2 h,
55 minSource range and intermediate range
neutron instrumentation dropped
sharply.

Meters andstrip charts(panel 12)

Slug of water filleddowncomer, giving
better shielding.

1,3,4

151

2 h,
56 minStart circulating water pump
CW-P1B, and CW-PIE.
(Close atmospheric dump, resume
steaming to condenser).

Meters andstatus lights(panel 17)

This allows control
1,2,3,4of main steam pressure
by turbine bypass
valves, and use ofcondenser.

152

2 h,
56 minSite Emergency declared.

153

2 h,
59 minReactor building purge unit area
monitor and fuel handling building
area monitors increased.
( HP-R-3236 and HP-R-3240)
Fuel handling building air supply
fans turned off.

Reason:alarms.
Annunciators,
meters, strip
charts (panel 12)

radiation

1,2,3

EventNumber
154

Date

Time
after
initiation

3/28/79 3 h

EventInformation
available tooperators

Plant Status:
Makeup pump MV-P1A is operating,the PORV block valve is closed,
reactor coolant pump RC-P2B isoperating but with very little flow.
Both steam generators were being
fed, with dump to condenser fromsteam generator A only. The
hourly log typer gives the following information for 3 h 1 min:RCS Pressures:
Loop A = 2055 psig
Loop B = 2051 psig
RCS Temperatures:
Loop A: TH offscale highTC offscale low
Loop B:
TH offscale highTC offscale low
Pressurizer level = 375 inches.
MU Flow = 125 gpm
Steam Pressures:A = 308 psig
B = 416 psig
Steam Temperatures:A = 495OF
B = 520oF

Remarks

Calculated decay
power = 22.3 MW

155

3 h +

Pressurizer level offscale high.

Meter (panel 5)
Strip chart(panel 4)

156

3 h,
2 min

RCS Loop B hot-leg temperaturereaches 8000F.

Strip chart(panel 4)

157

3 h,
3 min

Hotwell low level alarm.

158

3 h,
4 min

Shut turbine bypass valves fromsteam generator B. Shut emergency
feedwater valves to steam
generator B.

Postaccident
calculations
and data

References

10,12

1,6,7

This is the limit on
multipoint recorder.

1,7
2,3,4

Status lights(panels 4 & 5)

Condenser vacuum pumpexhaust radiation
monitor had increased.
A leak from primaryside was suspected.
This completely isolates steam generator
B.

1,2,3

EventNumber

Date

Time
after
initiation

Event

Information
available tooperators

159

3/28/79 3 h,
5 min

160

3 h,
7 min

Condensate storage tank low level
alarm.

161

3 h,
10 minEmergency feedwater pump (EF-P2A)
was stopped.

Status lights andmeters (panel 4)
SG level: panels(panels 4 and 5)

162

3 h,
11 minCondenser hotwell low level alarm
cleared.

Meter (panel 5)

163

3 h,
12 minOpened PORV block valve.

Status light(panel 4)
Operator action

164

3 h,
13 minPressurizer spray valve closes.

165

3 h,
13 minStopped reactor coolant pump
RC-P2B.

Status lights,
meters, andstrip charts(panel 4)

166

3 h,
14 minIntermediate closed cooling pumparea radiation monitor increased.
(HP-R-207)

Annunciator,
meter, strip
chart (panel 12)

167

3 h,
20 min

ESF manually initiated.
Makeuppump MU-PLC starts.
Loop A hotleg temperature drops.

Annunciator(panel 13)
Status lights(panels 3 & 13)

168

3 h,
20 minSource range and intermediate
range detectors drop suddenly.

Meters and strip
charts (panel 4)

Source range and intermediate
range detectors increasing.

Postaccident
calculations
and data

Meters and strip
charts (panel 4)

Remarks

Indicates dropping
water level.
Alarm printer delayed
50 min.

References

1,3,7
2,3,4

Steam generator level 1,2,3,4
above 502 on startup
range.
2,3,4
Inferred from pressure
and temperatures.
Time cannot be
specified accurately.

Attempt to control RCS 1,2,3,4,7
pressure.
Outlet hightemperature alarm,pressure spike in
RCDT, drop in RCS
pressure, increase
in reactor building
pressure.
6
Zero flow, lowcurrent, highvibration.

1,2,3,4

2,3,7

Rapid quenching probably caused major
fuel damage.

Reason for actuation
was low RCS pressure.
HPI gives water incore.

1,2,3,4

Indicates reflooding.

1,2,3,7

EventNumber

Date

Time
after
initiation

169

3/28/79 3 h,
21 min170

Information
available tooperators

Event

Postaccident
calculations
and data

Remarks

References

Many radiation alarms received.
Annunciators,( MU-R-720HI, MU-R-720LO, IC-R-1091, meters, strip
IC-R-1092, IC-R-1093, WDL-R-1311,
charts (panel 12)
DC-R-3399, DC-R-3400, NS-R-3401,
SF-R-3402, HP-R-225, HP-R-226,
HP-R-222)
The control building(except the control room) was
evacuated.

Indication of majorcore damage.

1,2,3,73 h,
24 minGeneral Emergency declared.

Based on highreading on HP-R-212.

1,2,3

171

3 h,
26 minPressurizer high level alarm
clears.

Meter (panel 5)
Strip chart(panel 4)

1,2,4

172

3 h,
27 min

ESP actuation reset.

Operator action

1,4

173

3 h,
30 minBWST low level alarm at

174

3 h,
30 minShut PORV block valve.

Status light(panel 4)

175

3 h,
33 minPressurizer high level alarm level
increasing rapidly.

Meter (panel 5)
Strip chart(panel 4)

176

3 h,
35 minAuxiliary building basement flooded. Meters and strip
High radiation readings in many
charts (panel 12)
areas of auxiliary building.
Annunciators(panel 12)

177

3 h,
35 minStart emergency feedwater pump
EF-P2A.

Status lights andmeters (panel 4)

OTSG A level had beenfalling.

1,2,3,4178

3 h,
37 minMakeup pump MU-PlC stopped.

Status lights andmeters (panel 3)
Annunciator(panel 8)

Apparently stopped toslow rate of rise inpressurizer level.

1,2,3,453 feet.

1,4Time of closing isvery uncertain.
May
have been closed at
3 h 17 min.
Definitely closed
before 3 h 34
min.

1,2,3,4

1,2,4

1,7

EventNumber

Date

Time
after
initiation

Event

Information
available tooperators
Status lights(panel 4)

Postaccident
calculations
and data

Remarks

Time is in doubt.
Could have been
opened earlier.

References

1,2,3,4

179

3/28/79 3 h,
41 minOpen PORV block valve. Outlet
temperature alarms.

180

3 h,
45 minPressurizer spray valve opens.

181

3 h,
46 minSudden jump in source range
detectors.

Meters and strip
charts (panel 4)

182

3 h,
54 minReduced feed to OTSC A.

Operator action

183

3 h,
56 minES actuates on high reactor
Reactorbuilding pressure.
building isolated.

Annunciator(panel 7,3)

184

3 h,
56 minMakeup pump MU-PlC starts.

Annunciator(panel 8)
Strip charts andmeters (panel 3)

185

3 h,
56 minClose PORV block valve.

Status light(panel 4)

Inferred from reactor 7building pressure.

186

3 h,
56 minIntermediate closed cooling pumps
1A and lB tripped.

Annunciators,
status lights,
meters (panel 8)

By building isolation. 1,2,3,4

187

4 h

Plant status: makeup pumps
MU-PIA and B operating. No reactor
coolant pumps operating.
Thehourly log typer gives the following information:
RC Pressures: Loop A = 1460 psig
Loop B = 1453 psig
RCS Temperatures:
Off scalePressurizer level 381 inches
Steam Pressures
A = 30 psig
B = 358 psig (isolated)
Steam Temperatures
A = 4680F
B = 4990F

188

4 h

ESF and reactor building isolation
defeated.

6
May have been due tosudden steam flashingor change in coregeometry.

1,6This is the first time 1,2,3,4
the reactor building
has been isolated.
1,2,3,4Calculated decay
heat = 20.3 MW

Annunciator(panel 13)

1,2,7

ES actuation and RB
isolation have justoccurred.

10,12

1,2,4

EventNumber

Date

Time
after
initiation

Event

Information
available tooperators

Remarks

References

189

3/28/79 4 h

Started intermediate closed coolingpumps IA and 1B.

190

4 h

Incore thermocouples being manually
read.

191

4 h,
8 min

Start reactor coolant pump
RC-P1A.

192

4 h,
9 min

Stop reactor coolant pump
RC-P1A.

193

4 h,
15 minOpen PORV.

Status light(panel 4)

Inferred from reactor
building pressure.

7

194

4 h,
17 minStop makeup pumps MU-PIA and
1C.

Status lights andmeters (panel 3)
Annunciator(panel 8)

No makeup pumps now
running.

1,2,3,4195

4 h,
18 minAttempt to restart MU-P1A.

196

4 h,
19 min

ESF actuates on high building
pressure.
Decay heat pump DH-PIA
starts.
Intermediate cooling pump
IA trips. MU-P1A and C do notstart.

Annunciator(panel 13)

197

4 h,
19 minCleared ESF actuation.

Annunciator(panel 13)

1,2,3,4198

4 h,
19 minRestart intermediate coolingpump lA.

Annunciators,
status lights,
meters (panel 8)

1,2,3,4to
5 h,
30 minAnnunciators,
status lights,
meters (panel 8)

Postaccident
calculations
and data

Status lights,
meters, strip
charts (panel 4)

Necessary for letdown
cooling.

1,2,3,4This permits reading
beyond range of
7000F.
Range fromreadings was
80-2580°F.

1,2,3

purpose of start was
to observe current andflow.
Started satisfactorily, but runningcurrent was low, andflow was zero.

1,2,3,4

1,2,3,4

Switch apparently then 1,2,4,8
put in "pull-to-lock"position.
KU-P1A will
not now start on ESF
actuation.
One channel actuated, one channel
defeated.
2/3 logic
satisfied.
Immediately bypassed.

1,2,3,4

Time
after
initiation

Information
available tooperators

Postaccident
calculations
and data

Event
NumberDate

199

3/28/79 4 h,
20 min200

4 h,
22 minPressurizer spray valve closes.

201

4 h,
22 minOperator starts makeup pump
MU-P1B.

Status lights andmeters (panel 3)
Annunciators(panel 8)

202

4 h,
24 minPressurizer heater groups 1-5
return to service.

Annunciator(panel 8)
Status lights(panel 4)

203

4 h,
26 minLetdown cooler high temperature
alarm.

2044 h,
27 minStart makeup pump MU-PlC.

Status lights andmeters (panel 3)
Annunciator(panel 8)

1,2,3,4205

4 h,
31 minPressurizer heater group 10 trips.

Status lights(panel 4)
Annunciator(panel 8)

1,2,3,4206

4 h,
31 minStop condenser vacuum pumps.
condenser vacuum.

Status light(panel 17)
Annunciator andstrip chart(panel 17)

207

4 h,
31 minOpened main steam dump valve(MS-V3A).

meter (panel 5)

208

4 h,
35 minIncore thermocouple readings
printed out.

Utility printer

209

4 h,
36 minLetdown high temperature alarm
clears.

Event

Close PORV.

Status light(panel 4)

Broke

Remarks

inferred from reactor
building pressure.

References

7
6
1,2,3,4All heaters now inservice.

1,2,3,4

Probably a late alarm
when ESF was cleared.

1,2,4

Condenser vacuum had
been seriously degraded previously.
Auxiliary boiler
out of service.

1,2,3,4

2,3
Range from 310oF
to off scale.

1,8
1,4

EventNumber

Date

Time
after
initiation

Event

Information
available tooperators

Postaccident
calculations
and data

Remarks

References

Open PORV block valve.

Status light(panel 4)

inferred from reactor
building pressure.

7

4 h,
42 minEmergency feedwater pump EF-P2A
stopped.

Status lights and Steam generator could
meters (panel 4) only be operating in
reflux mode.
Heatremoval capability is
low.

Steam generator level
had risen and would
now remain up.

1,2,4

212

4 h,
44 minLetdown cooler A radiation monitor
went offscale low. (IC-R-1092)

Strip chart andmeter (panel 12)

Apparently failed.

2,3,7

213

4 h,
46 minPressurizer heater groups 4-5 trip.

Annunciator(panel 8)
Status lights(panel 4)

Did not come on again
for rest of 3/28.

1,3,4

214

4 h,
47 minIncore temperature readings again
printed out.

Utility printerRange from 3780F
to off scale.

1,8

215

4 h,
59 minintermediate cooling pump area
radiation monitors and reactor
building emergency cooling monitors(HP-R-207 and HP-R-204)
increase.

Strip chart(panel 12)

216

5 h

Plant status:
No reactor coolant
pumps running, makeup pump MU-P1B
and IC running, steaming throughatmospheric dump valve, only reflux
circulation, many radiation monitors
off scale (containment dome monitor
up to 6000 R/h), RCS pressure
1266-1296 psig, steam pressure(A) - 43 psig, temperature 454°F,
hot leg superheated, PORV block
valve open.

217

5 h,
15 min

RCS pressures (1203, 1164, 1126
psig) and pressurizer surge line
temperature (3030F) printed out.

Utility printer

218

5 h,
15 minDecision made to repressurize
system.

Operator action

210

3/28/79 4 h,
36 min211

3,7Calculations indicatethat a large quantityof hydrogen was now
in the RCS.
Calculated decay
power = 18.9 MW.

1,8

Bubble contained hyThere was nodrogen.
possibility of collapsing the bubble.

Believed hot legs
contained steam
bubble.
Hoped repressurizing would
collapse bubble.

1

EventNumber

Date

Time
after
initiation

219

3/28/79 5 h,
17 min220

Event

Information
available tooperators

Postaccident
calculations
and data

Remarks

References

The alarm printer returned toservice.

Alarm printer

5 h,
18 minClosed PORV block valve.

Status light(panel 4)

221

5 h,
19 minDecay heat pump DH-P1A stopped.

Status light(panel 3)

222

5 h,
24 minES actuates on building pressure.
Pumps MU-P1A and DH-P1A do notcome on.
ES immediately defeated.
Intermediate cooling pump lA trips
and is immediately restarted.

Annunciator(panel 13)
RB Pressure:
strip
chart (panel 3)

223

5 h,
29 minDiesels are placed in "MAINT
EXERCISE" position.

Operator action

Diesels can now be
started from the control room, but will
not automaticallystart.

1

224

5 h,
31 minPressurizer heater group 3 trips.

Annunciator(panel 8)
Status lights(panel 4)

Remains out ofservice.

1,3,4

225

5 h,
35 minPORV outlet temperature alarms
clear.

Evidence of closure
at 5 h 18 min.

1,4

226

5 h,
35 minCondensate storage tank low level
alarm.

227

5 h,
43 minSystem is repressurized. Pressure
maintained by cycling PORV block
valve.

Alarms had previously
been on utility
printer.
Alarms are
1 h 26 min behind
time.

3,4

1,2,3
Switch placed in"pull-to-lock".

1,4
1,2,4

4
Meter and strip
chart (panel 4)

Intention is to hold
1,2,3,4,7
pressure at about
2050 psig.
Intermittent outlet temperature alarms and pressure fluctuations show
block valve cycling.

EventNumber

Date

Time
after
initiation

Event

Information
available tooperators

Postaccident
calculations
and data

Remarks

References

228

3/28/79 5 h,
49 minControl room intake radiation
monitors (gas, particulate, iodine)
all increased.

Strip charts(panel 12)

229

5 h,
59 minAuxiliary building exhaust fansstopped because of high radiation.

Strip charts(panel 12)

230

6 h

Plant status:
RCS pressure being
maintained between 2050-2200 psigby cycling PORV block valve. No
reactor coolant pumps running,
makeup pumps MU-PIB and 1C
running, hot legs superheated.
Atmospheric dump from OTSG A.

231

6 h,
14 minRaise OTSG level to 97%, using
condensate pumps for feeding.

Meters andstrip charts(panels 4 and 5)

1,2

232

6 h,
14 minPressurizer heater groups 1 and 2
trip, but are immediately returned.

Annunciator(panel 8)
Status lights(panel 4)

2,3,4

233

6 h,
14 minAuxiliary building fans restarted.

Status lights(panel 25)

3,4

234

6 h,
17 minControl room personnel don
respirators.

235

6 h,
18 minOperator gets "Sequence of Events
Review" from computer.

236

6 h,
23 minTemperature on reactor building air
cooling coils B emergency discharge
goes off scale, then returns.

237

6 h,
39 minStart fuel handling building air
exhaust fans.

238

6 h 54 min Steam generator A downcomer andtoshell temperatures printed by
6 h 56 min computer.

Nonessential personnel 2,3,7
cleared from control
room.
Emergency control station moved to
TMI-1.
2,3
Calculated decay
power = 17.8 MW

1,3
Utility typer

1,8
Indicative of severe
temperature transient
in reactor building.

1,4

Status light(panel 25)

3

Utility printer

1,8

EventNumber

Date

Time
after
initiation

Event

Information
available tooperators

Postaccident
calculations
and data

Remarks

References239

3/28/79 7 h

240

7 h

Confirmed OTSG A not contaminated.

Measurement ofsteam plume.

1

241

7 h,
9 min

Started emergency feedwater pump
EF-P2A to raise steam generator
level higher.

SG level: Metersand strip charts(panels 4 and 5)

1,2,4

242

7 h,
30 minSteam generator A filled.

Meters andstrip charts(panels 4 and 5)

1,2,3

243

7 h,
30 minNote:
Natural circulation
cannot be achieved by repressurizing.
Reactor coolant pumps have
proven to be inoperable. At thistime it is planned to depressurize
via the PORV, with the hope ofgetting the pressure low enough toinject core flood tank water.

244

7 h,
30 minOpen PORV block valve andpressurize spray valve.

Status lights(panel 4)

1,2,3,6245

On orders of station
manager.

7 h,
42 minDefeated ESF actuation.

Operator action
Status light(panel 3)

1,2,3,4246

7 h,
44 min

ES would have been
actuated 1 min later
if it had not been
defeated.

Pressurizer heater groups 1 and 2
trip but immediately return.

Status lights(panel 4)

1,3,4

247

7 h,
44 minAuxiliary building air exhaustfans stopped.

Status lights(panel 25)

3

248

7 h,
50 minPressurizer heater groups 1 and 2
trip.

Status lights(panel 4)

Plant status: No reactor coolant
pumps operating, makeup pumps 1B
and 1C operating.
Maintaining RCS
pressure between 2000 psig and 2100
psig by cycling EMOV block valve.

Calculated decay
heat = 16.9 MW

10,12

May be depressurizing
via pressurizer vent
now.

1,3,4

EventNumber
249

Date

Time
after
initiation

3/28/79 7 h,
53 minEvent

operator gets "Sequence of Events
Review."Information
available tooperators

Postaccident
calculations
and data

Remarks

References

Utility printer

1,8

Utility printer

1,8

250

7 h 54 min Print out RCS and pressurizer
topressures and temperatures.
8 h 19 min

251

7 h,
58 minPressurizer spray valve opens.

252

8 h

Plant status: No reactor coolant
pumps operating. Makeup pumps
MU-PLB and 1C operating. PORV
block valve open. Pressurizer ventvalve probably open. Depressurizing
RCS hourly log typer gives thefollowing data:
RCS Pressure:
Loop A = 1035 psig
Loop B = 1038 psig
RCS temperatures off scale.
Pressurizer level - 395 inches
Steam Generators:
Pressures:A - 7 psig
B - 320 psig
Temperatures: A - 4220F
B - 458oF
Levels:A = 374 inches
B = 228 inches
Steaming through atmospheric
dump valve from OTSC A.

253

8 h,
1 min

Letdown cooler high temperature
alarm.

254

8 h,
12 minCore flood tank high level alarm.
(13.32 feet).

Annunciator andmeter (panel 8)

Possibility of checkvalve leakage.

1,3,4

255

8 h,
31 minStart decay heat cooling pumps
DH-P1A and 1B.

Status lights(panels 3 & 13)

Hoped to be able to
go on decay heatremoval system.

1,2,3,4256

8 h,
40 minOperator requests incore thermocouple readings.

Utility printerMost are off scale.

1,8

257

8 h,
40 min

RCS pressure is down to 600 psig.

Meter and strip
chart (panel 4)

Indicates RCS now
1,2,3,7
floating on core floodtanks.
Level ofCR tanks decreased
very little.

6
Calculated decay
heat
16.2 MW

10,12

1,4

EventNumber

Date

Time
after
initiation258

3/28/79 8 h,
43 min259

Event

Information
available tooperators

BWST level down to 32 feet.

Meter (panel 8)8 h,55 minCore flood tank high level alarm
clears (13.13 feet).

Annunciator andmeter (panel 8)

260

8 h,
58 minPrintout of RCS pressure andpressurizer temperature.
Pressure:483-526 psig, temperature 350°F.

Utility printer

261

9 h

Plant status: RCS has been
depressurized.
Makeup pumps
MU-P1A and 1C operating. EMOV
block valve open, vent valve may
be open. Steaming through atmospheric dump valve.
RCS Pressure:
Loop A = 473 psig
Loop B = 480 psig
RCS temperatures off scale.
Pressurizer level = 399 inches.
Steam pressures:A = 13 psig
B = 296 psig
Steam temperatures:A = 413oF
B = 4490F

262

9 h,
4 min

Stopped makeup pump MU-PlC.

263

9 h,
7 min

Pressurizer spray valve closes.

264

9 h,
8 min

Stopped taking makeup from BWST.

265

9 h,
15 minClosed atmospheric dump valve. (#)

Postaccident
calculations
and data

Remarks

References

1
Very little water
injected.

1,3,4
1,8

Calculated decay
heat = 15.6 MW

Annunciator(panel 8)
Status lights andmeter (panel 3)

1,2,3,4

6
Concerned that BWST
would run out.
Meter (panel 5)

1

There is now no heat
1,2,3
sink for the steam
generators.
Refs.
2 and 3 have this eventat 8 h 30 min.

Time
after
initiation

Event

Information
available tooperators

Postaccident
calculations
and data

Event
NumberDate

266

3/28/79 9 h,
15 min267

9 h,
17 minPORV outlet high temperature alarm
clears.

268

9 h,
20 minLetdown cooler high temperature
alarm clears.

269

9 h,
21 minPORV outlet high temperature alarm.
(EMOV block valve open-time notaccurately known)

Block valve must havebeen reopened prior
to this time.

1,4

270

9 h,
32 minPORV outlet high temperature alarm
clears (block valve closed-time
not accurately known).

Valve must have beenclosed again.

1,4

271

9 h,
40 minStart intermediate closed coolingpump IC-PIB.

This clears letdown
alarm.

1,4

272

9 h,
49 minPORV outlet high temperature
alarm (block valve reopened).

Valve was opened
again.

1,4

273

9 h,
50 minPressure and temperature incontainment show sudden spike.

Pressure spike wasbelieved to be "electrical noise."Max.
pressure 28 psig.
Not ascribed todetonation at thetime.

1,2,3,6,7

Shut PORV block valve.

Status light(panel 4)

Remarks

References

Cannot get RCS pressure low enough to go
on decay heat removal
system.
The line atclosure is not well
fixed.

1,2,3,5

Indicates that PORV
block valve was definitely closed bythis time.

1,3,4

1,4

Annunciators,
status light,
meters (panel 8)(RB Pressure:
Strip chart(panel 3)
RB Temperature:
Strip chart(panel 25)
Audible "thump"

Hydrogen combustionin containment.

EventNumber

Date

Time
after
initiation

Event

Information
available tooperators

ESF actuation on high/high building
pressure (setpoint = 28 psig).
Decay heat pumps DH-P1A and 1B
start.
Int. cooling pumps IC-P1A
and 1B trip. Reactor building
isolates.
Reactor building sprays
start.
Makeup pump MU-PlC
starts.
Reactor building isolated.

ES: Annunciatorand status lights(panel 13)
Status light(panel 3)
MU-PlC:
Annunciator(panel 8),
meters andstatus lights(panel 3)
Spray:
Statuslights (panels
13 and 15)Meterspanel 3)9 h,
51 minStopped makeup pump MU-P1C.

Annunciator(panel 8)
Status lights andmeter (panel 3)

276

9 h,
51 min480 v motor control centers 2-32A
and 42A trip.

277

9 h,
55 minPressurizer heater group 8 trips.

Status light(panel 4)

278

9 h,
56 minReactor building spray pumps
stopped.

Meters (panel 3)
Status lights(panels 13 & 15)
Annunciator(panel 8)

279

9 h,
57 minStopped decay heat pumps, DH-P1A
and 1B.

Status lights andmeters (panel 3)
Status lights(panel 13)

280

10 h

Plant status: RCS pressure 512522 psig, temperatures off scale,no RCPs running, makeup pump
MU-P1B running, pressurizer shows
400 inches, no secondary heat sink.

274

3/28/79 9 h,
50 min275

Postaccident
calculations
and data

Remarks

References

1,2,3,4,5
Later "Sequence ofEvents" review showed
only that 4 psi had
been received on 4
Log entry
channels.
has "4 psi" apparently
based on this printout.
Reactor coolant
pump air temperatures
alarmed high (clearedin 1 min).

1,2,3,4

1,4
1,2,3,4
Sprays operated for
5 min 40 s.

Calculated decay
power - 15.1 MW

Observed that pressure and temperature
had been brought down.

1,2,3,4Cannot get pressure
down far enough fordecay heat system.
Core Flood tanks remain floating, withintermittent changesof level.

1,2,3,4

EventNumber
281

Date

Time
after
initiation

3/28/79 10 h

Event

Information
available tooperators

Opened PORV block valve.

Status light(panel 4)
Utility printerPostaccident
calculations
and data

Remarks

Outlet temperature
alarms high 1 minlater.

References

2,3,4

282

10 h,
3 min

Operator gets "Sequence of Events"
covering last ESF actuation.

1,8

283

10 h,
5 min

Pressurizer spray valve opens.

284

10 h,
6 min

Pressurizer heater groups 1 and 2
returned to service, but trip
again less than 2 min later.

Status light(panel 4)

285

10 h,
28 min

RCS loop A outlet temperature
comes back on scale. Goes tominimum of 548OF and stays onscale for 10 min.

Strip chart andmeter (panel 4)

286

10 h,
32 minRCS
Makeup pump MU-PlC started.
pressure had dropped to 440 psig.

Annunciator(panel 8)
Meter and statuslight (panel 3)
RC Press:
Meter and strip
chart (panel 4)

1,2,3,4287

10 h,
33 minPressurizer heater groups 1 and 2
return to service.

Status light(panel 4)

1,3,4

288

10 h,
35 min

RCS pressure drops to 409 psig,
then starts to rise again.

Meter and strip
chart (panel 4)

2,7

289

10 h,
36 minMakeup pump MU-PIC stopped.

Annunciator(panel 8)
Meter and statuslight (panel 3)

1,3,4

290

10 h,
38 min

RCS loop A outlet temperature goes
off scale again, then comes back onand continues to drop.

Strip chart andmeter (panel 4)

3,6,7

291

10 h,
39 minPressurizer heater groups 1 and 2
tripped again.

Status light(panel 4)

3,4

6
1,3,4

Ref. 1 postulatespressurizer dumped toloop.
Operators may
have believed they
now had control ofpressurizer level.

1,2,3,7

EventNumber

Date

Time
after
initiation292

3/28/79 10 h,
40 min293

10 h,
44 min

294

11 h

Event

Information
available tooperators

Auxiliary building sumps now full.

Observation

Auxiliary building fans came on.

Strip chart(panel 25)

Plant status: Makeup pump
MU-PlB operating.
EMOV block
valve open.
RCS Pressure:
Loop A = 415 psig
Loop B - 421 psig
RCS Temperatures:
TH-A = 5250F
All others off scale.

Postaccident
calculations
and data

Remarks

References

1
Ran for 30 min.
Calculated decay
heat = 14.6 MW

3,7
10,12

Pressurizer level 378 inches.
Steam pressures:A = 63 psig
B = 266 psig
A = 404 psig
Steam temperatures:
B = 431 psig
OTSG levels: A = 371 inches
B = 224 inches

295

11 h,
6 min

Pressurizer decreased to 180
inches in next 18 min. RCS
loop A temperature increases.

Annunciator(panel 8)
Strip chart(panel 4)
Meter (panel 5)

1,3,6,7296

11 h,
10 minRespirators removed in control
room.

Operator action

1,3,5

297

11 h,
10 minShut PORV block valve.

Status light(panel 4)

1,2,3

298

11 h,
18 minStart makeup pump MU-PlC
pressurizer low level alarm.

Annunciator(panel 8)
Meter and statuslight (panel 3)
PZR level:
Annunciator(panel 8)
Strip chart(panel 4)

1,2,3,4299

11 h,
27 minComputer printout of PORV andpressurizer safety valve outlet
temperatures.

Utility printer

EMOV outlet 191oF
safety valves 17loF
and 1750F.

1,8

EventNumber

Date

Time
after
initiation

300

3/28/79 11 h,
28 min301

Event

Information
available tooperators

Postaccident
calculations
and data

Remarks

References

Stopped makeup pump MU-PlC.

Annunciator(panel 8)
Meter and statuslight (panel 3)
Pressurizer(panel 4)

11 h,
29 minPressurizer heater groups 1 and 2
tripped again.

Status light(panel 4)

1,3,4

302

11 h,
33 minStart makeup pump MU-PlC.

Annunciator(panel 8)
Meter and statuslight (panel 3)

1,2,3,4303

11 h,
34 minStart emergency feedwater pump
EF-P2B.

SG level:
Strip charts andmeters (panels
4 and 5 )EF-P2B:
Statuslights andmeters (panel 4)

To raise level in
OTSC B to 97% to
99% range.

1,2,3,4304

11 h,
36 minStop makeup pump MU-PlC.

Annunciator(panel 8)
Meter and statuslight (panel 3)

Pressurizer level
continues to climb.

1,2,3,4305

11 h,
44 minPressurizer low level alarm clears
at 206 inches.

Annunciator(panel 8)

306

11 h,
52 minStopped emergency feedwater pump
EF-P2B.

SG level:Stripcharts and meter(panels 4 and 5)

307

11 h,
54 minPressurizer high level alarm at
260 inches.

Annunciator(panel 8)

Pressurizer level
increasing.

1,2,3,4

1,4
Steam generator B at
97%.

1,2,4

1,4

EventNumber
308

Date

Time
after
initiation

3/28/79 12 h

EventInformation
available tooperators

Postaccident
calculations
and data
Calculated decay
heat = 14 MW

Plant status:
No reactor coolant
pumps running.
Makeup pump
MU-P1B running.
RCS pressure
560 psig and rising. Pressurizer
level 294 inches and rising.
RCS Temperatures:
Loop A TH = 590OF
TC - 340oF and rising
Loop B TH = 620OF
TC - 180OF
OTSG B isolated and full.
OTSG A without heat sink,pressure 44 psig and falling,
and nearly full.

Remarks

References

There is no indication of natural
circulation.
Verylittle of the decay
heat is being removed,
except by makeup
water and by occasional opening of
PORV block valve.
Gradual heatup of RCS
is causing temperatureand pressure to rise.
Attempting to control
pressure by juggling
makeup and PORV block
valves.
6

309

12 h,
6 min

Pressurizer spray valve
closes.

310

12 h,
11 minComputer printout of selected
incore thermocouples.

Utility printer

311

12 h,
14 minAuxiliary building exhaust fansrestarted.

Strip chart(panel 25)

3

312

12 h,
22 minPressurizer level goes off scale.

Strip chart(panel 4)
Meter (panel 5)

1,6

313

12 h,
30 minOpen PORV block valve.

Status light(panel 4)

Attempting to depres- 1,2,3,4
surize further. PORV
outlet alarms
5 min later.

314

12 h,
40 minClose PORV block valve.

Status light(panel 4)

Closing time in doubt; 1,2Ref. 2 has 12 h
46 min.

315

12 h,
48 minPressurizer level back on scale.

Strip chart(panel 4)
Meter (panel 5)

316

12 h,
52 minOpen PORV block valve. (?)

Status light(panel 4)

Almost all off scale. 1,8

3,6

RCDT temperatures suggest the block valve
remains closed therest of 3/28.

This is extremely
doubtful.
Safetyvalve alarms clear a
few minutes later,which is inconsistent
with opening.

2

EventNumber
317

Date

Time
after
initiation

3/28/79 13 h

Event

Information
available tooperators

Plant status: RCS at low pressure
without secondary heat sink. Makeup pump MU-PlB operating.

Postaccident
calculations
and data

Remarks

Calculated decay
heat = 13.8 MW

References

10,12

RCS Pressure:A = 613 psig
B = 613 psig
RCS Temperatures:
THA = 522°F
All others off scale.
Pressurizer level = 379 inches
A = 95 psig
Steam pressures:
B = 172 psig
Status of PORV block valve notpositively known; believed to beclosed.

318

13 h,
2 min

Start condenser vacuum pumps
VA-P1A and 1C.

319

13 h,
20 minReactor building pressure starts togo negative.
Pressurizer level
starts to drop.
RCS pressure 637
psig and falling. Pumping 425 gpm
with two HPI pumps. It is now thethe intention to repressurize,
collapse bubbles (hopefully) andbegin steaming from OTSG A.

320

13 h,
23 minStart makeup pump MU-PIC.

321

13 h,
25 minPORV outlet temperature alarm
clears (block valve
closed-time not known).

322

13 h,
26 minPressurizer heater groups 1 and 2
trip.

Status light(panel 17)

Condenser vacuum will
be restored in a few
minutes.

The auxiliary boiler
1,2,3,4
has finally been returned to service andis now supplying
turbine gland seal
steam (this is anecessary prerequisite
to using the condenser).
Pump 1A
trips, but is restarted 10 min
later.

High points wereactually hydrogenfilled.
Collapse ofloop bubbles was still
impossible.

it is operators' belief that main condenser will soon beavailable.

Annunciator(panel 8) Meterand status lights(panel 3)

1,2,3,4

Indicates valve isdefinitely closed.
Status light(panel 4)

1,5,7

1,4

1,2,3,4

EventNumber

Date

Time
after
initiation323

3/28/79 13 h,
38 min324

Event

information
available tooperators

Postaccident
calculations
and data

Remarks

References

1,5,8

RCS pressure bottoms out at 611
psig and begins increasing.

Utility printerMeter and strip
chart (panel 4)13 h,
45 minOTSG A now steaming.

Meter (panel 4)(Steam pressure)Some difficulty
earlier encounteredwith outlet valve-now cleared.

1,5,7

325

13 h,
52 minOTSG A high level alarm clears
at 81.3%.

Annunciator(panel 17)
Meter (panel 4)

Indicates some heattransfer--steaming
down.

1,4

326

13 h,
59 minOTSG A high level alarm again.

Annunciator(panel 17)
Meter (panel 4)

Indicates now feeding
OTSG.

1,4

327

14 h

Plant status:
RCS at low pressure;pressure increasing.
EMOV block
valve closed.
Makeup pump
MU-P1B operating.
Loop A = 852 psig
RCS Pressure:
Loop B = 868 psig
RCS Temperatures:
THA = 5490F
All others off scale.
Pressurizer level 312 inches.

328

14 h,
20 min

RCS pressure 1200 psig, BWST 23
feet.

Meter and strip
chart (panel 4)

1,5

329

14 h,
25 minPressurizer heater groups 1 and 2
returned to service.

Status light(panel 4)

1,3,4

330

14 h,
39 minClosing valve MU-V16B.
MU flow
now 120 gpm. RCS pressure 2080
psig.

MU-V16B: Statuslight (panel 3)
Flow: Meter(panel 8)
RCS P.: Meterand strip chart(panel 4)

331

14 h,
41 minCutting back on valve MU-V16C.
MU flow 105 gpm.

StatusMU-V16C:
light (panel 3)
Flow: Meter(panel 8)

Calculated decay
heat = 13.5 MW

10,12

RCS is now fully repressurized.
Valveis throttled toreduce flow.

1,5,6

1,5

EventNumber

Date

Time
after
initiation332

3/28/79 14 h,
43 min333

Information
available tooperators

Event

Postaccident
calculations
and data

Remarks

References

Stop makeup pump MU-PlC.
MU-V16C closed.
RCS pressure
2275 prig.

MU-P1C:
Annunciator(panel 8)
Meter and statuslight (panel 3)
RCS P.:
Meterand strip chart(panel 4)

1,4,5

14 h,
47 minHolding at 2300 psig. Operators
have now decided to "bump" areactor coolant PUMP .

Meter and strip
chart (panel 4)

334

14 h,
48 minAlarm printer fails.
until 15 h 10 min.

335

14 h,
59 minMany radiation monitors come backon scale. (HP-R-3236, HP-R-232,
HP-R-218, HP-R-3240, HP-R-215,
HP-R-234)

336

15 h

Plant status:
PORV block valve
closed. MU-P1B operating.
RCS pressures:A = 2285 psig
B = 2304 psig
Attempting to collapse bubbles.

337

15 h,
10 minAlarm printer back in service, butalmost illegible.

338

15 h,
11 minComputer prints out reactor coolant
pump and makeup pump status onrequest.

Utility printer

Only MU-P1A now
operating.

339

15 h,
15 minStart DC reactor coolant pump oil
lift pumps.

Auxiliary
operator action

AC pumps not oper1
able, due to power
loss at motor control
centers.
Had to send
personnel to auxiliarybuilding to start.
RCPs will not start
without oil lift pumprunning.

340

15 h,
16 minFull condenser vacuum
reestablished.

Strip chart(panel 17)

BWST level 22 feet.
80 gpm letdown flow
32 gpm seal injection,
20 gpm makeup flow.

Not available

1,5

1,4
Strip charts(panel 12)

2,3Calculated decay
heat
13.2 MW

10,12

1,4
1,8

1,5

EventNumber

Date

Time
after
initiation341

3/28/79 15 h,
22 min342

Event

Information
available tooperators

Start condensate booster pump
CO-P2B.

Annunciator(panel 17)
Meter and statuslight (panel 5)15 h,
32 minStart makeup pump
MU-PlC.

Annunciator(panel 18)
Meter and statuslights (panel 3)

343

15 h,
32 minStop condensate booster pump
CO-P2B.

344

15 h,
33 minStart reactor coolant pump RC-P1A.
Ran for 10 s, then stopped.

Status light(panel 4)
Meters:amperage, flow
(panel 4)

345

15 h,
39 minStop makeup pump MU-PlC.

Annunciator(panel 8)
Meter and statuslight (panel 3)

Postaccident
calculations
and data

Remarks

To complete fillingof OTSG B.

References

1,4

1,2

1,4
Starting amperage
normal, flow OK.
RCS pressure and temperature immediately
drop, then start torise again.
ESF
actuates, but was
bypassed.

1,2,3,4,5

1,3,4

15 h,
49 minStart makeup pump MU-PlC.

347

15 h,
50 minStart reactor coolant pump
RC-P1A.

Status light(panel 4)
Meters and strip
chart (panel 4)

348

15 h,
55 minStop decay heat pumps DH-PIA and1B.

Status lights andmeters (panel 3)

1,4

349

15 h,
56 minStop makeup pump MU-PlC.

Annunciator(panel 8)
Status light andmeter (panel 3)

1,3,4

346

1,3,4
Adequate core cooling
now has been
established.

Satisfactory operation.

1,2,3,4

EventNumber
350

Date

Time
after
initiation

3/28/79 16 h

Event

Information
available tooperators

Plant status:
Reactor coolant pump
RC-P1A is operating, makeup pump
MU-PlB is running, the plant is
now being well cooled with a heatsink to the condenser. Reactor
coolant flow 28 million lb/h.
RCS
Pressurizer level - 400 inches.
pressure 1310-1330 psig.
Loop A: TH = 520OF
TC = 2860F
Loop B: TH = 520oF
TC = 2820F
Steam pressure (OTSG A) - 76 psig
(OTSG B) = 99 psig
Steam generator levels:
A = 414 inches
B - 393 inches.

A bubble of nonconsensible gas had collected in the upper
head of the reactor
pressure vessel.
Calculated decay
power = 12.9 MW.

351

17 h,
25 minValve DH-V187 from the decay heatpumps to the RCS was opened.

352

17 h,
29 minCommenced transfer of material fromauxiliary building neutralizer tank
WDL-T8B to TMI-1.
This tank had
been filled before the accident,
and was now being emptied to accept
water from the auxiliary building
sump.

Operator action

353

18 h,
18 minBubble reestablished inpressurizer.

18 h,
34 minLetdown flow is lost.

Meter (panel 5)
Strip chart(panel 4)
Flow meter(panel 3)

354

Postaccident
calculations
and data

Remarks

References

Steam generator B is
isolated.

6,7

Indicates intention
to depressurize.

5
1,3

Went back off scale
at 18 h 30 min.
Probably due toplugging with boric
acid.

1,5,6
3

Time
after
initiation

Event
NumberDate

355

3/29/79 (All times RCS pressure = 1026 psig
after 0000 RCS temperature = 240OF
on Mar. 29 Pressurizer level = 362 inches
are given Steam pressure (A) = 25 psig
as timeof day0000.)

Event

Information
available tooperators

Postaccident
calculations
and data

Remarks

References

356

0020

Stopped transfer fom WDL-T8B to
TMI-1.

357

0051

High pressure drop observed acrossletdown prefilters.

358

0055

Secured auxiliary building and fuelhandling building ventilation.

1,5

359

0210

Restarted auxiliary building andfuel handling building ventilation.

1,5

360

0211

The control room gas and particulate radiation monitors showed
high levels.
Control room
personnel donned masks.

361

0300

Pressurizer level and RCS pressure
dropping slowly.
Loop A: TC = 238oF
Flow = 28 million lb/hPressurizer temperature = 549oF
RCS pressure = 1028 psig
Pressurizer level = 400 inches
OTSG A at 95%.

362

0315

Control room radiation monitors
dropped and respirators were
removed.

363

0400

Plant status:
RCP-lA running.
Loop A: TC = 2340F
Loop B: TC = 233°F
Flow = 28 million lb/h
RCS pressure = 998 psig
Pressurizer temperature = 5470F
Pressurizer level = 394 inches.

1,5
Alarm printerStrip charts(panel 12)

5,4

5

5,6

Strip charts(panel 12)55,6

EventNumber

Date

Time
after
initiation

Event

Information
available tooperators

Postaccident
calculations
and data

Remarks

References364

3/29/79 0435

Vented makeup tank MU-T1 to ventheader by opening MU-V13.

365

0443

Seal water high temperature alarmon RCP 2A. Requested seal watertemperatures on all RCPs.

Alarm printerUtility printer

366

0504

RCP seal water temperature alarms
cleared.

Alarm printer

367

0510

RCS pressure = 969 psig
TC B = 284OF
Pressurizer temperature = 543oF
Pressurizer level = 352.5 inches.

5

368

0615

RCS pressure = 945 psig
TC B = 284OF
Pressurizer temperature = 540OF
Pressurizer level = 341 inches
BWST = 20.5 feet.

5

369

0630

Sprayed down pressurizer.
Levelrose from 345 inches to 367 inches,pressure dropped 50 psi.

5370

Level:
Meter(panel 5)
Strip chart(panel 4)
Pressure:
Meter (panel 4)
Strip chart(panel 4)

0631

Letdown flow (-25 gpm) reestablished after raising intermediatecooling temperature.

Meter (panel 3)

5

371

0710

RCS pressure = 899 psig
TC B - 283OF
Pressurizer level = 352 inches.

5

372

0715

Pumped auxiliary building sumptank to auxiliary building
neutralizer tank.

1,5

1,5
High temperatures on
RC-PIB, 2A, 2B (allnonoperating).

4,5,8

4

EventNumber

Date

Time
after
initiation

Event

Information
available tooperators

Postaccident
calculations
and data

Remarks

References

When makeup tank wasvented, auxiliary
bldg. radiation
increased.

1,5

Preaccident water
being transferred
to make room in
tank.

1,5

373

3/29/79 0716

Letdown flow shifted to RCBHT B.

374

0845

Commenced transfer from WDL-T8A
to TMI-1.

375

1215

Plastic sheet put down on auxiliary
bldg. floor to reduce rate of release.

376

1240

Shut off turbine building, control
bldg., control and service bldg.
sump pumps.

High level in industrial waste treatOverment system.
flowing and draining
to settling pond.
Leakage to river.

1

377

1315

Started industrial waste treatment
system.

Discharges to river.

1

378

1410

Shut down industrial waste treatment system.

Because of apparent
Xenon release.

1

379

1458

Shifted letdown from RCBHT B
to C.

380

1600

Pumped auxiliary building sumptank to WDL-T8A.

381

1610

Restarted industrial waste
processing system.

I

382

1815

Stopped industrial waste treatment
system.

1

383

1900

Washed down auxiliary building
floor under the plastic.

384

1920

Letdown flow was 20 gpm.

385

1945

Lined up M.U.T. degassing systemthrough TMI-1 sample system to
TMI-2 vent header.

Calculated decay heatat 1000 = 10.3 MW.

1Xenon measurement
was false.

5Will later pump sumpto sump tank.

After pumping sumpto sump tank.
Meter (panel 3)

1,5,9

5
9
9

EventNumber

Date

Time
after
initiation386

3/29/79 2020

387

Information
available tooperators

Event

Postaccident
calculations
and data

Remarks

References

Started degassing M.U.T. via
sample system.

Secured 10 min
later.

1,52035

Opened MU-V13 for 5 s.

Vents makeup tankto vent gas system.

9

388

2036

Isolated nitrogen to waste gas header.

To keep pressure down. 9

389

2040

Significant increase in fuelhandling building exhaust gas
monitor.

From 300 mr/h to
1 r/h.

9

390

2045

MU-T1 vented to waste gas header.

Cautiously (to keepin waste gas header
down).
Reduce M.U.T.
pressure to 55 psi.

1,5

391

2105

Secured venting MU-T1.

392

2114

LT2 pressurizer level indicator
failed.

393

2200

Decided no leak in OTSG B.

Pressure steady at
5
25 psig.
Level steadyat 380 inches.

394

2330

Vented MU-T1
header.

Cycling MU-V13 at
2 s periods.

395

2400

Now believed steam bubble inreactor vessel.
TC A = 3250F
RCS pressure = 1105 psig
Pressurizer level = 325 inches.

5396

3/30/79 0058

MU-T1 level decreasing, pressure
increasing.

5,9

397

0130

Shut turbine bypass value for5 min.

Temperature increased 5,9
8°F.

398

0150

Vented MU-Tl to waste gas decay
tank WDG-TIB.

Secured at 0215.

to waste gas vent

Strip chart(panel 12)

9Alarm printerReturned to service
at 2230.

4,5,9

5,9

1,5,9

EventNumber

Date

Time
after
initiation

Event

information
available tooperators

Postaccident
calculations
and data

Remarks

References

Secured transfer from aux. bldg.
sump tank to neutralizer tank
WDG-T8A.

10215

Shut off all sump pumps fromturbine building and control
building area.

1,5,9

401

0315

Pumped control building area sump
to turbine building sump.

Using temporary
pump.

1,5,9

402

0330

Vented MU-TI
header.

Secured at 0350
Tank pressure:A - 50 psig,
B = 80 psig.

1,5,9

403

0346

Cycling MU-V376.

To try to reestablish
letdown.

5,9

404

0430

Started industrial waste discharge
filter system, discharging to riverfrom mechanical draft cooling tower
blowdown line.

Sump level - 76%.

1,5,9

405

0435

Liquid pressure relief valve MU-R1
on MU-T1 opened, venting MU-TI toreactor coolant bleed holdup
tanks. 14U-TI level dropped to zero.
Shut MU-V12.
Seal flow dropped.
Pressure in RCBHTs went off scale.
Realigned make up to BWST.

Increase in gas discharge, coincident
with venting.

1,5,6,9406

0530

Flow to RCP seals adjusted to
7.2 gpm each, using needle values.

5,9

407

0710

Venting MU-T1 to vent header via
MU-V 13.

1,5,9

408

0750

Started waste transfer pump
WDL-P5A pumping from RCBHT to
MU-T1.

409

0753

Added 371 gal demineralized water
to MU-Tl and boric acid fromCA-TI.

399

3/30/79 0155

400

to waste gas decay

Calculated bubble at0730--893 ft3(GPU).

Unsuccessful becauseof high pressure in
MU-T1 (80-84 psi)
stopped at 0753.

1,5,9

So as not to draw
from BWST.
Finished
at 0800.

5,9

EventNumber

Date

Time
after
initiation

410

3/30/79 0805

411

Event

Information
available tooperators

Postaccident
calculations
and data

Remarks

References

Secure seal water injection to nonoperating pumps RC-P2A, 1B, 2B.

Log says IA; obvious
error.

5,90815

Open MU-V12, shut'DH-V5A, switch
MU-P1A to MU-T1.
Commenced
adding water and boric acid to
MU-T1.

Finished at 0820.
Added 300 gal shiftsuction from BWST to
KU-T1.

5,9

412

0855

Sent personnel to start hydrogen
recombiner.

5

413

0900

Venting 14U-T1.

5,9

414

0908

Shut DH-V5B.

5,9

415

0940

Shut off OTSG A.

416

1045

Closed MU-V17.
Commenced bleeding
letdown to RCBHT A. Began reducing pressurizer level to 100
inches.

417

1120

RCS status:
TC A - 280OF
Pressure = 1043 psig.
Pressurizer level = 390 inches.
Pressurizer temperature = 5600F.

418

1220

Started transfer of miscellaneous
waste tank to TMI-1.

419

1405

Attempted to open WDG-V30B to vent
WDG-TlB into reactor building.

Unsuccessful.
Finally 1,5,9
opened at 1442.

420

1410

Switched letdown from MU-Tl to
RCBT A.

Switched back to
MU-Tl at 1420.

9

421

1442

Venting waste gas decay tank B
WDG-TlB to reactor building.

Stopped at 1450.

1,9

422

1502

Added 462 gal from RCB HT A to
MU-T1.

423

1530

Fuel handling exhaust unit ARM andaux. bldg. access corridor ARM
climb from 240 mr/h and 70 mr/h
at 1145 to 700 and 160 mr/h.

To heat RCS to 280OF
for 7 min.

5,99Calculated bubble at1240 (CPU)308 ft3.

1,55Strip charts(panel 12)

Decline slowly to 100 9
and 35 mr/h on
4/1/79.

Time
after
initiation

Information
available tooperators

Postaccident
calculations
and data

Event
NumberDate

424

3/30/79 1600

RCS status:
TCA - 2800F,
pressure 1049 psig, pressurizer
level 215 inches, pressurizer temperature 557°F, BWST level
15.5 feet.

425

1634

Turned off all pressurizer heaters
to calculate rate of RCS pressuredrop.

Status lights(panel 4)
RCS pressure:
Meter and strip
chart (panel 4)

426

1650

OpenedLetdown temperature high.
valve MU-V376 to cool down.

Strip chart(panel 10)

427

1704

Started RCP-2A oil pump. K3 relay
failed and pump tripped.

428

1719

Added 200 gal from RCBT A to MU-T1.

5

429

1730

Lining up to pump from TMI-1 spent
fuel tank to TMI-2 surge tank andthen to TMI-2 EWST.

9

430

1810

Found and replaced blown fuse on
RC-P2A control circuit.

431

1850

Starting to refill BWST at 4000
gal/h.

432

1920

Switched letdown to RCBHT C.

433

1945

Isolated letdown from RCBHTs.

5,9

434

2036

Added 300 gal from RCBHT A to
MU-T1.

9

435

2053

Shut off feedwater to OTSG A.

436

2132

Venting pressurizer to RCDT.

437

2200

Oil pumps on RCP-2A tested
satisfactorily.

438

2229

Transferring misc. waste tank to
TMI-1.

Event

Remarks

References

95,9Calc. bubble at 1907
(GPU) - 1806 ft3.

Cleared at 1655.

9Ground fault.

5,9

CR log says being
filled from Halliburton truck.
BWST
level 15.5 feet.

5,9

RCBT A filled.

5

Steaming down.

9

Until 2217.

5,95

EventNumber

Date

Time
after
initiation

Event

Information
available tooperators

Postaccident
calculations
and data

Remarks

Restored feed to OTSG A.
TCA 285°F, pressure 1029 psig,
pressurizer level 215 inches,
BWST 16.5 feet.

References439

3/30/79 2240

9

440

2310

Starting to vent pressurizer again.

Completed 0140, 3/31.

5,9

441

2330

"Gas bubble" noted for first timein C.R. log.

Volume given as
400 ft3.

5

442

2347

Added 300 gal from RCBHT A to
MU - TI.
Pressure in MU-T1 at
43.5 psig.

5443

3/31/79 0145

Venting RCS.

5,9

444

0205

Reactor building equipment hatch
contact reading 60 r/h. WDG-TIA
and lB contact readings 40 r/h.

5,9

445

0315

Secured venting.
Waiting for hydrogen
recombiner to be placed inoperation.

5,9

446

0325

Shift supervisor, shift foreman,
and CROs reviewed Emergency Procedure for loss of RC-P1A.

5,9

447

0400

RCS status:
TCA 282°F, pressure1060 psig, pressurizer level 215
inches, pressurizer temperature
550°F, BWST level 18 feet.

448

0423

Auxiliary operators instructed not
to enter auxiliary building withouta "teletector".

9

449

0546

Pressure in MU-T1 is 32 psig.

545005180638

Taking hydrogen samples from reactor
building.

5,9

451

0548

Turbine bypass valves from OTSG A
closed from 47% open to 44% open
to heat up RCS.

9

Calculated decay
power = 7.43 MW.

9EventNumber

Date

Time
after
initiation

Event

Information
available tooperators

Postaccident
calculations
and data

Remarks

References452

3/31/79 0735

Reduced pressure in RCS to 1025
psig using pressurizer spray.
Level after spraying was 233 inches.

5,9

453

0753

Commenced venting pressurizer whileheating and spraying simultaneously.

Secured at 0803.

9

454

0828

Venting pressurizer (same as 0753).

Secured at 0846.

5,9

455

0907

Venting pressurizer.

Secured at 0917.

5,9

456

0930

Sump and tank levels: MWHT, 7 feet;
Aux. Bldg. sump 3.2 feet; auxiliary
bldg. sump tank 3.4 feet; waste gas ventheater -20 psig. Auxiliary sumptank lined up to MWHT.

457

0935

Venting pressurizer.

458

0950

Drained spent fuel surge tankto TMI-2 BWST.

459

1312

Venting pressurizer.

460

1344

Transferring water from TMI-1 spent fuelfuel pool to TMI-2 spent fuel surge
tank with two sump pumps. Pumping (intermittently) to TMI-2
with SF-P1A.

461

1425

Venting pressurizer.

462

1511

Halted transfer from TMI-1 spent
fuel to TMI-2 BWST, until spent
fuel refilled.
BWST level 26.5 feet.

463

1537

Cracked pressurizer vent valve.

464

1542

Secured turbine bldg. ventilation.

465

1656

Venting pressurizer.

466

1741

Pressure in KU-T1 vent to zero.
Closed MU-V13.

467

1815

Cracked pressurizer vent valve.

5,9

Secured at 0957.
Calc. bubble (CPU) at
1032 = 860 ft3.

5,9
5,9

Secured at 1350.
5,9Secured at 1500.

5,9
5,9

Closed at 1619.

5,9
5,9

Secured at 1737.

5,9
5,9

Closed at 1850.

5,9

EventNumber

Date

Time
after
initiation

Information
available tooperators

Event

Postaccident
calculations
and data

Remarks

References468

3/31/79 1858

469

1950

Cracked pressurizer vent valve.

470

2110

Pressurizer venting:

471

2124

Transferring water from SF surge
tank to BWST.

0016

Pressurizer vented at same
frequency throughout the day.

5,9

473

0029

Opened bypass valve on OTSG A
slightly to compensate for higher
RCS temperature.

9

474

0750

Stopped transfer of water to BWST.
BWST level 40.5 feet.

475

0930

Transferring MWHT WDL-T2 to TMI-1.
Reactor building hydrogen concentration
2% throughout day.

476

1500

Reduced RCS pressure to 1000 psig.

9

477

2020

WDG-T1A and 1B is 86 psig.

9

1000

Lost auxiliary boiler for 2 min.

9

1347

Hydrogen recombiner in service.

Calc. bubble (CPU)at 1315 - 174 ft3.

9

0906

Reduced steaming on OTSC A.

Calculated decay
power - 5.4 MW.

9

481

0950

Slowly raised OTSG level to 97%.

9

482

1830

DC ground faults, RCP alarms.

9

472

478

4/1/79

4/2/79479
480

4/3/79Opened MU-V13.
KU-TI pressure
equalized with waste gas ventheader.
Discharge level increased.

9

Closed at 2034.

2110-2139
2221-2352

5,95,9Calc. bubble (GPU) at
2245 - 894 ft3.
B+W - 487 ft3.

Calc. bubble (GPU)at 0731 - 564 ft3.

5,9

5
5

EventNumberDate

483

4/3/79Time
after
initiation
2400

Event

Information
available tooperators

Plant status:
TC A = 281oF
TH A = 281oF
TC B = 281OF
TH B = 278OF
Pressure = 1050 psig
BWST level = 54 feet
Reactor building
pressure - 1.3 psig
Reactor building
temperature = 87.50F.

1
NRC, investigation into the March 28, 1979 Three Mile Island Accident
by Office of Inspection and Enforcement, Investigative Report No.
50-320/79-10, NUREG-0600, Washington, DC, August 1979.
2 Nuclear Safety Analysis Center, Analysis of the Three Mile
Island--Unit 2 Accident, NSAC-1, Electric Power Research Institute, Palo Alto,
CA, July 1979.
3 Metropolitan
4 Alarm

Edison Co., Annotated Sequence of Events, Rev. 1, July 1979.

Printer.

5Control Room Logs.
6 Reactimeter

data.

7

Plant strip charts.

8

Utility printer.

9

Emergency Control Station (ECS) logs.

10

Log typer.

11

pperator Interviews.

12

Letter from D. E. Bennett, II, Sandia Laboratories, to J. Murphy, NRC(PAS), dated April 24, 1979, with attachments.

Postaccident
calculations
and data
Bubble gone.

Remarks

References

APPENDIX 11.2

CARBON PERFORMANCEWITH TIME

A. INTRODUCTION

triethylenediamine (TEDA). These 79 trays were refilled with carbon impregnated only with KI .
Met Ed has been obtaining samples of the carbon
after every 720 hours of filter system operation
since the carbon was replaced. Difficulties in foll owing the performance of the filter systems are attributed to the two types of impregnated carbons
being obtained from two sources, and the possibilityof the carbon samples not being representative 3(see Section II.B.2.g). The available data on filter
system efficiencies over time are given in App.
Table II-1 for the auxiliary and fuel handling building
filter trains. The test procedures used were in accordance with Regulatory Guide 1.52 (Revision 1), including a 16-hour preequilibration at the stated relative humidity. Each sample has been analyzed after
successive 720-hour periods of exposure, with the
exception of fuel handling building train B. For thistrain, the 3-month and 4-month samples eachserved only 2 months. The data lack consistency
but generally indicate decreasing efficiencies withti me. As a result, the filter banks were changed out
and replaced with NUCON KITEG carbon (KI +TEDA impregnant) during late October-early November 1979. Additional data on moisture content,
pH, and iodine activity for the replacement carbon is

Activated carbon is used in filtration systems to
reduce the amount of radioiodine released to theenvironment. This carbon degrades in performancewith time of service as contaminants build up on the
carbon. Normal atmospheric contaminants havebeen shown to severely degrade the ability of the
carbon to retain radioiodine. 1 The performance ofcarbon in four separate filter systems operated at
TMI-2 after the initial stages of the accident (i.e.,
after mid-April) has been followed. 2 This appendix
contains the available data for the auxiliary building,fuel handling building, supplementary auxiliary buildi ng, and condenser vacuum pump air exhaust filtration systems.
B. AUXILIARY AND FUEL HANDLINGBUILDING VENTILATION FILTER SYSTEMSThe carbon in all four trains of these filter systems was replaced with new (unused) carbon in
April-May 1979. All trays except for 79 trays in theauxiliary building B train were refilled with carbon
coimpregnated with potassium iodide (KI or KI) and705

APP. TABLE II-1. Filter system operation with time of service
One Month (May)Two Months (May-June)

Three Months (May-July)

Four Months (May-August)Five Mos. (May-September)

95% R.H. 1

30% R.H.

95% R.H.

30% R, H.

95% R.H.

30% R.H.

95% R.H.

30% R.H.

95% R.H.

30% R.H.

Aux.
Bldg
Train A

97.9

99.5

88.8

99.9

94.1

99.9

92.2

99.7

93.6

99.9

Aux
Bldg
Train B

88.7

99.9 2

95.9

99.9

96.5

99.9 ,

94.5

99.9'

90.0

99.9

98.7

99.9

93.3

99,91

80.4

99.3

82.4

99.7

84.9

99.9

98.7

99.9'

91.2

99.91

86.03

99.9, 382.7 499.4 4

83.5

99.9

Fuel
Handling
Bldg.
Train A
Fuel
Handling
Bldg.
Train Bt

2

R H means relative humidity.

99 9 , i ndicates the laboratory result reported was 99.9°°,. the upper limit of accuracy and detection.

3 Experiences only 2 months service. June-July.
4

Experienced only 2 months service. July-Augustpresented in App. Table 11-2. The general decreasein pH with increasing time of exposure indicates thedegrading of the carbon by normal atmosphericcontaminants, 4 ' 5 and supports the decision tochange the carbon in late October 1979.

with time of exposure until the September samples.
Carbon performance of trains 1 and 2, however, is
not explainable because of the sampling problems.
Because the samples did not contain sufficient carbon, only limited investigation of the physical properties of the carbon was possible. App. Table H-4
presents the available data. The pH values of approximately 7 indicate degraded carbon due to normal atmospheric contaminants
4 (pH of unexposed
Although the carcarbon is approximately 9.5).1
bon has not yet been replaced, this action is underdiscussion (November 1979).

C. SUPPLEMENTARY AUXILIARY BUILDINGAIR FILTRATION UNITS
The four 30 000-cfm filter units installed on theroof of the auxiliary building provide a second filter
system in series with the auxiliary and fuel handlingbuilding filter systems prior to release of ventilation
exhaust to the environment. Before installation, theKI -impregnated carbon was certified to remove atleast 96.3% methyl iodide and 99.9% elemental
iodine when tested at 95% relative humidity and
212°F. Samples have been obtained monthly sinceMay, but the samples are not representative (seeSection II.B.2.g). The available test results for theused carbon in the supplementary auxiliary building
filter systems are presented in App. Table 11-3.
Testing was performed for methyl iodide removal efficiency primarily at 95% relative humidity and 25°C
and with 16 hours' preequilibration at the stated rel ative humidity. Filter trains 3 and 4 show the expected trend of decreasing carbon performance

D. CONDENSER VACUUM PUMP FILTERSYSTEM
The carbon in the first bed of the condenser vacuum pump filter system has been sampled monthly
since May and has been tested in the laboratory formethyl iodide removal efficiency at 25°C and 95%
relative humidity. The results are presented in App.
Table 11-5. Before installation, the KI-impregnatedcarbon was certified to remove 98.7% methyl iodide
when tested in the laboratory at 130°C and 95% rel ative humidity. The carbon is not considered (November 1979) to be sufficiently degraded to require
replacement.

707

, APP. TABLE 11-2. Physical properties of the replacement carbon with time of service

Aux. Bldg.
Train A

One Month (May)Moisture
Activity
%
pH
Cl/gm
7.6

9.3

2.6(-6)

Aux. Bldg.
Train B

1 3.2

9.2

Fuel handli ng Bldg.
Train A

30.6

Fuel Handli ng Bldg.
Train B

1 5.1

( Three Months (May-July)
Moisture
Activity
%
pH
Cl/gm

Two Months (May-June)
Moisture
Activity
pH
Cl/gm
%
8.2

9.4

9.2(-11)

22.8

8.6

3.6(-10)1.3(-6)

8.7

1 0.0

1.2(-11)

21.8

9.1

9.2

1.3(-7)22.0

9.5

3.0(-11)

20.0

9.3

3.3(-10)

25.0

1 0.1

3.7(-11)

23.2

Four Months (May-Aug.)
Moisture
Activity%pH
Ci/ g m1 3.2

8.9

1.6(-10)8.2(-11)

1 2.4

9.2

3.7(-11)

9.0

1.91-10)

1 7.2

9.2

6.0(-11)

6.8

2.6(-10) -

1 8.0

7.1

4.1(-10)'Experienced only 2 months service, June-July.
"Experienced only 2 months service. July-August

APP. TABLE 11-3. Supplementary auxiliary building filter system performance
May

June

August -July

September

CH 3 1
Efficiency

Days ofOper-

CH 3 1
Efficiency

Days ofOper.

CH 3 1
Efficiency

Days ofOper.

CH 3 1
Efficiency

30

1 7

81.5

8

96.2

"'

"'

Train 3

24

29

96.3

32

95.7

"'

95.0
( 99.9)Train 4

12

1 5

99.3

32

97.2

"'

84.3
(99.9)"'

Days of
Operation

CH 3 1
Efficiency

Train 2Train 1

29

Days ofOper.

No samples
taken

29

70.9

'Performed at 95'. relative humidity and 25'CEfficiencies in parentheses were obtained at 30% relative humidity at 25°C.
"'Not available.

32

88.0

"'

93.8
( 99.8)90.7(99.9)

"'

"'

94.1
( 99.4)87.2( 99.9)96.8(99.9)

98.1( 99.9)

APP. TABLE 11-4. Physical properties of the supplementary
auxiliary building filter carbon
June
Activity
Ci/gm

July
Activity
Ci/gm

Moisture%

5.0(-12)1.5(-10)

6.8

Train 1

4.4(-12)Train 31.3(-12)Train 2Train 42.1(-12)1.2(-10)2.7(-10)1.9(-10)

7.6
7.6
6.4

APP. TABLE 11-5. Condenser vacuum pump filter system
CH 3 Efficiency at
25°C, 95%
Relative Humidity

Activity on Carbon
Ci/gm

May

99.6

4.9(-9)

June

July

89.0

1.3(-11)

709

85.62

2.3(-11)

AugustpH

Activity
Ci/gm

7.9

6.6(-11)7.1

1.0(-10)7.5
6.8

3.3(-11)
6.1(-11)

AugustSeptember

89.7

90.2

2.6(-11)

Not Available

REFERENCES AND NOTES

R. R. Bellamy and V. R. Deitz, "Confirmatory
Research Program-Effects of Atmospheric Contaminants on Commercial Charcoals," in Proceedings of the
15th DOE Nuclear Air Cleaning Conference, DOE Conf780819, August 7-10,1978, Boston, Mass.
2
Ncclear Consulting Services, Inc.., "Summarized Post
Accident TMI Unit 2 HVAC Adsorber Systems Sample
Data," NUCON 6MT611/13, October 1979.
3
A representative sample of carbon is considered asa sample from the carbon bank that has experienced thesame service conditions due to the air flow as the rest of
the carbon bank.

NRC, "Effects of Weathering on Impregnated Charcoal Performance," NRC Report NUREG/CR-0025, V. R.
Deitz, Naval Research Lab, Washington, D.C., March
1978.
5
NRC, "Effects of Weathering on Impregnated Charcoal performance," NRC Report NUREG/CR-0771RQ(also published as NRL Memorandum Report 4006), V. R.
Deitz, Naval Research Lab, Washington, D.C., May 10,
1979.
4

1

710

APPENDIX 11.3

RADIOLOGICAL ENVIRONMENTAL
MONITORING PROGRAMFOR THREE MILE ISLAND STATIONThe objectives of the TMI Station Radiological
Environmental Monitoring Program (REMP) are to:ments. Samples of various media were selected toobtain data for evaluation of the radiation dose to
man and important organisms. Sample types werebased on (1) established critical pathways for thetransfer of radionuclides through the environment toman, and (2) experience gained during the preoperational and initial operational phases. Sampling
l ocations were determined from site meteorology,
Susquehanna River hydrology, local demography,
and land use.'
Sampling locations were divided into twoclasses-indicator and control. Indicator stations
are those that are expected to show the effect ofstation operation; control samples are collected atl ocations that are believed to be unaffected by station operations. Indicator station data are also
evaluated relative to background characteristics
established prior to station operation. Audit samples beyond those required by the ETS may be coll ected and analyzed. The REMP sampling locations
and requirements are shown in App. Table 11-6.

1. Comply with the radiological environmental
requirements of the environmental technicalspecifications (ETS) for TMI-1 and TMI-2;
2. Determine whether any statistically significant
i ncrease occurs in the concentration of radionuclides in critical pathways;
3. Detect any buildup of long-lived radionuclides inthe environment;
4. Detect any change in ambient gamma radiationlevels; and5. Verify that radioactive releases are within allowable limits and to evaluate any effects of theThree Mile Island Station on the health and safetyof the public and the environment.'
To meet these stated objectives, an operational
REMP was developed by a consultant for Met Ed.'
Samples for the operational REMP were taken fromthe aquatic, atmospheric, and terrestrial environ-711

APP. TABLE 11-6. Radiological environmental monitoring program sampling locations'
SampleMediumAl, AP, ID
ID
ID
ID
ID
ID
E
ID
AQP, AQS
ID
Al, AP, ID, RW
AQP, SWID
M
FPL, M
FBL, M
AQF, AQP, AWS, SW
ID
AP, ID
AQF
Al, AP, ID
SW
Al, AP, ID, RW
FPL, NSW
Al, AP, ID, RW
SW
FPL, MID
I D, SW
AP, ID
Al, AP, ID, RW
SW
AQS
M

Location
Code
1 S2
2S2
4S23
3
5S2
9S2
11S1 3
1 4S1
1 6S1 3
1 A2
4A1
5A1 4
9A2
1 6A1
4B1
5B1
7B3
9B1
1 081
4
1 2B1
1681
1 C1 4
1 C3
8C1 4
14C1
8E1
7F1
1 5F1
2G1
4G1
7G1
9G1
1 5G1
8C2
1 0A1
1131
3

Map
2
No.
2
3
5
6
8
9
10
11
12
13
14
15
17
18
19
20
21
23
24
25
26
27
28
29
30
34
35
36
37
38
39
40
43
44
45

Description 2

0.4 mile N of site, North Weather Station
0.7 mile NNE of site on light pole in middle of North Bridge
0.3 mile ENE of site on top of dike, East Fence
0.2 mile E of site on top of dike, East Fence
0.4 mile S of site at South Beach of Three Mile Island
0.1 mile SW of site, west of Mechanical Draft Towers on dike
0.4 mile WNW of site at Shelly's Island picnic area
0.2 mile NNW of site at gate in fence on west side of Three Mile Island
0.7 mile N of site at north tip of Three Mile Island
0.5 mile ENE of site on Laurel Rd., Met. Ed. pole #668-010.4 mile E of site on north side of Observation Center Building
0.5 mile S of site below Discharge Pipe
0.4 mile NNW of site on Kohr Island
1.1 miles ENE of site, west of Gringrich Road
1.0 mile E of site on Peck Road
1.6 miles SE of site on east side of Conewago Creek
1.5 miles S of site, above York Haven Dam
1.1 miles SSW of site on south beach of Shelly's Island
1.6 miles WSW of site adjacent to Fishing Creek
1.1 miles NNW of site below Fall Island
2.6 miles N of site at Middletown Substation
2.3 miles N of site at Swatara Creek
2.3 miles SSE of site
2.7 miles WNW of site near intersection of Routes 262 and 392
4.1 miles SSE of site at Brunner Island
9 miles SE of site at Drager Farm off Engle's Tollgate Road
8.7 miles NW of site at Steelton Municipal Water Works
2 miles NNE of Hershey on Rt. 39 Hummelstown
1 0 miles ENE of site at Lawn - Met. Ed. Pole #J1813
15 miles SE of site at Columbia Water Treatment Plant
13 miles S of site in Met. Ed. York Load Dispatch Station
15 miles NW of site at West Fairview Substation
2.3 miles SSE of site - York Haven Hydro
0.8 mile SSW of site
1.2 miles N of site - along Rt. 441

1
A11 distances are measured from a point that is midway between the Reactor Buildings of Units One and Two.
2
Refers to number on maps in Figure II- 14.
3
Also had RMC quality control TLD.
4

Also had Commonwealth of Pennsylvania and DOE TLD's.

Sampling locations are shown in Figure 11-14 andColor Plates I and II.
REMP samples are identified by a three-partcode. The first two letters are the power stationi dentification code, in this case, TM. The next one
to three letters are for the media sampled.
Al = Air iodine
AP = Air particulates
AQF = Fish
AQP = Aquatic plants
AQS = Sediment
E = Soil
FPF = Fruit

FPL = Green leafy vegetables
I D = Immersion dose (TLD)
M = Milk
RW = Precipitation
SW = Surface water
V = Fodder crops
MG = Milk (goats)

ed weekly at eight locations with low volume air
samplers and are analyzed for gross /3-activity.
Monthly composites of all indicator and control samples are examined for y-emitting nuclides. On aquarterly frequency, the air particulate samples arecomposited by individual stations and are analyzed
for y-emitting radionuclides, and then compositedfor gross a-particles and 90 Sr by indicator and control locations. 4
Air Iodine- Gaseous iodine samples are collected

The last four symbols are a location code basedon direction and distance from the site. Of the last
four symbols, the first two represent each of the 16
angular sectors of 22.5° centered about the reactorsite (numbered in a clockwise direction from thenorth axis). The next symbol is a letter which
represents the radial distance from the plant:
S = Onsite location
A = 0-1 mile off site
B = 1-2 miles off siteD = 3-4 miles off site

Air Particulates-Air particulate samples are collect-

E = 4-5 miles off siteF = 5-10 miles off siteG = 10-20 miles off site
H = Further than 20 miles

on charcoal cartridges at four locations and are
analyzed weekly for 1311. 5
Precipitation- Precipitation is collected at eachsampling station. Monthly composite samples areanalyzed for gross /3-activity, and quarterly composite samples are analyzed for tritium and y-emitting
9nuclides. Concentrations of 89Sr and oSr are
determined in semiannual composites from eachsampling station. 5
Terrestrial Environment- The terrestrial environ-ment is examined by analyzing samples of milk fromsix locations on a monthly basis and green leafy
vegetables 131
on an annual basis. Each sample isanalyzed for
I and for other y-emitting radionuclides. Quarterly composite samples are analyzed
90
for 89 Sr and
Sr. Green leafy vegetables (cabbage) are collected in July and August from five stations and are analyzed for y-emitting radionuclides. 5

The last symbol is the station numerical designation
within each sector and zone. The location codes
are shown in App.Table 11-6.
Fish- Fish samples are collected at two locations
each August and October and are separated intoclasses of bottom feeder versus predator-gamespecies. Gamma spectrometry and S9Sr and 90Sr
analyses are performed. 3

Direct Radiation-The ambient radiation levels in thearea of Three Mile Island Station are determinedwith energy compensated calcium sulfate TLDs.
Twenty TLD packets of four TLD sections each areplaced quarterly at 20 locations. In addition, prior to
the accident, RMC TLDs were placed at 10 of the
REMP locations for quality control (see App. Table
11-6). The Commonwealth of Pennsylvania had TLDs
at four of the REMP locations (see App. Table 11-6) . 6

Sediment-Three sediment samples are taken inboth July and October and are analyzed for 89Sr
and 90Sr and y-emitting nuclides. 3

713

REFERENCES AND NOTES'Met Ed Radiological Environmental Monitoring Report,
1978 Annual Report, Three Mile Island Nuclear Station,
IWL-5590-443, Teledyne Isotopes, Westwood, at 4.
2
Id. at 27.
3
Id. at 13.

Id. at 14.
Id. at 16.
6
Id. at 17.
4
5

714

APPENDIX 11.4

OFFSITE RADIOLOGICALMONITORING ACTIVITIESOF DOE ORGANIZATIONThis Appendix describes the contribution of units
within the DOE force which increased the offsite
radiological monitoring effort after the TMI-2
accident.
Brookhaven National Laboratory (BNL)- A sevenperson radiological assistance team from BNL arrived at the Capital City Airport via Coast Guard helicopter on the afternoon of March 28, and immediately began to collect air, soil, and vegetation samples and to make field measurements for externalradiation. After coordination with the Pennsylvania
Department of Environmental Resources (PDER),
BNL dispatched two teams to the Three Mile Island
site boundary.
The teams worked in an area in the downwind
direction. External exposure rate measurements,
gamma scans with an Nal(TI) portable analyzer,
TEDA-impregnated charcoal air samples, silverloaded silica gel air samples, and water, soil, andvegetation samples were obtained at several loca-

tions within a 15-mile radius of the plant. Results of
the radiation survey were reported at or near theti me of measurement and samples were turned overto PDER at midnight on March 28, 1979.
A member of the BNL team served as DOE
representative and remained in Harrisburg to keep
PDER officials informed of BNL field measurement
results throughout the night. A second BNL teamconsisting of five people arrived in Harrisburg on themorning of March 29 to supplement the first team's
effort. The BNL team continued to perform offsite
monitoring until March 30. 1
Aerial Measurement System (AMS)-Nuclear Emergency Search Team (NEST)-The DOE AMS-NEST
unit stationed at Andrews Air Force Base sent ahelicopter equipped with sensitive gamma-radiation
detectors and an onboard computer for data acquisition to Three Mile Island. This system was too
sensitive to operate within the release plume and asecond helicopter was sent. This helicopter was715some soil, water, and vegetation samples were provided to the NRC field command post as available
on a 24-hour basis. 4

equipped with a greater variety of radiation detection equipment, including hand-held gamma detectors with sensitivities ranging from µR/h to mR/h,and an Nal(TI) detector with a multichannel analyzer
for spectral measurements. In addition, an air
sampler provided by BNL was also used to specifically monitor airborne iodine.
From the period March 28 through April 15, the
AMS-NEST unit made 72 sorties, with 17 of theseon March 31 and April 1, that provided both routine
and specially requested aerial radiological measurements. 2

Oak Ridge National Laboratory (ORNL)-The ORNL
team (a DOE representative and five ORNL healthphysics personnel) arrived at the DOE command
center on the evening of March 30. The ORNL
team brought two multichannel analyzers, eight GM
survey instruments, air sampling equipment (pumpand charcoal cartridges), and miscellaneous support
gear. The ORNL team began operations the afternoon of March 31, and conducted radiological environmental monitoring in the offsite area. 5

Bettis and Knolls Atomic Power Laboratories (BAPL
and KAPL) with Pittsburgh and Schenectady Naval
Reactors Offices- The Pittsburgh Naval Reactors
Office (PNR)-BAPL team arrived at the DOE command post at the Capital City Airport on the afternoon of March 29, and deployed field radiation survey meters, air samplers, environmental media collection materials, Ge(Li) detectors, Na(TI) detectors,
y-spectrum analyzers, and self-sufficient power
generators to perform specific y-emitting isotopic
analyses in the field. 3
The low level radiochemistry laboratory was
operational that evening. Four environmental monitoring and sample collection teams were dispatchedwith State representatives and airport security personnel as guides. They remained in the field, 1 mile
north to 8 miles south of Three Mile Island Station,i n regions most recently covered by the plume, until
early on the morning of March 30. Field measurements for external radiation were made and samples of air, soil, water, and vegetation were coll ected. Samples collected the previous day and thatevening were analyzed for evidence of radioiodine
deposition and the results were provided verbally to
PDER the morning of March 30.
PNR-Bettis personnel and equipment were supplemented and replaced in part by KAPL and
Office( SNR)
Schenectady
Naval
Reactors
resources in subsequent days.

Mound Laboratory-A team of six from the MoundLaboratory reported to the DOE command centeron the morning of March 31 and was assigned to the
DOE Region I Radiological Assistance Team. The
Mound team assisted the FDA and BRH on April 1,
1979 by placing TLDs in the environment 10 to 20
miles from Three Mile Island Station and by recordi ng the TLD locations for FDA and BRH.
DOE Environmental Measurements Laboratory(EML)-In response to the accident, EML deployed
several continuous exposure rate monitors and performed field gamma-ray spectrometry in the vicinityof the plant. Field measurements of deposition andradionuclide identification were begun by EML on
the morning of April 2 and were performed with a
130 cm 3 Ge(Li) gamma-ray detector. The energy
range for this spectrometer was set for 50 keV-4
MeV, and analysis was performed using a 4000channel analyzer and a programmable calculator.
Exposure rate measurements were performedwith6high pressure ionization chambers (HPIC).
Based
on estimates of possible maximum deposition, mostmeasurements with the Ge(Li) system were made invarious directions within 6 to 7 miles of the plant.
Particular emphasis was placed on making
representative measurements, so the sites chosen(e.g., lawns, pastures and fields) were relatively
l arge, flat, and open. Because the HPIC monitors
are sensitive and saturate at 200 µR/ h, most ofthese were positioned at distances of about 12.4
miles in the prominent wind directions and near population centers. App.Table 11-7 contains a list of
the sites monitored and App.Figures 11-1 and 11-2 indicate their locations.

Argonne National Laboratory (ANL)- An initial
response team of four ANL and DOE personnel arrived at the Capital City Airport command center on
the evening of March 30. This initial ANL response
team was supplemented the morning of March 31
with a mobile van from ANL equipped to support
field measurements of direct radiation and radioactivity in air, water, vegetation, and soil. The ANLteam was assigned to assist the NRC field command post in performing terrestrial monitoring inareas covered by the plume. Results of direct radiation measurements and air samples as well as

Lawrence Livermore Laboratory (LLL)- LLL, using
its atmospheric release advisory capability (ARAC)
computerized system, provided meteorological forecasts and predictions of plume trajectories for gui716

APP. TABLE 11-7. Field Ge(Li) and HPIC measurement locations and time'r
EML
Location
No.

Distance( miles)

Direction(degrees)

Sector

2

1 5.5

40

NE

1

3

4
5

6
7

8

9

10
11

12

13

325

NW

11.3

124

SE

2.5

203

SSW

90

E

12.1

8.14
6.52
0.4
1.2

NW

305
143

SE

5

2.3

346

NNW

1.8

281

W

2.5

1.8

1.9

304

SSE

294

WNW
NW

309

4.3

16

5.0

318

6.34

323

17

18

19

20

3.9

3.5
6.9

125

NW
SE

2.6

1 08

ESE

26

0.6

133

SE

25
27

28

29
30
31

0.5
0.4

109

1 0:35a.m.

4/3

2:50p.m.

4/3
4/3
4/3
4/4

12:40p.m.

3:40p.m.
4:30p.m.

9:45a.m.

4/4

1 0:20a.m.

4/5

2:00p.m.

4/4

4/5
4/6
4/7

12:20p.m.

4:00p.m.
2:1Op.m.

9:15a.m.

4/7

4/7

12:25p.m.

3:50p.m.

9:25a.m.

4/8

11:00a.m.

4/8

3:30p.m.

4/8
4/9

2:05p.m.
9:30a.m.

10:40a.m.

ESE

4/10

11:55a.m.

SE

4/10

SE

1 31

4/3

4/9

1 39

4.7
3.7

ESE
ENE

1 04

1.9

E

70

1.2

6:1Op.m.

4/8

24

87

4/2

N

NE

1.8

4:20p.m.

1:30p.m.

2:40p.m.

46

23

4/2

4/2

4/7

NW

1.7

22

11:05a.m.

NW

311
1

4/2

10:45a.m.

NNW

NNW

3.7

Time
( EST)

4/7

332

341

21

5.4

NW

1 62

14
15

N

Date
Monitored

E

1 00
717

4/9

4/10

4/10

11:45a.m.

3:25p.m.
4:35p.m.

6:05p.m.

APP. TABLE 11-7. Field Ge(Li) and HPIC measurement locations and time-Continued
EML
Location
No.

Distance( miles)

Direction( degrees)

2.2

195

Date
Monitored

SectorTime( EST)

32

1.3

243

WSW

4/11

11:25a.m.

34

2.5

1 86

S

4/11

2:35p.m.

36

2.4

33

35
37

3.0

267

2.9

241

SSW

W

SSE

1 63

WSW

4/11

1 2:1Op.m.

4/11

4/11

4/13

APP. FIGURE II-I. EML Measurement Sites Close to TMI Station718

4:10p.m.

6:10p.m.

8:55a.m.

APP. FIGURE 11-2. EML Measurement Sites in Harrisburg Metropolitan Area

trial radiological monitoring and sampling efforts inthe vicinity of Three Mile Island. 10 Other agencies,
i ncluding the NRC, unfamiliar with ARAC capabilities
for predicting plume behavior did not use it during
the response to the accident. Appendix 11.5 contains a detailed discussion of ARAC.

dance in radiation monitoring and evacuation planning. The purpose of ARAC is to provide estimatesof the effects of accidental or routine atmosphericreleases of hazardous materials, including radioactive materials. The DOE used ARAC in its accident
response functions by directing aircraft and terres-

719

REFERENCES AND NOTES'"Region I Radiological Assistance Program (RAP)
Response to the Incident at Three Mile Island, March 28April 18,1979," DOE, Appendix G, at 1ff.
2
Department of Energy Radiological Response to theThree Mile Island Accident, April 14,1979, at Fig. 3.
3"Region I Radiological Assistance Program (RAP)
Response to the Incident at Three Mile Island, March 28April 18,1979," DOE, Appendix G at 1, 2.
4
5

k1. at 1.

Id. at 1-2.

Kevin M. Miller, et al., "Radiation Measurements Following the Three Mile Island Reactor Accident," (EML6357) Environmental Measurements Laboratory, NewYork,
at p. 2.
7
1d., Table I at 7, 8.
81d., Figure 1 at 12.
91d., Figure 7 at 13.
10
Memorandum from O. D. T. Lynch, Jr., TMI SIG, toFiles, Task Group 3, TMI SIG, "Meeting with Lawrence
Livermore Laboratory (LLL) Officials on AtmosphericRelease Advisory Capability (ARAC) Response to TMI
Accident," August 22,1979.

720

APPENDIX 11.5

ATMOSPHERIC RELEASE ADVISORYCAPABILITY (ARAC) UTILIZATIONDURING THE TMI ACCIDENT

ARAC is a computer service developed by theLawrence Livermore Laboratory (LLL) under a
Department of Energy (DOE) contract. The purposeof ARAC is to provide accurate estimates of theeffects of accidental or routine atmosphericreleases of hazardous materials, including radioactive materials.
During the accident, ARAC was utilized extensively by DOE and the results were provided to the
NRC and other agencies. As a sponsor of the system, DOE personnel were familiar with ARAC andused the ARAC products to direct aircraft and terrestrial radiological monitoring and sampling efforts.
Other agencies, including the NRC, were much lessknowledgeable of ARAC and its capabilities forpredicting plume development and did not use it
effectively during the response to the accident.

single trajectory model to a set of advanced regional transport and diffusion models.
ARAC Product - The ARAC system produces

several graphical presentations (plots) that include
the following:

1. Simple Gaussian Curves-This plot is aconcentration-downwind distance curve that indicates cloud center concentration, ground level
concentration on center line, and integrated
ground levels.
2. Relative Concentration-This plot is a plan viewof the plume (as a distribution of dots) intended
to depict an overview of general plume behavior.
3. Instantaneous Concentration (x/ o)-This plot indicates contour lines of instantaneous concentrations at a particular elevation. The instantaneousconcentrations are used, with field measurements
i n the plume, to predict exposure rates on the
ground for use as health physics advisory information.

ARAC System-The ARAC system provides real-time regional assessments of plume developmentusing numerical models and local site data. The
models used by ARAC vary in complexity from a721

Robert Bores at the NRC Region I office, King ofPrussia, Pa. Again, some difficulties were encoun6
tered due to facsimile machine interfaces, but plots?
were not distorted.
On March 31, eight ARAC runs were madebetween 9:00 a.m. and 6:00 p.m. ARAC products
continued to be provided through April 4, after
which they were only provided to the DOE on an
as-needed basis until April 18, 1979. During the emergency, ARAC products were provided to the following agencies: DOE Command Center, Capital
City Airport; NRC IRC, Bethesda, Md.; EG&G, Las
Vegas, Nev.; DOE EOC, Germantown, Md.; DOE
Nevada, Las Vegas, Nev.; NRC, Region I, King ofPrussia, Pa. 8
ARAC was typically able to produce its productand provide it to Harrisburg within 55 to 60 minutes
from input of meteorological data. It was assumed
that the meteorology was consistent for a 2-hour
i nterval.
For the TMI-2 accident, ARAC provided (1) the"dot plot" relative concentration plot and (2) the instantaneous concentration plot for a 65-meterheight above the surface. The grid size used for the
TMI-2 accident was 2 kilometers on the horizontal
and 35 meters on the vertical, although a smaller
grid size was available, down to 62.5 meters for thehorizontal.

4. Vertical Plume Distribution-This plot provides aside view of the plume.
5. Dose-This is a health physics advisory plot
similar to the instantaneous concentration plot. A
source term is required, and exposure-dose
rates on the ground or above the ground are provided. Integrated exposure and dose can also be
provided.
ARAC Input-Output for TMI-ARAC was activatedat 11:20 a.m. (EST) on March 28, 1979, by J. Bufait,
DOE, Germantown, Md. The first product was provided to Bufait at the Emergency Operations Center(EOC), DOE Headquarters, Germantown, at approximately 1:00 p.m. This product was an integrated air
and surface concentration calculation using a simple
Gaussian model. 2
LLL transmitted an improved ARAC product (usi ng TMI-2 local meteorology and topographic data)
to Bernard Weiss at the NRC Incident Response
Center, in Bethesda, Md. at 4:07 p.m. There weretransmission-reception problems due to facsimile
machine incompatibility and the product was finallyreceived at the NRC Incident Response Center (IRC)3
at approximately 6:00 p.m. ( Correct facsimile
machine matching was never realized, and the
ARAC plots received at the NRC IRC were continually seriously distorted.) The NRC staff using the
product had never seen it before and never realizedthat distortion existed. 4 The producttransmitted to1311
NRC at this time consisted of two
contour plots:(I) i ntegrated surface air concentration at the surface (about 2 meters above) for an assumed unit
release at 7:00 a.m. based on 12:00 noon meteorolan assumed unit
ogy; and (2) deposition from 131
release at 7:00 a.m. (of 1 Ci/s of 1) based on 12:00
noon meteorology.
By 8:00 p.m., USGS-digitized terrain data wasadded to the ARAC computer bank. By this time
the DOE at Capital City Airport had chosen the gridsize of 2 kilometers for the ARAC product. The
USGS terrain data, which were on a 62.5-meter
grid, were averaged over a 2-kilometer grid tomatch the computer model grid network. 5
On March 29, ARAC runs were made every 2hours during the day and provided to the DOE. Calculations were not performed at night; however, LLL
did have the capability to provide 24-hour service.
At 2:00 p.m. on March 30, ARAC received theTMI-2 meteorological tower data from Pickard,
Lowe, and Garrick, consultant to Met Ed. These
data were provided hourly to LLL until 10:00 p.m. on
March 31, when the tower data were transmitted automatically. At 8:15 p.m., on March 30, the ARAC
products were transmitted, for the first time, toAgency Use of ARAC Products During the Accident

DOE-DOE at Capital City Airport, the primary userof ARAC, utilized ARAC plots to vector their aircraft
and ground sampling operations. Aircraft operations
by EG&G and reports from ground survey teams indicated agreement with ARAC predictions on the location and extent of plume. 9
NRC Incident Response Center (IRC), Bethesda,
Md.- The ARAC information was received at the
I RC in Bethesda, Md. by Bernard Weiss. Weisspassed the ARAC plots on to the Meteorology Section of theHydrology-Meteorology Branch, NRR
1o( HMB(M))
Hydrology-Meteorology Branch [HMB(M)]-Personnel were providing meteorological support to the
I RC. The predictions performed by the HMB(M)personnel were based on a simple straight-line
Gaussian model that did not account for changes inwind direction at distances away from the site or topography. HMB(M) personnel had confidence intheir model and calculations. Although several
HMB(M) personnel had some knowledge of ARAC,
722

they did not have enough familiarity with it to makeit their primary source of information. Thus, the
ARAC products were used only as a check. In addition, the model used by HMB(M) was sufficiently
accurate close in (within 5 miles) and they believedthat ARAC could not be utilized close in, but was
useful at ranges over 10 miles. 11
The NRC was not a subscriber to the ARAC system (it was a DOE-sponsored effort being used for
DOE facilities), and no one at the NRC had sufficientfamiliarity with ARAC to make effective use of thesystem.
Because the NRC staff was not familiar with the
ARAC product, they did not recognize the usefulness of the ARAC plots that were available.
Although it was recognized that 2-kilometer grid
spacing was being used, no one knew that the gridsize could be varied, down to 62.5 meters, if necessary. ARAC was not effectively used by the NRC

723

IRC staff. One individual indicated his reasons forli mited use:

This is one of the reasons why, I will be quite
honest, I hesitate to run with new data when we
don't understand exactly how it is coming in, how it
i s being developed, the quality control that goes
i nto it because you get into a lot of trouble making
erroneous decisions. That is why I say the main
value of the ARAC data was to confirm the general
directionthat we would have a problem if we had
12one.

ARAC was a valuable tool that utilized wind fields
developed from a variety of onsite and off site
sources. ARAC provided near real-time predictionsof plume behavior, and, if necessary, close-in
downwind concentrations, but was relegated to a
position of low importance. ARAC was an available
tool for use in responding to the accident, but was
not effectively used by the NRC.

REFERENCES AND NOTES
M. H. Dickerson, Atmospheric Release Advisory
Capability (ARAC), Update 1977, IEEE Transactions on
Nuclear Science NS-25, 850 (1978). AtmosphericRelease Advisory Capability (ARAC) Operator's Guide,
Site Facility, UCID-17490, Lawrence Livermore Laboratory, July 13,1977.

Livermore Laboratory (LLL) Officials on AtmosphericRelease Advisory Capability (ARAC) Response to TMI
Accident, at 2, August 22, 1979.
6
Id. at 2.
7Memorandum from J. P. Stohr, NRC IE, to J. C. Guibert, Office of Commissioner Kennedy, "Request for DOE
Illustrative Material," April 12,1979.
8
Id. at 4.
9
Id. at 5.
10
Weiss dep. at 215.
"Memorandum of telephone call from P. Murray, NRC,
to J. E. Fairobent, ARAC, "ARAC Data Received from B.
Weiss," July 13,1979.
12
Sniezek dep. at 40.

1

Memorandum from O. D. T. Lynch, Jr., TMI SIG, toFiles, Task Group 3, TMI SIG, "Meeting with Lawrence
Livermore Laboratory (LLL) Officials on AtmosphericRelease Advisory Capability (ARAC) Response to TMI
Accident," at 1, August 22, 1979.
3
LLL TMI Incident Log Book, entry for 3:00 p.m.,
March 28,1979.
4
Weiss dep. at 223.
5
Memorandum from O.D.T. Lynch, Jr., TMI SIG, toFiles, Task Group 3, TMI SIG, "Meeting with Lawrence
2724

APPENDIX 11.6
RADIOLOGICAL CHRONOLOGYOF EVENTSITEM

DATE AND TIME

EVENT DESCRIPTIONREFERENCES

3/28/791

4:00 a.m.

TMI-2 at 97% full power, auxiliary
and fuel handling building ventilation systems exhausting through
HEPAs and charcoal adsorbers.

1

2

4:00 a.m.

Reactor trip.

1

3

4:08 a.m.

Reactor containment sump pump
WDL-P-lA started to pump coolant
resulting from stuck-open PORV to
auxiliary building sump tank.

1

4

4:10 a.m.

Reactor containment sump pump
WDL-P-2B also started.

1

5

4:38 a.m.

Sump pumps manually turned off
1
after transfer of approximately
8000 gal to auxiliary building.
This liquid was not highly radioactive.

6

5:42 a.m.

Primary to secondary steam generator
leaks indicated by samples from thecondenser vacuum pump.

725

2

EVENT DESCRIPTIONREFERENCESITEMDATE AND TIME

7

6:30 to7:00 a.m.

Technicians reported rapidly
increasing levels of radiationin the auxiliary building, up to
10 R/h.

1

8

6:43 a.m.

Reactor coolant sample taken thatalarmed TMI-1 sample room area
monitor, sample analyzed at
140 µCi/ml gross activity.

1

9

6:48 a.m.

Particulate channel of station ventmonitor HP-R-219 alarmed at its
setpoint of 0.3 µCi/sec, thetechnical specification limit for
1311 and particulates.

I10

6:50 a.m.

Technician walked through liquid in
auxiliary building, but was notcontaminated.

1

11

6:51 a.m.

Particulate channel of auxiliarybuilding exhaust monitor HP-R-228
alarmed at 0.3 µCi/sec setpoint.

1

12

6:54 a.m.

Condenser vacuum pump discharge
monitor VA-R-748 alarmed at
0.024 µCi/sec setpoint.

1

13

6:55 a.m.

Site emergency declared by shift
supervisor Zewe.

1

14

6:58 a.m.

R. Dubiel, Supervisor of Radiation
Protection and Chemistry noted that
containment dome monitor HP-R-214 wasin alert and increasing.

I

15

7:01 to7:06 a.m.

Fuel handling building iodine monitor
downstream of filters, fuel handlingbuilding particulate monitor upstreamof filters, and reactor containment
purge particulate monitor alarmed.

1

16

7:12 a.m.

Noble gas channel of station ventmonitor HP-R-219 alarmed at 2.8x10 -4µCi/cc setpoint.
Reactor coolant
letdown monitor alarmed.

1

726

ITEM

DATE AND TIME

17

7:00 to8:20 a.m.

EVENT DESCRIPTIONREFERENCES

Numerous TMI-1 and TMI-2 area andexhaust monitors alarmed forparticulates, iodines, and noble
gases.
Of importance, iodine channelof station vent stack monitor HP-R-219
alarmed at 7:35 a.m. Other monitorsthat alarmed included:

1

1.

Reactor containment purge area
monitor (7:19 a.m.).
2.
TMI-1 fuel handling building
particulate monitor (7:20 a.m.).
3.
Fuel handling building exhaust area
monit& (7:23 a.m.).
4. Reactor containment purge gas monitor(7:23 a.m.).
5. Fuel handling building exhaust gas
monitor downstream of filters(7:23 a.m.).
6.
Fuel handling building exhaust gas
monitor upstream of filters(7:25 a.m.).
7. Auxiliary building exhaust gas
monitor (7:28 a.m.).
8.
Reactor containment purge iodine
monitor (7:29 and 7:37 a.m.).
9. Auxiliary building exhaust iodine
monitor (8:00 a.m.).
10. TMI-1 fuel handling building exhaust
particulate monitor (8:19 a.m.).
18

7:24 a.m.

General emergency declared by Station 1
Manager Miller.

19

7:55 a.m.

Offsite survey team reported lessthan 1 mR/h at both the northgate and observation center.

1

20

7.56 a.m.

Reactor building isolated
automatically on high reactor
building pressure.

1

21

8:07 a.m.

Model room door between auxiliary
and fuel handling buildings recorded
as closed, separating the buildings
with respect to ventilation.

1

22

Approx.
8:00 a.m.

Control Room Operator Hugh A. McGovern 3
manually activated control room
recirculation by starting fan AH-E-4B.

727

EVENT DESCRIPTIONREFERENCESITEMDATE AND TIME

23

8:30 a.m.

Onsite radiation readings of 7-14
mR/h. Offsite readings less than
1 mR/h, with a few locations at
1-3 mR/h.

2

24

8:30 a.m.

NRC mobile lab left Millstone Station
for the Three Mile Island Station.

I25

8:43 a.m.

TMI-1 nuclear sampling room monitor
increased to 10 R/h (5 feet from
TMI-2 coolant sample lines).

1

26

8:50 a.m.

Reactor coolant sample showed highradioactivity levels (over 500µCi/ml).

1

27

9:22 a.m.

Goldsboro air sample indicated-8µCi/cc iodine-131.
10

1

28

9:48 a.m.

Particulate channel of control room
air intake monitor HP-R-220 alarmed.

129

10:10 a.m.

Noble gas channel of control room air
intake monitor alarmed.

130

10:12 a.m.

ECS moved from TMI-2 control room
to TMI-1 control room.

131

10:17 a.m.

TMI-2 control room personnel donned
face masks with particulate filters.

1

32

11:10 a.m.

Island evacuated of all nonessential
personnel.

133

11:25 a.m.

Onsite radiation readings of
5-10 mR/h recorded; highest 365
mR/h at western boundary. Offsite
readings increasing average of
1-5 mR/h; highest 13 mR/h 6 miles
WNW. The radioactive releases fromthe plant are confused with the plumeof steam being released by atmosphericsteam dumping.

2

34

12:00 noon

Entries into auxiliary building madewithout high range pocket dosimeters.
Areas up to 1000 R/h surveyed. The
three individuals each received
800 mrem (10-min entry).

1

728

ITEM

DATE AND TIME

EVENT DESCRIPTION

35

2:27 p.m.

Offsite radiation readings in
Middletown indicated 1-2 mR/h.

236

3:10 p.m.

Masks removed by control room
personnel.

137

3:28 p.m.

Met Ed personnel report 50 mR/hreadings on Pa 441 east of plant.

238

4:45 p.m.

Met Ed reported to Commonwealthof Pennsylvania that radiation levels
onsite at north gate have increased
from 30 mR/h to 50 mR/h. Offsite
readings less than 1 mR/h and amaximum of 9.6x10 - 9 µCi/cc 1311.

2

39

5:20 p.m.

Onsite radiation level of 210 mR/h
at northwest boundary.

240

6:00 p.m.

BNL team reported radiation levels of
1-2 mR/h in the plume 5-10 miles fromthe site with less than MDA (10 10µCi/cc 1311.)2

41

7:00 p.m.

NRC inspectors reported 2 mR/h on Pa.
Turnpike and 10-15 mR/h at Olmstead
Plaza.

142

7:30 p.m.

NRC mobile lab in operation.

143

7:43 p.m.

Onsite radiation levels decreased
to 10-20 mR/h with maximum of 42
mR/h behind TMI-1 warehouse.
Offsite readings less than 1 mR/h.

2

44

9:00 p.m.

Auxiliary operator entered auxiliarybuilding alone and without a safety
man or high range dosimeter. After
passing through 100 R/h (measured)radiation fields, he discovered his
pocket dosimeter off scale, and also
caused the GM counter to alarm on
entering the control room. Insteadof decontaminating, he reentered theauxiliary building after he zeroed
his pocket dosimeter.
Again, thepocket dosimeter went off scale. His
TLD indicated a dose of 3.2 rem.

145

11:25 p.m.

Onsite radiation readings increased
to 365 mR/h beta-gamma and 50 mR/h
gamma 1000 feet NW of TMI-2 vent.

1

729

REFERENCESITEMDATE AND TIME

EVENT DESCRIPTION

46

During Day

D. Frederickson, NIH, advised
4
Secretary Califano of HEW that as aprecautionary measure there should
be supplies of potassium iodide in the
Harrisburg area as a thyroid blocking
agent.

47

0:55 a.m.

Auxiliary and fuel handling building
ventilation fans were stopped in an
attempt to reduce releases.

48

2:11 a.m.

Particulate channel of control room5
air intake monitor HP-R-220 alarmed,
and all personnel in TMI-2 control
Ventilation fans inroom donned masks.
auxiliary and fuel handling buildings
restarted.

49

3:15 a.m.

Levels of particulate radioactive
material in TMI-2 control room
quickly decreased, allowing theremoval of masks.

550

Duringmorning

Onsite radiation levels gradually
decreased to 5-10 mR/h. Offsite
levels were 1-3 mR/h with nodetectable 1311.

2

51

4:35 a.m.

Makeup tank MU-T-l vented to thevent header and the waste gas decay
tanks for the first time.

152

8:30 to11:30 a.m.

Survey at letdown filter cubicle
indicated >1000 R/h through aporthole, 2-5 R/h general area. The
technician received 1.4 rem obtaining
these readings.

1

53

Approx.
7:00 a.m.

Technician surveyed the auxiliarybuilding, and reported several areas
with > 100 R/h radiation fields.

154

9:03 a.m.

TLD reader moved to observation
center due to 40 mR/h backgroundon site.

I55

12:15 p.m.

Plastic sheets placed over water in
the auxiliary building to reduce
gaseous releases.

1

730

REFERENCES

1

ITEM

DATE AND TIME

EVENT DESCRIPTION

56

12:40 p.m.

Sumps turned off from turbine
building, control building, andcontrol and service building.

157

1:30 p.m.

IWTS discharge sampled.
was detected.

158

2:00 p.m.

RMC set up their whole-body counterand mobile lab at observation center.

59

2:10 p.m.

A helicopter measured 3 R/h beta-gamma 1
and 400 mR/h gamma, at
15 feet above the TMI-2 stack.

60

3:00 p.m.

Met Ed retrieved 17 TLDs from fixed
positions located within 15 miles ofthe plant. These TLDs had been
exposed for 3 months, including thefirst 1-1/2 days after the accident.

61

4:15 p.m.

100 ml reactor coolant sample takenIby a radiation protection foreman anda chemistry foreman.
Although they
were informed that exposure rates of
800 to 1000 R/h were probable, they
wore no extremity dosimeters and took
no air samples. The sample read >1000
R/h on contact, 400 R/h at 1 foot and10-15 R/h at 3 feet. The chemistry
foreman received 4.1 rem whole-body andhad nonremovable contamination measuring
25 mR/h contact on his hands. The
radiation protection foreman had 150 mR/hcontact nonremovable contamination on
his forearm.

62

5:55 p.m.

NRC executive management team
directed Met Ed to stop discharging
all water.

1

63

8:20 to8:45 p.m.

Makeup tank vented intermittently tovent header.
Radiation monitors
increased during each attempt,
indicating leaks into the vent header
system.

1

64

10:04 to10:13 p.m.

The contaminated chemistry foreman,with 25 mR/h hand contamination,
was whole-body counted and sent home.

165

11:00 p.m.

Two engineers surveyed the auxiliarybuilding for water leaks, and one
engineer received 3.14 rem.

1

731

REFERENCES

No iodine

1

1

ITEM

DATE AND TIME

EVENT DESCRIPTIONREFERENCES

Onsite and offsite readings generally
less than 0.5 mR/h; some onsite
readings 1-30 mR/h.

2

66

12:00
midnight

67

12:00
Makeup tank vented intermittently
midnight to numerous times.
7:00 a.m.

68

4:35 a.m.

1
The liquid pressure relief(MU-R-1) on the makeup tank opened
to the reactor coolant bleed holdup
tanks.
The makeup tank level dropped
to zero, and suction for the makeup
pumps was supplied by the borated
water storage tank.
The borated water
cycled directly to the makeup tank and
RCBHTs.

69

7:10 a.m.

Operator Faust opened the makeup
tank vent valve MU-V-13 (withsupervisory concurrence) in orderto stop depleting the BWST. The vent
was left open continually except forpossible short periods.

170

7:22 a.m.

Readings of 150-180 mR/h at 130 feetabove TMI-2 stack.

271

7:56 a.m.

Reading of 1 R/h (beta-gamma) at
130 feet above stack.

2

72

8:01 a.m.

Reading of 1200 mR/h (beta-gamma) at
130 feet above stack. Helicopter
Onsitecannot duplicate reading.
readings 10-30 mR/h at west boundary,offsite locations close to plantincreased to 5-18 mR/h.

1, 2

73

8:34 a.m.

Unit supervisor of station operations
called Civil Defense to discussevacuation.

174

12:30 p.m.

Met Ed received TLD analyses from
TLDs pulled on 3/29. Results showed
less than 25 mrem per quarter offsite,
maximum onsite dose was 1044 mrem per
Iodine air samples on thequarter.
island all less than 0.03 p Ci/m3
except one location NNE
on island of 0.47 p Ci/m3(unrestricted area MPC is 100
3p Ci/m ).

732

1

1

ITEM

DATE AND TIME

75

2:40 p.m.

The contents of waste gas decay tank
B were transferred into the reactor
building.

176

7:45 p.m.

Air sample at observation center
showed 1x10 - 9 ,Ci/cc 1311
activity.

2

77

During Day

Secretary Califano directed FDA tomake potassium iodide available to
Commonwealth of Pennsylvania.

4

78

12:00
midnight

Radiation work permit system back in
use by Met Ed.

679

6:20 a.m.

Argonne team began terrestrial
monitoring under the plume.

2

80

9:00 a.m.

2

81

Offsite readings increased to 5-10mR/h, up to 38 mR/h on Pa 441.

11:15 a.m.

100 mR/h observed at east siteboundary.

2

82

Approx.
12:00 noon

EPA, NRC, FDA-BRH all distributed
TLDs. RMC and Met Ed TLDs collected.

283

2:37 p.m.

56 mR/h observed at east siteboundary.

284

During day

FDA requested Mallinckrodt Corporation 4
to manufacture potassium iodide.

85

1:30 a.m.

86

Approx.
12:00
Noon

11000 1-ounce bottles of potassium
4
iodide delivered to Harrisburg Airport.
NRC TLDs collected, 37 additional
stations established up to 12 miles
from the plant.

2

87

4/1/79-4/5/79

Six shipments of potassium iodide
received at Harrisburg Airport.

488

4/1/79-4/18/79

TLDs distributed and collectedperiodically.

2

89

4/8/79Science Applications, Inc., obtained
7
auxiliary building samples upstream
and downstream of the exhaust filters,
which showed an overall decontamination
factor of 1.2.

EVENT DESCRIPTION

733

REFERENCESITEMDATE AND TIME

EVENT DESCRIPTIONREFERENCES

90

Early April

Supplementary air filters arrived by
air transport for installation on
auxiliary building roof.

891

4/20/79

Filters (carbon adsorbers and HEPAs)
changed in the A train of theauxiliary building exhaust system.

992

4/24/79

Filters (carbon adsorbers and HEPAs)
changed in the A train of the fuelhandling building exhaust system.

993

4/25/79

Filters (carbon adsorbers and HEPAs)
changed in the B train of theauxiliary building exhaust system.

994

5/1/79Supplementary auxiliary building
filtration system put into operation.

1095

5/20/79

TMI-2 stack capped to ensure all
releases go through the supplementary
auxiliary building filtration system.

11

96

5/23/79

Filters (carbon adsorbers and HEPAs)
changed in the B Train of the fuelhandling building exhaust system.

9734

REFERENCES AND NOTES
NRC, "Investigation into the March 28, 1979 Three
Mile Island Accident by Office of Inspection and Enforcement," NRC Report NUREG-0600, August 1979.
2"Report of the Task Group on Health Physics andDosimetry" to President's Commission on the Accident atThree Mile Island, J. A. Auxier, et al., October 1979.
3
H. A. McGovern, "Chronology of Actions and Observations of System Beginning 7:00 a.m.," March 28, 1979,
NRC Accession Number 7906180096.
4
G. K. MacLeod, Secretary of Health, Commonwealthof Pennsylvania, "The Decision to Withhold Distribution of
Potassium Iodide During the Three Mile Island Accident:Internal Working Document."
5
TMI-2 Control Room Log, NRC Accession Number
7906140471.
B
Radiation Work Permit Log, NRC Accession Number
7906150259.

Memorandum from R. R. Bellamy, NRC, to F. Miraglia,"Telephone Conversation Regarding TMI Iodine Species,"
November 13, 1979.

1

8

Collins dep. at 71.

9"Technical Staff Analysis Report on Iodine Filter Performance," to President's Commission on the Accident atThree Mile Island, William M. Bland, Technical Assessment Task Force, October 1979, p. 9.

10*Memorandum, J. T. Collins, NRC to Ben Rusche,GPU, "Charcoal Test Cartridges from Supplementary
Auxiliary Building Filtration System," June 3, 1979.

f
J. T. Collins, W. D. Travers, R. R. Bellamy, "Report on
Preliminary Radioactive Airborne Release and Charcoal
Efficiency Data: Three Mile Island Unit 2", NRC, Washington, D.C. 20555.

735

APPENDIX 11.7

CALCULATION OF LEACHING FROMREACTOR FUEL

where w is total leached in grams.
2
The total weight of fuel is 9.31x10 g.
If it is assumed that 1/3 of the fuel is damaged,
the mass of damaged fuel is 3.1x10 g.
If the damaged fuel is in the form of spheres of
uniform size, the volume of each isAnalysis of a sample of reactor coolant taken on
March 29 showed only a minute fraction of a percent of the core inventory of refractory elements( Sr, Ru, Ba) in the reactor coolant. A sample taken
on April 10 showed about 1% of the core inventoryof Sr, Ba, La and Mo. The fractions were quite variable both from element and from laboratory tolaboratory but a figure of 1% represents a reasonable average.
A fit to the data of Katayama l gives, for earlyti me,and the surface area is

The number of spheres is thenwhere M is the mass of fractured fuel, and p is fueldensity. The total surface area is then

Then the total amount leached is

73 7

The apparent surface area isExperimental data 3 indicates that particle sizes
under similar (LOCA) conditions may be of the orderof 0.2 centimeters.
Although the calculations cannot be made withany precision, it appears that the presence ofrefractory elements in the reactor coolant can be
explained by leaching alone.
A similar calculation has been carried out byPowers. 4 His results are not precisely the same as
those found above, though they are certainly within
the expected error bounds for such an uncertain
computation. Powers has computed the possible
fraction of the core in any particle size range. A
lower limit of about 0.03 centimeter radius is
imposed, because particles smaller than this would
be levitated by the flow and would be distributed
throughout the system. As will be seen, if the particles are larger than about 0.2 centimeter radius,
almost any amount of the core can be involved. If
the particles are smaller than about 0.1 centimeterradius, only a small fraction of the cores can bei nvolved. Therefore, it appears improbable thatmuch of the core has been broken up into
extremely fine particles.

For April 10 (t =14)

The equivalent radius sphere isThis measurement appears to be rather small foran average size, a diameter of about .090"; however, the precision of the concentration data is sopoor that a factor of 2 larger would be completely
reasonable also. If the fraction of fuel damaged
enough to be leached is larger, the average radiuswould be larger.

73 8

REFERENCES AND NOTES
Cladding Doc-3. Results Presentation at 7th Water
Reactor Research Information Meeting, Gaithersburg,
Maryland, November 5-9, 1979. Available from the NRC
Public Document Room.
4
D.A. Powers, Sandia Laboratories, "Status of theReactor Core Based on Fission Product Analysis,"
November 29,1979.

1
Y.B. Katayama and J.E. Mandel "Leaching of Irradiating LWR Fuel Pellets in Deionized Water, Sea Brine, andTypical Ground Water," ANS Trans., 7:447, Nov.-Dec.
1977.
2
Met Ed, Jersey Central Power and Light Co.,
Pennsylvania Electric Co., "Final Safety Analysis Report,
Three Mile Island Nuclear Station-Unit 2."
3
T.R. Yackle & P.E. MacDonald, Influence of Internal
Pressure and Prior Irradiation on Deformation of Zircaloy739

APPENDIX 11.8

TMIBOIL CODE CALCULATIONS OF
CORE DAMAGE AT 3 HOURS• parametrical use of the conduction heat transfer

A code called TMIBOIL was written recently to
calculate more precisely the time-temperature relationship for the fuel rods in TMI-2, using relatively
precise analytical expressions, few simplifying
assumptions, and parametric treatment of several of
the system variables. The code has been written sothat the accident "scenario" can be varied over wide
ranges, and the calculations fit parametrically into
the scenario. Specifically, the code does not
require an exact knowledge of the makeup and letdown flows, but it does require a stated rate ofchange (as one of the parameters) of level of
coolant in the core. In addition, the functions of
TMIBOIL include the following:

coefficients, the final depth of boil off, the rate ofboil off, the assembly power (radial peaking factor times a fixed axial power profile), and thepresence of "chilling" rods (such as control andpoison rods);• calculation of the total steam produced in eachti me increment, and the surplus of steam exiting
the fuel subchannels for each time increment;• report of the axial node in 1-inch increments, theelapsed time in minutes, the fuel (cladding) temperature in °F, the steam temperature in °F, thesteam flow in pounds per hour, the thickness of
Zircaloy metal left in the wall (not converted tooxide), and the ratio of the oxidation heat to the
decay heat at each node;• calculation of the total number of gram moles ofhydrogen produced;• cutoff of oxidation heat of Zircaloy-steam reaction at 3600°F, assumption that molten material isformed between oxide and metal that leaves thenode, and thereafter, at that node, report of the
thickness of metal remaining when the nodereaches 3600°F (3600°F ensures melting of the• calculation of the steam production rate as afunction of the length of the fuel rod submerged
i n coolant, the system pressure, the time in the
scenario, and the rate of coolant level change;• calculation of the specific heat of the fuel rod;• analytical calculation of the heat of oxidation ateach node, time, and temperature;• calculation of the radiative heat transfer coefficient and addition to the conductive heat transfer
coefficient;741

ry of radioactivity released), and the boil off to 9 feetproduces too much. It appears that the boil off to 8
feet ± /z foot produces damage values not inconsistent with known levels such as hydrogen, radioactivity release, and maximum temperatures.
App. Tables 11-8 and 11-9 present most of thesame data in somewhat different order, so thatcomparisons of several parameters are madeeasier.
I n App. Table 11-8, the effect of changing thepower in the assembly on the significant points canbe seen by comparing lines 1 through 4. As thepower in the assembly increases, the location of the
burst (defined as the first position on the rod toreach 1500°F) can be seen to rise toward the top of
the fuel rod, and the time to burst decreases from29 to 20.6 minutes. Also, the location of the firstformation of liquid phase (3600°F) rises, and theti me to formation decreases. It may seem surprisingthat the maximum depth of liquid phase formation
decreases with increasing power in the assembly,
but this is due to the increasing rate of steam production with increased power.
The effects of changing the maximum depth ofboil off can be seen by comparison of lines 1-4 with
8-11 and 12-15. At the 7-foot level of boil off, thepeak temperature on the fuel rod increases from3042°F to 3600°F, with decreasing assembly powerfrom rpf=1.467 to rpf=0.622, and only the lowest
power assemblies on the periphery of the corereach temperatures high enough to form the Zr-U-0"liquefied fuel" phase.
The ranges of time before the burst and thel ocation of the burst for the different levels or rates
of boil down vary about 4 inches of range of levelacross the core, with differences of 7-10 minutes
between first and last bursts for each of the boil
down levels. Changes in most of the parameters do
not have a large effect on time versus temperature,or on burst time and elevation. The largest effects
are observed in the influence of level of boil downon the first and maximum levels of liquefaction andon the peak temperature reached. The calculations
for the 9-foot level of boil down (from the top of thecore) indicate that more than three-fourths of thecore had exceeded temperatures of 5200°F (melting
point of UO) for a depth of about 2 feet at anelapsed time of 78 minutes from the start of the uncovering of the core.
The estimate of damage present in the core at 3
hours depends on the time assumed for the first uncovering of the core. The best evidence available
for determining this time is shown in Color Plate 5,
where the temperatures of the hot and cold legs ofthe two OTSGs and the levels of coolant on thealpha Zircaloy whether or not the eutectic with
the Zircaloy oxide is formed); and• assumption of the time as zero at the time the
top of the fuel stack is first uncovered.
The code has been used to calculate theti me-temperature relationship for the fuel rods using
the following set of parametric values:• boil down to 7, 8, or 9 feet from the top of thefuel stack;• a time of boil off of 20 minutes for mostscenarios, but 30 or 33 minutes for certain
scenarios;• radial peaking factors in the assemblies of 1.467,
1.2, 1.0, and 0.622 (a spread reasonably
representative of the core). Power in the assemblies at each node is obtained by multiplying theradial peaking factor (rpf) by the axial power profile value at each node;• conduction heat transfer coefficients over arange of representative low steam flow rates (3and 10); and• the boil down and refill scenario proposed by
EPRI in NSAC-1.
Results

The principal results are presented in summary
form in App. Tables 11-8 and 11-9, and in App. Figures 11-3 to 11-19. The effects of varying the parameters can be seen in App. Tables 11-8 and 11-9 on theti me and location of bursting of the fuel rods at
1500°F (assuming that bursting occurs at 1500°F),
the time and location of the first formation of theZr-U-0 liquid phase (assumed to have formed at
3600°F) and of the maximum depth of formationfrom the top of the fuel stack, and of the time andlocation of the maximum temperature reached in thefuel rod. The App. Figures 11-3 to 11-19 show theti me-temperature curves for 1-foot nodes on thefuel rods over a time interval of 80 minutes.
Because the time zero for the TMIBOIL calculation is the time at which the top of the fuel stack
was first uncovered, the time scale can be moved
along the clock-time axis (or accident time axis) as
needed to examine the effects of modifying an accident scenario.
Discussion

I n general overview of the TMIBOIL calculational
results, and the known "facts" of the TMI-2 accident
sequence, it is believed that boil off of 7 feet produces too little damage (considering the amount ofhydrogen produced and the amount of core invento742

APP. TABLE 11-8. TMIBOIL calculations on core damage at 3 hours
Boiloff
Depth
Time
( ft)
( min)

Power( Rpf)

he

15000 F
Burst
Depth
Time
(in)
( min)

Liquefaction
First
Maximum
Depth
Time
Depth
Time
(in)
( min)(in)( min)

Peak Temperature
Depth
Time
°
( min)
F
(in)

8
8
8
8
8
8
8
7

20
20
20
20
20
33
33
20

0.622
1.0
1.2
1.467
1.467
1.467
1.467
0.622

3
3
3
3
10
3
3
3

22
20
19
18
17
13
16
16

29
23.2
21.5
20.6
21.5
30
31.9
32.2

14
10
7
6
9
3
4
1

46.2
36.5
33.8
31.3
31.6
44
48
55.0

41
39
37
36
36
35
31
2

57
48
42
38
38
52
56
55.4

4358
4410
4412
4370
4362
4280
4195
3600

1
1
1
1
1
1
1
2

77.5
62.5
57.5
52.5
50
61
70
55.4

7

20

1.0

3

15

26.8

-

-

-

-

3549

1

50.0

7

20

1.2

3

15

24.1

-

-

-

-

3265

1

45.0

7

20

1.467

3

16

22

-

-

-

-

3042

1

40.0

9

20

0.622

3

25

27.0

24

43.8

74

56.1

4796

29

77.5

9

20

1.0

3

22

21.5

18

33.6

72

45

5590

20

77.5

9

20

1.2

3

22

20.5

17

30.1

72

42.5

5892

15

77.5

9

20

1.467

3

21

20

17

28.5

71

39

6194

9

78

9
8

30
33

1.467
0.622

3
3

16
22

24.7
38

16
4

36.5
58

70
36

48
68

5444
4200

1
1

70
80

Comments

Without cold rod
With Cold rod
Steam flow at peakTemp. 1.02 l b/h
Steam flow at peakTemp. 1.60 l b/h
Steam flow at peakTemp. 1.89 l b/h
Steam flow at peakTemp. 2.30 l b/h
Temp. still increasing
at 77.5 min
Temp. still increasing
at 77.5 min
Temp. still increasing
at 77.5 min
Temp. still increasing
at 78 minEPRI NSAC-1

APP. TABLE 11-9. TMIBOIL calculations on core damage at 3 hours
Boiloff
Depth
Time
(ft)

( min)

7
8
9
9

20
20
20
30

7
8
9
7
8
9
7
8
9

20
20
20
20
20
20
20
20
20

Power
( Rpf)
1.467

he1500° F
Burst
Depth
Time
(in)
( min)

3
3
3

16
18
21

1.2
1.2

3
3
3

15

0.622
0.622
0.622

3
3
3

1.467
1.467
1.467
1.2

1.0
1.0
1.0

3

3
3
3

16

22
20.6
20
24.7

19
22

24.1
21.5
20.5

16
22
25

32.3
29
27.0

15
20
22

26.8
23.2
21.5

Liquefaction
First
Maximum
Depth
Time
Depth
Time
(in)
( min)(in)( min)
6
17
16

7
17
10
18

1
14
24

31.3
28.5
36.5

33.8
30.1

36.5
33.6

55.0
46.2
43.8

36
71
70

37
72
39
72
2
41
74

38
39
48

42
42.5
48
45

55.4
57
56.1

Peak Temperature
Depth
Time
°
F
(in)
( min)
3042
4370
6194
5444

3265
4412
5892
3549
4410
5596
3600
4358
4796

1
1
9

40.0
52.5
78

1
1

15

45.0
57.5
77.5

2
1
29

55.4
77.5
77.5

1

1
1
20

70

50.0
62.5
77.5

Comments

EPRI NSAC-1

APP. FIGURE II-3. Fuel Temperature Histories

APP. FIGURE 11-4. Fuel Temperature Histories
745

APP. FIGURE 11-5. Fuel Temperature Histories

APP. FIGURE 11-6. Fuel Temperature Histories
746

APP. FIGURE 11-7. Fuel Temperature Histories

APP. FIGURE 11-8. Fuel Temperature Histories
747

APP. FIGURE 11-9. Fuel Temperature Histories

APP. FIGURE II-10. Fuel Temperature Histories
748

APP. FIGURE II-11. Fuel Temperature Histories

APP. FIGURE 11-12. Fuel Temperature Histories
749

APP. FIGURE 11-13. Fuel Temperature Histories

APP. FIGURE 11-14. Fuel Temperature Histories
750

APP. FIGURE 11-15. Fuel Temperature Histories

APP. FIGURE 11.16. Fuel Temperature Histories

751

APP. FIGURE II-17. Fuel Temperature Histories

APP. FIGURE 11-18. Fuel Temperature Histories
752

APP. FIGURE 11-19. Fuel Temperature Histories
secondary side are plotted as functions of clock
ti me.
There are two possible interpretations of these
data. When the prior level in OTSG B is considered(shown in Color Plate 5), it can be argued that thefirst break in the curves for the hot-leg temperatures of both steam generators at 5:42 a.m. (1 hour
42 minutes of accident time) indicates that superheated steam was detected in both A and B
steam generators at the top of the hot legs. The
continued rise and subsequent decrease in temperature for OTSG B could indicate the flow of superheated steam into a condenser that was heatsaturated. The reversion of OTSG A hot-leg temperature to a decreasing temperature-time relationship paralleling the previous curves and thesucceeding curves for the cold legs could indicatethat OTSG A could absorb no significant amount ofheat (it was already known to have been "boileddry") until its refilling had begun. Thus, it can be argued that the core was first uncovered at 102
minutes. It can be stated with certainty that thecore had been uncovered no later than 5:52 a.m. (1hour 52 minutes, or 112 minutes of accident time),
because at that time the OTSG A hot-leg temperature began a rise that did not stop (other than for
two short inversions) until a temperature of about

820°F was reached at 6:52 a.m. (2 hours 52
minutes, or 172 minutes accident time). These twoti mes (102 and 112 minutes of accident time) allow
placement of the TMIBOIL zero time and the time atwhich the RC-P2B pump was started on theti me-temperature elevation plots, so that bounds forthe amount of damage to the core at 3 hours can be
estimated. It must be assumed that at least a small
amount of water was pumped by RC-P2B into thecore to reverse the heatup of the fuel rods, even iffor only a few minutes.
If it i s then assumed that the TMIBOIL calculations for boil off to 8 feet in 33 minutes apply (thebest estimate from such variables as the amount ofhydrogen and radioactivity released, the SRM data,
and the first detection of radioactivity in the primarysystem at 6:25 a.m.), the PORV block valve wasclosed at 6:20 a.m. (2 hours 20 minutes accident
ti me), and the RC-P2B was started at 6:54 a.m. (2hours 54 minutes accident time), then the amount ofcore damage at 7:00 a.m. (3 hours accident time)
can be bounded.
With these assumptions, it can be estimated that(1) the great majority of the fuel rods burst at about
the time the block valve was closed at 140 minutes
and all of the rods burst within the next 10 minutes;(2) the first "liquefied fuel" formation occurred at753

Zircaloy contained in the "liquefied fuel." Theseamounts are equivalent to 300-pound moles and360-pound moles of hydrogen, respectively. Because there is evidence that more hydrogen may
have been produced at a later time, this is not to betaken as an estimate of the amount of hydrogenpresent in the containment and the primary system
at 1:54 p.m. (9.9 hours accident time), the time of the"hydrogen burn" in the containment.
The Zircaloy cladding was embrittled by oxidation
down to at least 4 feet from the top of the fuel in thefuel rods. A considerable amount of "liquefied fuel"had formed and flowed down between oxidized
cladding shells, and would have frozen upon reaching a lower temperature at a lower level. When thereactor coolant pump was turned on at 2 hours 54
minutes, the embrittled cladding would have been
thermally shocked by the influx of coolant (whether
steam or water) and would have shattered to produce a "rubble" or "debris" bed of cladding fragments, Zircaloy oxide shells, fuel pellets, and "liquefied fuel," supported by fuel rod stubs, unmelted grid
spacers, and intact guide and instrumentation tubes.
A significant part of the "debris" bed would havebeen "melted" or "glued" together with "liquefied
fuel" that would have frozen after flowing from ahigher position and temperature.

about 10 minutes after the block valve was closed;( 3) the maximum depth of formation of "liquefied
fuel" in the hot assembly occurred about 20 minutes
after the block valve was closed and about 10
minutes after that time in the lowest power assembly; and (4) the maximum temperature reached in
the fuel rods was about 4000°F for a "middle power"
assembly at about 72 minutes after the block valve
was closed, and at the time the RC-P2B was started. Additionally, peak temperatures of about
4300°F or more were reached in more than twothirds of the core by the time the RC-P2B wasstarted. The maximum penetration of the formationof "liquefied fuel" was to about 41 inches in thel owest powered assemblies on the periphery of thecore and to 36 inches in the center of the core.
(The steam production rates decreased greatly as
the periphery of the core was approached, and thus
the cooling capability of the steam flow also decreased.)
Additionally, it is estimated that the amount of
Zircaloy converted to oxide as a result of the events
to 7:00 a.m. (3 hours accident time) is between 32
and 39% of the Zircaloy in the fueled part of thecore, and between 26 and 31% of the total Zircaloy
i n the core, including plenum regions and end plugs.
This estimate includes complete oxidation of the754

REFERENCES AND NOTESMemorandum from G. P. Marino and J. M. Marks, NRC,
to File, "Calculation of Fuel Rod Temperatures Reached in
the Three Mile Island-2 Incident," October 25, 1979.

755

APPENDIX 11.9

HYDROGEN CALCULATIONS
R. COLE - SANDIA LABORATORIESThe Hydrogen Bubble
During the period from 29 March through at least 8
April, measurements were made to determine the size ofthe (assumed) hydrogen bubble in the TMI-2 reactor

i s negligibly small-about 2 psi at a total pressure of1000 psia. The partial density of water vapor in the
bubble is essentially the saturation density pv(sar) ( T).

We have independently derived a "bubble formula,"compared it with the Met Ed and B&W formulae, andused it to reduce the raw data in the "Bubble Book."
The total hydrogen content of the RCS, includinghydrogen in solution, was then fit by a straight line (as afunction of time) to estimate the average removal rate.

I f Eq 2 is evaluated for two (PT) states and theresults subtracted, one finds

The total water mass in the RCS is given bycoolant system (RCS). The procedure was to define amass balance for the RCS (exclusive of pressurizer) byrecording changes in the levels of the pressurizer (PZR)
and makeup tank (MUT). From this, the change inbubble size (and therefore the apparent compressibility)
could be calculated and the bubble size inferred.

With the general notation (f is any quantity)

The Bubble Formula

We assume that the bubble is a mixture of hydrogengas and water vapor. Because of the low temperature andwater vapor pressure (280 ° F, 50 psia), Dalton's Law
should apply. The change in water vapor pressure due tothe partial pressure of hydrogen*Eq 3 becomes.

P M. Morese, Thermal Physics, W. A. Benjamin Inc., 1969,

p. 124.

75 7

moles where R is the gas constant andThis equation (which contains no approximations)
may be simplified by elimination of several small terms.*
At 1000 psia and 280 ° F, pQ = 58 Ibm /ft 3 and pvsat 0.12 Ib m /ft3 . Also, VRCS ^- 10300 ft 3 and (we willfind) VB i s typically several hundred cubic feet while
MRCS i s typically a few thousand pounds for apressure change of 100 psi. The expansion of a cylindri-is the partial pressure of hydrogen. The solubility ofhydrogen is proportional to its partial pressure and( neglecting the compressibility of the water) is given by
S'(T)PH moles per unit volume. The total hydrogencontent of the RCS (exclusive of the pressurizer) is given

cal vessel is given byby

where Rh i s the ratio of radius to thickness, about 8
modulus, roughly
for the RCS, and E is Young's RCS
i s typically 30
3X10 psi for steel. Thus TQLV

assuming that a bubble is present. If MH i s eliminatedfrom Eq 14 by using Eq 12, the resulting equation is

I bm , a 1% effect. Temperature changes were almost
never greater than 1 ° F. Therefore, from steam tables,
we find 8AP R Z . 05 Ibm /ft 3 and Ap v Z . 002 Ib m /ft 3 .
iThus V A(P Q -P v ) RCS s a few tens of pounds,
RCS OpQRCS may be
again a 1 % effect, while V

where the dimensionless quantity

several hundred pounds and is more significant.
Finally, neglecting p v compared to pQ we findi s simply the ratio of the volumetric concentration ofhydrogen in solution to that in the vapor phase, and isapproximately 0.03 at 280 0 F.* Equation 15 explicitly
i ncludes the possibility that all hydrogen is in solution
with no bubble present.
I f measurements are made at two pressures but nearly
equal temperatures so that changes in S' and T may beneglected, Eq 15 may be used to show that"

accurate to a few percent.
The mass increase in the RCS is simply the net massl oss from the makeup tank and pressurizer, reduced by

net leakage. Because the pressure and temperature in the
makeup tank are essentially constant, the change in its
density may be neglected, but this is not the case for thepressurizer. The resulting expression iswhere the A notation of Eq 5 has been used and PHmini s the lesser. Once the hydrogen content of the system
has been calculated from Eq 17, Eq 15 may be used to
calculate the size of the bubble at any pressure. If abubble is present in both states 1 and 2, the first term inbrackets in Eq 17 is the greater, and the bubble volume
i s given by

where the A's are horizontal cross-sectional areas, L's arel evels, L o i s the effective height of the hemisphericalsection of the pressurizer below the lower
leak sensing nozzle
i s the unknown(2/3 the radius or 28 in.) and AM,,l eakage term.
The hydrogen content of the bubble is simply"Calculated from H. A. Pray et al. "Solubility of Hydrogen,
Oxygen, Nitrogen, and Helium in Water," Industrial and EnginearingChemistry 44 ( 5) 1146-1151, 1952.
OS
i s constant during the measure**We assume that MH*The reader may skip to Eq 8, an obvious approximation,and miss only a discussion of the accuracy of that approximation.

ment. Changing hydrogen content could be included with minorchanges in the following equations.

75 8

I f a bubble is present only at the lower pressure, theconsistently 50 psi lower than Psat ( TPZR ). This discrepancy, in the wrong direction to be explained by apartial pressure of hydrogen, could be due to a 5 ° F error
i n TPZR. However, we also noted that for the earliest
data sets pressure was reported from the wide range
recorder as well as from the computer, and is typically
50 psi higher. This problem has not been resolved.
Therefore, in those cases where TPZR was reported aswell as P, the pressurizer mass term was evaluated twice,first using P to determine saturation densities and thenusing T, and the average used. In no case was thedifference significant.
The results in these calculations* are presented in
Figures 1-3. The first shows total mass while the second

second term in Eq 17 is the greater, andFinally, if no bubble is present in either state, Eq 17
yields an upper bound on hydrogen content given by theamount soluble at the lower pressure, and Eq 15 gives
zero volume for any pressure about which we haveknowledge. In practice, because of experimental errors,
it may be difficult to distinguish MCS
the latter two cases,
and it may be better to interpret
from Eq 17 as
an upper bound whenever the second term dominates.
For the case where a bubble is present at both states
1 and 2, our bubble formula is given by Eqs 8, 9, and 18.
The B&W formula is in close agreement, although

and third given bubble volumes at the average systempressure of 1000 psia and at the Met Ed-establishedstandard 875 psia. Also shown in these figures are
generalized** least-squares fits to the data from 3/31/79
through 4/3/79 with an approximate one-standard-deviation confidence band on the fit, and a fit presented by
B&W.***We feel that the difference between the two fits may
be due to B&W's apparent use of only 5 data points. The
standard deviation of the points used in our fit from thefit line is ±12 kg, in reasonable agreement with the error
bars shown by B&W, corresponding to a mass error of ±8kg.
We find an average removal rate of 1.7 (±0.3) kg/hr.
This corresponds to the complete degassing of 60 (±10)
gpm of letdown flow. This is not meant to imply that all
the hydrogen was removed through letdown, but merely
to note that typical letdown rates are sufficient toremove most of it. For comparison, the B&W line
i mplies a significantly larger removal rate of 3.0 kg/hr,
again perhaps due to the small data set used.
Our fit suggests that the bubble was gone at 1000 psia

matching the solubility terms takes a little work. The
main differences are B&W's neglect of changes in vapor
mass in the pressurizer, and of liquid below the lower
sensing nozzle ( L o i n Eq 10), which are offsetting effects
of a few percent each. Also, they appear to use totalpressure rather than hydrogen partial pressure in theirequivalent of Eq 18, which would lead to a 5%
underprediction of bubble size.
The Met Ed formula also uses total pressure, andfurther neglects all compressibility and thermal expansion terms for the water. The most important of theseneglected terms is thermal expansion in the pressurizer
under increasing saturation temperature, leading to a
1 0% underpredictionof bubble size. The next largest
RCSterm, AppI s dominated by temperature changes andtherefore not consistent in sign. Much more important is
the neglect of the solubility of hydrogen. The effect isshown by the last term of Eq 18 to be a systematic 300
ft3 overprediction of bubble volume (SRT
. 03 andVRCS
10 300 ft'). While the previously mentioned
errors tend toward underprediction, they are substantially smaller so that the overprediction through theneglect of solubility is the overriding effect. Finally, thedata reduction in the Bubble Book contains a number ofarithmetic and/or transcription errors.

at 1800 on 4/1/79 (±3 hrs). During this time period, thepressure was being cycled between 950 and 1050 psia.
The bubble would be eliminated at the higher pressure
about an hour earlier.
I f the constant removal rate is used to estimate thehydrogen content of the RCS at 16 hours-a veryquestionable extrapolation of inaccurate data-one finds
a total mass of 190 (±40) kg. At 1400 psia and 360 ° F,there would be roughly 45 kg in solution and an 1100ft 3 bubble. Two or 3 hours later when the pressure had
fallen to 1000 psia, and the temperature was also lower,
we would estimate a bubble size of 1300 ft 3 .

Results

The bubble formula derived in the preceding section
has been used to reduce the raw data presented in the*The mass-leak term was taken as zero. We intend to repeat

Bubble Book. The RCS temperature and the makeup
tank temperature were taken as 280 ° F and 80° F
respectively, when these data were not recorded. We
observed that the pressurizer temperature and systempressure were not consistent in that the pressure wasthe calculations using the value mentioned later in the text.

"The generalization involves points where the bubble was"almost gone" and the formula yields an upper bound.
***Memo from James H. Taylor to John Bickel, 20 July
1 979. We consider only the data 'With Solubility Correction."

75 9

We have not included the effects of any leakage of

gpm). This is confirmed in the data reduction in that, forcases where it is clear that no bubble exists (on 4/2/79
and 4/3/79), the RCS still appears to accept an excess
500-1000 Ib m of water during a typical pressure
excursion. When time permits, we intend to repeat theanalysis, including this average leakage rate in the massbalance from which the bubble size is inferred. We do
not anticipate any large change in results.

water or loss of hydrogen during the course of ameasurement. The former clearly exists; an analysis in
the Bubble Book shows replenishment of the makeup
tank at an average rate equivalent to 46 ft 3 /hr at RCS
temperature and pressure. The excess over the bubble
shrinkage rate of 16 ft 3 /hr is presumably unaccounted

leakage, a mass loss of perhaps 1700 Ib m /hr (3 or 4

APP. FIGURE 11-20. Total Hydrogen in RCS (Figure 1)
760

APP. FIGURE 11-21. Bubble Volume at 1000 psig (Figure 2)

761

APP. FIGURE 11-22. Bubble Volume at 875 psia (Figure 3)762

APPENDIX 11.10

ANALYSIS AND CALCULATIONSBY AND FOR SANDIALABORATORIES

pressurizer and the measuring leg attaches near thebase of the pressurizer. Both lines extend out tothe wall of the containment building.

1. HYDROGEN EFFERVESCENCE AND
THE PRESSURIZER LEVEL DETECTOR
D. A. Powers
During the accident at Three Mile Island the pressurizer level detector indicated several changes inwater level that seem to coincide with depressurization of the primary reactor coolant system. It has
been suggested that effervescence of hydrogenfrom the reference leg of the pressurizer level
detector may be responsible for these apparentchanges in water level. In this analysis, it will beshown that the magnitude of hydrogen effervescence is insufficient to support this suggestion.

Hydrogen Solubility in Water

At the modest temperatures and pressures encountered in the reactor situation hydrogen solubility in water is well-described by Henry's Law:

Description of Level Detector

The pressurizer level detector is schematically diagrammed in Figure 1. The level detector consistsof two /2 " pipes and a differential pressure transducer. The reference leg passes up the side of theData concerning the solubility of hydrogen in water are summarized in Table 1. Conclusions that
may be drawn from this data are:76 3

gen solubility calculated here is based on the reported system pressure and the assumed temperature of the level detector plumbing-160°F. The assumed temperature of the plumbing is much lower
than the water temperature in the reactor coolant
system since:a) The fugacity coefficient of hydrogen gas may betaken as unityb) The Henry's Law coefficient is a function of theabsolute temperature only
The data in Table 1 may be correlated by the expression (1):-0.1233[log 1 a ( H x 10

-4+0.02155[log1a(H x 101) the detector plumbing is insulated from the pressurizer, and2) most of the level detector extends well awayfrom the primary coolant system into cooler regions of the secondary containment building.

)] 2 -0.1366(10 3/ T) 2

-4)](10 3/ T)-0.2368 [log l p](H x 10 -4 ))+0.824g (10 3/ /T)=1

Where

Water ejection during the depressurization may
be considered as the result of two processes.
When hydrogen bubbles form they displace water.
This will be termed "static ejection" of water. During
rapid bubble formation, the expansion of the bubble
may impart a kinetic velocity to the slug of water
above the bubble which is dissipated by gravity anddrag forces of the plumbing walls. The combinationof static ejection and ejection due to an imparted
velocity to the water will be termed "kinetic ejection."
The magnitude of the "static ejection" is simply
determined by the difference in hydrogen solubility
before and after the depressurization event. The
volume of water ejected is equal to the volume ofhydrogen at the system pressure and temperaturethat must be removed from solution to re-attainequilibrium.
Calculations of static ejection were made assumi ng the system pressure was due to water vaporand hydrogen. Pressure due to the water head wasneglected. Water vapor partial pressure was taken
as the saturation pressure at the temperature of thedetector. This treatment of water vapor partialpressure should also yield over-prediction of waterejection.
To compute the "kinetic ejection," the maximum
work done by an expanding bubble is computed.
To insure an upper bound on the work is computed,
assumptions that are not consistent are made:

T= absolute temperature (K)H = Henry's Law coefficient(atmospheres/ mole fraction)

A solubility map for hydrogen in water at temperatures of 0-700°F and hydrogen partial pressures of 1 to 2200 psia based on the above correlation is shown in Figure 2. The map and the correlation are strictly applicable only to hydrogen solubility
in pure water. Data exist showing that hydrogensolubility decreases when strong electrolytes are
dissolved in the water (8) 9. The reduction in solubility for dilute electrolyte solutions is approximately
additive based on the molar concentration of thesolution. No data on the reduction of hydrogensolubility with addition of sodium borate, boric acidand sodium hydroxide have been found. Discussions below are based, then, on hydrogen solubility
in pure water. Water ejection predicted below isconservative in that predictions of ejection will be
too high.
Water Ejection

When the partial pressure of hydrogen in equilibrium with a water solution of hydrogen is reduced,hydrogen bubbles may form in the solution. In appropriate geometrics such as the pressurizer level
detector, hydrogen bubble formation may cause water to be ejected from the system.
Water will sustain some super-saturation of hydrogen. However, in the high radiation environmentof the nuclear reactor and the strong system vibrations of the TMI accident, nucleation would be expected to be easy and super-saturation unimportant.
Water ejection that occurs equally in the two legsof the level detector will not produce a change inl evel indication. Consequently, it is only water ejection in the incremental 30' length of the referencel eg of the detector that is of concern here. Hydro-

1) bubble expansion is reversible and adiabatic2) bubble formation is rapid in spite of the assumption of reversibility3) bubble formation occurs in a single location andthe water above the bubble behaves like a solid
slug4) hydrogen gas in the bubble is at the system temperature in spite of the adiabatic assumption.
The work done by adiabatic bubble expansion duri ng a depressurization event from P to Pf is:i

76 4

APP. FIGURE 11-23. The Pressurizer (Figure 1)

765

TABLE 1. Hydrogen solubility data
Temperature(c)Partial Pressure
Hydrogen (atm)

H x 10 -4
atm/mol
frac)
(

1 9.5
1 9.5
1 9.5
19.5
1 9.5
1 9.5
19.5
19.5

1.184
2.632
3.947
5.263
6.579
7.895
9.210
1 0.855

7.42
7.42
7.43
7.47
7.56
7.70
7.87
8.17

1 63
1 63
1 63
1 63
1 63
1 63
1 63
1 63
1 63
1 63
1 63
163
1 63
1 63
1 63
1 63
1 63

1 5.31
1 7.35
1 7.35
35.71
38.71
39.73
40.14
41.16
44.56
54.15
67.35
68.37
74.15
76.53
83.27
87.76
89.80

0
5
10
15
20
25
30
35
40
45
50
60
70
80
90
1 00

23.5
23.5
23.5
23.5

1 35
1 35
1 35
1 35
1 35
1 35
1 35
1 35
1 35
135
1 35
135
1 35

1.447
2.632
3.947
5.263

5.79
6.08
6.36
6.61
6.83
7.07
7.29
7.42
7.51
7.60
7.65
7.65
7.61
7.55
7.51
7.45

7.75
7.76
7.77
7.81

Solubility( ml H 2 STP/ml H 2 0)

766

2
2
2
2
2
2
2
2
2
2
2
2
2
2
2
2
3
3
3
3
3
3
3
3

0.48
0.498
0.51
1.04
1.08
1.08
1.097
1.17
1.285
1.64
1.89
1.93
2.12
2.25
2.45
2.42
2.52
0.362
0.363
0.36
0.414
0.80
0.84
0.87
1.42
1.38
1.38
1.42
2.15
2.17

1 3.94
1 4.63
1 5.31
1 5.99
35.03
35.71
36.39
60.20
60.88
62.24
63.60
93.54
94.22

Reference

3
3
3
3

4
4
4
4
4
4
4
4
4
4
4
4
4
4
4
4
4

4
4
4
4
4
4
4
4
4
4
4
4
4

TABLE 1. Hydrogen solubility data-Continued
Temperature(c)Partial Pressure
Hydrogen (atm)

100
100
100
1 00
100
1 00
100
100
100
1 00
100
100

135
135

24
24

52
52
52

1 49
1 49
1 49
1 49
1 49
174
174
1 74
1 74
1 74

1 99
1 99
1 99
199

224
224
224
224
224
260
260
260

315.5
315.5
315.5
343
343
343
343

Solubility( ml H 2 STP/mI H 2 0)

Reference

1 5.31
1 5.99
16.67
35.71
37.07
38.43
69.73
70.41
71.08
71.77
96.46
98.98

0.32-0.33
0.35
0.306-0.33
0.67
0.71
0.74-0.76
1.38
1.35
1.34
1.35
1.81
1.93

4
4
4
4
4
4
4
4
4
4
4
4

1 3.6
20.4
23.81

0.33
0.41
0.45

95.58
96.26

H x 10 4(atm/mol frac)

20.41
24.96

6.8
13.6
20.4
25.51
34.01

2.05
2.10

4
4

0.32
0.44

5
5

0.13
0.28
0.40
0.52
0.75

6.80
1 3.60
20.40
25.51
34.01

0.15
0.30
0.43
0.56
0.75

6.80
1 3.60
20.40
25.51

0.18
0.34
0.52
0.68

6.80
1 3.60
20.40
25.51
34.01

0.22
0.49
0.75
0.94
1.26

6.80
1 3.6020.40
6.80
1 3.60
20.40

767

7
7
7
7
7
7
7
7
7
7
7
7
7
7
7
7
7
7
7

0.39
0.91
1.25

6
6
6

1.40
1.63
1.68
1.74

6
6
6
6

0.65
1.32
2.01

6.80
7.82
8.16
8.50

6
6
6

6
6
6

APP. FIGURE 11-24. Hydrogen Solubility Versus Temperature and Pressure(ml H2(STP)/g H20) (Figure 2)
moves is equal to the head of water lost. Assume
the friction forces are negligible. Then,Thus, the maximum head-loss due to the ejection ofwater because velocity imparted by bubble formation is equal to that loss due to "static ejection."
Thus,

where V. = initial velocity of the water column.
Then,"kinetic ejection" = 2 ("static ejection").
a. Comparison of the Model with Experiments

The water column will move upward until the forcesof gravity and friction reduce the velocity to zero. If
the water column is full, the distance the water

Babcock and Wilcox have tested the performance of the pressurizer level detector during768

depressurization (10). The model described above
was used to predict head-loss due to hydrogen effervescence in these experiments. System pressure was used as input data for the model. Results
are shown in Figures 3-6. "Static ejection" and"kinetic ejection" are shown in these figures as solidand dashed lines, respectively.
The following conclusions may be drawn from thecomparison of model predictions with experimental
results:
1) The experimental headloss is less than head-loss
predicted by "kinetic ejection."
2) Kinetic effects other than those considered here
i nhibit head-loss so that "static ejection" is usuall y an upper bound to head-loss.
3) The rate at which re-equilibrium is attained in theexperiments is rapid in comparison to events of
the reactor accident, but the rate is not always
well described by the model.

These results give some confidence that headl osses predicted by the model will be useful in assessing whether pressurizer level indications werei n error during the accident due to hydrogen effervescence.
b. Head Loss During the Accident
The possible head-loss, based on the coolant
system pressure, due to hydrogen effervescence isshown in Figures 7 and 8. The losses were computed assuming the water was saturated with hydrogen at about 2200 psi and an instantaneousdepressurization to the observed pressure at any
time occurred. The maximum predicted head-loss
based on "kinetic ejection" was 57 inches. It is apparent that head-loss due to hydrogen effusion is
too small to be responsible for the large levelchanges reported for the accident.

APP. FIGURE 1I-25. B&W Test #2-Proprietary Data Deleted (Figure 3)769

APP. FIGURE 11-26. B&W Test #5-Proprietary Data Deleted (Figure 4)

770

APP. FIGURE 11-27. B&W Test #3-Proprietary Data Deleted (Figure 5)771

APP. FIGURE 11-28. B&W Test #7-Proprietary Data Deleted (Figure 6)772

APP. FIGURE 11-29. Reactor Coolant System, TMI-2 (Water Head) (Figure 7)773

APP. FIGURE 11-30. Reactor Coolant System, TMI-2 (Percent of Water
Ejected) (Figure 8)

774

REFERENCES AND NOTES'D. M. Himmelblau, J. Phys. Chem 631803 (1959)
2lnternational Critical Tables Vol. 3, p. 256. Data attributed to:

Kobe and Markham, Chem. Revs. 28 521 (1941) citing
data attributed to:a. Markham and Kobe J. Am. Chem. Soc. 63 449(1941) solubility of Co in aqueous solutions of
sodium potassium chlgrides and nitrates up to 1
molar concentrationb. Van Slyke and Sendroy, J. Biol. Chem. 78 765,
801 (1928) solubility of H and Co2 in alkali
chlorides lactates and phosphates.
c. Steiner Ann. Physik 52 275 (1894) effect ofstrong electrolytes on hydrogen solubility inwater.
9
H. A. Pray and E. F. Stephan, Battelle Memorial Institute, Columbus Ohio BMI-840 June 10, 1953; BMI 870
Sept. 25,1953; BMI-897, Jan 18, 1954.
10
G. C. Rush, Proprietary Report Babcock & Wilcox
Co. (1977).
8

a. Winkler, Z. Physik Chem g 171 (1892)
b. Winkler, Ber. 24 8g (1891)
c. Winkler, Math. naturw. Ber. Ungarn g 195 (1892)

Perry's Chemical Engineer's Handbook 4th edition p.
14-5 data attributed to:
Cassuto, Physik Z. 5 233 (1904)
4
H. Pray and E. F. Stephan BMI-870 Sept. 24,1953
5
Wiebe and Gaddy J. Am. Chem. Soc. 55 947 (1933)
6
H. A. Pray, C. E. Schweickert and B. H. Minnich Ind.
Eng. Chem. 441146 (1952)
7
lpatieff and Teodorovish, J. Gen. Chem. (USSR) 4
395 (1934)
3

77 5

ORIGEN. Power distribution data (R-Z) was used
to distribute the gamma source spatially within
the core regions for the intact core. For disrupted configurations the source was redistributed
accordingly.
2. R-Z Gamma Transport calculations were performed with TWOTRAN II. This yielded thespace- and energy-dependent gamma flux for agiven configuration.
3. A space and energy dependent y-n neutron
source was calculated from the gamma flux andthe photoneutron response function for deuterium. The threshold energy for this reaction is 2.2
MeV.
4. The (y-n) neutron source was integrated overenergy and space to obtain a normalization factor. This factor is a function of the water density,
water level, and core configuration. This factor isrequired to correctly normalize the detector
response in the neutron transport problem.
5. An R-Z neutron transport problem with
TWOTRAN II was then performed. A normalization of 1.0 was used and results were correctedby the factor calculated in step 4. This calculation provides the detector response for a given
core configuration. In general, each change inreactor configuration required a repeat of steps 2
through 5. The ENDF/B cross section sets used
i n these calculations were not changed as thecore configuration changed.

2. EXCERPTS FROM TMI-2 SENSITIVITY
STUDY
PurposeThe purpose of this phase of the review group investigation was to examine the sensitivity of the
Source Range Monitor (SRM) to a range of possible
reactor configurations following the TMI-2 accident.
A detailed analysis of the SRM trace could then beundertaken utilizing these sensitivity results to provide additional input to the explanation of the sequence of events in TMI-2. A series of gamma andneutron transport calculations were performed forseveral possible reactor configurations. This reportbriefly summarizes these SRM sensitivity calculations. Configurations and parameters examined included the following: homogeneous voiding, core
uncovery, fuel relocation, the relative importance ofthe distributed source and core multiplied neutrons,
the hotoneutron effect of changing the boron content in the coolant water, and the effect of removing
control poison from the core.
Sequence of Calculations-(Fig. 1)
1. A gamma source from the fission product inventory was calculated at 2 hours after the accident.
A core-averaged inventory was obtained from

APP. FIGURE 11-31. Block Diagram of TMI-2 Radiation Transport Calculations
Sequence (Figure 1)
77 6

Calculational Model

25%, etc. refer to 0.75 p (normal), 0.5 p (normal),etc.

Overall dimensions of core, downcomer, vessel,and detector locations were based on data from the
TMI-II SAR. Enrichments for simplified two fuel zone
model were derived from a B&W memo from E.J.
Bateman to A.W. Snyder dated October 18,1979.
The
twodimensionaltransport
code,
TWOTRAN-II was used in R-Z geometry for all gamma and neutron transport problems.
Specialsoftware was developed to generate gamma andneutron sources in standard interface file format.
The initial K eff was set at 0.91 and the equivalentnatural boron content of the water was set at 1000
ppm. A distributed source of photoneutrons wasestablished as the only neutron source for most of
the calculations relevant to early accident times (<4 hrs) and a fixed startup source alone was assumed for a selected number of the remainingcases. The photoneutron source was due to gammas (E > 22 MeV) interacting with the deuterium inthe coolant. The spectrum and total intensity of the
gammas were derived from an ORIGEN calculation
for the TMI-II core at a time of 2 hours after thereactor trip. This reference gamma source wasused for the majority of the sensitivity studies. The
spatial distribution of the gamma source was varied
for the cases where fuel disruption and fission product releases were postulated but the spectrum andi ntegrated total gamma source were fixed. The total
photoneutron source (used in the neutron transport
problems) varies, however, due to changes in water
density, water level, etc., this change in neutron
source level is accounted for thru a normalization
factor which is calculated for each configuration.
Normal water density as referred to in this memo isassumed to be p = 0.72 g/cc. Void fractions ofGroup II-Coolant Level Change Series-(Fig. 2)[Including Soluble Boron and Control Position
Effects]

These calculations apply primarily to the transients in the SRM data beginning at about 1.8 hours.
After the pumps were turned off phase separation
occurred and coolant began to boil off. Pump 2B
was turned on briefly apparently injecting a slug of
coolant into the core/downcomer causing the sharp
dip at 2.85 hours. The process of uncovery thencontinued. During the SRM peak the reading was
greater than two orders of magnitude above thenormal shutdown trace (- 135-140) and about afactor of 115 higher than the reference SRM readingat 2 hours. (Note: The gamma source for the sensitivity study calculations was not adjusted for decay). The solid line is for the reference naturalboron concentration of 1000 ppm. The other lines
show the sensitivity to reduced poison in the coreregion alone. There is a large increase in the SRM
activity near the top of the active core. An increaseof 86 is observed by the time the water level is just
30 cm (1 ft) below the top of the core. A higher multiplication factor (k= 0.95) due to a reduced
boron content or poison rods melted during theperiod of uncovery could increase the readings to
170 or higher at that level. There is poor sensitivity
once the core is uncovered. It should be noted thatcore and downcomer water levels were lowered together in these calculations, essentially assuming azero void fraction in the core. A less severe initialslope to the curve is expected if a nonzero void
fraction in the core is calculated.

77 7

APP. FIGURE 11-32. Relative SRM Response as Function of H20 Level in Coreand Downcomer (Figure 2)77 8

3. INTEGRATED ANALYSIS OF SOURCERANGE MONITOR DATA FROM TMI-II

parameter which is not at its nominal value, as
shown in Eq. (1).
C(t) = N(t)F 1 (v,t)F 2 ( w,t)F 3 (b,t)F 4 (c,t)

Prepared for Sandia Laboratories
as part of Rogovin Study Review Group(1)

where,

C(t) is the expected count rate,
N(t) is the nominal or normal count rate,
F1 (v,t) is the factor associated with void fractionchanges,F2 ( w,t) is the factor associated with water levelchanges,F3(b,t) is the factor associated with boron concentration changes,
F4 (c,t) is the factor associated with changes in
the core conditions.

November 28,1979

E. A. Straker and W. K. Hagan
I ntroduction

There are numerous factors which affect thesource range monitor (SRM) count rate. These factors include water level in the core and downcomer,
void fraction in the core, bypass and downcomer,
boron concentration in the core and the physicalcondition of the core. The objective of this investigation was to determine the consistency between
the reactor conditions and the observed SRM countrate.
Because of the large range in possibilities forcore condition and coolant characteristics, aparametric systems analysis approach was taken.
Since the SRM count rate is determined by photoneutrons and source neutrons both of which are
multiplied by the fissile material in the core, theresponse must be calculated using a radiation transport code capable of performing both deep penetration shielding analysis and core multiplication. If
transport results are obtained for a large number ofconditions, and the results utilized in a systemmodel in conjunction with postulated reactor conditions to calculate an expected SRM count rate. The
postulated reactor conditions may be determined byother analyses or by engineering judgment.
To implement the approach a computer code
was developed at Science Applications, Inc. (SAI), toquantitatively predict the count rate at the source
range monitor as a function of several reactor
parameters. This effort has been made with theflexibility that such a tool could also be used "in reverse," i.e., knowledge of the SRM count rate would
then allow the calculation of some reactor parameters for the time period of interest.

These multiplicative factors include the effect on the
count rate of deviation from their nominal value andcould be considered correction factors for nonnormal conditions. The code can handle any
number of parameters; the four used here arerepresentative and were used in the TMI analysis.
Thus, to predict the SRM response for an abnormal
trip, information on the count rate for a normal trip isrequired. By using normal trip results the timedependent behavior of the photoneutron source isproperly treated for a non-distorted core.
The approach utilized was "one-dimensional" inthe sense that all of the reactor parameters affectthe count rate independently, e.g., the effect ofvarying the boron concentration is taken to be independent of the water level. This simplification
was required for this study since there was not yet
enough data to quantify the interdependencies.
However, once the information is available it can beeasily incorporated into this model. For example,
the void fraction and the water level effects may be
i nterdependent and Eq. (1) would be modified to takethe form of Eq. (2).
C(t) = N(t)G1 (v,w,t)F3 (b,t)F 4 (T,t) (2)where

Also, the interdependence between water level inthe downcomer and the core water level and void
fraction could be treated as dependent effects.
For this project the independence of variables
was determined by the transport data base generated at Sandia. If additional transport results wereavailable then other approaches could be utilized.
For example, work funded by EPRI is oriented toward including all possible core condition dependencies in the transport calculation and thus the in-Analysis Procedure

The approach used in the SRM code is to basethe expected count rate at the SRM on the countrate which would be expected if all reactor parameters (e.g., water level, void fraction, etc.) were attheir nominal values. This nominal count rate is thenmultiplied by correction factors for each reactor
77 9

TABLE 3. Correction factor
for void fraction

tegration over time dependent variables is considered in the transport results. Results are alsopresented for comparison in this paper for some
EPRI transport results.

Void Fraction (%)
0
10
20
30
40
50
60

Data Base

The data base information was obtained from
Sandia Laboratory calculations and documented by
Paul Picard in a handout of 20 November 1979. The
data base was supplemented by alternative dataobtained from Technology for Energy Corporation(TEC). The data utilized in our analysis are given in
Tables 1 through 5. Linear interpolation was utilized.

5
10
12
14
16
18
20
22
24
26
28
30
32
34
36
40
60
80
1 00
1 20
1 40
1 80
240
360
480

Boron Concentration (ppm)
500
1 000
2000

I ntensity

1.0(+5)1.0(+4)3.5 (+3)
1.8(+3)
1.2 (+3)
9.5 (+2)
8.5 (+2)
7.7 (+2)
7.2 (+2)
6.9(+2)
6.5(+2)6.2 (+2)
6.0(+2)5.8 (+2)
5.6 (+2)
5.2 (+2)
4.1 (+2)
3.3(+2)2.7 (+2)
2.3 (+2)
1.9 (+2)
1.5 (+2)
1.25 (+2)
1.0(+2)
8.7(+1)

16
13
12
11
10
7
5
4

Percent Core Displaced
0
5
10
15
20

1.5
1.0
0.5

Factor
1.0
2.4
3.7
4.2
4.6

The two sets of data in Table 2 on water levelshould not be directly compared since the TEC data
i ncludes a hydrostatically balanced core and downcomer and thus the water level in the downcomer
results in a higher water level in the core. Also, theTEC data were modified for levels near the top of
the core after discussions with Jim Robinson of
TEC. The core exit void fraction varies up to 40% in
the TEC transport calculation.

Factor(Sandia)

Factor( TEC)

220.0

93.0
95.0

1.0
1.3
8.0
85.0
120.0
1 90.0

FactorTABLE 5. Correction factor forcore condition

Analyses of TMI-11

TABLE 2. Correction factor for waterl evelWater Level(feet above
bottom of core)

1.0
2.0
3.5
6.0
10.0
15.0
25.0

TABLE 4. Correction factor for boron
concentration

TABLE 1. Normal reactor
trip data
Time (min)Factor

The analysis is separated into two parts. The
first analysis was based on the trial and error
choice of water level and void fraction versus time inorder to obtain a reasonably good agreement withthe observed count rate. Figure 1 shows the plotsof the data base. Figure 2 shows the comparison
between the observed (dashed curve) and calculated SRM count rate using the Sandia data base. The
time dependent boron concentration, core condition,water level and void fraction are given in Fig. 3.
As noted previously the data derived from the
Sandia calculations is valid for the water level being

1.0
1.1
1.6
3.5
10.0

78 0

the same in the downcomer and the core. Analysis
was also performed using the TEC data base andFigs. 4 and 5 show the results. Due to the maxi mum variation in the TEC data being only a factor of
95, it was not possible to obtain the full variation
between a normal trip and TMI-II data without adding a factor for void fractions. This void fraction
could account for the difference in behavior in thecore and bypass region. There is no sound basis
for the void fraction and therefore it might indicate
the range of uncertainty that might be associatedwith the data.
A comparison of the water levels derived fromthe two data bases is given in Fig. 6. Note that the
TEC data base would indicate that about 5 feet
more of the core would be uncovered since for low
water heights the core water level is approximately
the same as the downcomer water level in the TEC
transport calculations. It is important to realize thel ack of uniqueness of conclusions to be drawn fromthe analysis. Besides an uncertainty in the normal
trip data and the observed TMI-ll data, there are uncertainties
associatedwiththetransport
modeling-especially the relationship between void
fraction and water level. Assumptions on thecharacteristics of the water in the bypass region
could affect the transport results by about a factorof 2.
Early analysis of fuel assembly and exit coretemperature have been used by others to estimate
the amount of core uncovery. The core water levelversus time has been postulated as that given in
Table 6 by different investigators (assuming linear
i nterpolation between data points). Using these
postulated water levels and the TEC data, a comparison of the resulting SRM count rate and the ob-

TABLE 6. Core water levelversus time
Time (min)
100
1 05
120
1 30
1 40
1 60
170
176
1 80
1 90
200
205
210
215
270
280

Water Level (ft)Case 1Case 2
16.0
12.0
5.5
5.5
9.0
7.5
7.5

9.5
1 2.0
16.0

16.0
12.0
7.5

5.0
6.0
6.0

9.0
9.0
12.0
16.0

served count rate is given in Figs. 7 and 8. The
parameter changes which yield the count rates in
Figs. 7 and 8 are given in Fig. 9. Note that timedependent water levels were input and it was assumed that core water level was the same as downcomer water level when the data base is utilized.
Although this is not correct, there is not enough other data available to do otherwise.
The integration of postulated core conditions andtransport results indicate that a number of different
core conditions could lead to the observed SRM
count rates. The differences in the data bases leadto significantly different water levels. As transport
data changes, other analyses can be performed
easily using the approach discussed in this paper.

78 1

A99 FIGURE D-33 Plots of Input Data Base (Figure 1)

78 2

APP. FIGURE 11-34. SRM Reading Versus Time Using the Sandia Data Base (Figure 2)

78 3

APP. FIGURE 11-35. Postulated Core Conditions for Calculating SRM Count
Rate Shown in App. Figure 11-34 (Sandia Data Base) (Figure 3)784

APP. FIGURE 11-36. SRM Reading Versus Time Using the TEC Data Base (Figure 4)785

APP. FIGURE 11-37. Postulated Core Conditions for Calculating SRM Count
Rate Given in App. Figure 11-36 (TEC Data Base) (Figure 5)786

APP. FIGURE 11-38. Comparison of Parameter Inputs for SRM Count Rates
Shown in App. Figures 11-34 and 11-36 (Figure 6)

78 7

APP. FIGURE 11-39.
SRM Reading Versus Time forCase 1 Water Level Data *( Figure 7)*

Dashed curve is TMI-2 observed data.

APP. FIGURE 11-40.
SRM Reading Versus Time forCase 2 Water Level Data *(Figure 8)*Dashed curve is TMI-2 observed data.
788

APP. FIGURE 11-41. Input Conditions for Calculations Shown in App. Figures
11-37 and 11-38 (Figure 9)78 9

38-minute period, the collapsed equivalent void-freeli quid level in the core was 60 inches, leaving 7 feet(less liquid level swell due to steam due to steam
bubble entrainment) uncovered. During this period,
the major clad, fuel, and in-core structural damageand ex-core structural damage (if any) occurred.
I n a subsequent, approximately 26-minute period,
08:20 a.m. (260 minutes after turbine trip) until
08:46 a.m. (286 minutes after turbine trip), the coreappears from computations to have been uncovered
to a collapsed equivalent void-free liquid level of 110
i nches. Approximately the top three (3) feet (lessli quid level swell due to steam bubble entrainment)of the fuel appears to have been uncovered. During
this 26-minute period, little, if any, additional significant damage was sustained by the clad fuel andstructure. However, uncertainties in the coolant
makeup/letdown quantities make this estimate ofliquid level uncertain.
I n a third period, approximately 02:00 p.m. until
05:30 p.m., it appears from computations that theupper levels of the core might have again been uncovered, but the estimates are uncertain.
Even though additional uncovery of the core
might have occurred during the periods, 08:00 a.m.
until 09:30 a.m. and 2:00 p.m. until 5:30 p.m., theextent of the uncovery was not likely to have been
sufficient to cause significant additional clad, fuel,and structural damage. However, these additional
periods during which damaged fuel could have been
above the coolant mixture level could account forthe continued existence of superheated steam at
the tops of the outlet (hot) legs of both Loops A & B,
for the period, approximately from 06:00 a.m. until
7:30 p.m.
During the 38-minute period of maximum core
uncovery, within the total period of 64 minutes ofsome core uncovery (05:52 a.m. until 06:56 a.m.),
substantial core heatup and clad/fuel/in-core structural damage occurred. Within the maximum units
of uncertainty of core heatup estimates (top coretemperatures to 3600°F), it is possible that ex-core
thermal/structural damage could have occurred tothe upper grid assembly and control rod guidetubes, to the top portion of the core basket, to thecore support assembly (core barrel) and to theguide lugs, due to loading by the axial thermal expansion of the core support assembly. Constraints
by the two diametrically opposite outlet nozzles on
the radial thermal expansion of the core support assembly at elevated temperature might have produced a permanent elliptical set to the core support
assembly and opened a gap at the vessel/support
assembly mating surfaces of the outlet nozzles.
Upon core reload, such a gap, if it were caused,
would permit coolant to bypass the core.

4. ALTERNATE INTERPRETATION OF
THE ACCIDENT SEQUENCE
Sandia Laboratories
A special study group at the Sandia Laboratories,
Albuquerque, New Mexico, was asked by the NRC
TMI Special Inquiry Group (through the Office of Nuclear Regulatory Research) to conduct a very shortterm (2 months) examination of the data available on
the first 16 hours of the TMI-2 accident on March
28, 1979, to determine, in consultation with the Task
Group 2 of the NRC/SIG, if any additional interpretations or aspects of the accident scenario could be
developed logically beyond those developed by
Task Group 2 and by the MARCH code analysis bei ng conducted at Battelle Columbus Laboratories(BCL). The intent of the request was to try to insurethat a minimum of "surprises" would be encounteredwhen the TMI-2 core is examined at some time in
the future.
Lacking the time to conduct an intensive investigation independently, the study group was briefed
on the interpretations developed at that time, thetypes and range of "hard" data available in the wayof reactimeter data, plant computer and alarm
printer, strip and multipoint recorder charts, etc.,
and furnished with copies for their own examination
and analysis.
A summary of their interpretations of the accident
sequence is given below, with the addition of a setof figures presenting various system summaries ascalculated by M. I. Baskes, Sandia, Livermore, using
a new code called "TMI". This interpretation also
requires that all of the water removed from the
BWST pass through the reactor primary system or
be used for repressurization of the system.
Summary of TMI-2 Accident Scenario

Upon stopping both Loop A coolant pumps at
05:41:03±3 a.m. (about 101 minutes after turbinetrip), the coolant level above the core subsequently
collapsed to a mixture level no less than about 50
i nches above the top of the fuel. The Source Range
Monitor data suggest that the steam voids, entrained in the liquid by the prior operation of thepumps, separated from the liquid in the downcomer
during a period of several minutes. At approximatel y 05:52 a.m. (112±4 minutes after turbine trip), thecore was uncovered for the first time and remained
partially uncovered until approximately 06:56 a.m.
(176±2 minutes after turbine trip). Reactor coolant
pump RCP-2B was restarted at 06:54 a.m. In the
64-minute interval, 05:52 a.m. until 06:56 a.m.,maximum uncovery occurred for 38 minutes of thei nterval (06:10 a.m. until 06:48 a.m.). During this79 0Using a highly modified version of the computercode, BOIL, calculations indicate that the earliest
clad rupture (about 1500°F) occurred approximately
17 minutes (about 06:09 a.m.) after core uncovery.
Reactor building radiation monitors, indicating probably gross fuel damage, went off-scale "high" at
06:15 a.m. At 06:18 a.m. the PORV block valve( RC-V2) was closed for the first time. Strip chart
recordings of the Self-Powered Neutron Detectors( SPND) subjected to high temperature environmentsi ndicated outputs at 06:15 a.m. At 06:48 a.m. (as indicated by the updated Alarm Printer) SPNDs at levels 3 (52 inches above the core bottom) thru 7 (nearthe top of the core) indicated temperatures deduced
to be greater than approximately 1700°F. Likewise,
at some indeterminate time prior to 06:48 a.m. (asi ndicated by the Alarm Printer), a large fraction of
the core thermocouples had experienced temperatures in excess of 700°F.
At
about
1750°F,an
I nconel(gridspacers)/zirconium (clad) eutectic forms and consequently some liquefaction and weakening of the grid
spaces in the area of contact would be expected.
At increased temperatures, ca 1800°F, the reactionof the steam with the zirconium occurred on theclad exterior surfaces of the control rod guide tubes
and the instrument tubes. The estimated quantities
of hydrogen produced, ranging from 4-4.5 x 10 5grams, imply oxidation of 45-50% of the available
core zirconium. If, however, temperatures of theupper grid reached about 2500°F, some fraction of
the hydrogen could have been produced by thesteam/iron (stainless steel) reaction. The implied
oxidation of 45-50% of the available core zirconium
i s consistent with an estimated 40-50% of coredamage derived from measurements of cesium concentrations in the reactor coolant.
The estimated depth (7 ft.) and duration (38 to 64
minutes) of the initial core uncovery was sufficent to
expect, within the limits of computational error,
upper core temperatures in the range of 3200 to
3600°F. At, or below, these temperatures, Zr(0) +UO2 and Zr(O) + ZrO 2 melts occur. At temperatures ca 2600°F, the steam/zirconium reaction
power exceeds the decay heat power, thus accelerating the core heatup. As melts form, slumping
along the fuel pin surface will occur with resolidification occurring above, the coolant mixture level. Dueto the fuel pins occupying approximately half (45%)
of the core cross sectional area, the resolidified
melts could produce a tight crustal zone of fuel pin
stub and interstitial eutectics.
At 07:44:00 a.m., approximately 48 minutes after
reflood at 06:56 a.m., an anomalous event occurred
within the reactor core. The event appears to haveoccurred spontaneously since no external changes

were made to the primary system. Key responses
observed were rises in both cold leg temperatures,
system pressure rise, SPND responses at levels 1
and 2, and core thermocouple responses. Since
prior to this event the coolant liquid level was well
above the top of the core, a plausible explanation of
the event is localized dryout beneath the impermeable crustal zone conjectured to have occurred duri ng the prior core uncovery. Such a condition would
allow superheating of the dry region. Accompanyi ng pressure and/or temperature increases could
have caused a breach in the crustal zone followed
by a rapid reflood of the previously dried out zone
and by a sudden generation of steam. If temperatures in the dried out zone beneath the crustal layer
reached ca 2600°F in the presence of zirconium, thepower generated by the steam/zirconium reaction
could have enhanced the effect of low crustal zone
and debris permeability and additional hydrogen
could have been generated. One descriptive prognosis of the condition of the TMI-2 core is thus:• oxidation of up to 50% of the zirconium; lesser

quantities of oxidized zirconium would be consistent with the hydrogen mass estimates, if temperatures at the upper grid were sufficient tocause the steam/iron reaction. At such temperatures, ca 2500°F, structural failure and slumpingof the stainless steel onto the top of the fueldebris would have occurred.
• the top of the core is extensively disarrayed,consisting of predominantly whole and fractured
fuel pellets and stainless steel debris predominantly from the fuel element, end pieces and theupper grid. Beneath the zone of predominantly
fuel pellets and fractured pellet debris there
would be a crustal zone of eutectic mixtures ofzirconium, oxygen and uranium, breached by theevent which occurred at 07:44:00 a.m.
• less probable, but possible, extreme temperatures induced structural deformations of the corebasket, the core support assembly, and the guidelugs.
Summary
The major features of this Alternate Interpretation
are:(a)all of the water removed from the BWST passed
through the reactor primary system or was used
for its repressurization,(b)the top of the core was first uncovered at about
108 minutes, recovered at 174 minutes (2 hr 54min), uncovered again beteen about 250 and 290
minutes (4 hr 10 min to 4 hr 50 min) and again,

79 1

174 minutes (2 hr 54 min), but additional damage
occurred in the time period around 3 hr 44
minutes, when an impermeable crustal zone
formed by melting in the debris bed, sealing off
the core and allowing the development of a"dryout" zone below the debris bed. It was ultimately breached by increasing pressure or temperature. The total core damage was estimatedto be about 50% of the Zircaloy converted to oxi de.
(f) the picture of the core damage is a disarrayed
top consisting mostly of whole and fractured fuelpellets covered with stainless steel debris fromthe upper end fittings and upper grid structure, al ower zone of fuel pellets and fractured cladding,and Zircaloy oxide, containing within it a crustal
zone of eutectic mixtures of zirconium, oxygen
and UO2, and a still lower zone of oxidized andembrittled Zircaloy clad fuel rod stubs,(g) structural deformations may have been induced
i n the core basket, the core support assembly,
and the guide lugs.

between about 740 and 775 minutes (12 hr 20
min to 12 hr 55 min),(c) the water level in the core dropped to about 5
feet from the bottom in the first period of uncovering between 108 and 174 minutes (1 hr 48 min
and 2 hr 54 min), to about 9 feet from the bottom
at about 260 minutes (4 hr 20 min), and to about
10 feet from the bottom at about 750 minutes (12hr 30 min),(d) approximately 990 pounds of hydrogen weregenerated (495 lb-mole), about 1/2 of this was
released to the containment between 225 and315 minutes (3 hr 45 min and 5 hr 15 min), about
1/5 was released to the containment between
470 and 550 minutes (7 hr 50 min to 9 hr 10min), about 1/7 between about 590 and 600
minutes (9 hr 50 min to 10 hr), and about 1/6
remained in the primary system when the PORV
block valve was closed at about 800 minutes (13hr 24 min),(e) the major damage to the core occurred by theti me the reactor coolant pump was turned on at

79 2

APP. FIGURE II-42. Hydrogen Inventory (Figure 1)
Hydrogen was generated over a short period of time (^150-175 minutes). The model had
been "tuned" so that 4.5x105 g of hydrogen was produced. When the PORV was opened
at -220 minutes, hydrogen was rapidly vented from the reactor to containment. From
-220 to ^'300 minutes the hydrogen venting continued from both A and B steam
generators and hot legs. On opening of the PORV at ^-450 minutes (systemdepressurization), the venting continued and resulted in a hydrogen deflagration in
4
containment at ^600 minutes. About 6x10 g of hydrogen remained in the system after
900 minutes.

79 3

APP. FIGURE II-43. Hydrogen Pressure in Reactor Void Space (Figure 2)

From the onset of hydrogen generation (^'150 minutes) to ^ •240 minutes, a substantial
amount of the reactor void space was filled with hydrogen gas. Hydrogen was vented
rapidly through the open PORV at -200 minutes and again at -240 minutes. At ^ •3 15
minutes when the PORV was closed and the system repressurized, hydrogen again
occupied a substantial amount of the reactor void space. During the depressurization
starting at -450 minutes, hydrogen was again vented rapidly through the open PORV.
After the repressurization at ^'800 minutes, hydrogen again occupied a substantial
amount of the reactor void space.

794

APP. FIGURE 11-44. Hydrogen Pressure in B Steam Generator and Hot Leg (Figure 3)
From the onset of hydrogen generation (-150 minutes) through -900 minutes, hydrogen
occupied a substantial amount of the void space in the B steam generator and hot leg.

79 5

APP. FIGURE 11-45. Hydrogen Pressure in A Steam Generator and Hot Leg (Figure 4)
From the onset of hydrogen generation (^-150 minutes) through -600 minutes, hydrogen
occupied a substantial amount of the void space in the A steam generator and hot leg.
From -600 to ^-800 minutes, hydrogen partial pressure in the A steam generator and hot
leg was small.

79 6

APP. FIGURE 11-46. Water Inventory in System (Figure 5)
The water inventory in the system was calculated assuming net makeup/letdown fromBWST levels and flow through the PORV and vent valve. A saturated vapor model, asaturated liquid model, or a subcooled liquid model, depending on the recordedpressurizer level, temperature, and pressure was used. The system volume was large
0enough to contain this amount of water in addition to the calculated hydrogen (at 700 K),
except during the short period from 350 to 500 minutes. This excess water could have anumber of explanations, for example, a net gain in the makeup tank, a lower averagehydrogen temperature, a smaller amount of hydrogen generated, or a larger amount ofhydrogen released to containment.

79 7

APP. FIGURE II-47. Water Flow Rates Used To Construct Water Inventory (App. Figure11-46) (Figure 6 )"IN" represents the net makeup/letdown flow from the BWST, and "OUT" represents
flow out the pressurizer PORV and vent valve.

798

APP. FIGURE 11-48. Water Height in Reactor (Figure 7)
The water level in the reactor fell rapidly at ^'100 minutes when the steam generator A
RCP was turned off and the voids collapsed. Boiloff then reduced the level to ^-150 cm
above the bottom of the core. The top of the core was uncovered at ^'108 minutes. The
starting of the steam generator B RCP and the subsequent HPI recovered the core rapidly.
A slight uncovery occurred at ^'250 minutes; however the makeup/letdown details could
easily have resulted in the core not being uncovered. The reactor was filled at -350
minutes and remained filled until -475 minutes when the system was depressurized. The
level slowly rose until ^750 minutes when the core was again uncovered. As shown
above, makeup/letdown details could easily have resulted in the core not being
uncovered. The level rose rapidly as the system was repressurized at ^-800 minutes.

799

APP. FIGURE 11-49. Water Height in Hot Leg (Figure 8)
The hot legs filled with water above nozzle elevation prevented the flow of hydrogen gas
for most of the accident. However, from ^-200 to ^'300 minutes the water level in the hotlegs allowed gas flow. In addition, the depressurization at -500 to ^'800 minutes emptied
the hot legs and allowed hydrogen redistribution and flow to containment.

800

APP. FIGURE 11-50. Water Height in Steam Generator (Figure 9)
Steam generator water levels generally fluctuated about the pump elevation. An
exception occurred at -175 to -200 minutes when the steam generator B RCP emptied
the B steam generator. It appears that a calculational error emptied the B steam generator
rather than the A steam generator during the depressurization at ^'500 minutes. When thewater level in the reactor was below pump elevation, the A steam generator emptied due
to letdown (^-600 to -800 minutes).

80 1

APP. FIGURE 11-51. Temperature Levels in Reactor (Figure 10)
Until -200 minutes, cold water flow into the reactor was insufficient to remove decay
heat; thus the reactor remained at saturation temperatures with the excess heat being
used to vaporize water. From -200 to -600 minutes, the cold water flow was sufficient
to remove decay heat. This removal resulted in subcooling of the reactor. The subcooled
reactor water flow through the open PORV during this period resulted in the subcoolingof the pressurizer. From -600 to -800 minutes the decay heat again became greater thanthe cooling, and vaporization resumed. The saturated vapor flowed through the hot legs
to condense in the steam generators; thus the hot leg temperature was lowered. Because
flow to the B steam generator was much less than that to the A steam generator due tohydrogen blockage. A significantly larger hot leg temperature drop occurred in the A hot
leg. After ^-800 minutes the reactor again became subcooled.

80 2

The Pu and U gradients in the sump water are
consistent with solids dissolving in the water rather
than solids precipitating from the water. This indicates the Pu and U in the sump came either fromsolids ejected from the reactor coolant system or
dissolved species that initially precipitated in thesump and subsequently began to redissolve.
The consistency of U236
the uranium isotopic ratios,with the exception ofwhich may be in error,
with those expected of the fuel provides no evidence for the intrusion of river water into the reactor sump.
134
136
137
131
The concentration of
1,
Cs,
Cs, andCs
i n the reactor coolant system decrease with timeeven when corrected for radioactive decay. Thissuggests that little leaching of these materials is occurring. Since they are among the most leachable
species in the fuel, it appears that these species
were volatilized nearly to completion from the damaged fuel during the accident.
The decreasing concentrations of these species
i n the reactor coolant system is consistent withleakage of coolant. Constant leak rates estimatedfrom the concentrations of the species are:

5. STATUS OF THE REACTOR CORE BASEDON FISSION PRODUCT ANALYSIS
D. A. Powers

Coolant water in the reactor coolant system andthe reactor sump at TMI-2 contains large quantities
of non-volatile and sparingly volatile fission products
and fuel materials. This effluent from the reactor
fuel can give some insights into the nature and theextent of damage sustained by the reactor core.
The mere presence of the fission products in the
coolant water is evidence of fuel cladding failure.
However, it is desirable to obtain indications of what
regions of the reactor core sustained damage, howextensive was that damage, and what is the state of
the reactor fuel following the accident.
The following analyses were attempted to answer
these questions:
(a)

(b)
(c)

(d)

Isotopic ratios of plutonium and uranium in thesump were compared to the ratios expected
for the TMI-2 fuel to determine the regions of
the core that were damaged.
137
The time variations of 1 I, 134Cs,
Cs concentrations in the reactor coolant system wereused to determine the rate of coolant leakage.
The inventories of fission products in thesump and the coolant system were used todetermine the "prompt" losses of these
species and thereby the extent of fuel damage.
89
90
The rates of leaching of
Sr andSr wereused to derive the effective particle size of thedamaged fuel in the core and to establish abound on the fine particulate material in thecore.

Species

Leak Rate (gal/min)

1.02
1.34
1.28
1.42
mean =1.26
std. dev. =0.13

1311
134

Cs
136
137Cs
Cs
std. dev.

These leak rates apply to the first 43 days after
the accident. Concentration data taken from laterti mes suggest that leakage may have slowed considerably.
The inventory of the Cs and I in the sump andcoolant system may be used to determine theextent of damage to the reactor core. Results ofsuch calculations are shown below:

235U

The fuel in the TMI-2 core is enriched intothree different levels: t 2.96, 2.64, and 1.98% 2351.1.
The enrichments are located in the core as shownin Figure 1. The isotopic ratios of Pu and U calculated for fuel assemblies of various enrichments arecompared with the ratios found for Pu and U in thesump of the reactor. The observed ratios compare
favorably with an average of the expected ratios
for235
fuel initially enriched with 2.64 and 1.98%
U. If
more error is tolerated between observed and calculated ratios, the observed ratios also compare
well with expected ratios for a uniformly damaged
core.
This comparison of observed and calculated isotopic ratios suggests that the central region of thereactor core was certainly damaged. With less certainty the comparison is consistent with a coredamaged across its entire cross-section.

Species
1311

137

Cs
134
Cs

% of Core

Expectedin WaterFraction

Inventory

58
43
36

Release1.00-0.95
0.89-0.96
0.89-0.96% of Core
Damaged

61-58
48-45
40-38

The expected release fractions listed in the table
above were taken from experimental data for melt80 3

i ng fuel (G. W. Parker et al. ORNL-3981, July 1967).
The computation of "% of core damage" was madeunder the presumption that the release of thespecies occurred only from the damaged fuel. Consequently, the result for 13 1 is an upperbound sincei odine would be released from the fuel-clad gap
even from relatively intact fuel. The results for cesium are lower bounds since only the sump andcoolant system inventories of cesium were considered. The computed extent of core damage
based on these fission products are in remarkably
good agreement with similar calculations based on
the extent of hydrogen formation.
Attempts to calculate the extent of core damage
using other isotopes were not fruitful. The range of
uncertainty for the "Expected Release Fraction" wastoo great for other species to provide useful estimates of the percentage of core damage.
The concentrations of 89Sr, 9OSr, and 14013a in thereactor coolant system increase with time. These
species are leaching from the damaged fuel exposed to the coolant water. Leaching data are
available for strontium which allow the time dependencies of 89 Sr and 90Sr to be used to compute thesurface area of the fuel exposed to the water. The
surface area to weight ratio so found can be used

to derive an equivalent spherical particle radius forthe damaged fuel. Results are shown below:
Surface Area

Equivalent

to Weight Ratio t

Spherical Particle

2(cm /g)Species

89

Sr
OSr

Size * (cm)

3.0
2.0

9

0.1
0.15

t assumes that 40% of the core is exposed tocoolant.
• spherical particle.

If it is assumed that the core debris is made up ofi ntact pellets and fuel fragments of a particular size,
an estimate of the volumetric fraction of fine fragments in the core may be made. The volume fraction of the core that could have a size r is plottedversus r in Figure 2. Very fine fragments are notli kely to have developed. Fine materials would be
levitated by the coolant flow and would have escaped the reactor coolant system to a much greater
extent than observed. Consequently, a cut-off in
the possible size of the fines of about 0.03 cm isshown in Figure 2.

% of Isotope restive to total elemental abunrana in:
1 A0%
E.iabod Fed

2.04%
EuricM4 Fed

290%
Enriched Fool

Observed
in Steep

Average of
1.01 ad 2.14%
E.idhd Fool

Core Average

235 U

1.105

2254

2.572

2.207

1.943

2.166

236 U

1.174

1.111

SAM

OA71

SAO

Species

0913

238 U

1132

17AS

97.346

97.71

9791

97.713239 pr

67A16

11274

91 M0

90A

87.145

M107

9.644

797

7.341

714

1.710

1264

2292

1187

I A7

240 h
241

pu

1 A0

1.102

APP. FIGURE 11-52. Comparison of Calculated and Observed Isotopic Ratios (Figure 1)

804

1111

APP. FIGURE 11-53. Percent of Total Core as Fines of Radius (Figure 2)

80 5