Masayuki Nakao (Institute of Engineering Innovation, School of Engineering, The University of Tokyo) An acc ident oc curred a t T hree M ile I sland  site, Unit 2 nucl ear power plant 1 0 mil es ( 16 km)  southe ast of Harrisburg, Pennsylvania (See Figure 1). Failure of the coo ling sy stem of the Unit 2  nuclear reactor led to overheating and partial melting of the pressurized-water reactor's uranium core and release of radioactive gas and contaminated water. The accident had a number of primary causes, related both to technical malfunction in the c ondensation sy stem  and huma n  error. Thr ee day s af ter th e a ccident, the  official iss ued a n advis ory to evacuate pregnant women and preschool children living within a 5- mile radius of  Three Mile Island, raisi ng fears an explosion and dispersal of radioactivity among residences. The accident increased public concern over 1
Figure 1. Location of Three Mile Island Generating Station [4]
1. Event
An accident occurred at Thr ee Mile Island site  of a nuclear power plant 10 miles (16 k m) southeast of Harrisburg, Pennsylvania. Failure of the cooling system of the Unit 2 nuclear reactor led to overheating and partial  melting of   the pr essurized-water r eactor's ur anium  core a nd r elease of  r adioactive  gas  and contaminated wa ter. Thr ee  days aft er the  ac cident, t he of ficial issu ed an a  dvisory to e  vacuate  pregnant women and preschool children in a 5-mile radius of Three Mile Island, raising fears of a n explosion and dispersal of radioactivity among residences.
2.   Course (Figure 2, 3 and 4)
(1) The Three Mile Island Generating Station had two pressurized water reactors. Unit 2 was rated at 959 MWe. The accident in the Unit 2 reactor began when the plant's main feedwater pumps in the secondary non-nuclear cooling system failed (4 in Figure 2). In response to the failure, the auxiliary feedwater pumps kicked in, however, the water did not reach the steam generator because the outlet valves were closed (5 in Figure 2). The valve was discovered closed about eight minutes into the accident. Responding to the increase in temperature and pressure in the primary system, the pressurizer relief valve automatically opened in the line between the pressurizer and the quench tank (7 in Figure 2). After the nuclear reactor automatically shut down (8 in Figure 2), pressure in the reactor dropped. The valve, which was supposed to close after the pressure dropped below the set-point for closure, failed to re-close (11 in Figure 2). The valve was left open for 2 hours and 20 minutes, leaking 80 ton of primary coolant water from the quench tank. At this point, over 100 warnings tripped in the control room causing a big panic. (2) Pressure drop in the reactor caused the Emergency Core Cooling System (ECCS) to pour water into the reactor system at 4ton/min (13 in Figure 3). As water and steam escaped through the relief valves, coolant water surged into the pressurizer, raising the water level in it. Unaware of the stuck valve and the false indicator readings, operators manually turned off the ECCS (15 in Figure 3). Temperature rose, steam then formed in the reactor primary cooling system (22 in Figure 3). The pumping of the mixture of steam and water caused the reactor cooling pumps to vibrate, and the operators shut down the pumps to stop severe vibrations (24 in Figure 3). As the reactor cooling water boiled away, the top of the reactor core was exposed (26 in Figure 3). (3) Coolant water stopped flowing into the pressurizer, the temperature in the primary system reached 2,000 degrees Celsius, and approximately 45% of the reactor core melted down (32 in Figure 4). The coated tubing and water reacted to generate hydrogen gas, and ten hours later, a hydrogen explosion occurred. Water from the pressure relief valves overfilled the quench tank (18 in Figure 4) and flooded the containment vessel floor. The floor pump sent the radioactive coolant to the auxiliary building ventilation system (20 in Figure 4) where the radioactivity escaped to the outside. Eventually, cooling water was added and the reactor (33 in Figure 4) which then started to cool with natural circulation, however, hydrogen gas and radioactive gas kept generating and approximately 10 million curies ofしFigure 2. Three Mile Island Nuclear Accident: Sequence of Events 1 [1] Figure 3. Three Mile Island Nuclear Accident: Sequence of Events 2 [1]
3. Cause
(1) Inadequate failure information system Problems  with the fa  ilure info rmation  system  in  the  control r oom  caused ina dequate  emergency response by the op erators. A warning si gn bl ocked the  view of a  LED indicating that the auxiliary feedwater v alve  was  closed, an d  moreover, a gr een  LED was   lit  when  the v alve was   closed.  The instruments in the control room did not have consistent LED color – some LEDs were green and some were red under abnormal conditions. The instruments only showed th at a CLOSE signal was sent to the relief valve without indicating the valve's actu al posi tion. The LED i   nstruments wer e not   designed t o  warn m alfunctions,  and the operators did not know that the relief valve was stuck open. Operators generally try to prevent filling up the pressurizer because them they will then not be able to control pressure i n the pres surizer filled with water. Not e that the pr essurizer water level r ises with high-pressure in jection pumps pushing replacement water into the reactor system and cooling water surging into the pr essurizer while water and ste am escape thr ough th e open relief val ves. Gas generation fr om  the hea ted r eactor cor e a lso l ifts the p ressurizer water  lev el  as wel l. The op erators mistakenly judged that the pressurizer water level was rising under these situations. The water level indicator did not show the actual amount of water in the pressurizer. The control panel had more than 1,200 LEDs and over 100 alarms went off during the emergency. (2) Lack of reliability assurance The malfunctioned pressurizer relief valve had repeated troubles earlier and was unreliable. Despite of the obvious issue, the plant instructed the operators t o "fool" the system without replacing the valves with reliable ones. (3) Inadequate training of operators The operators of the Three Mile Island Nuclear Power Plant were not employees of the utilities firm. The utilities firm had contracted out the plant operations, however, the contract operators lacked proper knowledge about nuclear reactors and thermal phenomena. They had har dly been tr ained for accident situation. (4) Unexpected event not in the safety design standards Safety devices of nuclear plants are designed to handle certain nuclear accidents. The chain of events in the Three Mile Island Nuclear accident was far out of the ran ge of assumed failures and no one had thought about how to handle such cases.
4.
Immediate Action
The above sections describe actions taken by the  operators. Because of confused communication among people uninformed about the plant's status, officials concluded that the accident released hazardous amount of radiation and issued an advis ory to evacuate pregnant w omen and preschool children w ithin a 5-mile radius of Three Mile Island. Approximately 140,000 people evacuated the area in panic.
5. Countermeasure
Many agen cies a nd  officials i nvestigated  the Thr ee  Mile  Island Nucl ear ac cident.  The  U.S. Pr esident ordered  a full in  vestigation of th  e in cident, and th  e Ac cident I nvestigation Boar d r eported inad equate training of operators. Nuclear Safety Commission of Japan submitted the first, the second and the third reports on the incident. The reports provided 52 safety measures including safety standards, safety study, safety design, o perating control, disas ter pr evention and   safety  research.  The  local  government r eviewed  its nu clear disas ter prevention plan.
6. Summary
The plant continued operation with unreliable equipment without through maintenance. Inadequate control room instrumentation confused the operators and failed to pr ovide proper  information about the acciden t. The operators' misunderstandings and inadequate responses to the events led to the worst accident.
7. Knowledge
(1) Most of the time, an accident starts from a malfunction and gets aggravated with human misunderstandings and other problems further complicating the event.. It is important to install highly reliable equipment and maintain a backup system so that it functions properly when needed. (2) It is essential to design safety devices that has easy-to-read indicators accommodating human cognitive constraints. It is also essential to develop safety systems for preventing inadvertent control inputs and erroneous operations. (3) Outsourcing can involve risks to the operations. It is necessary to prevent outsourcing from degrading operation efficiency and reliability.
8. Background
The energy sources in the world at the time had shared of 70% oil, 20% coal, and a  little less than 10% hydroelectric; oil by  far supp lied  most o f the electr icity  to the wor ld.  At the ti me, OP EC t urned i ts oil pricing policy and the infrastructure of oil supply was vulnerable. Nuclear power then was the star alternate energy source. Commercial nuclear power generation involves containing and controlling the fission reactions so that the heat can be used to make steam, which in turn drives a turbine and generates electricity. Basically the heat source, which is oil or coal for thermal power stations, was replaced with fission. Three Mile Island Nuclear Generating Station consists of two pressurized light water reactors, each with its own containment building and cooling towers. The Unit 2 r eactor, which suffered a partial meltdown, had 959MWe  total  capacity. It  was co  nstructed by  Ba bcock an d  Wilson, and   its  operations wer e run  b y Metropolitan  Edison  Company. There we re nu mber o f  malfunctions repo rted s ince  its tes t op eration in March 19 77  and dur ing th e co mmercial operati on  until  January 1979: 9   malfunctions in the   feedwater system, stuck-open main steam relief valve, 9 activation of ECCS (1 manual activation). In particular in March 1 978,  a station black out o ccurred during low-p ower operation,  and the pr essurizer r elief va lves opened by accident. ECCS (high-pressure injection system) was activated automatically, but it was unable to c ontrol the r eactor pr essure and t he pressurizer water level because of the station blackout. When the power cam e b ack on, the operators responded to the emergency si tuation ap propriately, but not immediately because the control room was not equipped with open/close indicator of the pressurizer relief valve and it took time for the operators to understand the circumstances. Prior to this accident, s imilar accidents were reported at a Swiss power station in August 1974, at Oconee Nuclear Station in the US in June 1975 and at Davis-Besse Nuclear Power Station in the US in September 1977, and their reports including analysis and evaluation on the events were available. The utilities firm should have studied these accident reports closely and have taken preventive measures. Public confidence in nuclear energy declined sharply following the Three Mile Island accident. It was a major cause of the decline in nuclear construction through the 1980s and 1990s.