ML11221A325

521- R326C B&W Tech Cross Training - Chapter 18 Three Mile Island

ML11221A325
Person / Time
Site:	Three Mile Island
Issue date:	07/01/2011
From:	NRC/HR/ADHRTD/RTTB-PWR
To:
References
Download: ML11221A325 (50)

Text

Pressurized Water Reactor B&W Technology Crosstraining Course Manual Chapter 18.0 Three Mile Island

TABLE OF CONTENTS 18.0 THREE MILE ISLAND................................................................................................... 1 18.1 Introduction (Figure 18-1) ....................................................................................... 1 18.2 Loss of Feedwater - March 28, 1979 ...................................................................... 2 18.2.1 4:00 AM (Figure 18-2) ..................................................................................... 2 18.2.2 4:08 AM (Figure 18-3) ..................................................................................... 5 18.2.3 5:00 AM (Figure 18-4) ..................................................................................... 7 18.2.4 6:00 AM - 8:00 PM (Fig. 18-5) ....................................................................... 10 18.2.5 8:00 PM (Figure 18-6) ................................................................................... 15 18.3 Major Issues ......................................................................................................... 16 18.3.1 Natural Circulation......................................................................................... 16 18.3.2 Reactor Coolant Pump Operation ................................................................. 18 18.3.3 Hydrogen Generation .................................................................................... 19 18.3.4 Radiation Release Paths (Figure 18-7) ......................................................... 21 18.4 Analysis ................................................................................................................ 25 18.5 References ........................................................................................................... 26 APPENDIX Sequence of Events ........................................................................................................... 27 LIST OF FIGURES Figure 18-1 Three Mile Island Figure 18-2 T = 0 Minutes Figure 18-3 T = 8 Minutes Figure 18-4 T = 1 Hour Figure 18-5 T = 2 Hours Figure 18-6 T = 16 Hours Figure 18-7 TMI Radiation Release Path USNRC HRDT 18-i Rev 07/2011

This page intentionally blank.

USNRC HRDT 18-ii Rev 07/2011

18.0 THREE MILE ISLAND Learning Objectives:

1. Explain how a loss of feedwater resulted in a reactor trip and subsequent LOCA.

2. Describe the major radiation release paths which occurred at TMI-2.

3. Describe the decay heat removal methods used at TMI-2 during the transient.

4. Explain which parameters are used and how they indicate decay heat removal by natural circulation (or loss of natural circulation).

5. List the operational conditions which enhance natural circulation. Include which systems may be operated different from normal conditions.

6. List the sources of hydrogen and oxygen within the primary system and containment.

7. Determine which RCS parameters can be used as possible indications of boiling (steam formation) within the system.

18.1 Introduction (Figure 18-1)

The accident at TMI-2 began March 28, 1979 at 4 oclock in the morning. The initiating event was a loss of feedwater to the steam generators. The resulting degradation of heat transfer from the primary system caused an increase in pressure and shutdown of the reactor. The pilot operated relief valve (PORV) on the pressurizer opened at the setpoint of 2255 psig in response to the increase in primary system pressure. The coolant leakage through the open PORV continued until about 140 min later when a block valve was closed. The coolant leakage rate during most of this period was about 2800 lb/min while the net makeup rate from ECC injection was an order of magnitude less. The system pressure fell below 1300 psig at 15 min and remained at approximately 1100 psig until 101 min., when the last two primary coolant pumps were shut down in response to indications of pump cavitation. The first sign of core un-covery began at about 110 min. when thermo-couples in the hotlegs indicated the steam boiling out of the core was superheated. The system pressure decreased to a minimum of about 650 psia at about the time the coolant leakage was stopped at 140 min. Also, during this period between 110 and 140 min.,

thermocouples above the core and the self powered neutron detectors (SPND) began to indicate temperatures in the 1000°F range, source range core power level monitors began to read high in response to increased neutron flux from the uncovering core, and high radiation levels were observed in coolant samples and in the containment building as the result of fission product release from the over-heated core.

USNRC HRDT 18-1 Rev 07/2011

When the coolant leakage was stopped at about 140 min, the system pressure began to increase. At about the time reactor coolant pump "2B" was temporarily turned on at 174 min, the system pressure increased rapidly to over 2000 psi. ECC injection was significantly increased at about 200 min. (March calculations indicate the core remained covered after 3.5 hrs.) Over the next 14 hours0.583 days <br />0.0833 weeks <br />0.0192 months <br />, the primary system pressure varied between about 2200 and 550 psi in response to changes in the ECC injection rate and the opening and closing of the block valve in the line of the stuck relief valve. Containment building temperatures and pressure generally responded as expected to whether the relief valve line was open or closed. At about 10 hours0.417 days <br />0.0595 weeks <br />0.0137 months <br />, the containment pressure briefly increased by 28 psi, indicating a containment hydrogen burn. During most of the first 16 hours0.667 days <br />0.0952 weeks <br />0.0219 months <br /> of the accident, the pressurizer water level indicated a full pressurizer. Under normal conditions, this would be an indication that the primary system was water-filled.

18.2 Loss of Feedwater - March 28, 1979 18.2.1 4:00 AM (Figure 18-2)

At 4:00 a.m. on March 28, 1979, TMI-2 was operating between 97% and 98% full power. The shift foreman and two auxiliary operators had been working in the auxiliary building on the No. 7 condensate polisher. Two licensed control room operators were on duty in the control room. The shift superintendent was in his office adjacent to the control room.

The condensate polishers use ion exchange resins for purification of the feedwater (Figure 18-1). During operation, flow through the resin bed tends to compact the material into a rather solid mass. To transfer the resin beads to the resin regeneration system, it is necessary to break up this mass by blowing compressed air through it. (Apparently, during this process water entered an instrument air line through a check valve that had frozen in the open position.)

It has been postulated that the water in the air piping caused the polisher inlet or outlet valves, or both, to close. Closure of either the inlet or outlet valves would interrupt the flow of feedwater and cause the condensate pumps and condensate booster pumps to trip, that is, to be automatically shut down. Tripping of these pumps causes tripping of the main feedwater pumps, which in turn, causes tripping of the main turbine and electrical generator.

The three emergency feedwater (EFW) pumps (two electric-driven and one steam-driven) started automatically within 1 second after the main feedwater pumps tripped.

Water from the EFW pumps is not normally delivered to the steam generators immediately after the main pumps cease to operate. The automatic valves will not open until two conditions have been met: (a) the emergency pumps are delivering their normal discharge pressure (at least 875 psig) and (b) the water level in the steam generators is 30 inches or less.

USNRC HRDT 18-2 Rev 07/2011

In addition to the automatic valves, there are block valves in the lines to the steam generators. These valves are required to be open while the plant is operating. At the time of the accident, however, the block valves were closed. The closed indication of these valves, which was shown on an indicator light in the control room, was not noticed by the operators.

On loss of feedwater followed by turbine trip, the energy removed from the steam generators was less than the energy added by the reactor, and the pressure in the reactor coolant system (RCS) increased. The pressure increase began immediately.

To protect the RCS from excessive pressure, a pilot-operated relief valve (PORV) and two safety valves are provided. Three seconds after turbine trip, the pressure in the RCS had increased to the point (2255 psig) at which the PORV opened. The reactor was still delivering power, and pressure continued to rise, although not as rapidly. Eight seconds after the turbine trip, the pressure had reached the point (2355 psig) at which the reactor is automatically shut down.

Before the accident, leakage was higher than usual, because a code safety valve, or possibly the PORV, was leaking. Leakage from the PORV went to the reactor coolant drain tank (RCDT) where it was condensed and was then pumped to the reactor coolant bleed tanks. The buildup of water in the bleed tanks was then being transferred periodically to the makeup tank.

If not compensated for, the expected shrinkage of reactor coolant on cooldown could cause an excessive change of volume. To reduce the rate of volume change, therefore, letdown is stopped and makeup is increased.

An indicator light in the control room shows when the PORV has been ordered to close

- that is, when power to the valve opening solenoid is cut off - but does not show when the valve actually closes. It is now known that the valve did not, if fact, close as it was designed to do. The operators, however, had no direct means of knowing this. By 28 seconds after turbine trip, the two conditions for admission of emergency feedwater to the steam generators had been met, and the automatic valves should have begun to open.

Because the block valves were closed, of course, no water could be admitted to the steam generators even with the automatic valves open. It appeared to the operator that the automatic valves were opening at an unusually slow rate, and the slow opening of these valves was initially attributed to the delay in feeding the steam generators.

A second operator now noticed that the second makeup pump had not started, and successfully started pump "1B." He also opened the makeup throttling valve to increase the amount of makeup flow. (This increased flow, along with reduced letdown, apparently overcame the coolant contraction.)

Meanwhile, the condenser hotwell was undergoing some expected level fluctuations, first dropping to 21.7 inches, then rising to normal. Unknown to the operators, however, an USNRC HRDT 18-3 Rev 07/2011

air line to the hotwell level controller was broken, apparently by a water hammer during the initial transient. The operators were unable to regain control of hotwell level.

Very shortly thereafter, the temperature of the water in the RCDT had significantly increased. Unfortunately, the meter showing this temperature is in back of the main control panels and cannot be seen from the normal operating position.

Two minutes after turbine trip, the RCS pressure had dropped to 1600 psig. At this pressure, the engineered safeguards (ES) automatically actuate. The ES system is designed so that when the RCS pressure drops to this level, makeup pumps "1A" and "1C" will start (if not already operating) makeup pump "1B" will trip (if running), and the makeup valves will open to admit the full output of the pumps into the RCS.

If the PORV had not been opened, it could not be expected that increased flow of makeup water into the system would accelerate the rate of the rise of the pressurizer level and cause the RCS pressure to begin to climb again. Uncontrolled filling of the pressurizer might cause it to fill completely (pressurizer solid). Control of RCS pressure is lost with a solid pressurizer, and a very small temperature increase in the totally filled system could cause the pressure to rise to the point where the safety valves would open. The safety valves might have to be repaired, because it is not unusual for safety valves to leak after being lifted. Operators are trained to avoid this situation. Operating procedures require them to switch to manual control and reduce makeup as soon as the pressurizer regains a normal level.

The operator bypassed the ES system and reduced the makeup flow, but the pressurizer level continued to increase rapidly. Pressure did not rise and even began to move slightly downward. The reason for the anomaly of rising pressurizer level and decreasing pressure was not recognized by the operators. Trained to avoid a solid pressurizer, they stopped makeup pump "1C" and increased letdown flow to its high limit, thereby temporarily arresting the rate of pressurizer level increase.

If the pressure dropped low enough for boiling to occur, control of the pressurizer level would have become more difficult. The open PORV would reduce the pressure in the pressurizer steam space. Steam forming elsewhere in the system would force more water through the surge line, raising the pressurizer level. If the RCS pressure rose so that the water was no longer saturated, the steam bubbles in other parts of the system would be condensed, and the pressurizer level would fall. In other words, the pressurizer level would be controlled by steam formation, as well as by the makeup and letdown system. At the same time, it would have been difficult to regain a bubble by using the heaters. The rate of energy loss through the PORV at the system pressure was many times greater than the energy added by the heaters.

The relief valve on the RCDT was opening intermittently after approximately 3-1/2 minutes. Operation of this valve allowed the tank to overflow into the reactor building sump. Operation of the relief valve was not noticed by the operators. RCDT parameters USNRC HRDT 18-4 Rev 07/2011

are displayed on a panel located out of the operators view. The level in the reactor building sump eventually got high enough to cause a sump pump to be automatically turned on.

The reactor building sump is normally pumped to the miscellaneous waste holdup tank. It appears that at the time of the accident, however, the reactor building sump pump was actually lined up to pump into the auxiliary building sump tank - which was already nearly full and had a broken rupture disk. Overflow of the auxiliary building sump tank would cause overflow to go to the auxiliary building sump.

18.2.2 4:08 AM (Figure 18-3)

At 8 minutes after turbine trip, the operator discovered that the emergency feedwater block valves were closed and opened them. Opening these valves caused a rapid increase in steam pressure, which had previously dropped when the steam generators boiled dry, and a drop in RCS temperature. The reason for the 14 minute lag in recovery of the steam generator level is that emergency feedwater is sprayed directly onto the hot tubes and evaporates immediately. Evaporation raises steam pressure, but no water collects in the bottom until the tubes are cooled down.

At the beginning of the accident, the computer alarm printout was synchronized with real time. The alarm printer can only type one line every 4 seconds, however, and during the accident, several alarms per second were occurring. Within a few minutes, the computer was far behind real time, and the alarms being printed were for events that had occurred several minutes earlier.

About 25 minutes after turbine trip, the operators received a computer printout of the PORV outlet temperatures. (The high temperature - 285°F - was not perceived by the operators as evidence that the PORV was still open. When the PORV opened in the initial transient, the outlet pipe temperature would have increased even if the PORV had closed as designed. The operators supposed that the abnormally slow cooling of the outlet pipe was caused by the known leak in the relief or safety valves. Actually, sufficient evidence of the failure of the PORV to reclose was now available: the rapid rise in RCDT pressure and temperature, the fact that the rupture disk had blown, the rise in reactor building sump level (with operation of the sump pumps), and the continuing high PORV outlet temperature.

The PORV outlet temperature was read again at 27 minutes after turbine trip. The evidence of an open valve, however, was not interpreted as such by the operators.

An auxiliary operator noticed that the reactor building sump pumps were on and that the meter showing the depth of water in the reactor building sump was at its high limit (6 feet). The background radiation in the auxiliary building had increased. (Although it was believed that the reactor building sump pumps were discharging to the miscellaneous waste holdup tank, the level in the holdup tank had not changed. On the orders of the control room operator, with the shift supervisors concurrence, the operator shut off the sump pumps.)

USNRC HRDT 18-5 Rev 07/2011

The reasons for the problems with the reactor coolant pumps were that steam bubble voids had formed throughout the system when the pressure was below the saturation pressure. The system pressure at the coolant pump inlets is required to be significantly above the saturation pressure. This requirement is called the net positive suction head (NPSH) requirement. If the NPSH requirement is not met, vapor bubbles will form in the lowest pressure regions on the suction side of the pumps. The formation of vapor bubbles, called cavitation, could cause severe pump vibration, which in turn could damage the seals and might even damage the attached piping. Operators ignored the NPSH requirement and left the reactor coolant pumps operating as long as possible. Had they not done this, more severe core damage could have occurred. As long as the pumps provided circulation, even of froth, the core was being cooled. As soon as all the pumps were stopped, circulation of coolant decreased drastically, because natural circulation was blocked by steam. Some circulation can be maintained by refluxing. In this type of flow, the water boils in the reactor vessel, and the steam flows through the hot legs, is condensed in the steam generators, and flows (as liquid water) back to the reactor vessel.

For refluxing to occur, a spray of emergency feedwater must be hitting the tubes, or the water level on the secondary side of the steam generators must be higher than the water level on the primary side and the temperature significantly cooler. The level in steam generator A was low (about 30 inches). The steam pressure, hence the temperature, on the secondary side was not much lower than that on the primary side. Reflux circulation, therefore, would probably not have been effective. Effective cooling might have been maintained if the steam generators had been filled to a high level and if the steam pressure had been kept significantly lower than the RCS pressure.

The voids in the system also caused the neutron detectors outside the core to read higher than expected. Normally, water in the downcomer annulus, outside the core but inside the reactor vessel, shields the detectors. Because this water was now frothy, however, it was not shielding the detectors as well as usual. Not realizing that the apparent increase in neutrons reaching the detectors was caused by these voids, operators feared the possibility of a reactor restart. Although it can now be seen that their fears were unfounded, at the time they were one more source of distraction.

The emergency diesel generators had been running unloaded ever since ES actuation. These diesels cannot be run unloaded for long without damage. They cannot be shut down from the control room, but must be locally tripped. Once the diesels are stopped, the fuel racks must be reset so the diesels can be automatically restarted. At 30 minutes after the turbine trip, the operator sent a man to the diesels to shut them down.

The fuel racks, however, were not reset. Failure to reset these racks could have had serious consequences if offsite power had been subsequently lost, because radioactivity restricted access to the diesels.

Voiding throughout the system and the deteriorating performance of the reactor coolant pumps decreased the efficiency of the heat transfer through the steam generators.

The rate of boiling was lower than usual, and operators found it difficult to keep the water USNRC HRDT 18-6 Rev 07/2011

level from creeping up. The condensers must be maintained at a vacuum to operate efficiently, however, and condenser vacuum was gradually being lost. If condenser vacuum were to drop below acceptable levels, the condensate system would be automatically tripped and an uncontrolled dump of secondary steam to the atmosphere would occur. To prevent loss of vacuum, operators deliberately shut down the condensate system 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> after the turbine trip and sought to maintain control over steam pressure by controlling the atmospheric steam dump.

18.2.3 5:00 AM (Figure 18-4)

At the end of the first hour, the situation with which the operators were confronted had severely deteriorated: pressurizer level was high and was only barely being held down, the reactor coolant pumps were still operating but with decreasing efficiency, the condensate system was no longer operable, the reactor building pressure and temperature were slowly increasing, the alarm computer lagged so badly that it was virtually useless, and radiation alarms were beginning to come on.

At 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> 11 minutes, operators initiated reactor building cooling. Their action soon halted, and eventually reversed, the rise in reactor building temperature and pressure. The increasing temperature and pressure should have been a good indication that a small-break LOCA was in progress. In fact, if the air cooling had not been initiated, the reactor building would probably have been isolated (sealed off) shortly after this time.

The operation of the reactor coolant pumps was seriously impaired. High vibration, low flow, low amperage, and inability to meet NPSH requirements led the operators to start shutting down pumps. At 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> 13 minutes, reactor coolant pump "1B" was stopped, and pump "2B" was stopped a few seconds later (pressurizer spray comes from the A loop).

Shutting down two pumps reduced the flow of coolant through the reactor core.

Apparently, there was still enough mass flow in the steam/water mixture to provide cooling, but not as much cooling as that provided when a large volume of void-free water was circulating. There is no firm evidence of overheating at this time. The open valve was reducing the inventory of water in the RCS, though, and the pressure was getting lower.

Water continued to boil to remove decay heat; this boiling increased the amount of steam in the system and further impeded circulation.

A few minutes later, analysis of a sample of reactor coolant indicated a low boron concentration. This finding, coupled with that of apparently increasing neutron levels, increased operators fears of a reactor restart. As explained earlier, the supposed increase in neutron levels was spurious, appearing on the detector only because bubbles in the downcomer were allowing more neutrons to reach it. It is believed that condensed steam diluted the sample.

At 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> 20 minutes, an operator had the computer print out the PORV (283°F) and pressurizer safety valve outlet temperatures (211°F and 219°F). Since there had been USNRC HRDT 18-7 Rev 07/2011

essentially no change in temperature in 55 minutes, the operators should have realized that the PORV valve had not closed. Additionally, the letdown line radiation monitor began to increase. It increased steadily to the full-scale reading. The letdown monitor was notoriously sensitive, so that even minor changes in radioactivity would cause great variations in the reading.

The low steam pressure in steam generator "B" and the increase in reactor building pressure were believed to be caused by a leak from the steam generator. At 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> 27 minutes, steam generator "B" was isolated (taken out of service). With hindsight, it can be seen that the low pressure was simply caused by steam bubbles and a reduction of heat transfer in the "B" loop following stoppage of the pumps.

The temperature of the RCS coolant in all primary system piping had been slowly increasing. Eventually, the primary side of steam generator A got hot enough so that more steam was produced on the secondary side, and the steam pressure began to rise. The increased steam production had two side effects: (1) the water level on the secondary side dropped and the steam generator boiled dry for the second time, and (2) the increased heat removal brought the RCS temperature down again.

The efficiency of the reactor coolant pumps was still decreasing, and at 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> 40 minutes, the frothy mixture became too light to circulate. Separation of the froth would have sent the steam to the high parts of the system, while water collected in the low parts.

An analogy is a kitchen blender with the bowl half full of water. With the blender at high speed, enough air bubbles are whipped into the water so that the bowl is full. If the speed drops, the air bubbles are lost and the lower half of the bowl is solidly filled with liquid water. This was reflected in the behavior of the neutron instrumentation. Apparently the down-comer, which had been previously filled with froth, now filled with water. The increased shielding stopped neutrons from reaching the detector and the apparent neutron level dropped by a factor of 30.

Operators recognized that steam generator "A" was dry, and in an attempt to regain water level, they increased feedwater flow.

At 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> 41 minutes, both remaining reactor coolant pumps were stopped because of increasing vibration and erratic flow. The only heat transfer through the steam generators was now achieved by reflux flow. This was inadequate for core cooling. It is now believed that the core was drying out. The operators were hoping to establish natural circulation in the primary system. Natural circulation was blocked by steam, and refluxing would be ineffective because the secondary temperature was nearly as high as the primary temperature.

The pressurizer is at a higher level than the reactor. It was assumed that the presence of water in the pressurizer meant that the core must be covered. Actually, because the PORV was open, pressure in the upper part of the pressurizer was reduced. The strong boiling that was occurring in the core, however, caused more steam to go into the upper USNRC HRDT 18-8 Rev 07/2011

part of the reactor vessel, and the pressure there was increased. The difference of pressure forced the water level higher in the pressurizer than in the reactor vessel.

Previous reports have alluded to a loop seal, thus giving the false impression that the piping configuration alone somehow created this difference of level. Even with the loop configuration, to maintain a higher level in the pressurizer when the water in the pressurizer is saturated, a higher pressure is required in the reactor than in the pressurizer. If the pressures are equalized with the hot leg voided, the saturated pressurizer water level would drop to the level of the connection of the pressurizer surge line into the hot leg. Subcooled water could be maintained at a higher level. During most of the accident, the water in the pressurizer was slightly subcooled or saturated. During the time that the surge line was uncovered, the water in the pressurizer was subcooled. It was the combination of loop seal and temperature that kept the level high, rather than the loop seal alone.

At 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> 42 minutes, the decreasing level in the reactor vessel again reduced the shielding of the neutron instrumentation, and the apparent neutron count increased by about a factor of 100. Emergency boration was commenced to avert a restart.

The hot-leg temperature now became decidedly higher than the cold-leg temperature.

Superheated steam was present in the hot leg. The superheating of the hot leg showed that a fair amount of the core was uncovered. It is impossible to superheat the hot leg without uncovering the core.

Although none of the instrumentation directly indicates to the operators that the saturation temperature has been reached or exceeded, a copy of tables that show saturation temperatures as a function of pressure (the steam tables) was available to them.

Up to this time, it might have been possible to salvage the situation without extensive core damage. If the PORV had been closed and full makeup flow had been instituted, it might have been possible to fill the system enough so that a reactor coolant pump could be restarted. As the uncovering of the core became more extensive, the opportunity to reverse the tide dwindled.

The upper part of the core was now uncovered. The steam rising past the fuel rods gave some cooling, but not nearly as much as when they were covered with water. The decay heat - about 26 MW - was higher than the heat removed, so the fuel temperature increased.

The fuel rods are clad with Zircaloy, an alloy of zirconium. Zirconium reacts with water to form zirconium dioxide and hydrogen. At operating temperatures, this reaction is extremely slow and does not represent a problem. At higher temperatures, however, the reaction goes faster. It is believed that the temperature of the fuel rods reached a point at with the reaction occurred rapidly, producing significant amounts of hydrogen.

USNRC HRDT 18-9 Rev 07/2011

Furthermore, the reaction itself releases heat. Heat released from the reaction would have caused the cladding to become hotter, driving the reaction faster.

As long as the upper part of the system contained only steam, the bubble could be condensed (collapsed) by increasing the pressure or decreasing the temperature.

However, with large amounts of hydrogen in the system, these measures would reduce the size of the bubble but could never collapse it. The accident could not now have been reversed by simply closing the PORV and increasing makeup.

18.2.4 6:00 AM - 8:00 PM (Fig. 18-5)

At 2 hours0.0833 days <br />0.0119 weeks <br />0.00274 months <br /> into the accident, the pressure in loop A was 735 psig. The loop A hot-leg temperature was actually 558°F - definitely superheated. The narrow range hot-leg temperatures went offscale high, and cold-leg temperatures went offscale low.

The wide range temperature measurements were still available, although the narrow range temperatures can be read more accurately and the operators are in the habit of using them exclusively. One meter shows average temperature, which is actually an average of the narrow range indications. Average temperature shown at this time was 570°F, the average of the constant readings of 520°F and 620°F (lower to upper limits). (This steady average temperature evidently convinced the operators that the situation was static). The operators now knew that there was a problem. Natural circulation had not been established, and they had been forced to turn off the last RCP. At 2 hours0.0833 days <br />0.0119 weeks <br />0.00274 months <br /> 15 minutes, the reactor building air sample particulate radiation monitor went off scale. This was the first of many radiation alarms that could definitely be attributed to gross fuel damage.

A shift supervisor who had just come into the control room isolated the PORV valve by closing the block valve in the same line. Apparently, he did this to see whether it would have an effect on the anomaly of high pressurizer level and low steam pressure. The reactor building temperature and pressure immediately began to decrease and the pressure of the RCS increased. The shift supervisor who had closed the block valve immediately recognized that a leak had been stemmed.

Leakage through the PORV had now been stopped, but there was still no way to get rid of the decay heat, because there was virtually no circulation through the steam generators. The once-through steam generator ("A" OTSG) had 50% cold water, which would have been adequate if there had been circulation. The situation was in some ways worse than it was before the valve was closed.

During this period of probable core damage, there was virtually no information on conditions in the core. Incore thermocouples (temperature measuring devices), which measure reactor coolant temperature at the exit from the core, could measure only up to 700°F. This limit is imposed by the signal conditioning and data logging equipment, not by the instruments themselves.

USNRC HRDT 18-10 Rev 07/2011

Many radiation monitors began to go offscale high. This is an indication of severe core damage. The intense boiling could have caused shattering of much of this material, and the loss of cladding integrity, coupled with the high temperatures, could have allowed the more volatile radioactive substances in the fuel to escape into the reactor coolant.

The problems with the condenser hotwell level control were finally solved at 2 hours0.0833 days <br />0.0119 weeks <br />0.00274 months <br /> 50 minutes. The broken air line to the reject valve was repaired, the valve now operated properly, and the condensate hotwell was pumped down to its normal level.

The attempted starts of the reactor coolant pumps had not established circulation in the reactor coolant system. It appears, however, that a slug of water was forced into the downcomer by the momentary running of pump "2B." The boiling caused a rapid pressure rise and probably did considerable damage to the brittle oxidized cladding.

As a result of receiving several high radiation alarms within the plant, a site emergency was declared and the local authorities notified. The letdown sample lines had now been reported to have an extremely high radiation level (600 r/hr), and the auxiliary building was evacuated. An attempt was being made to obtain another reactor coolant sample.

By 3 hours0.125 days <br />0.0179 weeks <br />0.00411 months <br /> after the turbine trip, the situation appears in hindsight to have become quite grave. It should have been obvious that there was no circulation of reactor coolant.

The abortive attempts to start reactor coolant pumps and the attempts to secure natural circulation by a high water level in the steam generator indicate that this was suspected at the time. Most incore thermocouples were reading off scale. The hot-leg temperatures were nearly 800°F. This superheating of the hot leg indicates both that the hot leg had virtually no liquid water in it and that at least the upper part of the core was dry. The many high radiation alarms indicate that extensive fuel damage had occurred.

At 3 hours0.125 days <br />0.0179 weeks <br />0.00411 months <br />, the condenser vacuum pump exhaust radiation monitor was showing increased radiation levels. A leak in steam generator B had been previously suspected, and the increased level of radiation seemed to confirm this. At 3 hours0.125 days <br />0.0179 weeks <br />0.00411 months <br /> 4 minutes, the turbine bypass valves from steam generator "B" and the auxiliary feedwater valves to this generator were closed. This completely isolated the steam generator from the condensate system.

At 3 hours0.125 days <br />0.0179 weeks <br />0.00411 months <br /> 12 minutes, the PORV block valve was opened in an attempt to control RCS pressure. The opening of the valve caused a pressure spike in the RCDT, an increase in reactor building pressure, and an increase in the valve outlet temperature.

At 3 hours0.125 days <br />0.0179 weeks <br />0.00411 months <br /> 20 minutes, the ES were manually initiated by the operator. This was quickly followed by a drop in pressurizer level. The reason for actuation of the ES was the rapidly dropping RCS pressure. Makeup pump "1C" started and the makeup valves opened fully. RCS temperature dropped rapidly as the cold water flooded in. It is believed that the sudden admission of cold water to the extremely hot core probably caused additional major damage to the core because of thermal shock. The external neutron USNRC HRDT 18-11 Rev 07/2011

indicators dropped suddenly, indicating a rapid change of level in the downcomer. The water added should have ensured that the coolant level was above the core height.

Almost immediately, many radiation monitors registered alarms. The control building, except for the control room itself, was evacuated. These radiation alarms are a good indication that severe core damage occurred. Apparently, the brittle oxidized cladding was shattered by the sudden admission of cold water, so that the fuel pellets were no longer held in their original position. This sudden rearrangement of the core may have permitted the volatile fission products to enter the coolant; these could later have streamed out of the open PORV into the reactor building.

At 3 hours0.125 days <br />0.0179 weeks <br />0.00411 months <br /> 24 minutes, a general emergency was declared on the basis of the many radiation alarms.

The borated water storage tank (BWST) low level alarm was received at 3 hours0.125 days <br />0.0179 weeks <br />0.00411 months <br /> 30 minutes. There were still 53 feet of water in the BWST. That the level was falling, however, caused concern. Additional ES actuations could cause all the water in the BWST to be used up, and the highly radioactive water in the reactor building sump would have to be used for high pressure injection. The HPI pumping system would became radioactive, which could cause grave problems if repairs became necessary. There was thus an inclination to use ES as little as possible (high pressure injection water is taken from the BWST). ES was reset and makeup pump "1C" was stopped. At the same time, the PORV block valve was shut. Closing this valve, with makeup pump "1A" still running, caused a rapid increase in pressurizer level.

About 4 to 4-1/2 hours0.0833 days <br />0.0119 weeks <br />0.00274 months <br /> into the accident, incore thermocouple temperature readings were taken off the computer; many registered question marks. Shortly after, at the request of the station superintendent, an instrumentation control engineer had several foremen and instrument technicians go to a room below the control room and take readings with a millivoltmeter on the wires from the thermocouples. The first few readings ranged from about 200°F to 2300°F. These were the only readings reported by the instrumentation control engineer to the station superintendent. Both have testified that they discounted or did not believe the accuracy of the high readings because they firmly believe the low readings to be inaccurate. In the meantime, the technicians read the rest of the thermocouples - a number of which were above 2000°F - and entered these readings in a computer book which was later placed on a control room console. The technicians then left the area when nonessential personnel were evacuated.

Both makeup pumps ("1A" and "1C") were stopped at 4 hours0.167 days <br />0.0238 weeks <br />0.00548 months <br /> 18 minutes. Two unsuccessful attempts were made to restart pump 1A. The control switch was then put in the pull-to-lock position. This completely defeated automatic starts of the pump. The pressurizer indicated full, and the operators were concerned about full high pressure injection flow coming on with an apparently solid system.

USNRC HRDT 18-12 Rev 07/2011

Actually, a very large part of the RCS was filled with steam and gas, and the system was far from being solid. This condition could have been recognized from the fact that the RCS hot legs were superheated.

Problems in the condensate system were continuing. The condensers had been steadily losing vacuum. It was also necessary to maintain steam to the main turbine seals in order to operate the condenser at a vacuum. When main steam is not available, seal steam is provided by the oil-fired auxiliary boiler, which is shared by both TMI units. The auxiliary boiler broke down, so that seal steam could not be maintained, and it was necessary to shut down the condensate system completely.

Only a small amount of heat could be removed by the steam generator because the upper part of the RCS was filled by a steam-gas mixture. This drastically cut flow on the primary side. The water level on the secondary side was rising because more water was coming in as feedwater than was leaving as steam. At 4 hours0.167 days <br />0.0238 weeks <br />0.00548 months <br /> 42 minutes, emergency feedwater pump was stopped.

The diesel engines that operate the emergency generators had been stopped at 30 minutes after the turbine trip. These details provide an emergency electrical supply for the ES in the event of failure of the regular supply. During the past 5 hours0.208 days <br />0.0298 weeks <br />0.00685 months <br />, the diesels had been incapable of being rapidly started. If there had been an interruption in the power, someone would have had to go to the diesel generator area to start them. On the other hand, if the fuel racks were reset, the diesels would have restarted on every ES actuation.

They cannot be run for long periods when unloaded, and someone would have had to go to the diesel generator area each time to reset them. Either way, someone would have had to pass through a high radiation area.

It was possible to reset the fuel racks at once, however, and then to leave the controls in position so that the diesels would not automatically start on ES actuation. In the event of a blackout, the diesels could have been immediately started from the control room, as soon as the operators realized that power was lost. Resetting the fuel racks was carried out at 5 hours0.208 days <br />0.0298 weeks <br />0.00685 months <br /> 29 minutes.

By 5 hours0.208 days <br />0.0298 weeks <br />0.00685 months <br /> 43 minutes, the RCS was full repressurized. The pressure was maintained between 2000 and 2200 psig by operation of the PORV block valve.

It was supposed that the higher pressure might be able to collapse the bubble and allow natural circulation. In order to encourage natural circulation, operators raised the water level of steam generator "A" to 90% by using the condensate pump for feeding.

It became clear that even with a full steam generator and high pressure, natural circulation was not being established. The next plan was to depressurize sufficiently to inject water from the core flood tanks. When water is injected from the core flood tanks, expansion of the nitrogen gas causes its pressure to drop until it balances the RCS pressure. If the RCS pressure drops slightly below 600 psig, only a small amount of water USNRC HRDT 18-13 Rev 07/2011

will be injected. An amount of water approaching the fuel volume of the tanks will be injected into the reactor vessel only when the RCS pressure is much lower than 600 psig.

The operators did not realize this and incorrectly believed that the small amount of water injected was indicating that the core was covered.

Up to this time, the atmospheric steam dump valve was open. Sometime between 8 hours0.333 days <br />0.0476 weeks <br />0.011 months <br /> 30 minutes and 9 hours0.375 days <br />0.0536 weeks <br />0.0123 months <br /> 15 minutes, the atmospheric dump valve was closed on orders to the control room from Metropolitan Edison management, because of concern that this might be the source of small radioactivity levels being measured outside the plant.

At 9 hours0.375 days <br />0.0536 weeks <br />0.0123 months <br /> 50 minutes, coincident with opening of the PORV, there was a very sudden spike of pressure and temperature in the reactor building. The building was isolated, and the ES actuated and building sprays came on. The setpoint for the building sprays to come on is 28 psig, so the pressure spike must have been at least that high. The strip chart shows a peak pressure of 28 psig.

It is now known that the pressure spike was due to hydrogen combustion in the reactor building. The building sprays quickly brought the pressure and temperatures down. At 6 minutes after actuation, the sprays were shut off from the control room because there appeared to be no need for them.

Initially, the spike was dismissed as some type of instrument malfunction. Shortly afterward, however, at least some supervisors concluded that for several independent instruments to have been affected in the same way, there must have been a pressure pulse. It was not until late Thursday night, however, that control room personnel became generally aware of the pressure spikes meaning. Its meaning became common knowledge among the management early Friday morning.

At 13 hours0.542 days <br />0.0774 weeks <br />0.0178 months <br /> after the turbine trip, the auxiliary boiler was brought back into operation.

Steam for the turbine seals was now available and it was possible to hold a vacuum on the condenser.

Two condenser vacuum pumps were started. It was now expected that repressurization would collapse the bubble in the hot legs, and natural circulation could be achieved through OTSG "A."

It was now believed that it might be possible to start a reactor coolant pump. There was some concern, however, as to whether a pump would operate. If there were voids in the system, sustained running would possible damage the pump or blow out the seals.

Therefore, the control room personnel decided to bump one of the pumps (run it for only a few seconds) and to observe current and flow while the pump was running.

The loss of two MCCS (at a time of explosion) meant that the ac oil lift pumps were out of service. It is not possible to start a reactor coolant pump unless the oil lift pump can be USNRC HRDT 18-14 Rev 07/2011

started. There is a standby dc oil lift pump, but it was necessary to send people to the auxiliary building to start it.

At 15 hours0.625 days <br />0.0893 weeks <br />0.0205 months <br /> 33 minutes, operators started reactor coolant pump "1A" by manually bypassing some of the inhibiting circuitry. The pump was run for 10 seconds, with normal amperage and flow. Dramatic results were seen immediately. RCS pressure and temperature instantly dropped, but began to rise again as soon as the pump was stopped.

Evidently, there was an immediate transfer of heat to the steam generator when the coolant circulated. There was also a rapid spike in the steam pressure and a drop in steam generator level.

18.2.5 8:00 PM (Figure 18-6)

After analysis of the results of the short term run of the reactor coolant pump, conditions looked so hopeful that operators decided to start the pump and to let it run if all continued to go well. Reasonably stable conditions had now, for the first time, been established. New problems were to arise later, but they were less serious than those that had been handled up to this time.

Apparently, no none at this time realized that a bubble still existed in the RCS. What appears to have happened is that the starting of the reactor coolant pumps swept the remaining gas in the upper part of the system around with the water as discrete bubbles.

The gas bubbles would tend to collect in the most quiescent part of the system - the upper head of the reactor vessel.

It is now believed that the gas was largely hydrogen. Hydrogen is slightly soluble in water, and its solubility is greater at high pressure. An attempt to depressurize the system would cause some of the dissolved hydrogen to effervesce out of the water, thereby increasing the amount of hydrogen in the bubble which would interfere with attempts to depressurize. As the pressure dropped, the bubble would grow in size and could interfere with circulation of the reactor coolant.

In addition to growing in size, the bubble and the dissolved gas would make it impossible to depressurize the RCS completely. The pressure is controlled by the size of the steam bubble in the upper part of the pressurizer. When this bubble contains only steam, spraying colder water into the top of the pressurizer shrinks the bubble and reduces the pressure. When the bubble contains a gas like hydrogen, however, spraying does not reduce the size of the bubble as much, so there is less control over the pressure.

Another problem with reduced pressure occurred in the letdown system. As explained, gas comes out of solution when the pressure is reduced. The gas from the letdown water collected in the bleed tanks and makeup tank, increasing the pressure and making it necessary to vent the tanks often. The gas vented off, though, was not pure hydrogen - there were small amounts of radioactive materials as well. There was a limited space available for holding the gas released from the letdown flow. These two factors USNRC HRDT 18-15 Rev 07/2011

would make the reduction of pressure an extremely slow process that took several days to accomplish.

At 9:25 p.m. on March 28 (17 hours0.708 days <br />0.101 weeks <br />0.0233 months <br /> 25 minutes after turbine trip), it was apparent that the utility believed pressure could soon be reduced to a level at which the decay heat system could be used.

18.3 Major Issues 18.3.1 Natural Circulation Natural circulation is a basic thermal hydraulic phenomenon that occurs during the loss of power to the reactor coolant pumps. Heating and cooling of water changes the density of the coolant. As the density decreases, a given volume of water contains less mass. The heated water will tend to rise while the cooled water will tend to fall. This is similar to the principles of operation of a hot air balloon. To rise, heat is added to the gas volume of the balloon. As the hot air cools, the balloon falls. Natural circulation is the mechanism by which the coolant is transferred out of the reactor vessel to the steam generators which act as a heat sink.

To take advantage of the buoyant forces, sometimes called the thermal driving head, the plant is designed with a maximum height difference between the center of heat generation, the core, and the center of heat removal, the steam generator. Resistances to flow such as pipe restrictions, valves, bends, elbows, etc., especially in the hot legs of the RCS, are minimized. The design enhances the natural circulation flow due to the thermal gradients which will occur when a loss of pumping power is sustained.

Although plant design is fixed, there are some operational things that can occur that will interrupt natural circulation. Operation of normal plant systems is sometimes different during natural circulation. Therefore, the operator must understand natural circulation to avoid problems. Several things can be done to enhance natural circulation. Pressurizer level should be maintained at 50% or greater to ensure that no vapor pockets have formed in the loops. Large vapor pockets result in large resistance to flow. The Reactor Coolant System should be maintained at least 15 degrees subcooled. 50 degrees subcooling is desired, but at least 15 degrees subcooling is required. Again, this ensures that no steam pockets form in the reactor coolant loops or the steam generators. Another necessary requirement is to maintain a heat sink. The heat sink required is at least one steam generator. The Auxiliary Feedwater System should be used as necessary to maintain narrow range level in one steam generator. Without the heat sink, the reactor coolant will not be cooled and the thermal driving head will be reduced, therefore natural circulation will be reduced. Boiling will likely occur in the core and hot leg forming steam voids in the steam generator tubes and in the reactor vessel head. These will all offer a high resistance to natural circulation flow.

USNRC HRDT 18-16 Rev 07/2011

Several parameters measured in the plant are available to help provide indication of natural circulation. The Reactor Coolant System differential temperature should be approximately 25% to 80% of full power as indicated by wide range resistance temperature detectors (RTDs). The hot leg RTD should be indicating either a steady value or a slowly decreasing value. This indicates that heat removal is operating properly and that the decay heat generated by the core is decreasing slowly as it should. Core exit thermocouples should be monitored. These also should be indicating either a steady value or a slowly decreasing value. Steam pressure should follow reactor coolant temperatures. As average reactor coolant temperature decreases, so should steam pressure. Cold leg temperatures of the RCS should also indicate either a constant value or slowly decreasing value. This measurement is again by RTDs. These measured parameters can also be used to detect a loss of natural circulation flow. If natural circulation flow is lost, the RCS differential temperature will exceed the 100% full power value. This is because the hot leg temperature will increase as boiling occurs in the core. Since there is no flow, the hot leg temperature will rise dramatically while cold leg temperature remains relatively constant.

The core thermocouple temperatures will also rise as the heat is generated by the core.

Steam pressure from the steam generated will decrease as boil off occurs in the steam generators. Since flow is zero, temperature and pressure will decrease in the steam generator as a cold water slug is formed on the reactor coolant side of the steam generator.

Steam generator level will also increase with the same auxiliary feedwater flow since less steam will be formed as the RCS cools.

As mentioned previously, some systems will have to be operated differently when in natural circulation. One of these systems is the Pressurizing System. Normally spray comes from one of the reactor coolant loops. In natural circulation, however, there will not be enough driving head for this spray to work. In this case, an auxiliary spray will have to be used. The operator will have to control spray very carefully manually to control pressurizer pressure. During natural circulation it is imperative to make changes to reactor coolant loop temperatures and pressures in a slow manner. Otherwise, the thermal driving head can be upset and natural circulation will stop. If the operator does not control pressurizer pressure correctly, the subcooling temperature may be lost and a bubble or steam void may be formed in the reactor vessel or loops. The operator must prevent pressure from rising to the power operated relief valves opening setpoint. These valves have been known to fail to reseat. A sudden drop in pressure due to a stuck open relief valve could cause flashing in the reactor coolant loop hot leg and a loss of natural circulation. As mentioned, the operator must control pressurizer pressure by controlling auxiliary spray and heaters.

The cooldown of the RCS will have to be accomplished by control of the atmospheric dumps or turbine bypass valves (if condenser is available). The operator will have to manually make all changes to the system control parameters. Once again, all changes should be made slowly or natural circulation flow may be disrupted.

The Auxiliary Feedwater System flow will also have to be controlled manually by the operator. Flow should be controlled so as to maintain a fairly constant level in the steam USNRC HRDT 18-17 Rev 07/2011

generators. Overfeeding can cause a rapid cooling down of the steam generator and a disruption to the natural circulation flow in the RCS. As small changes are made to the Steam Dump Control System, small changes should be made to the flow in the Auxiliary Feedwater System. These two systems should be adjusted slowly to provide a slow, steady cooldown rate of the Reactor Coolant System.

18.3.2 Reactor Coolant Pump Operation The previous section discussed considerations and operations in the natural circulation mode of core cooling. Emergency procedures, based on recommendations from vendors, outline the criteria for operating the RCPs if natural circulation is not working. This section will discuss factors to be considered in RCP operation during accident conditions.

Consideration will be given to possible situations in which written procedures may be inadequate to prevent severe degradation of the reactor core.

Many operating procedures usually require some minimum value of RCS pressure (normally 1250 psig to 1550 psig) before RCPs can be started, regardless of other conditions in the RCS. Several factors, however, could affect a decision to operate the pumps below this minimum pressure. First, the RCS inventory may be sufficient to operate the pumps intermittently without serious damage. For example, a non-condensible blockage could occur in the steam generator tubes and the only method of removal could be RCP operation. Secondly, if chemistry, radiation levels and hydrogen generation indicate severe core damage is occurring and operator actions to cover the core are not adequate, turning on the RCPs in an attempt to send slugs of water and steam for cooling the core may be necessary.

Prior to attempting to start a RCP, an alternative method of restoring natural circulation would be to increase steaming in the steam generator (increase the size of the heat sink).

This could be accomplished using turbine bypass valves or atmospheric dump valves.

Using this method should condense steam that may be blocking material circulation flow in the steam generator U-tubes. However, if the void in the steam generator U-tubes contains large quantities of non-condensible gases, RCPs may be needed intermittently to force the blockage out of the steam generator and into the reactor vessel. Another alternative that may be pursued if inadequate core cooling exists is to intentionally depressurize the RCS in a controlled fashion, using a pressurizer relief valve.

The purpose of depressurization is to create conditions which will allow increased emergency core cooling flow. Extreme caution must be used in a depressurization as increased voiding may result at lower pressures, if core cooling continues to be inadequate and saturated conditions exist in the RCS.

If depressurization below the low pressure safety injection pump discharge head fails to improve core cooling and increase vessel water level, then pressure should be increased by isolating letdown and closing the pressurizer relief valves. Then, once pressure reaches the minimum level for RCP operation or the maximum achievable pressure, an attempt USNRC HRDT 18-18 Rev 07/2011

should be made to start the RCPs. This procedure of depressurization, repressurization and RCP operation can be repeated until blockages are cleared and the core is covered.

18.3.3 Hydrogen Generation The issue causing the most concern and public apprehension during the incident at TMI involved hydrogen and the hydrogen bubble. The erroneous assumption that the accumulation of hydrogen within the primary system was or could become explosive led to speculations of a massive spread of contamination and consequent damages to the general population. As was later confirmed publicly, these speculations and fears about the bubble were totally unfounded. The presence of even small amounts of free hydrogen prevents accumulation of oxygen and thus any possibility of hydrogen/oxygen explosion.

However, the amount of hydrogen produced was sufficient to cause legitimate concerns about core cooling and flammability in the reactor building atmosphere. An ignition, as measured by pressure and temperature spikes, did occur about 10 hours0.417 days <br />0.0595 weeks <br />0.0137 months <br /> into the incident.

Although equipment may have been damaged, the integrity of the reactor building remained in tact. Significant amounts of hydrogen may be produced by radiolysis and the zirconium/water reaction.

Absorption of energy from ionizing radiation will cause the decomposition of water by a somewhat complicated mechanism to form primarily hydrogen and oxygen.

2H20 <--> 2H2 + 02 The yield of this reaction is dependent upon the energy absorbed, the nature of the radiation, temperature, reaction produces residence time, etc. Throughout the incident at TMI-2, the dissolved hydrogen levels in the RCS were considerably above 1 ppm. Thus, radiolysis in the RCS was a source of neither hydrogen nor oxygen.

Above 1600°F zirconium alloys react with water to form hydrogen and zirconium dioxide.

Zr + 2H20 --> Zr02 + 2H2 The reaction rate increases with temperature and is very rapid above 2700°F.

Stoichiometrically, about 8 standard cubic feet of hydrogen are produced per pound of zirconium oxidized. Each kilogram of Zr that reacts can release about 6.5 megawatts of energy.

If the coolant were lost from the reactor vessel due to an accident, the temperature of the fuel would increase dramatically. When temperatures reached near 2200°F, the zirconium-water reaction would begin, in the presence of water vapor. The reaction would then proceed autocatalytically, accelerating rapidly to a temperature of approximately 3000°F, where actual melting occurs. Once the heat source is removed, the reaction, in the presence of liquid water, stops by itself. However, a complete and violent reaction with USNRC HRDT 18-19 Rev 07/2011

water is conceivable if the entire reactor core vaporizes, an event that is considered highly improbable. In the course of the zirconium-water reaction, hydrogen gas is produced in proportion to the amount of the cladding material that has reacted. A large concentration of hydrogen would therefore indicate a large amount of damaged cladding. During a LOCA, the hydrogen gas may escape through a break in the reactor vessel. Since hydrogen is lighter than the surrounding air, it will tend to rise and collect in a bubble at the top of the containment dome. The concentration of hydrogen in the top of the dome would be high enough to prevent oxygen from entering the bubble and creating an explosion; however, an explosion could occur while the hydrogen is rising from the reactor vessel toward the dome.

During containment spray operation another means of hydrogen gas production exists.

If the operation uses a sodium hydroxide (NaOH) chemical addition, any aluminum inside the containment may react as shown in the following equation.

2A1 + 2 (NaOH) + 2H20 --> 2NaA102 + 3H2 The amount of hydrogen gas generated by this process can be limited by keeping the amount of aluminum used in the plant to a practical minimum. In the event that hydrogen gas does collect in the containment, hydrogen recombiners are provided to burn off the hydrogen under controlled conditions.

Another possible reaction with aluminum which can liberate hydrogen is:

2A1 + 3H20 --> A1203 + 3H2 The potential sources of aluminum within the containment building are as follows:

1. Neutron detector supports

2. Reactor Coolant Pump fins

3. Electrical conductors

4. Refueling machine

5. Incore instrumentation components In addition, hydrogen may be liberated by means of zinc-water reactions following a loss of reactor coolant within the containment. The typical reaction which takes place under these circumstances is:

Zn + H20 --> Zn0 + H2 The typical zinc metal sources in containment are:

1. Floor gratings

2. Electrical conduit and trays

3. Ventilation ducts

4. Zinc-based paint USNRC HRDT 18-20 Rev 07/2011

Hydrogen gas generation in the reactor core is of major concern in the operation of a pressurized water reactor. The hydrogen gas which was produced at TMI was a major importance for several reasons:

1. The presence of a hydrogen bubble in the vessel at TMI confirmed what had already been suspected: a significant amount of fuel damage had occurred.

2. The gas bubble in the core complicated the task of cooling the core.

3. The explosive nature of the hydrogen gas introduced another danger to the already complicated recovery process.

18.3.4 Radiation Release Paths (Figure 18-7)

The radioactive materials released to the environment as a result of the TMI-2 accident were those that escaped from the damaged fuel and were transported in the coolant via the letdown line into the auxiliary building and then into the environment. The noble gases and radioiodines, because of their volatile nature and large concentration, were the primary radionuclides available for release from the auxiliary building. Because the releases occurred primarily through a series of filters including charcoal filters designed to remove radioiodines, the released materials consisted primarily of the noble gas isotopes of krypton and xenon. The total quantity of released radioactive materials is estimated as 2.5 million curies.

On March 28, 1979, prior to 4:00 a.m., the TMI-2 liquid radwaste treatment system was operating normally. TMI-1 was returning to operations after a refueling outage, which generated liquid radwaste that required processing in order to continue startup. A spill of 20,000 gallons of contaminated water from the fuel transfer canal into the reactor building of TMI-1 near the end of the outage resulted in large volumes of low level liquid radwaste from decontamination operations. Because there is no minimum level below which low level liquid radwaste can be released untreated, this volume was being stored, which reduced the available liquid radwaste storage capacity at Three Mile Island Station on March 28.

Immediately prior to the accident, approximately 60% of the stations available liquid radwaste storage capacity (300,000 gallons per unit) was filled. Of particular importance, the auxiliary building sump was approximately 63% full, the auxiliary building sump tank was approximately 76% full, the two contaminated-drains tanks were 77% and 24% full, respectively, and the three reactor coolant bleed holdup tanks, each of 83,000-gallon capacity, were 40%, 61%, and 61% full, respectively. Although there was minimal input of liquid radwaste from TMI-2, 60% of the Three Mile Island Stations liquid radwaste tank capacity was not available on March 28. Accordingly, we find that for normal operations the liquid radwaste storage and treatment system was marginal at best.

USNRC HRDT 18-21 Rev 07/2011

Prior to March 28, 1979, the gaseous radwaste system and the heating and ventilating systems had satisfactorily undergone numerous functional and acceptance tests.

However, a number of maintenance work requests for the waste gas system were outstanding at the time of the accident. Both waste gas compressors needed service for various conditions (described in maintenance requests as over pressurized, makes loud noise, no seal water level, level control pump operation). These compressors leaked during the March 28 incident. In addition, makeup tank vent valve was suspected to be leaking.

Operation of compressor A resulted in releases of gaseous radioactive materials to the auxiliary and fuel handling buildings with each venting of the makeup tank to the waste gas decay tanks. The radioactive noble gases in this leakage were not held up in the decay tanks and were released untreated to the environment. Compressor B, which was to be operated only in an emergency because it was considered to be in poor condition, was not used until Thursday, March 29 and therefore, leaks in this compressor were not significant.

We find that the leaks, particularly in compressor A, which led to the release of small amounts of radioactive material during normal operation, led to releases of radioactive material after core damage.

Following the turbine trip, the open pilot-operated relief valve (PORV) on the pressurizer permitted reactor coolant, at high temperature and pressure, to fill the reactor coolant drain tank. Fifteen minutes after the turbine trip, the reactor coolant drain tank rupture disc, which had a setpoint of 192 psig, failed and primary coolant flowed to the reactor building sumps. As a result, the reactor building sump pumps started automatically and transferred at most 8100 gallons to the auxiliary building sump tank. These pumps were manually turned off at 4:38 a.m. Since the available capacity of the auxiliary building sump tank was only 700 gallons, liquid overflowed to the auxiliary building sump, which caused water to back up through the floor drains in both the auxiliary and fuel handling buildings.

This liquid did not contain large amounts of radioactive material because significant core damage did not occur until after 6:00 a.m. However, the liquid proved to be a means for highly contaminated reactor coolant to travel into areas of the auxiliary and fuel handling buildings as the accident progressed.

After core damage occurred, radioactive material was transported out of the reactor by the letdown line of the makeup and purification system. Because the letdown is a stream of primary coolant directly from the reactor, it contained significant amounts of radioactivity.

It was necessary to maintain some letdown flow to the makeup and purification system to ensure safe cooldown of the reactor between March 28 and April 2, 1979. As a result, leaks in the makeup and purification system (located in the auxiliary building), which release small amounts of radioactive material in normal operation, released large amounts of radioactive material during the accident, even though the letdown flow was reduced from its normal volumetric flow of 45 gallons per minute to about 20 gallons per minute. The USNRC HRDT 18-22 Rev 07/2011

letdown flow was, in fact, the major path for transferring radioactive material out of the reactor.

We find that leakage of radwaste system components, particularly in the makeup and purification system, which contained small amounts of radioactive material during normal operation, led to the most significant releases of radioactive material after core damage occurred. This source of liquid radioactivity was released to the auxiliary building and uncontaminated water spread over the floors of the auxiliary and fuel handling buildings.

The TMI-2 stack was the main release point for gaseous effluents. Numerous pathways to the stack existed for the release of radioactive gaseous effluents. The release pathways from the reactor to the auxiliary and fuel handling buildings are shown in Figure 18-7.

The release of radioactive gases into the auxiliary and fuel handling building occurred by direct gas leakage and leakage of radioactive liquid from which radioactive gases evolved. Direct leaks of radioactive gas were the major source of radioactive gaseous releases.

Leaks in the vent header system and the waste gas decay system were the primary mechanisms for the direct release of gaseous radioactive material. The high pressure in the reactor coolant drain tank (up to 192 psig) prior to rupture disc failed led to a sequence of events that created a significant release pathway for gaseous radioactivity through the vent header.

The reactor coolant drain tank was connected to the vent header via two paths.

Pressures in the reactor coolant drain tank prior to rupture disc failure pressurized the vent header. Before the rupture of the reactor coolant drain tank relief at 4:15 a.m., the radiation monitoring system detected activity that indicated that the waste gas vent header was leaking. Subsequent inspection has identified six leaks in the vent header system. The vent line from the reactor coolant drain tank to the vent header was open on March 28, 1979.

The high pressures in the reactor coolant drain tank forced liquid (primary coolant) through the vent line to the vent header. The vent header relief valve is set at 150 psig, so water under pressure caused leaks in the water drains. This water also damaged some of the 10 check valves located between the vent header and connected tanks reactor coolant bleed holdup tanks. These check valves are designed to permit flow only from the component to the vent header and not in the opposite direction, but are known to operate inefficiently and fail easily. Therefore, a significant pathway existed from the vent header to a number of tanks. The relief valves on these tanks, which were set at relatively low pressures (reactor coolant bleed holdup tank at 20 psig, reactor coolant evaporator at 10 psig), opened. Lifting of these relief valves resulted in untreated releases directly to the stack via the relief valve vent header. We find that the gaseous radwaste system design included relief to atmosphere, which provided a path to the environment for untreated gas.

USNRC HRDT 18-23 Rev 07/2011

We find, also, that the high reactor coolant drain tank pressures between 4:00 and 4:30 a.m. on March 28 damaged portions of the vent gas system and resulted in a gaseous release pathway to the vent header, through failed check valves to components with low-pressure relief valves. Once established, this release path was available whenever the vent header was used, such as in the venting of the makeup tank.

The makeup tank has a liquid relief to the reactor coolant bleed holdup tanks. The tank is designed to operate with approximately one-third of its volume as a gas space to allow gases from the cooled and depressurized primary coolant to evolve and be collected.

Collection of non-condensible gases in the makeup tank caused a reduction in the letdown flow because of pressure buildup. This reduction of letdown flow became a concern in the early morning of March 29. As a result, manual ventings of the makeup tank to reduce pressure began at 4:35 a.m. on March 29. The venting process consisted of short bursts, with vent valve being cycled open for short periods of time to minimize leakage of radioactive material. According to a Shift Supervisor, venting of the makeup tank occurs only once every 2 or 3 months during normal operation to remove nonradioactive non-condensible gases and there is no standard operating procedure for venting the tank.

Nonetheless, on March 29, Met Ed wrote and approved operating procedures for the periodic venting of the makeup tank.

The rate of pressure buildup in the makeup tank became too rapid to control with the cyclic opening of the vent valve during early Friday morning, March 30. The liquid relief on the makeup tank opened, allowing all of the contents in the tank to flow into the reactor coolant bleed holdup tanks. The makeup pumps then switched suction to the borated water storage tank. This water bypassed the primary system and was recirculated to the makeup tank and to the reactor coolant bleed holdup tanks through the open liquid relief valve, thus depleting the supply of borated water.

It was crucial to reduce the pressure in the makeup tanks at this time for two reasons.

First, the supply of borated water in the borated water storage tanks was being depleted.

This supply was the only readily available source of borated water for continued boron control of the primary coolant. Second, the increase in pressure in the reactor coolant bleed holdup tanks through the open relief valve on the makeup tank increased the probability that the relief valves on the bleed holdup tanks would open. The opening of the tanks would permit an uncontrolled release of gaseous radioactive material to the environment via the relief system.

A decision was made to vent the makeup tank continuously in an attempt to reduce pressure. During the morning of March 30, 1979, this action was suggested by a Control Room Operator, and all personnel present in the TMI-2 control room agreed. At approximately 7:00 a.m. on March 30, the makeup vent valve was opened. A caution tag was placed on the valve on March 31 at 11:15 p.m., stating, Do not move this valve without Supt. or Shift permission.

USNRC HRDT 18-24 Rev 07/2011

The opening of the vent valve at 7:10 a.m. on Friday, March 30 resulted in a momentary reading of 1200 mR/h, 130 feet above the TMI-2 stack. This reading was the event that apparently triggered the Friday evacuation recommendations. Leaving the valve open provided a continual pathway for gaseous radioactive material to enter the auxiliary building. Leaks in the vent header permitted the gases to enter the auxiliary and fuel handling buildings and be discharged through the stack. Since letdown flow is still being maintained, this release pathway still exists. However, all short-lived radionuclides in the reactor coolant have undergone significant decay since March 28, and releases of radioactive material from Three Mile Island Station are now negligible.

A post accident examination of waste gas compressor B found a hole approximately the size of a quarter. The operation of the compressor at any pressure would be considered a significant release path. However, compressor "B" was off line from March 28 until March 29. In addition, the design of the waste gas system includes a pressure regulator that limits the inlet pressure to the compressors to approximately 1 inch of water gauge. This prevented any high pressures in the vent header from reaching the compressors. These two factors lessened the significance of the release pathway presented by the leaking waste gas system compressors.

18.4 Analysis A number of analyses were performed with the MARCH computer code to assist the TMI Special Inquiry Group. The MARCH code predicts the thermal and hydraulic conditions in the reactor primary system and containment building in core meltdown accidents. The purpose of the analyses was to examine a number of variations in system operation in the TMI accident to evaluate their effect on the extent of core damage. The results indicate that:

1. The throttling of HPI had a major effect on core damage. If the system had been permitted to operate at high flow, the core would not have uncovered regardless of PORV position or the availability of emergency feedwater.

2. Closure of the block valve in the PORV line at 25 minutes into the accident would have permitted the operation of the reactor coolant pumps to continue and would have prevented core damage. An additional delay of one hour in closing the valve would have resulted in severe core damage and possibly core meltdown.

3. The delay in operation of the emergency feedwater system had little effect on the extent of core damage. However, a delay of one hour in the delivery of emergency feedwater would probably have resulted in more severe core damage and possibly core meltdown.

Although the operation of a reactor coolant pump at 2:54 was probably important in limiting the extent of core damage, the core was not recovered until operation of the HPI at 3:20. The top of the core was not uncovered again, although regions of the core remained USNRC HRDT 18-25 Rev 07/2011

vapor blanketed for days. For a number of hours following core recovery, flow through the hot legs was blocked by the presence of hydrogen and the hot leg temperatures remained in the range of 750 - 800°F, to which they had been heated during core uncovery.

Some analyses were performed with MARCH for sequences leading to complete core meltdown to examine the likelihood of different containment failure modes. Since the containment coolers were operational, the greatest threat to containment integrity was felt to be from the rapid combustion of the hydrogen generated from metal-water reactions. If the hydrogen concentration in containment corresponding to 100 percent cladding reaction were to accumulate well beyond the flammability limit, containment failure could result upon ignition. The most likely time for this to occur would be when the pressure vessel fails and the molten core falls into the reactor cavity. Whether, indeed, hydrogen would accumulate to critical levels without undergoing prior combustion and then explode with sufficient energy to fail containment, cannot be determined without further research.

Finally, analyses were performed to evaluate the impact that the hydrogen burning event that occurred in the TMI-2 containment would have, if it were to occur in other types of containment design. In general, the pressure suppression containment designs with lower design pressures are much more vulnerable to hydrogen explosion than large dry containments.

18.5 References

1. NUREG/CR-1250 Vol. II Part 2, A report to the Commissioners and to the public.

2. General Physics Mitigating Core Damage.

3. NUREG/CR-1219, Analysis of the Three Mile Island Accident and Alternative Sequences.

4. General Physics Courseware, Heat Transfer, Thermodynamics, and Fluid Flow Characteristics.

USNRC HRDT 18-26 Rev 07/2011

Appendix - Sequence of Events Initial Conditions:

Reactor Power 97%

Average Temp 581°F RCS Pressure 2155 psig Pressurizer Level 229 inches Pressurizer Heaters and Sprays in Manual ICS in Full Automatic RCS Boron = 1030 ppm RCS Activity 0.397 µC/ml 6 gpm Identified RCS Leakage Transient Initiator - Loss of Condensate Booster Pump Two licensed control room operators were on duty in the control room. The shift superintendent was in his office adjacent to the control room. The shift foreman and two auxiliary operators had been working in the auxiliary building on the No. 7 condensate polisher.

The condensate polishers use ion exchange resins for purification of the feedwater. Flow through the resin bed tends to compact the material into a solid mass. The transfer procedure utilizes demineralized water and station compressed air to break up this mass.

During this transfer process a resin block developed in the transfer line.

At this point, the plant operators had hypothesized that water pressure may have exceeded air pressure, forcing water into the air system. Further, the water made its way to the polisher isolation valve controls causing them to drift toward the close position. It is assumed that the condensate booster pumps tripped first, since the polisher outlet is operated within 50 psig of the NPSH limit for the booster pumps. This problem had occurred before.

Sequence of Events:

04:00:00 Condensate pump "1A" tripped. Feedwater pumps "1A" and "1B" tripped.

Main Turbine tripped. EFW pumps "1"," 2A", and "2B" started 04:00:03 Pressure setpoint of Power Operated Relief Valve (PORV) was exceeded (2255 psig).

04:00:08 Reactor tripped on high RCS pressure (2355).

04:00:12 RCS pressure decreased below PORV setpoint. Solenoid de-energizes providing a closed indication to the operator.

USNRC HRDT 18-27 Rev 07/2011

Sequence of Events (continued) 04:00:13 Indicated Pzr level peaked at 256 inches and began a rapid decrease.

Letdown flow was isolated. Makeup pump "1A" was started and a HPI isolation valve opened. This pump kept tripping (reason unknown) Pzr sprays and heater control returned to automatic.

04:00:15 SG "A" level indicates 74 inches (S/U range). SG "B" level indicates 76 inches (S/U range).

04:00:30 PORV and Pzr safety valve outlet temperatures alarmed high. RCS low pressure trip setpoint reached.

04:00:58 Pzr low level alarm. SG levels are very low, and the differential temperature, hot to cold leg, rapidly approaching zero indicating that OTSGs are going dry.

04:01:45 Both SGs are boiled dry 04:02:01 ESFAS on low RCS pressure. Makeup pump "1B" tripped. HPI pump "1C" started.

04:02:04 DHR pumps "1A" and "1B" started.

04:03:13 The safety injection portion of ESF was manually bypassed. RCDT relief valve lifted.

04:03:28 Pzr high level alarm 04:04:38 The operator stopped makeup pump "1C" and throttled the HPI isolation valves.

04:05:00 Pzr level reached 377 inches and continued to rise (pressure continued to decrease).

04:05:30 Indicated RCS Th and pressure reached saturation (582°F and 1340 psig).

04:08:18 OTSG level at 10 inches on the startup range. The EFW pumps were running, but the discharge valves were closed. The valves are now opened resulting in a dry OTSG being fed with relatively cool water. Th and Tc decreased. RCS pressure, now under control of the loop saturation considerations, followed.

04:10:19 Reactor building sump pump "2B" started.

04:11:43 Pzr level came back on scale and dropped rapidly, as RCS loop temperature continued to decrease from the heat being removed by the OTSGs and EFW pumps.

04:13:13 DHR pumps "1A" and "1B" were shut down.

04:14:48 The RCDT rupture disc failed (191.6 psig).

04:14:50 RCP related alarms actuated. Reactor coolant flow indicated oscillations.

(RCS pressure = 1275 psig, Tc = 567°F).

04:24:58 PORV outlet temperature = 285.4°F. Safety valve outlet temperature =

270°F 04:27:51 Reactor coolant temperature begins to stabilize at approximately 550°F.

Pressure = 1040 psig. OTSG level = 30 inches USNRC HRDT 18-28 Rev 07/2011

Sequence of Events (continued) 04:38:10 Reactor building sump pumps "2A" and "2B" were stopped.

04:40:00 Increasing count rate continued on the Source Range neutron detector.

04:46:23 Letdown cooler monitor count rate began increasing. It will increase by a factor of 10 within the next 40 minutes.

05:13:40 Stopped loop "B" RCPs ("1B" and "2B").

05:30:00 NI-3 (IR) came on scale (increasing).

05:40:40 Stopped loop "A" RCPs ("1A" and "2A") due to high vibration, erratic flow, and decreasing flow.

05:41:00 Excore instrumentation indicated a decreasing flux (factor of 30).

05:42:30 Excore instrumentation indicated increasing flux levels.

05:51:27 Loop "A" and "B" Th temperatures were increasing (eventually went off scale high - 620°F). Cold leg temperatures were decreasing.

06:14:23 Reactor building radiation monitor (particulate sample) went off-scale high.

06:19:00 PORV outlet temperature 228.7°F. Safety valve outlet temperature 189°F and 194°F. Operator closes PORV block valve 06:38:23 Letdown cooler "A" rad. monitor off-scale high.

06:39:23 Two samples indicate RCS boron is 400 ppm. Emergency boration started (feared restart).

06:47:00 Alarm typewriter indication showed SPNDs responding to high temperatures down to 4' level of the core. 90% of the core exit thermocouples >700°F.

06:54:09 After attempting to start RCPs "2A" and "1B", the operator successfully started RCP "2B" by jump starting the interlocks. "2B" ran with high vibration.

Flow was indicated for only a few seconds and returned to zero.

06:54:50 ESFAS logic automatically reset (HPI injection) on increasing pressure (1845).

06:55:00 Site emergency declared Radiation alarms: waste gas discharge, station vent, fuel handling building exhaust 06:55:13 ESF bypasses were cleared.

07:00:00 RCS pressure at 2045 psig.

07:12:00 Opened PORV block valve (RCS pressure control).

07:13:00 RCP "2B" was stopped (zero flow, low current, high vibration).

07:17:00 PORV block valve was closed.

07:19:45 Manually initiated safety injection (low RCS pressure).

07:20:13 Makeup pump "1C" started (rapid quenching probably caused major fuel damage).

07:21:00 Excore instrumentation indicated sharp decrease (reflood).

07:23:23 General emergency declared. Notified the off-site authorities.

USNRC HRDT 18-29 Rev 07/2011

Sequence of Events (continued) 07:32:26 High pressurizer level alarm.

07:37:00 Tripped makeup pump "1C."

07:40:00 Opened PORV block valve.

07:55:39 ESF "A" and "B" actuated on high reactor building pressure. Makeup pump "1C" started.

08:00:00 Over the next 90 minutes, core exit thermocouple readings were manually obtained ranging from 217 to 2580°F. Pzr level = 380 in. RCS pressure =

1500 psig. ESF actuation cleared.

08:18:00 Makeup pumps "1A" and "1C" tripped. Operator attempted to restart "1A" (switch then placed in Pull to Lock) 08:22:00 Makeup pump "1B" was started.

09:15:00 Decision made to repressurize RCS. Closed the PORV block valve. RCS pressure = 1250 psig 09:43:00 By cycling the PORV block valve, RCS pressure was maintained 1865-2150 psig during the next 2 hours0.0833 days <br />0.0119 weeks <br />0.00274 months <br />.

10:04:00 Commenced filling OTSG A (to 97%) using condensate pumps.

11:08:00 EFW pump "2A" was started. OTSG A level reached 100% (operating range) 11:38:54 Station manager ordered the PORV block valve opened.

11:41:35 Bypassed ESFAS 12:30:00 Power operated emergency main steam dump valve was closed at the request of corporate management.

12:31:00 RCS pressure had decreased to 600 psig (indicates floating on CFT).

13:04:00 Makeup pump "1C" stopped (concerned with BWST inventory).

13:10:00 PORV block valve was closed. RCS pressure had decreased to 435 psig and then began to increase (could not get on DHR).

13:50:00 ESF on high-high RB pressure (28 psig). HPI, RB isolation, RB spray pumps

& valves, DHR pumps started, Makeup pump "1C" started. Makeup pump "1A" - no indication of starting or running.

13:50:30 Makeup pump "1C" was stopped. RB spray pumps were stopped 13:57:00 DHR pumps "1A" and "1B" were stopped.

13:58:38 Cleared ESFAS 14:00:00 Opened PORV 14:26:15 Loop "A" Th <620°F. Stays on scale 10 minutes.

14:35:00 RCS pressure decreased to 410 psig and began to increase.

15:06:00 Pzr level decreases to 180" in the next 18 minutes. RCS loop "A" temperature increasing.

USNRC HRDT 18-30 Rev 07/2011

Sequence of Events (continued) 16:00:00 PLANT STATUS: No RCPs running, Makeup pump "1B" running, RCS pressure = 560 psig (increasing), Pzr level = 294" (increasing) Loop A, Th =

590°F, Tc = 340°F, OTSG without heat sink, 44 psig decreasing, nearly full.

Loop B, Th = 620°F, Tc = 180°F, OTSG - isolated & full.

There is no indication of natural circulation. Very little of the decay heat is being removed, except by makeup water and by occasional opening of the PORV block valve. Gradual heatup of the RCS is causing temperature and pressure to rise. Pressure control is being attempted by juggling makeup and PORV block valve.

17:20:00 Reactor building pressure starts to go negative. Pressurizer level starts to drop. RCS pressure = 637 psig (decreasing). Two HPI pumps are providing 425 gpm (total) makeup flow. It is now the intention to repressurize, hopefully to collapse bubbles and begin steaming from OTSG A.

High points were actually hydrogen filled. Collapse of loop bubbles was still impossible. It is the operators belief that the main condenser will soon be available.

20:00:00 Indications show that forced circulation had been reestablished using RCP "1A." RCS pressure was being maintained at 1000 - 1100 psig with temperatures indicating a cooling trend. Heat was being removed from the RCS using OTSG A. OTSG B was isolated and condenser vacuum had been established.

During the accident, there apparently was much concentration on the water level in the pressurizer. This, by the way is natural, because the operators knew to never let the pressurizer get empty (or full). It is, therefore, understandable that they would not be trying to imagine boiling occurring elsewhere in the system.

During this transient, the system pressure and temperature and their relationship to saturated steam conditions were not correlated, at least not in the control room; the operators were much too busy to think about the steam tables. We must endeavor to keep in mind the fact that if pressure drops, we can have DNB occur which ultimately will create partial film boiling in the reactor.

USNRC HRDT 18-31 Rev 07/2011

This page intentionally blank.

USNRC HRDT 18-32 Rev 07/2011

CONTAINMENT BLDG.

SAFETY VALVE ATMOSPHERIC ELECTROMATIC VENT VALVE RELIEF 2

BLOCK VALVE VALVE RUPTURE CONDENSATE STORAGE ISOLATION DISK VALVE RCDT 3

PRESSURIZER 1/2 CAP.

Figure 18-1 1/2 CAP.

STEAM TURBINE TO GENERATOR FULL CAP. REACTOR OTHER STEAM COOLANT REACTOR GENERATOR PUMP CONDENSER MAIN FEED 1 PUMP Three Mile Island CORE CONDENSATE CONDENSATE BOOSTER PUMP POLISHERS PUMP CONTAINMENT SUMP PUMP 4

SUMP

This page intentionally blank Figure 18-2 T = 0 Minutes This page intentionally blank Figure 18-3 T = 8 Minutes This page intentionally blank Figure 18-4 T = 1 Hour This page intentionally blank Figure 18-5 T = 2 Hours This page intentionally blank Figure 18-6 T = 16 Hours This page intentionally blank 0796-18 Figure 18-7 TMI Radiation Release Path1 Figure 18-7 TMI Radiation Release Path

This page intentionally blank