A Primer on Nuclear Safety: 1.4.2 Complexity and Three Mile Island

A Primer on Nuclear Safety:
1.4.2 Complexity and Three Mile Island
The Accident

Introduction: Nothing illustrates the complexity of the Light Water Reactor and the safety challenges it poses more than the Presidential Commission's report on the Three Mile Island accident. The words "Three Mile Island have become a Shibboleth for the anti-nuclear crowd. The anti-nuclear crowd believes that the words "Three Mile Island" with no other intellectual content is sufficient to both express and explain their opposition to nuclear power. For the anti-nuclear crowd, nuclear power exists out of time and space and thus there is not and there never can be a history of nuclear safety. Advocates of a probabilistic approach to nuclear safety, who hold a very different perspective, saw and continue to see the the Three Mile Island accident as an example of an possible but improbable set of circumstances leading to a nuclear accident. A historic view of the Three Mile Island accident would view that accident in terms of the lessons learned about nuclear safety from the accident.

The most important lesson from the accident was to take safety related decisions out of the hands of the operators, and place it in the hands of built in reactor passive safety systems. Nuclear safety research by reactor builders, has lead to ever safer reactor design. A General Electric description of its latest reactor design, the ESBWR describes, contains data reflecting the evolution of reactor safety.

The GE Boiling Water Reactor/4 was expected to have a core melt down once every 10,000 years.

The Boiling Water Reactor/6 included safety improvements and was expected to have a core meltdown once every 100,000 years.

The Advanced Boiling Water Reactor is expected to have a core meltdown once every 2,000,000 years.

Finally a core melt down is expected with the Evolutionary Simple Boiling Water Reactor once every 29,000,000 years.

To put the full implications of ESBWR safety into perspective, I would like to contrast the risk posed by an ESBWR core meltdown, to that caused u In contrast, the 1,500 square mile Yellowstone Caldera super volcano has a history of eruptions dating back 17 million years. The Yellowstone Caldera super volcano erupts every 600,000 to 800,000 years and it has been over 600,000 years since its last eruption. The last Yellowstone Caldera eruption sent a massive blew 240 cubic miles of rock and lava to bits and send an enormous cloud of volcanic dust high into the atmosphere. Such an eruption would kill millions of people, and virtually destroy the American economy. An eruption of the Yellowstone Caldera super volcano is between 50 and 300 times more likely than an ESBWR core melt down. The Yellowstone Caldera eruption could kill millions of people. The number of people killed and injured by a ESBWR accident is most likely 0. A Yellowstone Caldera super volcano would cause horrible suffering to most of the population of the United States. A ESBWR meltdown would cause extreme unhappiness in the head offices of some insurance companies. Guess which event the anti-nuclear crowd is most obsessed with? Hay some of them are related to insurance executives.

I might add that ESBRW safety feature in the very unlikely event of a core melt down, are superior to those of the Three Mile Island Reactor, which contained that accident without loss of live or injury. Thus there is a history of nuclear safety, and new reactor designs are far safer, than at the time of Three Mile Island.

From "Report of the President's Commission on The Accident at Three Mile Island"
Wednesday March 28, 1979
Part 1

In the parlance of the electric power industry, a "trip" means a piece of machinery stops operating. A series of feedwater system pumps supplying water to TMI-2's steam generators tripped on the morning of March 28, 1979. The nuclear plant was operating at 97 percent power at the time. The first pump trip occurred at 36 seconds after 4:00 a.m. When the pumps stopped, the flow of water to the steam generators stopped. With no feedwater being added, there soon would be no steam, so the plant's safety system automatically shut down the steam turbine and the electric generator it powered. The incident at Three Mile Island was 2 seconds old.

The production of steam is a critical function of a nuclear reactor. Not only does steam run the generator to produce electricity but also, as steam is produced, it removes some of the intense heat that the reactor water carries.

When the feedwater flow stopped, the temperature of the reactor coolant increased. The rapidly heating water expanded. The pressurizer level (the level of the water inside the pressurizer tank) rose and the steam in the top of the tank compressed. Pressure inside the pressurizer built to 2,255 pounds per square inch, 100 psi more than normal. Then a valve atop the pressurizer, called a pilot-operated relief valve, or PORV, opened -- as it was designed to do - - and steam and water began flowing out of the reactor coolant system through a drain pipe to a tank on the floor of the containment building. Pressure continued to rise, however, and 8 seconds after the first pump tripped, TMI-2's reactor -- as it was designed to do -- scrammed: its control rods automatically dropped down into the reactor core to halt its nuclear fission.

Less than a second later, the heat generated by fission was essentially zero. But, as in any nuclear reactor, the decaying radioactive materials left from the fission process continued to heat the reactor coolant water. This heat was a small fraction --just 6 percent -- of that released during fission, but it was still substantial and had to be removed to keep the core from overheating. When the pumps that normally supply the steam generator with water shut down, three emergency feedwater pumps automatically started. Fourteen seconds into the accident, an operator in TMI-2's control room noted the emergency feed pumps were running. He did not notice two lights that told him a valve was closed on each of the two emergency feedwater lines and thus no water could reach the steam generators. One light was covered by a yellow maintenance tag. No one knows why the second light was missed.

With the reactor scrammed and the PORV open, pressure in the reactor coolant system fell. Up to this point, the reactor system was responding normally to a turbine trip. The PORV should have closed 13 seconds into the accident, when pressure dropped to 2,205 psi. It did not. A light on the control room panel indicated that the electric power that opened the PORV had gone off, leading the operators to assume the valve had shut. But the PORV was stuck open, and would remain open for 2 hours and 22 minutes, draining needed coolant water -- a LOCA [loss of coolant accident] was in progress. In the first 100 minutes of the accident, some 32,000 gallons -- over one-third of the entire capacity of the reactor coolant system -- would escape through the PORV and out the reactor let-down system. Had the valve closed as it was designed to do, or if the control room operators had realized that the valve was stuck open and closed a backup valve to stem the flow of coolant water, or if they had simply left on the high pressure injection pumps, the accident at Three Mile Island would have remained little more than a minor inconvenience for Met Ed.

Part 2

To a casual visitor, the control room at TMI-2 can be an intimidating place, with messages coming from the loudspeaker of the plant's paging system; panel upon panel of red, green, amber, and white lights; and alarms that sound or flash warnings many times each hour. Reactor operators are trained how to respond and to respond quickly in emergencies. Initial actions are ingrained, almost automatic and unthinking.

The burden of dealing with the early, crucial stages of the accident at Three Mile Island fell to four men -- William Zewe, shift supervisor in charge of both TMI-l and TMI-2; Fred Scheimann, shift foreman for TMI-2; and two control room operators, Edward Frederick and Craig Faust. Each had been trained for his job by Met Ed and Babcock & Wilcox, the company that supplied the TMI Unit 2 reactor and nuclear steam system; each was licensed by the Nuclear Regulatory Commission; each was a product of his training -- training that did not adequately prepare them to cope with the accident at TMI-2. Indeed, their training was partly responsible for escalating what should have been a minor event into a potentially devastating accident.

Frederick and Faust were in the control room when the first alarm sounded, followed by a cascade of alarms that numbered 100 within minutes. The operators reacted quickly as trained to counter the turbine trip and reactor scram. Later Faust would recall for the Commission his reaction to the incessant alarms: "I would have liked to thrown away the alarm panel. It was'nt’t giving us any useful information." Zewe, working in a small, glass-enclosed office behind the operators, alerted the TMI-l control room of the TMI-2 scram and called his shift foreman back to the control room.

Scheimann had been overseeing maintenance on the plant's Number 7 polisher - - one of the machines that remove dissolved minerals from the feedwater system. His crew was using a mixture of air and water to break up resin that had clogged a resin transfer line. Later investigation would reveal that a faulty valve in one of the polishers allowed some water to leak into the air-controlled system that opens and closes the polishers' valves and may have been a factor in their sudden closure just before the accident began. This malfunction probably triggered the initial pump trip that led to the accident. The same problem of water leaking into the polishers' valve control system had occurred at least twice before at TMI-2. Had Met Ed corrected the earlier polisher problem, the March 28 sequence of events way never have begun.

Part 3

With the PORV stuck open and heat being removed by the steam generators, the pressure and temperature of the reactor coolant system dropped. The water level also fell in the pressurizer. Thirteen seconds into the accident, the operators turned on a pump to add water to the system. This was done because the water in the system was shrinking as it cooled. Thus more water was needed to fill the system. Forty-eight seconds into the incident, while pressure continued falling, the water level in the pressurizer began to rise again. The reason, at this point, was that the amount of water being pumped into the system was greater than that being lost through the PORV.

About a minute and 45 seconds into the incident, because their emergency water lines were blocked, the steam generators boiled dry. After the steam generators boiled dry, the reactor coolant heated up again, expanded, and this helped send the pressurizer level up further.

Two minutes into the incident, with the pressurizer level still rising, pressure in the reactor coolant system dropped sharply. Automatically, two large pumps began pouring about 1,000 gallons a minute into the system. The pumps, called high pressure injection (HPI) pumps, are part of the reactor's emergency core cooling system. The level of water in the pressurizer continued to rise, and the operators, conditioned to maintain a certain level in the pressurizer, took this to mean that the system had plenty of water in it. However, the pressure of reactor coolant system water was falling, and its temperature became constant.

About 2 1/2 minutes after the HPI pumps began working, Frederick shut one down and reduced the flow of the second to less than 100 gallons per minute. The falling pressure, coupled with a constant reactor coolant temperature after HPI came on, should have clearly alerted the operators that TMI-2 had suffered a LOCA, and safety required they maintain high pressure injection. "The rapidly increasing pressurizer level at the onset of the accident led me to believe that the high pressure injection was excessive, and that we were soon going to have a solid system," Frederick later told the Commission.

A solid system is one in which the entire reactor and its cooling system, including the pressurizer, are filled with water. The operators had been taught to keep the system from "going solid" - -a condition that would make controlling the pressure within the reactor coolant system more difficult and that might damage the system. The operators followed this line of reasoning, oblivious for over 4 hours to a far greater threat -- that the loss of water from the system could result in uncovering the core.

The saturation point was reached 5 1/2 minutes into the accident. Steam bubbles began forming in the reactor coolant system, displacing the coolant water in the reactor itself. The displaced water moved into the pressurizer, sending its level still higher. This continued to suggest to the operators that there was plenty of water in the system. They did not realize that water was actually flashing into steam in the reactor, and with more water leaving the system than being added, the core was on its way to being uncovered. And so the operators began draining off the reactor's cooling water through piping called the let-down system.

Eight minutes into the accident, someone -- just who is a matter of dispute -- discovered that no emergency feedwater was reaching the steam generators. Operator Faust scanned the lights on the control panel that indicate whether the emergency feedwater valves are open or closed. He first checked a set of emergency feedwater valves designed to open after the pumps reach full speed; they were open. Next he checked a second pair of emergency feedwater valves, called the "twelve-valves," which are always supposed to be open, except during a specific test of the emergency feedwater pumps. The two "twelve-valves" were closed. Faust opened them and water rushed into the steam generators.

The two "twelve-valves were known to have been closed 2 days earlier, on March 26, as part of a routine test of the emergency feedwater pumps. A Commission investigation has not identified a specific reason as to why the valves were closed at 8 minutes into the accident. The most likely explanations are: the valves were never reopened after the March 26 test; or the valves were reopened and the control room operators mistakenly closed the valves during the very first part of the accident; or the valves were closed mistakenly from control points outside the control room after the test. The loss of emergency feedwater for 8 minutes had no significant effect on the outcome of the accident. But it did add to the confusion that distracted the operators as they sought to understand the cause of their primary problem.

Throughout the first 2 hours of the accident, the operators ignored or failed to recognize the significance of several things that should have warned them that they had an open PORV and a loss of coolant accident. One was the high temperatures at the drain pipe that led from the PORV to the reactor coolant drain tank. One emergency procedure states that a pipe temperature of 2000F indicates an open PORV. Another states that when the drain pipe temperature reaches 1300F, the block valve beneath it should be closed. But the operators testified that the pipe temperature normally registered high because either the PORV or some other valve was leaking slightly. "I have seen, in reviewing logs since the accident, approximately 198 degrees," Zewe told the Commission. "But I can remember instances before . . . just over 200 degrees." So Zewe and his crew dismissed the significance of the temperature readings, which Zewe recalled as being in the 2300F range. Recorded data show the range reached 2850F. Zewe told the Commission that he regarded the high temperatures on the drain pipe as residual heat: "[K]nowing that the relief valve had lifted, the downstream temperature I would expect to be high and that it would take some time for the pipe to cool down below the 200-degree set point."

Part 4

At 4:11 am., an alarm signaled high water in the containment building's sump, a clear indication of a leak or break in the system. The water, mixed with steam, had come from the open PORV, first falling to the drain tank on the containment building floor and finally filling the tank and flowing into the sump. At 4:15 a.m., a rupture disc on the drain tank burst as pressure in the tank rose. This sent more slightly radioactive water onto the floor and into the sump. From the sump it was pumped to a tank in the nearby auxiliary building.

Five minutes later, at 4:20 a.m., instruments measuring the neutrons inside the core showed a count higher than normal, another indication - - unrecognized by the operators -- that steam bubbles were present in the core and forcing cooling water away from the fuel rods. During this time, the temperature and pressure inside the containment building rose rapidly from the heat and steam escaping via the PORV and drain tank. The operators turned on the cooling equipment and fans inside the containment building. The fact that they failed to realize that these conditions resulted from a LOCA indicates a severe deficiency in their training to identify the symptoms of such an accident.

About this time, Edward Frederick took a call from the auxiliary building. He was told an instrument there indicated more than 6 feet of water in the containment building sump. Frederick queried the control room computer and got the same answer. Frederick recommended shutting off the two sump pumps in the containment building. He did not know where the water was coming from and did not want to pump water of unknown origin, which might be radioactive, outside the containment building. Both sump pumps were stopped about 4:39 a.m. Before they were, however, as much as 8,000 gallons of slightly radioactive water may have been pumped into the auxiliary building. Only 39 minutes had passed since the start of the accident.

Part 5

George Kunder, superintendent of technical support at TMI-2, arrived at the Island about 4:45 a.m., summoned by telephone. Kunder was duty officer that day, and he had been told TMI-2 had had a turbine trip and reactor scram. What he found upon his arrival was not what he expected. "I felt we were experiencing a very unusual situation, because I had never seen pressurizer level go high and peg in the high range, and at the same time, pressure being low," he told the Commission. "They have always performed consistently." Kunder's view was shared by the control room crew. They later described the accident as a combination of events they had never experienced, either in operating the plant or in their training simulations.

Shortly after 5:00 a.m., TMI-2's four reactor coolant pumps began vibrating severely. This resulted from pumping steam as well as water, and it was another indication that went unrecognized that the reactor's water was boiling into steam. The operators feared the violent shaking might damage the pumps -- which force water to circulate through the core -- or the coolant piping.

Zewe and his operators followed their training. At 5:14 a.m., two of the pumps were shut down. Twenty-seven minutes later, operators turned off the two remaining pumps, stopping the forced flow of cooling water through the core.

There was already evidence by approximately 6:00 a.m. that at least a few of the reactor's fuel rod claddings had ruptured from high gas pressures inside them, allowing some of the radioactive gases within the rods to escape into the coolant water. The early warning came from radiation alarms inside the containment building. With coolant continuing to stream out the open PORV and little water being added, the top of the core became uncovered and heated to the point where the zirconium alloy of the fuel rod cladding reacted with steam to produce hydrogen. Some of this hydrogen escaped into the containment building through the open PORV and drain tank; some of it remained within the reactor. This hydrogen, and possibly hydrogen produced later in the day, caused the explosion in the containment building on Wednesday afternoon and formed the gas bubble that produced such great concern a few days later.

Other TMI officials now were arriving in the TMI-2 control room. They included Richard Dubiel, a health physicist who served as supervisor of radiation protection and chemistry; Joseph Logan, superintendent of TMI-2; and Michael Ross, supervisor of operations for TMI-l.

Shortly after 6:00 a .m., George Kunder participated in a telephone conference call with John Herbein, Met Ed's vice president for generation; Gary Miller, TMI station manager and Met Ed's senior executive stationed at the nuclear facility; and Leland Rogers, the Babcock & Wilcox site representative at TMI. The four men discussed the situation at the plant. In his deposition, Rogers recalled a significant question he posed during that call: He asked if the block valve between the pressurizer and the PORV, a backup valve that could be closed if the PORV stuck open, had been shut.
QUESTION: What was the response?

ROGERS: George's immediate response was, "I don't know, and he had someone standing next to the shift supervisor over back of the control room and sent the guy to find out if the valve block was shut.

QUESTION: You heard him give these instructions?

ROGERS: Yes, and very shortly I heard the answer come back from the other person to George, and he said, "Yes, the block valve was shut. . . "

The operators shut the block valve at 6:22 a.m., 2 hours and 22 minutes after the PORV had opened.

It remains, however, an open question whether Rogers or someone else was responsible for the valve being closed. Edward Frederick testified that the valve was closed at the suggestion of a shift supervisor coming onto the next shift; but Frederick has also testified that the valve was closed because he and his fellow operators could think of nothing else to do to bring the reactor back under control.

In any event, the loss of coolant was stopped, and pressure began to rise, but the damage continued. Evidence now indicates the water in the reactor was below the top of the core at 6:15 a.m. Yet for some unexplained reason, high pressure injection to replace the water lost through the PORV and let-down system was not initiated for almost another hour. Before that occurred, Kunder, Dubiel, and their colleagues would realize they faced a serious emergency at TMI-2.

In the 2 hours after the turbine trip, periodic alarms warned of low-level radiation within the unoccupied containment building. After 6:00 a.m., the radiation readings markedly increased. About 6:30 a.m., a radiation technician began surveying the TMI-2 auxiliary building, using a portable detector -- a task that took about 20 minutes. He reported rapidly increasing levels of radiation, up to one rem per hour. During this period, monitors in the containment and auxiliary buildings showed rising radiation levels. By 6:48 a.m., high radiation levels existed in several areas of the plant, and evidence indicates as much as two-thirds of the 12-foot high core stood uncovered at this time. Analyses and calculations made after the accident indicate temperatures as high as 3,500F to 4,000F degrees or more in parts of the core existed during its maximum uncovery. At 6:54 a.m., the operators turned on one of the reactor coolant pumps, but shut it down 19 minutes later because of high vibrations. More radiation alarms went off. Shortly before 7:00 a.m., Kunder and Zewe declared a site emergency, required by TMI's emergency plan whenever some event threatens "an uncontrolled release of radioactivity to the immediate environment."

Gary Miller, TMI station manager, arrived at the TMI-2 control room a few minutes after 7:00 a.m. Radiation levels were increasing throughout the plant. Miller had first learned of the turbine trip and reactor scram within minutes after they occurred. He had several telephone conversations with people at the site, including the 6:00 a.m. conference call. When he reached Three Mile Island, Miller found that a site emergency existed. He immediately assumed command as emergency director and formed a team of senior employees to aid him in controlling the accident and in implementing TMI-2's emergency plan.

Miller told Michael Ross to supervise operator activities in the TMI-2 control room. Richard Dubiel directed radiation activities, including monitoring on- and off-site. Joseph Logan was charged with ensuring that all required procedures and plans were reviewed and followed. George Kunder took over technical support and communications. Daniel Shovlin, TMI's maintenance superintendent, directed emergency maintenance. B&W's Leland Rogers was asked to provide technical assistance and serve as liaison with his home office. Miller gave James Seelinger, superintendent of TMI-l, charge of the emergency control station set up in the TMI-l control room. Under TMI's emergency plan, the control room of the unit not involved in an accident becomes the emergency control station. On March 28, TMI-l was in the process of starting again after being shut down for refueling of its reactor.

TMI personnel were already following the emergency plan, telephoning state authorities about the site emergency. The Pennsylvania Emergency Management Agency (PEMA) was asked to notify the Bureau of Radiation Protection (BRP), part of Pennsylvania’s Department of Environmental Resources. The bureau in turn telephoned Kevin Molloy, director of the Dauphin County Office of Emergency Preparedness. Dauphin County includes Harrisburg and Three Mile Island. Other nearby counties and the State Police were alerted.

Met Ed alerted the U.S. Department of Energy's Radiological Assistance Plan office at Brookhaven National Laboratory. But notifying the Nuclear Regulatory Commission's Region I office in King of Prussia, Pennsylvania, took longer. The initial phone call reached an answering service, which tried to telephone the NRC duty officer and the region's deputy director at their homes. Both were en route to work.

By the time the NRC learned of the accident -- when its Region I office opened at 7:45 a.m. -- Miller had escalated the site emergency at Three Mile Island to a general emergency. Shortly after 7:15 a.m., emergency workers had to evacuate the TMI-2 auxiliary building. William Dornsife, a nuclear engineer with the Pennsylvania Bureau of Radiation Protection, was on the telephone to the TMI-2 control room at the time. He heard the evacuation ordered over the plants paging system. "And I said to myself, 'this is the biggie,' " Dornsife recalled in his deposition.

At 7:20 a.m., an alarm indicated that the radiation dome monitor high in the containment building was reading 8 rems per hour. The monitor is shielded by lead. TMI’s shielding is designed to cut the radioactivity reaching the monitor by 100 times Thus, those in the control room interpreted the monitor's alarm as meaning that the radiation present in the containment building at the time was about 800 rems per hour. Almost simultaneously, the operators finally turned on the high pressure injection pumps, once again dumping water into the reactor, but this intense flow was kept on for only 18 minutes. Other radiation alarms sounded in the control room. Gary Miller declared a general emergency at 7:24 a.m. By definition at Three Mile Island, a general emergency is an "incident which has the potential for serious radiological consequences to the health and safety of the general public.

As part of TMI's emergency plan, state authorities were again notified and teams were sent to monitor radiation on the Island and ashore. The first team, designated Alpha and consisting of two radiation technicians, was sent to the west side of the Island, the downwind direction at the time. Another two-man team, designated Charlie, left for Goldsboro, a community of some 600 persons on the west bank of the Susquehanna River across from Three Mile Island. Meanwhile, a team sent into the auxiliary building reported increasing radiation levels and the building's basement partly flooded with water. At 7:48 a.m., radiation team Alpha reported radiation levels along the Island's west shoreline were less than one millirem per hour. Minutes later, another radiation team reported similar readings at the Island's north gate and along Route 441, which runs parallel to the Susquehanna's eastern shore.

Part 6

Nearly 4 hours after the accident began, the containment building automatically isolated. Isolation is intended to help prevent radioactive material released by an accident from escaping into the environment. The building is not totally closed off. Pipes carrying coolant run between the containment and auxiliary buildings. These pipes close off when the containment building isolates, but the operators can open them. This occurred at TMI-2 and radioactive water flowed through these pipes even during isolation. Some of this piping leaked radioactive material into the auxiliary building, some of which escaped from there into the atmosphere outside.

In September 1975, the NRC instituted its Standard Review Plan, which included new criteria for isolation. The plan listed three conditions -- increased pressure, rising radiation levels, and emergency core cooling system activation -- and required that containment buildings isolate on any two of the three. However, the plan was not applied to nuclear plants that had already received their construction permits. TMI-2 had, so it was "grandfathered" and not required to meet the Standard Review Plan, although the plant had yet to receive its operating license.

In the TMI-2 design, isolation occurred only when increasing pressure in the containment building reached a certain point, nominally 4 pounds per square inch. Radiation releases alone, no matter how intense, would not initiate isolation, nor would ECCS activation.

Although large amounts of steam entered the containment building early in the TMI-2 accident through the open PORV, the operators had kept pressure there low by using the building's cooling and ventilation system. But the failure to isolate early made little difference in the TMI-2 accident. Some of the radioactivity ultimately released into the atmosphere occurred after isolation from leaks in the let-down system that continued to carry radioactive water out of the containment building into the auxiliary building.

At 8:26 a.m., the operators once again turned on the ECCS's high pressure injection pumps and maintained a relatively high rate of flow. The core was still uncovered at this time and evidence indicates it took until about 10:30 a.m. for the HPI pumps to fully cover the core again.

By 7:50 a.m., NRC Region I officials had established direct telephone contact with the TMI-2 control room. Ten minutes later, Region I activated its Incident Response Center at King of Prussia, opened a direct telephone line to the Emergency Control Station in the TMI-l control room, and notified NRC staff headquarters in Bethesda, Maryland. Region I officials gathered what information they could and relayed it to NRC headquarters, which had activated its own Incident Response Center. Region I dispatched two teams of inspectors to Three Mile Island; the first left at about 8:45 a.m., the second a few minutes later.

Around 8:00 a.m., it was clear to Gary Miller that the TMI-2 reactor had suffered some fuel damage. The radiation levels told him that. Yet Miller would testify to the Commission: ". . . I don't believe in my mind I really believed the core had been totally uncovered, or uncovered to a substantial degree at that time."

Off the Island, radiation readings continued to be encouragingly low. Survey team Charlie reported no detectable radiation in Goldsboro. Miller and several aides concluded about 8:30 a.m. that the emergency plan was being properly implemented.

Part 9

At Three Mile Island, the control room was crowded with operators and supervisors trying to bring the plant under control. They had failed in efforts to establish natural circulation cooling. This essentially means setting up a flow of water, without mechanical assistance, by heating water in the core and cooling it in the steam generators. This effort failed because the reactor coolant system was not filled with water and a gas bubble forming in the top of the reactor blocked this flow of water. At 11:38 a.m., operators began to decrease pressure in the reactor system. The pressurizer block valve was opened and high pressure injection cut sharply. This resulted again in a loss of coolant and an uncovering of the core. The depressurization attempt ended at 3:08 p.m. The amount and duration of core uncovery during this period remains unknown.

About noon, three employees entered the auxiliary building and found radiation levels ranging from 50 millirems to 1,000 rems (one million millirems) an hour. Each of the three workers received an 800-millirem dose during the entry. At 12:45 pm., the Pennsylvania State Police closed Route 441 to traffic near Three Mile Island at the request of the state's Bureau of Radiation Protection. An hour later, the U.S. Department of Energy team began its first helicopter flight to monitor radiation levels. And at 1:50 p.m., a noise penetrated the TMI-2 control room; "a thud," as Gary Miller later characterized it.

That thud was the sound of a hydrogen explosion inside the containment building. It was heard in the control room; its force of 28 pounds per square inch was recorded on a computer strip chart there, which Met Ed's Michael Ross examined within a minute or two. Yet Ross and others failed to realize the significance of the event. Not until late Thursday was that sudden and brief rise in pressure recognized as an explosion of hydrogen gas released from the reactor. The noise, said B&W's Leland Rogers in his deposition, was dismissed at the time as the slamming of a ventilation damper. And the pressure spike on the strip chart, Ross explained to the Commission, "we kind of wrote it off . . . [as] possibly instrument malfunction.

Miller, Herbein, and Kunder left for Harrisburg soon afterwards for a 2:30 p.m. briefing with Lieutenant Governor Scranton on the events at Three Mile Island. At 2:27 p.m., radiation readings in Middletown ranged from 1 to 2 millirems per hour.