Minutes to Meltdown
by Bob Williams
The following article appeared in the October/December 2001 issue of Vidya (the journal of the Triple Nine Society).
Did you watch NBC's Dateline on August 14th? They did a one hour program titled Moments to Meltdown, about the accident at Three Mile Island. The program was somewhat interesting, but for me, very personal. I understand the difficulty of a television producer attempting to recount what happened in a very short air time and to present events in an understandable format. The producer also has the problem of trying to understand the events and the matters of importance.
I went to work for Babcock & Wilcox in 1966, before they sold the first of their modern nuclear power reactors. [B&W's nuclear operations were in Lynchburg, Virginia, also known for the Delcon Shield, and Jerry Falwell.] When the first sale was made (Duke power), it was based on a conceptual design. From that point, the company had to do the real design work, the experimental benchmarking, testing, construction, licensing, and startup. The whole process took 6 years, from date of sale to power production. Metropolitan Edison bought their reactor shortly after Duke. It was unit two to be placed with unit one on Three Mile Island.
I spent the first 4 years of my job doing core design, mostly for classified breeder reactors, but also for the second generation of B&W's PWRs (pressurized water reactors). At that point, I moved into the safety analysis area and became task engineer for TMI-2 and several other reactors that were in design phase. That was a long time ago. We were working on the Preliminary Safety Analysis Reports at that time. I probably wrote the accident analysis (Chapter 15) section of the one we submitted for TMI-2. It sort of didn't matter, as PSARs were mostly identical, with a few numbers changed here and there. By the time we got to licensing, I had a staff of engineers who wrote Chapter 15 of the Final Safety Analysis report for TMI-2. I recall signing off on a number of the calculations. I was then responsible for the Reactor Protection System that would scram the reactor, if the monitored parameters reached a setpoint. I determined the setpoints for TMI-2 and every other B&W reactor and set the performance standards for every component of the RPS. [another note... The RPS worked perfectly. The initiating accident was one that I had analyzed and used as the basis for setting the high pressure trip. When the feedwater stopped, the pressure shot up, and the RPS immediately released the control rods, shutting the reactor down.] The TMI-2 reactor was one of the most thermally efficient reactors ever built. It was the only B&W reactor that I inspected from inside (before startup). Startup of TMI-2 was the fastest and most trouble free of any B&W plant.
So, you can see that my interest in the reactor is not casual. I traveled to the site more times than to any of our other sites, lecturing the operators and management about safety analysis. I was not teaching the operators what to do, but rather explaining to them what we did (design, procedures, and specifications) and why. The hope was that this would help them to generally understand how the reactor would operate and protect itself.
I moved out of safety analysis into a different division (Contract Research) a few weeks before the accident and actually learned of it from a customer in New York, who obviously got word very early, as my office was in the same building where all of the design work was done. I was happy to stay out of the crisis, but I naturally watched very closely. Subsequently, my work circled back and involved a number of projects that related to the accident, and I even found myself back at the site once, to meet with the Nuclear Regulatory Commission about control room design.
Later in my career, I left the nuclear business for five years, but then returned to work on the design of a production reactor (weapons isotopes). After blowing abut a billion tax dollars on that, the project was canceled due to the signing of the SALT-2 treaty. Amazingly, I re-encountered the debris of TMI-2 one final time, as I was working on the disposition of DOE held uranium inventories.
Since I have gotten stirred up about the subject, I am going to write some observations that will deal with some aspects of the TV show, which I wish had been presented more clearly.
As the TV show started, we were greeted with camera shots of the cooling towers. This is ALWAYS the case. Somehow, the water vapor seen at the top of the towers becomes the only interesting, and menacing looking, thing that the TV people can find. The towers are basically hollow stacks, which allow air to enter from below and to flow through the hot water that is sprayed at the base of the tower. The heat causes an updraft, sucking in more cool air and allowing the water to be cooled, collected, and pumped not into the reactor, but into the steam generator as feedwater. The TV voice said "how huge" as they showed the cooling towers. Okay, they are big, but the reactor is in a closed containment that was not being shown.
The TV voice told us that the reactor was said to be "accident proof." This is the kind of nonsense that irritates me. What was I doing for 8 years, while analyzing the consequences of accidents? We never said these accidents would not happen, we knew that some of them were inevitable. What we did say was that we had designed systems to protect the reactor and that we had adopted a "defense in depth" concept that went beyond individual accidents to the generic. In this case, that was a very fortunate thing. We learned that there were events that we had not considered, but we also learned that there was so much safety equipment available, and so many precautions taken, that even with multiple failures, NO MEMBER OF THE PUBLIC WAS HARMED. The TV voice never bothered to point this out.
This is a good point to explain one important design consideration. The public is protected from the radioactive material in the reactor by three barriers and by distance. Two of the barriers failed, but all three would have had to fail for any significant off-site release of radiation. The barriers are the fuel clad (failed); the pressure boundary (pipes and vessels -- this failed in the sense that there was a valve stuck open); and the containment building (did not fail -- Note: Chernobyl did not have a containment building).
The TV show illustrated the escape of primary coolant into the containment building by showing a small valve on the top of the pressurizer (that much is sort of correct). But, it showed steam coming from the valve and being blown horizontally. No. If the steam had gone into the containment from the valve, it would not blow sideways, as there was no wind inside the building. But, the steam was not vented to the building, it was directed through a pipe into a quench tank, where it was condensed into water. Since the valve was stuck open, a lot of steam went into the quench tank, eventually overwhelming it, so primary coolant did get released into the building, as steam.
Then there was a small error, in which the TV voice said that the operators thought that too much water was going into the core. Not exactly. A PWR is supposed to be solid (water, but no bubbles). The operators were looking at the pressurizer, which is a vessel that is attached to the reactor vessel by two lines of pipes. They feared that the level in the pressurizer was rising and that it would go solid, causing it to explode. The reality was that the system had lost pressure and the level was not rising, it was falling. The operators could have figured this out from the information they had, but they looked only at the pressurizer level meter. The system pressure meter was located only about 2 inches to the side of the level meter.
The reactor lost feedwater (secondary coolant that goes to the steam generator, boils, then goes as steam to the turbines, then to the cooling tower, then back as feedwater). Primary pressure went up rapidly, causing a reactor trip and opening the emergency safety valve on the pressurizer, which stuck open. [At this point, the operators could have gone home and the reactor would have taken care of itself. They stayed.] Fearing a solid pressurizer, the operators turned off all emergency cooling water. This allowed the reactor to heat up without any way to safely dissipate heat. The result was that it boiled down to partly uncover the core and the uncovered portions of the fuel assemblies oxidized away, allowing fuel pellets to fall into the water below. Cooling water was turned back on, lots of boron-10 was added (a neutron poison) and the reactor was eventually stabilized. In the process, there was much confusion, mistakes, equipment failures, and lots of scared people.
At this point, the TV show began to discuss melting fuel, the China Syndrome and temperatures. This is where they got off in the wrong direction. They said the "core" "was hovering at" a temperature of 4300 F and that it would have melted at 5000 F. This is grossly misleading. They didn't explain what happens when a PWR core gets hot, but I am going to do it right now.
The "fuel" in this reactor was slightly enriched uranium oxide. We used UO2 (there are several other oxides of uranium). The oxide is pressed into cylindrical pellets that are about the diameter of a medium sized ball point pen. Each pellet is about 2 cm long, and has a number of features that are of no importance to this discussion. The pellets are loaded inside a small zircaloy tube, called a pin. The stack of pellets is 12 feet high. These pins are grouped into a matrix of 15 x 15, with a few missing locations (used for control rod pins and instrumentation). Each 15 x 15 group is called a fuel element and can be handled as one piece. The zircaloy tube is also called the fuel cladding. When it reaches a temperature (from memory) of about 1800 F, it starts to react with the cooling water. I can't do subscripts without resorting to HTML that irritates some of our readers, so I will (again from memory) try to describe the reaction with words. Zr + 2 water -> ZrOxide + 2 hydrogen + heat. The reaction is autocatalytic. So, as the temperature goes up, the most likely result is a metal-water reaction. It happens well below the melting point of the ceramic fuel (which I believe the TV people stated correctly as around 5000 F).
It would be impossible for the whole core to reach the temperature they reported. I rather doubt that even one pellet reached that temperature. Years later, when we finally got TV cameras into the core, we saw rubble. That is exactly what I expected to see. The clad was gone from the upper portion of the core (which uncovered) and the pellets simply fell into the bottom of the core area. I don't believe that either the clad or the fuel pellets experienced any melting.
The TV voice also told us that the core was "melting like candle wax." Sorry, that is simply impossible. The pins are not homogeneous and they are not going to just melt, the clad is going to oxidize. [We know that this is what happened, because we finally recovered the core and shipped it off to Idaho as waste.] BTW, the TV people never mentioned that the reactor was shut down and subcritical. They implied otherwise. The heat in question was residual heat and decay heat (plus some heat generated from the metal-water reaction).
Other than being a movie title (auspiciously released just before the accident), the term China Syndrome had been around in the industry for some time. There was a concern that a completely out of control reaction could form a molten ball and burn its way through the bottom of the reactor vessel. After years of analysis, I don't think that most core physicists believe that such a thing would pose the sort of hazard that was initially feared. The concern was, however, real. General Electric, at San Jose, offered me a job to come there and design a core catcher. I declined and don't think they every did the project. B&W also looked into the notion of a core catcher for a while. Most of us (core physicists) now believe that a worst case scenario would result in a mess, but not likely form a critical mass. There are many reasons for this which would take much explaining.
The TV show presented the appearance of the hydrogen bubble as something that was both unexpected and not understood. This is only half correct. Unexpected is absolutely true. We understood exactly what would happen at 1800 F and that it would generate hydrogen. I taught that to the TMI-2 operators and staff. Somehow, we never thought about what would happen to the hydrogen, if the metal-water reaction were to start. We didn't think it would ever start, so we just didn't worry about the gas. Oops... Okay, it happened. Two things followed:
First, some of the hydrogen got into the building and exploded. The TV show painted this as something of a major disaster. It was a surprise, but not a disaster. The building pressure did not reach the design point and our gross over design contained the explosion quite well. The last reactor I worked on, had a spark plug mounted at the top of the containment, so that any hydrogen there could be detonated as it accumulated, so there would not be a risk of a very large explosion.
Second, some people worried that the hydrogen still inside the vessel could find oxygen and explode. Given the stress of the real time discovery of the growing bubble, this was certainly frightening. But where would oxygen come from? Ultimately, it was pretty confidently demonstrated that there were no oxygen or spark sources and little likelihood of an explosion. Little, in this case, means virtually zero. The TV comparison of the hydrogen bubble to the Hindenberg was a very poor analogy.
There was a serious consequence to the hydrogen bubble, in that it pushed water out of the way. If it pushed enough, it may have prevented emergency water flow or some similar problem.
Among the many things that should have been done differently:
The accident was an economic loss. The safety systems were so deep that, even with manual circumvention, the public was protected.