Nuclear safety Lecture 4. The accident of the TMI-2 (1979) Ildikó Boros BME NTI 27 February 2017
The China Syndrome Opening: 16 March 1979 Story: the operator of the Ventana NPP tries to hide the safety deficiencies of the reactor Awards 4 Oscar nominations 5 Golden Globe nominations Cannes best actor award for Jack Lemmon Etc. 2
TMI-2 accident Harrisburg, Pennsylvania, USA 28 March, 1979. (12 days after the opening of The China Syndrome) Partial core melting in a PWR unit Very limited environmental release (or health consequences) But: large effect on nuclear safety 3
2 units at the site The TMI nuclear power plant Unit 1: 880-MW PWR, started on 1974-06-19 Still operating! Unit 2: 907 MW PWR, started on 1978-04-21 2 vertical steam generators, 4 main coolant pumps (2 hot legs, 4 cold legs), one turbine, 3 emergency feedwater pumps Owners: Pennsylvania Electric Company, Jersey Central Power & Light Company, Metropolitan Edison Company (MetEd) Operator: Metropolitan Edison Company (MetEd) 4
TMI-2 Dr. Aszódi Attila, 5 BME NTI
TMI-2 accident WARNING! This is not a TMI-2-type B&W PWR, only an illustration for 2/4 loops PWRs 6
TMI-2 accident 7
Timeline of TMI-2 Source: NUREG/CR-6042 Initial state: 97% power. t=0 s: A valve closed in feedwater system, that caused SG feedwater pump trip because of low suction side pressure -> turbine trip. t=0-3 s: Emergency feedwater pumps start, but supply no water because the suction side valves are closed. Maintenance error Maintenance + operator error No secondary heat removal! 8
The TMI-2 accident Source: Kemeny report 9
Source: NUREG/CR-6042 Timeline of TMI-2 t=3-6 s: Because of high primary pressure the PORV of pressurizer opens. t=8 s: SCRAM because of high primary pressure. t=13 s: Because of the decreasing pressure the operation of the PORV ends (voltage cut off), also the light indicating PORV open switched off, but the valve is stuck open! Operators recognize the coolant loss only two hours later. Operator error SB LOCA Stuck PORV: Maintenance + operator + management error 10
Timeline of TMI-2 t=41 s: Low pressurizer level -> operator starts 1A HPIS pump, level increases. t=60 s: SG starts to dry out. t=2 min 2 s: Low primary pressure -> automatic start of 1B and 1C HPIS, 1B shut down by operators. t=4 min 38 s: Pressurizer level increase -> Operators shut down 1C pump, and reduce flow rate of 1A to 10%. t=6 min: Primary pressure 93 bar, hot leg temperature 307 C, water is boiling in primary circuit. Operator error! LOCA is not recognized! t=7 min 29 s: Pump of the sump system transfers leaked primary water from containment to the auxiliary building make-up water tank Source: NUREG/CR-6042 11
Source: NUREG/CR-6042 Timeline of TMI-2 t=8 min: Operators recognize the closed emergency feedwater valves -> after opening feedwater is restored to the secondary circuit. t=11 min: Pressurizer level decreases into the measurement range t=14 min 48 s: Rupture disk of pressurizer relief tank breaks, steam passes into the containment. t=22 min: Strong MCP vibrations -> the phenomenon signs boiling in RCS 12
Timeline of TMI-2 t=1 h 14 min: Operators stop MCPs of B loop to disconnect SG B. t=1 h 41 min: Operators stop MCPs of A loop natural convection does not develop, temperature difference between cold and hot leg rises. t=2 h 18 min: Operators close isolation valves of pressurizer, primary pressure increases. t=2 h 54 min: One MCP starting for 15 minutes, pressure rises to 145 bar (steam formation and Zr-steam reaction). Source: NUREG/CR-6042 13
Source: NUREG/CR-6042 Timeline of TMI-2 t=3 h 12 min: Pressure decreased to 69 bar by opening pressurizer isolation valve t=3 h 20 min: Operators start two HPIS pump Operators try to reduce primary pressure but no success (hydrogen in RPV). t=9 h 50 min: Hydrogen deflagration in containment. t=15 h 50 min: one MCP starts. t=16 h: Core cooling restored. 14
The TMI-2 accident The accident sequence in 7 points: Loss of secondary coolant supply (loss of feedwater, loss of emergency feedwater for 8 minutes) As a result, primary pressure increase -> pressurizer relief valve opened, and stuck Small-break LOCA for 2.5 hours High-pressure injection system started but stopped by the operators Main coolant pumps stopped, but natural circulation is not developing in the primary circuit Core uncovery, partial meltdown Significant hydrogen generation, deflagration in the containment building 15
Core relocation Core state at t=150 min and t=225 min Total release to the environment from March 28 through April 27 was iodine (500-600 GBq) and noble gases (~370 PBq). The largest part of iodine was retained in the primary loop, and in the containment. 16
The TMI-2 accident Events of the following days 28 March, Wednesday Afternoon: hydrogen deflagration on the containment building Recognized only few days later 29 March, Thursday Improving conditions, but problems with accumulated waste water 30 March, Friday Problems with release from the auxiliary building (misunderstood of measured data) NRC considers the urgent evacuation of population NRC: sheltering suggested in the 5-miles radius Governor: evacuation of pregnant women and children under the age of 5, closing of schools Source: Kemeny report 17
The TMI-2 accident Events of the following days 31 March, Saturday The hydrogen problem concerns about possible hydrogen explosion in the primary circuit Free oxygen is necessary for the explosion the question is, whether the radiolysis of the water in the primary circuit is enough for this process or not New calculation results in Yes, in 2 days NRC announces possible evacuation for the 20 miles radius Panic, hundreds of thousands people travels away And Jimmy Carter announces his visit to TMI 1 April, Sunday New calculations: not enough oxygen New results were not published Schools reopen on 4 April, evacuation lifted on 9 April. 18
After the accident Mr. and Mrs. Carter at the control room of unit 2 on 1 th of April First containment access after the accident (summer of 1980) 19
After the accident 1982: the APSR examination APSR: axial power shaping rod assemblies They were inserted at 75% at the time of the accident June 1982: trying to move the 8 Axial Power Shaping Rod assemblies (equipped with measurement devices for acceleration and vibration) Result: 4 assemblies could not move, 4 assemblies inserted without resistance First representation: no core degradation 5 months later: no APSR assemblies exist 20
After the accident Quick Look project: July 1982 video inspection through a control rod drive mechanism penetration result: minor core degradation 21
Other examinations with ultrasonic and sonar equipments Result: significant core degradation without melting After the accident Assumption of core state in April 1984 22
After the accident 1983-1984: sampling from the damaged core By manipulators, tongs Only from the upper debris Assumption: no significant core melting July 1984: removal of vessel head 1985: removal of the upper plenum Investigation with video cameras Sludge-like material in the vessel bottom July 1986: sampling by boring presence of melted fuel! 1985-1993: fuel removal started 1987: half of the fuel is melted 1989: sludge-like material is also solidified corium 23
TMI-2 causes and consequences The Kemény-report Commission set up by President Carter to conduct a comprehensive study and investigation of the recent accident and make recommendations to enable us to prevent any future nuclear accidents Chaired by John G. Kemeny (1926-1992), mathematician, developer of BASIC programming language 24
Accident consequences Consequences of the accident (from the report of Kemeny-commission) Cladding failure of 90% of rods. ~50% of Zr converted into ZrO2 -> core degradation, fuel pellet replacement Fuel temperatures reached 2200 C in the upper part of the core and 2800 C in the lower part Substantial fractions of the control rods melted. Total release to the environment from March 28 through April 27 was iodine (500-600 GBq) and noble gases (~370 PBq). The largest part of iodine (7.5 million curies) was retained in the primary loop, and in the containment. No detectable amounts of the longlived radioactive cesium and strontium escaped to the environment Core melting not recognized! Source: A. Alonso Source: NUREG/CR-6042 25
Accident consequences Consequences of the accident (from the report of Kemeny-commission) Largest release was in the form of fission gases transported through the coolant let-down/ make-up system into the auxiliary building and through the building filters and the vent header to the outside atmosphere. The major release of radioactivity on the morning of March 30 was caused by the controlled, planned venting of the make-up tank into the vent header Maximum estimated radiation dose received by any individual in the offsite general population: 0.7 msv Average dose to a person living within 5 miles of the nuclear plant was calculated to be about 10 percent of annual background radiation Source: A. Alonso Source: NUREG/CR-6042 26
Findings of the Kemeny-report Causes of the accident The root cause is not technical but human error The operators Were not able to recognize the LOCA Stopped the high pressure injection system Not appropriate attitude of the operator and the authority Problems with Training of the operators, Development and implementation of emergency operating procedures Emergency preparedness Feedback from operational experience (9 similar events earlier + the Davis-Besse incident in 1977) Preparedness for emergency communication No health effects are expected as a result of radiation Most important health effect is stress 27
Consequences on nuclear safety Improvement of training and education Improvement of emergency operating procedures Introduction of PSA methods (Rasmussen report!) Preparedness for severe accidents Severe accident management system development (filtered containment venting), SAM procedures Emergency preparedness and response Importance of safety culture! 28
Safety culture Examples Chernobyl Total lack of questioning attitude Directing culture Workers not involved in safety processes (training, education) Management not committed to safety Fukushima Lack of independence of nuclear regulatory body No continuous safety improving Management not committed to safety TEPCO falsification scandal Paks fuel incident Complacency because of past results Deficiencies (IAEA): Commitment to safety Conservative decision making Reporting culture Use of procedures Learning organization 29