a sequence of physical events - Three Mile Island

still having trouble stabilizing the steam generatorlevel, as well. While steam generator B was still filling,the level in A was decreasing.][The condition of the condensate system continuedto deteriorate. Normally, the heat removed fromthe primary system via the steam generators isejected to the atmosphere via the main condenserand cooling towers. The condensers must be maintainedat a vacuum to operate efficiently, however,and condenser vacuum was gradually being lost. Ifcondenser vacuum were to drop below acceptablelevels, the condensate system would be automaticallytripped and an uncontrolled dump of secondarysteam to the atmosphere would occur (Figure11-7). To prevent loss of vacuum, operators deliberatelyshut down the condensate system 1 hourafter the turbine trip and sought to maintain controlover steam pressure by controlling the atmosphericsteam dump.March 28,1979-5:00 a.m.[At the end of the first hour, the situation withwhich the operators were confronted had severelydeteriorated: pressurizer level was high and wasonly barely being held down, the reactor coolantpumps were still operating but with decreasing efficiency,the condensate system was no longer operable,the reactor building pressure and temperaturewere slowly increasing, the alarm computer laggedso badly that it was virtually useless, and radiationalarms were beginning to come on.]At 1 hour 2 minutes, the alarm printer failed, andalarms were shifted to the utility printer for the next11 minutes. Alarms from 1 hour 13 minutes to 2hours 37 minutes are irretrievably lost.At 1 hour 11 minutes, operators initiated reactorbuilding cooling. Their action soon halted, andeventually reversed, the rise in reactor building temperatureand pressure. [That this step was considerednecessary by the operators suggests thatthey were aware of increasing temperature andpressure.][The increasing temperature and pressure shouldhave been a good indication that a small-breakLOCA was in progress. In fact, if the air cooling hadnot been initiated, the reactor building would probablyhave been isolated (sealed off) shortly after thistime.]March 28,1979-5:13 a.m.[The operation of the reactor coolant pumps wasseriously impaired. High vibration, low flow, lowamperage, and inability to meet NPSH requirementsled the operators to start shutting down pumps.] At1 hour 13 minutes, reactor coolant pump RC-P1Awas stopped, and pump RC-P1B was stopped a fewseconds later. [The reason for stopping pumps inthe B loop is that power for the pressurizer spraycomes from the A loop. The operators were hopefulof regaining control of pressurizer level and wantedto keep the pressurizer spray operable as long aspossible.]Shutting down two pumps reduced the flow ofcoolant through the reactor core. [Apparently, therewas still enough mass flow in the steam/water mixtureto provide cooling, but not as much cooling asthat provided when a large volume of void-free waterwas circulating. There is no firm evidence ofoverheating at this time. The open valve wasreducing the inventory of water in the RCS, though,and the pressure was getting lower. Water continuedto boil to remove decay heat; this boiling increasedthe amount of steam in the system andfurther impeded circulation.]A few minutes later, analysis of a sample of reactorcoolant indicated a low boron concentration.[This finding, coupled with that of apparently increasingneutron levels, increased operators' fearsof a reactor restart. As explained earlier, the supposedincrease in neutron levels was spurious, appearingon the detector only because bubbles in thedowncomer were allowing more neutrons to reachit. It is believed that the apparently low boron levelwas also spurious, that condensed steam dilutedthe sample. Neither explanation appears to havebeen considered at the time. The operators did apparentlydistrust the low boron concentration, andtook steps to get a second sample.]March 28,1979-5:20 a.m.At 1 hour 20 minutes, an operator had the computerprint out the PORV and pressurizer safetyvalve outlet temperatures. The temperature of thePORV outlet was 283°F. The temperatures on thetwo safety valve outlets were 211°F and 219°F. [Thatthere had been essentially no change in temperaturein 55 minutes should have alerted the operatorsthat the PORV valve had not closed; operatorscould have confirmed this by checking the RCDTand reactor building parameters or by closing theblock valve to see if the outlet temperatureschanged.]Also at 1 hour 20 minutes, the letdown line radiationmonitor began to increase. It increased steadilyto the full-scale reading. [The increase in radioactivitycannot definitely be attributed to fuel failure.Certainly, it was not attributed to this at the time.The letdown monitor was notoriously sensitive, sothat even minor changes in radioactivity wouldcause great variations in the reading.]321