Editing Three Mile Island accident (section)

===Reactor overheating and malfunction of relief valve===
Given that the steam generators were no longer receiving feedwater, heat transfer from the reactor coolant system (RCS)<ref>{{cite web |title=Reactor coolant system |url=https://www.nrc.gov/reading-rm/basic-ref/glossary/reactor-coolant-system.html |quote=The system used to remove energy from the reactor core and transfer that energy either directly or indirectly to the steam turbine. |website=U.S. NRC Glossary |publisher=U.S. Nuclear Regulatory Commission |date=March 9, 2021 |access-date=October 20, 2021}}</ref> was greatly reduced, and RCS temperature rose. The rapidly heating coolant expanded and surged into the pressurizer,<ref>{{cite web |title=Pressurizer |url=https://www.nrc.gov/reading-rm/basic-ref/glossary/pressurizer.html |quote=A tank or vessel that acts as a head tank (or surge volume) to control the pressure in a pressurized water reactor. |website=U.S. NRC Glossary |publisher=U.S. Nuclear Regulatory Commission |date=March 9, 2021 |access-date=October 21, 2021}}</ref><ref>{{cite book |last1=Kerlin |first1=Thomas W. |last2=Upadhyaya |first2=Belle R. |title=Dynamics and Control of Nuclear Reactors |date=October 2019 |publisher=Academic Press |location=London / San Diego, CA / Cambridge, MA / Oxford |isbn=9780128152614 |page=116 |edition=1 |url=https://www.sciencedirect.com/topics/engineering/pressuriser |access-date=October 27, 2021 |quote=A PWR pressurizer is a vessel with liquid water in the bottom section and saturated steam in the top section. A pressurizer is used to regulate the primary coolant pressure (≈ 150 bars) in PWRs and CANDU reactors. The pressurizer is connected to one of the hot leg pipings with a long surge line... Because of the contact between steam and liquid water, the water is also at the saturation temperature at steady state. Spray of cooler water enters from the top and electrical heaters at the bottom heat the liquid water. The steady state can be disturbed by water inflow or outflow, changes in inlet water temperature, changes in spray flow or changes in heater power. A PWR pressurizer control system can alter the pressure by modulating heater power and/or spray flow.}}</ref><ref>{{cite book |last1=Kerlin |first1=Thomas W. |url=https://www.sciencedirect.com/topics/engineering/pressuriser |title=Dynamics and Control of Nuclear Reactors |last2=Upadhyaya |first2=Belle R. |date=October 2019 |publisher=Academic Press |isbn=9780128152614 |edition=1 |location=London, UK; San Diego, California; Cambridge, Massachusetts; Oxford, UK |page=141 |language=en |quote=The purpose of the pressurizer is to control the pressure in the primary loop at a nominal coolant pressure of 2250 lb./in<sup>2</sup> (≈ 153 bars). The primary pressure is regulated by modulating heater power and spray flow from a cold leg… The water in the pressurizer is the only free surface in the primary coolant system. At full power the pressurizer contains 60% of its volume full of water. Changes in pressurizer water level are usually the result of water density changes caused by changes in average coolant temperature… A system called the… Makeup and Purification System controls the water level in the pressurizer… Water is injected into the primary coolant system to increase the pressurizer water level to the set point. A let down flow system decreases the water level… (other functions) are water purification using filters and demineralizers and controlling soluble poison concentration by adding or removing boric acid. |access-date=October 27, 2021}}</ref> compressing the steam bubble at the top. When RCS pressure rose to {{convert|2255|psi|bar|abbr=on}}, the [[pilot-operated relief valve]] (PORV) opened, relieving steam through piping to the reactor coolant drain tank<ref>{{cite web |date=October 2009 |title=Reactor Coolant System, Piping and Pressurizer |url=https://www.nrc.gov/docs/ML1122/ML11221A106.pdf |access-date=November 1, 2021 |website=Pressurized Water B&W Technology Crosstraining Course Manual |publisher=U.S. Nuclear Regulatory Commission, Human Resources Training and Development (HRTD) |pages=2.2-7, 2.2-8 |quote=The Reactor Coolant Drain Tank (RCDT) is designed to condense and cool the steam effluent from the pressurizer safety and relief valves if they should ever be actuated. The tank also serves as a collection point for the liquid waste disposal system... Steam discharged from the code safety valves and relief valves enters the tank through sparger nozzles and is condensed by water contained in the tank. Should the safety valves lift, 1,400,000 lb/hr of saturated steam at 490 psig would be discharged into the manifold of the tank. The steam flow in the tank is assumed to last 15 seconds. Peak pressure and temperature in the tank (outside the sparger manifold) would occur at the end of the steam blowdown and would be 30 psig and 200°F. Overpressure protection for the RCDT is provided by a relief valve with a setpoint of 90 psig and a rupture disc with a 100-psig setting.}}</ref> in the containment building basement. RCS pressure continued to rise, reaching the [[reactor protection system]] high-pressure trip [[Setpoint (control system)|setpoint]] of {{convert|2355|psi|bar|abbr=on}} eight seconds after the turbine trip. The reactor automatically [[Scram|tripped]], its [[control rods]] falling into the [[Nuclear reactor core|core]] under gravity, halting the [[nuclear chain reaction]] and stopping the heat generated by fission. However, the reactor continued to generate [[decay heat]], initially equivalent to approximately 6% of the pre-trip power level. Because steam was no longer being used by the turbine and feed was not being supplied to the steam generators, heat removal from the reactor's primary water loop was limited to steaming the small amount of water remaining in the secondary side of the steam generators to the condenser using turbine bypass valves.<ref>{{cite web |title=Turbine bypass System |url=https://www.nuclear-power.com/nuclear-power-plant/turbine-generator-power-conversion-system/turbine-bypass-system-turbine-steam-dump-system/ |website=Nuclear Power Com |publisher=Nuclear Power for Everybody |access-date=October 21, 2021 |quote=The function of the turbine bypass system is to remove excess energy from the reactor coolant system by discharging a stated percentage of rated main steam flow directly to the main condensers, i.e. by bypassing the turbine. This heat is rejected to the condenser through the steam dump valves.}}</ref><ref>{{cite book |last=Walker |first=J. Samuel |url=https://archive.org/details/threemileislandn00walk/page/73 |title=Three Mile Island: A Nuclear Crisis in Historical Perspective |date=2004 |publisher=University of California Press |isbn=0-520-23940-7 |location=Berkeley, California |pages=73 |quote=The closing of the secondary system caused heat and pressure to rise rapidly in the primary system, largely because the steam generators could no longer remove heat from the water that had come from the core. As a result, eight seconds after the polisher pumps tripped, the reactor scrammed automatically. The control rods entered the core and terminated the production of heat from nuclear fission. But the problem of dealing with decay heat remained... |access-date=October 18, 2021}}</ref><ref>{{cite book |last=Kemeny |first=John J. |url=https://www.hsdl.org/?view&did=769775 |title=Report of the Commission on The Accident at Three Mile Island—The Need For Change: The Legacy of TMI |date=October 1979 |publisher=[[U.S. Government Printing Office]] |isbn=978-1297534478 |location=Washington, D.C. |page=90 |language=en-us |chapter=Account of the Accident |quote=When the feedwater flow stopped, the temperature of the reactor coolant increased. The rapidly heating water expanded. The pressurizer level (the level of the water inside the pressurizer tank) rose and the steam in the top of the tank compressed. Pressure inside the pressurizer built to 2,255 pounds per square inch, 100 psi more than normal. Then a valve atop the pressurizer, called a pilot-operated relief valve, or PORV, opened – as it was designed to do – and steam and water began flowing out of the reactor coolant system through a drain pipe to a tank on the floor of the containment building. Pressure continued to rise, however, and 8 seconds after the first pump tripped, TMI-2's reactor – as it was designed to do – scrammed: its control rods automatically dropped down into the reactor core to halt its nuclear fission. |access-date=October 20, 2021}}</ref>

When the feedwater pumps tripped, three emergency feedwater pumps started automatically. An operator noted that the pumps were running but did not notice that a block valve was closed in each of the two emergency feedwater lines, blocking emergency feed flow to both steam generators. The valve position lights for one block valve were covered by a yellow maintenance tag. The reason why the operator missed the lights for the second valve is not known, although one theory is that his own large belly hid it from his view.<ref>{{cite news |last1=Omang |first1=Joanne |last2=Reid |first2=R. R. |date=May 18, 1979 |title=Nuclear Plant Operators Misread Data in Accident |url=https://www.washingtonpost.com/archive/politics/1979/05/18/nuclear-plant-operators-misread-data-in-accident/ac5da240-33d8-4f2c-9068-73dee5b12694/ |newspaper=[[The Washington Post]] |location=Washington, D.C. |issn=0190-8286 |oclc=1330888409}}</ref> The valves may have been left closed during a surveillance test two days earlier.<ref>{{cite book |last=Kemeny |first=John J |title=Report of the Commission on The Accident at Three Mile Island—The Need For Change: The Legacy of TMI |date=October 1979 |publisher=U.S. Government Printing Office |location=Washington, D.C. |isbn=978-1297534478 |pages=46, 47 |url=https://www.hsdl.org/?view&did=769775 |access-date=October 20, 2021 |chapter=Commission Findings |quote=(v) A 1978 revision in the TMI-2 surveillance procedure for the emergency feedwater block valves violated TMI-2's technical specifications, but no one realized it at the time. The approval of the revision in the surveillance procedure was not done according to Met Ed's own administrative procedures. <vi/>Performance of surveillance tests was not adequately verified to be sure that the procedures were followed correctly. On the day of the accident, emergency feedwater block valves which should have been open were closed. They may have been left closed during a surveillance test 2 days earlier.}}</ref><ref>{{cite book |last=Kemeny |first=John J. |url=https://www.hsdl.org/?view&did=769775 |title=Report of the Commission on The Accident at Three Mile Island—The Need For Change: The Legacy of TMI |date=October 1979 |publisher=U.S. Government Printing Office |isbn=978-1297534478 |location=Washington, D.C. |pages=90, 91 |language=en-us |chapter=Account of the Accident |quote= |access-date=October 20, 2021}}</ref> With the block valves closed, the system was unable to pump water. The closure of these valves was a violation of a key [[Nuclear Regulatory Commission]] (NRC) rule, according to which the reactor must be shut down if all auxiliary feed pumps are closed for maintenance. This was later singled out by NRC officials as a key failure.<ref name=postch1>{{cite news |title=A Pump Failure and Claxon Alert |url=https://www.washingtonpost.com/wp-srv/national/longterm/tmi/stories/ch1.htm |quote=Apparently the valves were closed for routine maintenance, in violation of one of the most stringent rules that the Nuclear Regulatory Commission has. The rule states simply that auxiliary feed pumps can never all be down for maintenance while the reactor is running. |newspaper=[[The Washington Post]] |year=1979 |access-date=September 4, 2016}}</ref>

After the reactor tripped, secondary system steam valves operated to reduce steam generator temperature and pressure, cooling the RCS and lowering RCS temperature, as designed, resulting in a [[Thermal expansion|contraction]] of the primary coolant. With the coolant contraction and loss of coolant through the open PORV, RCS pressure dropped as did pressurizer level after peaking 15 seconds after the turbine trip. Also, 15 seconds after the turbine trip, coolant pressure had dropped to {{convert|2205|psi|bar|abbr=on}}, the reset setpoint for the PORV. Electric power to the PORV's solenoid was automatically cut, but the relief valve was stuck open with coolant water continuing to be released.<ref>{{cite book |last=Walker |first=J. Samuel |url=https://archive.org/details/threemileislandn00walk/page/73 |title=Three Mile Island: A Nuclear Crisis in Historical Perspective |date=2004 |publisher=University of California Press |isbn=0-520-23940-7 |location=Berkeley, California |pages=73–74 |quote=At TMI-2, the PORV opened three seconds after the condensate pumps tripped, exactly as designed. Unfortunately, ten seconds later, after the temperature and pressure in the primary system had diminished, it failed to close as designed. The open relief valve allowed growing quantities of reactor coolant to escape. This was not the first time that the PORV had stuck open at TMI-2, and it was a chronic problem at Babcock & Wilcox plants. The same sequence of events had occurred at Davis–Besse in 1977. In that case, an operator recognized that the valve was open and immediately blocked it. |access-date=October 18, 2021}}</ref>

In post-accident investigations, the indication for the PORV was one of many design flaws identified in the operators' [[User interface|controls, instruments and alarms]].<ref name=cacophony /> There was no direct indication of the valve's actual position. A light on a control panel, installed after the PORV had stuck open during startup testing,<ref>{{cite book |last=Kemeny |first=John J. |url=https://www.hsdl.org/?view&did=769775 |title=Report of the Commission on The Accident at Three Mile Island—The Need For Change: The Legacy of TMI |date=October 1979 |publisher=U.S. Government Printing Office |isbn=978-1297534478 |location=Washington, D.C. |page=44 |language=en-us |chapter=Commission Findings |quote=After an incident at TMI-2 a year earlier during which the PORV stuck open, an indicator light was installed in the control room. That light showed only that a signal had been sent to close the valve—it did not show whether the valve was actually closed—and this contributed to the confusion during the accident. |access-date=October 19, 2021}}</ref> came on when the PORV opened.<ref>{{cite book |last=Norman |first=Donald |title=The Design of Everyday Things |date=1988 |publisher=Basic Books |location=New York |isbn=978-0-465-06710-7 |pages=43–44 |url=https://docs.google.com/viewer?a=v&pid=sites&srcid=ZGVmYXVsdGRvbWFpbnxkZHN1bmxhbXxneDplZGRkMGFiODdhNmJiY2I |access-date=October 18, 2021}}</ref> When that light—labeled ''Light on – RC-RV2 open''<ref>{{cite report |url=https://www.osti.gov/servlets/purl/5603680 |title=Human Factors Evaluation of Control Room Design and Operator Performance at Three Mile Island – 2 (NUREG/CR-1270) |last1=Malone |first1=T. B. |last2=Kirkpatrick |first2=M. |date=January 1980 |publisher=U.S. Nuclear Regulatory Commission |pages=12, 13 |quote=Invalid Information. The PORV status indicator is a single red light located on Panel 4. The light is designed to come on when an electrical signal is transmitted to the PORV to open, and go out when a signal is transmitted for the valve to close. As indicated in Figure 3 the light is labeled "Light on – RC-R V2 open." This design is a violation of basic HFE principles as referenced by the following provision of MIL-STD-1472B, paragraph 5.2.2.1.4-. "The absence or extinguishment of a signal or visual indication shall not be used to denote a 'go-ahead,' 'ready,' 'in-tolerance,' or completion condition ...Changes in display status shall signify changes in functional status rather than results of control actuation alone." |last3=Mallory |first3=K. |last4=Eike |first4=D. |last5=Johnson |first5=J. H. |last6=Walker |first6=R. W. |access-date=October 21, 2021 |others=The Essex Corporation}}</ref>—went out, the operators believed that the valve was closed. In fact, the light when on only indicated that the PORV pilot valve's solenoid was powered, not the actual status of the PORV.<ref>{{cite web |title=Pressurized Water Reactor B&W Technology Crosstraining Course Manual |url=https://www.nrc.gov/docs/ML1122/ML11221A325.pdf |website=USNRC HRDT 18-2 |publisher=U.S. Nuclear Regulatory Commission |access-date=October 20, 2021 |page=18-3 |date=July 2011 |quote=An indicator light in the control room shows when the PORV has been ordered to close—that is, when power to the valve opening solenoid is cut off—but does not show when the valve actually closes. It is now known that the valve did not, if fact, close as it was designed to do. The operators, however, had no direct means of knowing this.}}</ref> While the main relief valve was stuck open, the operators believed the unlighted lamp meant the valve was shut. As a result, they did not correctly diagnose the problem for several hours.<ref>{{cite book |last=Rogovin |first=Mitchell |title=Three Mile Island: a report to the commissioners and to the public. Volume I |date=January 1980 |publisher=U.S. Nuclear Regulatory Commission |location=Washington, D.C. |url=https://www.osti.gov/servlets/purl/5395798 |access-date=October 17, 2021 |pages=14–15 |doi=10.2172/5395798 |osti=5395798 |quote=An indicator light has been installed in the control room, connecting to the opening-and-closing mechanism in the relief valve: when electric power is passed to the solenoid, permitting the valve to open, the light goes on; when diminished pressure in the pressurizer cuts off power to the solenoid, permitting the valve to shut, the light goes off. Unfortunately, the light is proof only that power is reaching the valve-opening mechanism; it is only circumstantial evidence of the actual state of the valve itself, i.e., power has been cut off from the solenoid now, and the light shows it—but the valve remains open. It is ironic, in a day that will be marked by repeated refusal of the operators and supervisors to believe ominous readings from the reactor-monitoring instruments, that they elect to be misled by this bearer of what they perceived to be good tidings.}}</ref>

The operators had not been trained to understand the ambiguous nature of the PORV indicator and to look for alternative confirmation that the main relief valve was closed. A downstream temperature indicator, the sensor for which was located in the tail pipe between the pilot-operated relief valve and the pressurizer relief tank, could have hinted at a stuck valve had operators noticed its higher-than-normal reading. It was not, however, part of the "safety grade" suite of indicators designed to be used after an incident, and personnel had not been trained to use it. Its location behind the seven-foot-high instrument panel also meant that it was effectively out of sight.<ref>{{cite book |last=Walker |first=J. Samuel |url=https://archive.org/details/threemileislandn00walk/page/74 |title=Three Mile Island: A Nuclear Crisis in Historical Perspective |date=2004 |publisher=University of California Press |isbn=0-520-23940-7 |location=Berkeley, California; London, England |page=[https://archive.org/details/threemileislandn00walk/page/74 74] |url-access=registration}}</ref>