About fifteen seconds into the accident, the control room received the answer everyone wanted.

The relief valve had been told to close.

The indication changed accordingly.

The valve stayed open.

That distinction is small enough to disappear into a diagram.

On March 28, 1979, it sat near the beginning of the most serious accident in the history of American commercial nuclear power.

Three Mile Island Unit 2 did not explode. Nobody at the plant or outside it died or suffered a detectable injury from radiation, according to the Nuclear Regulatory Commission’s current assessment. The containment building remained standing. The reactor vessel held.

Inside that vessel, however, the core partially melted.

Years of examination eventually showed that at least 45 percent of the core had melted and roughly nineteen metric tons of damaged material had relocated into the lower part of the reactor vessel.

The accident began with water going somewhere it should not have gone.

The people in the control room were trying to figure out where.

4:00 a.m.

Unit 2 was a pressurized-water reactor.

Its primary system circulated water through the reactor core under enough pressure that the water remained liquid even at very high temperature. That hot primary water carried heat to steam generators, where a separate secondary water system turned into steam and drove the turbine.

At about four in the morning, the secondary side lost normal feedwater to its steam generators.

The turbine tripped.

The reactor automatically shut down.

That did not make the heat disappear. Fission had stopped, but radioactive decay in the fuel continued producing heat that still had to be removed.

Pressure in the primary coolant system rose.

A pilot-operated relief valve at the top of the pressurizer opened automatically to reduce it. As pressure fell again, the valve received the signal to close.

It did not close.

Mechanically, it had stuck.

The control-room indication nevertheless appeared to tell the operators that the relief action was over. NRC’s present history says the instruments indicated the valve was closed; later post-TMI requirements specifically added actual valve-position indication in control rooms.

The reactor had acquired a leak.

The people operating it thought the leak had stopped.

Thirty seconds

Other things were going wrong at almost the same time.

Three auxiliary feedwater pumps started automatically, but valves in their discharge lines had been left closed. NRC’s April 1979 chronology says the pumps were running by roughly thirty seconds into the event, yet no emergency feedwater reached the steam generators until operators opened the closed valves at about eight minutes.

That is important without needing to become the entire cause of the accident.

The plant had several problems arriving almost on top of one another.

Feedwater was lost.

A relief valve stuck open.

Emergency feedwater initially had nowhere to go.

Alarms and warning lights began accumulating in a control room designed to display the status of hundreds of individual systems rather than explain, in one sentence, what the plant as a whole was doing.

That last distinction matters.

The instruments were not silent.

They were talking too much.

The level went up

About one minute into the event, the indicated water level in the pressurizer began rising rapidly.

That looked like a different problem.

The pressurizer is supposed to contain both water and a steam space. Operators are trained not to let it become completely filled with water because that removes the compressible steam cushion used to control pressure. In the control room’s apparent version of events, the relief valve was closed and emergency injection was now adding water to a system whose pressurizer level was climbing.

So the automatic high-pressure injection system looked as though it might be overfilling the reactor coolant system.

Around two minutes after the accident began, high-pressure injection had started automatically. Within the next several minutes, operators began reducing that flow. One injection pump was manually stopped at roughly four and a half minutes; the second was stopped at around ten and a half.

The reactor was not too full.

It was losing coolant.

The pressurizer level was misleading them about the amount of water covering the core. NRC later made this point bluntly: operators assumed that a sufficiently high pressurizer level meant the reactor vessel itself remained full.

It did not.

The instrument was telling a truth

It is tempting to call the light a failed instrument.

That is not quite right.

The more disturbing problem was what the indication meant.

The control system had removed the electrical command holding the relief valve open. The interface gave the operators the state associated with that command. It did not independently verify that the physical valve had actually moved back to the closed position. Post-TMI requirements would later demand valve-position indication precisely because command state and equipment state were not safe substitutes for one another.

That seems obvious now.

It was apparently less obvious when the plant was designed.

When everything worked normally, the distinction barely existed. Command the valve closed; the valve closes. The indicator changes; the operator moves on.

Only a mechanical failure separates those events.

March 28 supplied one.

The evidence was elsewhere

There were other ways to infer that the relief valve was still open.

Temperature in its discharge piping was one.

Pressure and temperature elsewhere in the plant were others.

The problem was that those readings had to be interpreted against the stronger working assumption that the valve had already shut. NRC’s emergency bulletins issued immediately after the accident instructed other reactor operators specifically to use discharge-pipe temperature, valve-position information and relief-tank conditions to determine whether a relief valve remained open rather than relying on one indication alone.

This was not a case in which one enormous red gauge labeled COOLANT LEAK was ignored.

The control room contained pieces.

A valve indication.

A pressurizer level.

Pressure.

Temperatures.

Pump status.

Alarms.

The operators had to assemble those pieces into a model of a reactor they could not see.

Their model was wrong.

A surprising amount of the plant then behaved logically inside that wrong model.

Two hours and twenty-two minutes

The valve remained open for roughly two hours and twenty-two minutes.

At 6:22 a.m., operators closed a separate block valve in the relief line and stopped the coolant loss. The President’s Commission later preserved some uncertainty over exactly whose suggestion finally caused the block valve to be shut, which is worth leaving unresolved rather than assigning one perfect eureka moment after the fact.

By then, the accident had moved beyond the relief valve.

Coolant inventory had fallen.

Reactor coolant pumps had been turned off after severe vibration developed.

Voids and steam had formed in portions of the system.

The core began losing adequate cooling and overheated.

The original initiating event had been the sort of transient a nuclear plant was designed to survive.

The dangerous part came from the interaction among failures, indications, procedures and operator assumptions after it.

That is why calling Three Mile Island simply “operator error” has never been good enough.

The NRC’s own later summary describes the cause as a combination of equipment malfunctions, design-related problems and worker errors.

The control room

The photographs are almost unfair.

Rows of gauges.

Rows of switches.

Rows of annunciator lights.

One instrument panel runs into another until the room starts looking less like the command center of a machine and more like the inside of the machine itself.

NRC-sponsored human-factors investigators later studied whether the physical control-room design, training and emergency procedures had contributed to the operators’ mistakes. Human factors became one of the central regulatory legacies of the accident.

That is a more useful conclusion than deciding the people at the consoles should simply have been smarter.

A control room exists because human beings cannot stand inside a reactor vessel and watch what the coolant is doing.

Everything they know arrives through representations.

Needles.

Lights.

Alarm windows.

Numbers.

A good interface tells them what the plant is doing.

A bad one may tell them what a relay did and leave them to infer whether the plant followed.

They had seen the valve stick before

The stuck relief valve was not an unimaginable failure mode.

The President’s Commission later reported that TMI-2 had experienced an earlier event in which the same basic kind of relief-valve problem had occurred. An indicator had subsequently been added, yet the indication still did not directly establish the valve’s actual mechanical position.

That detail is unpleasant because it complicates the usual distinction between known and unknown danger.

The plant had learned something.

A relief valve can stick.

A change was made.

The change gave operators information.

The information was not enough to diagnose the same class of failure reliably when the plant was under stress.

That is a very particular kind of safety problem.

You fix the last accident without quite fixing the thing the last accident was trying to tell you.

The core nobody could see

For years, even the physical extent of the damage remained uncertain.

The reactor vessel stayed closed while cleanup and stabilization proceeded. The first manned entry into the reactor building did not occur until July 1980. The reactor vessel head was not removed until 1984, and fuel removal began the following year.

Eventually the interior supplied its own record.

Fuel rods were shattered and distorted.

Large quantities of core material had melted.

Later technical work concluded that at least 45 percent of the core had undergone melting and that roughly nineteen metric tons of core material had relocated toward the vessel’s lower head. The vessel nevertheless retained the damaged fuel rather than failing through its bottom.

That distinction was consequential.

Three Mile Island was a severe reactor accident.

It did not become the much larger radiological catastrophe it could have become if the vessel and containment had failed.

Outside the fence

Public fear was enormous.

The actual radiological release was much smaller than the physical damage inside the reactor might suggest.

NRC’s present assessment estimates that roughly two million people around the plant received an average additional dose of about one millirem from the accident, with the maximum dose to an individual at the site boundary below 100 millirem above background. The agency says extensive later studies found no directly detectable health effects attributable to the releases.

Those findings should not be used to declare the accident trivial.

A reactor partially melted.

The event permanently damaged public confidence in nuclear power and exposed weaknesses in plant design, training, regulation, emergency communication and operator-machine interaction.

The physical health consequences and the institutional consequences were simply very different in scale.

History gets worse when one is inflated to prove the other mattered.

The fix became much larger than the valve

NRC began issuing corrective bulletins almost immediately.

Operators at other plants were told not to rely on a single plant parameter, to identify alternative indications of stuck-open relief valves, and to close block valves when a PORV failed to reseat.

The later changes spread much farther.

The regulator required broader control-room design reviews and eventually published human-engineering guidance specifically for evaluating whether controls, displays and workspaces allowed operators to understand plant conditions reliably.

NRC’s post-TMI action program included safety-parameter displays, improved accident-monitoring instrumentation, better operator training and simulator requirements, revised emergency procedures and stronger attention to the man-machine interface.

Relief valves themselves changed too.

By 1990, NRC could point to post-TMI requirements for actual PORV and block-valve position indication in the control room, along with reliability, testing and quality-assurance improvements.

The lesson had become hardware.

The room and Houston

There is a natural Final Vestige connection to The Numbers Came Back.

Apollo 12 presents almost the mirror image of Three Mile Island.

During Apollo 12, Mission Control temporarily lost usable telemetry. John Aaron recognized how to restore it, and once the spacecraft could describe itself again, the crew and ground could begin repairing the underlying electrical problem.

At TMI-2, the control room had plenty of information.

What it lacked was a reliable way to turn that information into one accurate picture of the machine.

One accident needed the numbers back.

The other needed the numbers to mean what people thought they meant.

The light

A control-room photograph from 1979 looks archaic now.

Analog gauges.

Rows of mechanical switches.

Small square lights.

Paper procedures.

People standing close together because the information was distributed across walls instead of condensed onto modern integrated displays.

The temptation is to look at the equipment and decide the accident belongs to an older technological age.

That would miss the useful part.

Every complicated machine still has some version of the same problem.

A display may tell a person that a command was issued.

A database may say a process completed.

A status field may turn green.

A warning may disappear.

None of those things is necessarily the physical world.

At Three Mile Island, the difference was a valve.

The light said closed.

The water kept leaving.

Sources & Further Reading

• U.S. Nuclear Regulatory Commission, “Backgrounder on the Three Mile Island Accident.” The clearest current institutional chronology, health-effects assessment and summary of regulatory changes.
• President’s Commission on the Accident at Three Mile Island, The Need for Change: The Legacy of TMI (1979). Principal independent federal inquiry into the relief-valve indication, operator actions, plant design and institutional failures.
• NRC Special Inquiry Group, Three Mile Island: A Report to the Commissioners and to the Public (NUREG/CR-1250). Detailed technical and regulatory investigation.
• NRC IE Bulletin 79-05A and Bulletin 79-06. Near-contemporary records preserving the minute-by-minute early chronology and immediate lessons sent to other reactor operators.
• NRC, TMI-2 Lessons Learned Task Force Final Report (NUREG-0585). Recommendations for changes in reactor design, operation and regulation.
• NRC, Guidelines for Control Room Design Reviews (NUREG-0700, 1981). One of the clearest institutional descendants of TMI’s human-factors problems.
• NRC Generic Letter 90-06 / Generic Issue 70. Documents later PORV reliability requirements, including actual valve-position indication in the control room.
• Idaho National Laboratory / DOE post-accident core studies. Later physical examination establishing the extent of melting and relocation inside the reactor vessel.