Chapter 2. The Davis Besse September 24, 1977 Event

5 pre

Event Initial Plant Conditions

The plant was holding at about 9% power level to repair a small steam leak on the main turbine. The planned activity level must have been very low because several of the normal operators were off (it was a Saturday). Despite the fact that the shifts were doubled up, my shift was not at normal full manning for licensed operators, even for one normal shift, as I had no Assistant Shift Supervisor (a second SRO) on shift that night. So there were three licensed operators on shift at the time; myself (SRO) and two Reactor Operators (RO). The plant Technical Specifications allowed that Licensed Operator manning at that time. My two licensed Reactor Operators were one from my normal shift and one from the “doubled up” shift. I remember we were over the normal number of non licensed operators. During the Control Room walk through with the off-going shift I noticed the Steam Generator 2 Startup Feedwater Level Control Valve (the one being used) was in manual control. I remember thinking that after I completed shift turn over in the Shift Supervisor office, I’d return to the Control Room and we’d get it in automatic, as it had an operator tied down right at that control station. I was 33 years old, and this was to be my first ever actual Reactor Trip in a commercial nuke plant. In fact it was the first Reactor Trip for my whole operating crew. The next thing I recall was 1.5 hrs later hearing the Code Safeties (MSSVs) lift from the Shift Supervisor’s office; I still had not had the chance to get back over to the Control Room. But I was there in less than 15 sec.

Start-up Feed Fails

Start Up Feed Water Valve Fails Closed

SFRCS TRIP

The Steam/Feed Rupture Control System Trips

 

10sec pre trip

10 Seconds Pre Reactor Trip

When I entered the Control Room the first thing that caught my eye was a large back panel Reactor Coolant temperature meter (it looked like a large round clock used in grade school class rooms) and my recall is it was indicating about 592F degrees and I had the thought “Wow, we’re hot”. I think I had time to say “What happened?” when my RO RB said “Pressurizer is passing 290 inches, I’m going to trip the Reactor.” This was 1m 47s after the initial failure in the Steam/Feed Rupture Control System circuit had closed the feedwater valve to Steam Generator 2, and 49s after the full Steam/Feed Rupture Control System trip had isolated Main Feed Water to and Main Steam (closing Main Steam Isolation Valves) from both Steam Generators. The full Steam/Feed Rupture Control System trip closing the Main Steam Isolation Valves and causing the Main Steam code safeties to lift got the attention of everyone on site. The full Steam/Feed Rupture Control System trip also auto started the Auxiliary Feedwater System to restore feedwater flow to both Steam Generators. Unknown to us at that time Auxiliary Feed Water Pump 2 governor valve had “hung up” after starting, holding the pump speed at 2600 RPM (vice 3600 RPM full speed), insufficient to push Auxiliary Feed Water into Steam Generator 2, and the PORV had cycled open/closed nine times and then stuck open.

The initial Reactor Coolant System pressure drop after the manual trip was not all that unexpected, as the initial loss of feedwater and subsequent Reactor Coolant System heat-up that followed had in-surged a lot of relatively cooler Reactor Coolant System water (~560F) into the ~650F Pressurizer water volume, followed by the normal post reactor trip Pressurizer out-surge pressure and level drop. Add to that after the full Steam and Feedwater Rupture Control System (Steam/Feed Rupture Control System) tripped on an actual Steam Generator 2 low level, the Auxiliary Feed Water was now feeding cold water into the top of the Steam Generator (at least to Steam Generator 1) as opposed to normal hot (>300F) Main Feed Water feeding into the center of the Steam Generator at the preheating section. Auxiliary Feed Water was also starting to increase the Steam Generator water level above the normal pre-trip Main Feed Water level control point (Auxiliary Feed Water controls Steam Generator level a bit higher than Main Feed Water). Both of these effects turned around both the pre-trip Reactor Coolant temperature increase and the increasing Pressurizer level.

2min post trip

One Minute 50 Seconds After Reactor Trip

One minute 10s after the Reactor trip the Reactor Coolant pressure had decreased to 1600PSI initiating the Safety Features Actuation System (SFAS) which started the High Pressure Injection Pumps and initiated a partial Containment Isolation. In summary, roughly three minutes after the initiating failure we (three operators) had all three of the Primary Plant Designed Automatic Safety Systems actuated, The Reactor Protection System (RPS), Safety Features Actuation System, and Steam/Feed Rupture Control System, without a clue of the cause. But within that short duration time frame the cause didn’t really matter; the ROs were well into performing memorized and practiced Emergency Operating Procedure Immediate Actions. There were not any real conversations going on amongst us at the time, the ROs were performing their procedure steps, system verifications, and announcing completions out loud. I was stationed back from the main control boards by the RO desk, listening, and observing the plant response. About that time two additional SRO Licensed Station Staff arrived in the Control Room, my boss the Operations Engineer (BZ), and the Assistant Station Superintendent (TM). BZ volunteered to take over operation of the Make-up/Seal Injection panel relieving my RO, EK, to go to the back panels and block (override) the Safety Features Actuation System signals to the closed Reactor Coolant Pump Seal Injection and Seal Return lines to the 4 running Reactor Coolant Pumps so we could reopen the closed valves to restore these services to the running Reactor Coolant Pumps.

SI & SR

Seal Injection and Seal Return Restored to RCPs, HPI Off

For someone who has never been inside one of these plant Control Rooms it is hard to imagine the level of activity required, and the short time frame required, by the Operators during such an event. You are deluged with information such as Annunciator Alarms and system equipment status light changes as systems get actuated by the automatic Safety Systems. You have to sort the useful from the useless, and make your verifications of proper system response. You also have to “override” some automatic system responses, as we did to restore Seal Injection and Seal Return Leak-off flow to running Reactor Coolant Pumps. Post event analysis of the Reactor Coolant Pump seals showed all four Reactor Coolant Pumps operated for 1m15s without seal injection or seal return, seal return valves were shut for 1m16s, and seal injection valves were shut for 1m52s. I mention this detail because this is the type of thing an Operator has to deal with in real time, all the time… over riding Safety Systems. The fact so much post event investigation was put into analyzing if any damage was done to the Reactor Coolant Pump seals by operating the Reactor Coolant Pumps with the (SFAS) closed valves negates any argument about it being the right thing for us to do at that time. But yet plant designers continue to close these valves unnecessarily (for this event) requiring Operators to stick their neck out and override the Safety System. In this particular case I suggest we had things we could have focused on besides overriding this Safety System. By the way, there is probably not a PWR operator in the world that would not restore Seal Injection and Seal Return flows to his/her running Reactor Coolant Pumps, so why do designers continue to close them when not required?

In parallel to the Control Room activity at this time, another complete set of Operator actions outside the Control Room (unwritten at that time) had started; namely my non licensed Equipment Operators had started the “Steam/Feed Rupture Control System Drill.” It is ironic that this Steam/Feed Rupture Control System, designed to protect the plant from a Main Steam Line or Main Feedwater Line rupture (which to my knowledge has never occurred at any nuke plant, ever), had spuriously tripped so many times during the startup phase of the plant that we had developed a way to quickly recover from it. Once the Steam/Feed Rupture Control System had closed the Main Steam Isolation Valves we had lost our source of Auxiliary Steam (AS) to the Secondary Plant; the goal was to save the Main Condenser Vacuum. If we could do that it would save a full day in the plant recovery time, not to mention 8000 gal of Auxiliary Boiler fuel oil it took to re-pull a condenser vacuum and totally re-do the Feedwater Cleanup operation to de-oxygenate the Feedwater System. The Equipment Operator team basically shed every nonessential Auxiliary Steam load to enable the trapped steam pressure in the system to supply the Main Turbine shaft Gland Sealing steam, got the Auxiliary Boiler running, and restored Auxiliary Steam loads to support that function. Failing to do that the Control Room ROs would have to open the Main Condenser Vacuum Breaker valves to “break” the condenser vacuum, when they saw it start to decrease on the Control Room meter, as it was going to happen anyway when the Gland Sealing steam was lost, via sucking cold Turbine Building air in through the shaft seals, over a very hot Main Turbine shaft, with the potential to warp the shaft. Besides the activity in the Control Room I maintained an awareness of the progress of this Equipment Operator activity.

At about 2.5 minutes after the High Pressure Injection was initiated automatically by the Safety Features Actuation System, the High Pressure Injection flow had started to recover the Pressurizer level. It turned around from a low of about 190”, increased past the normal (pre-trip) level of 200” and was increasing. About 4.5 minutes post trip we turned off the High Pressure Injection pumps at a Pressurizer level of about 220”. About that same time frame we also got the Pressurizer Quench Tank (QT, where the PORV was dumping) High Pressure Annunciator Alarm. I glanced at the tank pressure gauge on the back panel and saw it drop to zero; an Equipment Operator, WTO, standing near the gauge said “The rupture disk just blew.” Yup, I glanced at the PORV position indicator light; it said it was closed. But within 1 minute of that our Pressurizer level started to go straight up. I only have vague recall of my thoughts about the Quench Tank rupture disk blowing; the PORV position indication said it was closed, I knew the PORV had lifted early in the event, I had seen a PORV lift fail the Quench Tank rupture disk before, and the Safety Features Actuation System actuation had closed the Containment Isolation valves for the Quench Tank overpressure vent and Quench Tank cooling system. So I think my thought process on that was simply to make my observation “fit” my experience and move on to what seemed more problematic. I was really more locked in on the Pressurizer level going straight up and the Reactor Coolant System pressure decreasing. A minute or so earlier I had actually had the thought that if Reactor Coolant System pressure continued to drop, that we would dump the Core Flood tanks at 600PSI.

6 min post trip

Six Minutes Post Trip

I’m really not sure anyone can actually describe how a mind works on a problem (but I did recognize I had one), but in the years of hind sight and “soak time” I think I was initially looking at the low pressure and high level as two different independent unrelated problems. We had done what we were trained to do, and the procedures implied, in response to the increasing Pressurizer level; that is stop adding more water. But still it increased at a rapid rate until the indicator actually went off scale high. To put that into perspective at my gut level, in about 2 minutes I watched the Pressurizer level increase from about 190 inches to over 320 inches. At roughly 30 gallons/in for the Pressurizer that’s a ballpark of 2000 GPM addition; a physical impossibility. I positively remember having the thought at the time, that something was happening that we had not been told about, and if we could get the plant “drawing straight lines” I could figure it out. In a way I did what nuke plant designers and trainers fear; an Operator abandoning his discipline conditioning and “winging it.” I was not referring to any Emergency Operating Procedure, as I couldn’t think of one that applied to what I was seeing. I also recall having the thought that I was missing something; some piece that would make this all “fit.” It was along the 7 minute post trip time frame (while the Pressurizer level was still going straight up) I had the thought I needed to both simplify the problem and reduce the heat input to the Reactor Coolant System, so I had the Operators shut down one Reactor Coolant Pump in each loop (an action judged to be “insane” by The Warning authors). This momentarily decreased the rate of Pressurizer level increase, but it quickly resumed the previous rate until it was full.

7min post trip

Seven Minutes Post Trip

8min post trip

Eight Minutes Post Trip

14min post trip

Eight to 14 Minutes Post trip

In the 8 – 10 minute time frame the Reactor Coolant System pressure bottomed out around the 850 – 900 PSI value. This really sunk in to me; we had not done anything to stop it from decreasing; so why did it stop decreasing? (Even I realized my prayers hadn’t really been answered… wink, wink). The only thing that made sense was the Reactor Coolant System was at saturation conditions, flashing to steam and holding the pressure up. At Approximately the 10 -12 minute time frame I grabbed a saturation pressure/temperature graph the ROs kept under the plexiglass cover of their desk and checked the Reactor Coolant System Pressure and Temperature, bingo… I had it. At that time I announced out loud in the Control Room “We are saturated, that’s why the Pressurizer is full… we are boiling in the loops pushing water into the pressurizer.” This is fairly significant and I can’t vouch for how well this sunk in to the other 2 SROs and 2 ROs in the Control Room, but for me it explained the abnormal Pressurizer level response and why Reactor Coolant System pressure hung up where it did. It also totally resolved any of my confusion over the pressure and level response being independent. At that moment I didn’t take it any farther. And it clearly illustrates the power of negative training. Nobody in that Control Room said the Pressurizer doesn’t indicate the water level in the system anymore, we are steam voiding, we have to initiate High Pressure Injection to refill, etc. Five licensed operators are responding to “never pump more water in when the Pressurizer is full.”

15 min post trip

Fifteen Minutes Post Trip

Before any of that really had time to soak in, we received a “Block Permit” Annunciator Alarm for Steam Generator 2 Low Main Steam Line Pressure Steam/Feed Rupture Control System Trip about 13 minutes post trip. This alarm serves as an alert to initiate a “shutdown bypass” block of a low steam pressure; which is a normal occurrence on a plant cool down. But it alerted us to the fact the Auxiliary Feed Pump 2 governor had hung up during starting and it had not been feeding any Auxiliary Feed Water into Steam Generator 2. My RO EK blocked the Steam/Feed Rupture Control System Low Steam Pressure trip to Steam Generator 2, took the Auxiliary Feed Pump 2 governor to manual and spent the next few minutes restoring Steam Generator 2 level. Steam Generator 2 never actually went dry, as reported, as it still had an indicated level and a steam pressure above 600PSI. The effect of the Auxiliary Feed Water spray into the top of the Secondary side of Steam Generator 2, with a highly steam voided Primary side is clearly seen in the above graph at the 16 minute time frame. Steam void collapse caused a significant temporary drop in Pressurizer level and the Loop 2 average temperature dropped also.

22min post trip

Twenty Two Minutes Post Trip

At about the 20 minute post trip mark we received an Annunciator Alarm for Containment High Pressure (at ~2psi), and the Equipment Operator, WTO,  standing by the back panel location of the 4 pressure gauges said “Channel (?) is bouncing off the peg,” meaning the meter pointer was just lifting up off of the zero indicated reading. I literately ran to the back panel and looked at it myself; one meter was bouncing around 1.5PSI and I immediately hollered “Shut the Block valve.” I have no recollection of having an “Aha, that explains it” moment. As I said earlier I knew I was missing something, I knew Mother Nature didn’t lie and the Reactor Coolant System instruments were indicating correctly (we had alternates and backups for everything, except the PORV position) so what I was seeing was in fact accurate and I was aware it was something that had I not been previously taught, explained, or exposed to. I had already “nuked out” (a highly technical Operator word for “think”) the Pressurizer level was full because the system pressure fell to saturation and I knew the PORV had lifted and they could stick open. When the Containment Vessel began to pressurize; it had to be a Loss of Coolant Accident through the PORV.

Once the Pressurizer PORV was isolated by its Block Valve, things did not immediately “get better”; Reactor Coolant System conditions did not immediately start to change. We had stopped the flow of water/steam out of the top of the Pressurizer, and I don’t have any specific recall of us manipulating the Pressurizer electric heaters so I’d imagine they were automatically on, responding to the very low Reactor Coolant System pressure. At that point the Pressurizer bulk water temperature must have been close to the average Reactor Coolant System water temperature, which was about 530F, due to the Reactor Coolant System inflow into the Pressurizer and out the stuck open PORV. In fact I don’t have any recall of what I was thinking during those first several minutes following PORV isolation; so my guess is that my gut was telling me we had found the problem and the plant would recover to more normal post-trip conditions. This is opposed to my fairly detailed recall of events & thoughts leading up to PORV Block Valve closure. I don’t think anybody in the Control Room said much of anything; we just all watched Reactor Coolant System pressure to see if it would recover. Today, in hindsight, the Reactor Coolant System was not exactly in a stable condition. We had one Reactor Coolant Pump running in each loop in a highly steam voided condition, the Pressurizer level was still indicating off scale high, Pressurizer heaters were on attempting to increase Reactor Coolant System pressure, both Steam Generators were being maintained at the correct level by Auxiliary Feed Water. The Reactor Coolant System temperature graph shows Reactor Coolant System temperature was increasing at this time. A mental heat balance of the Reactor Coolant System would indicate the 2 running Reactor Coolant Pumps (and any very small, if any, decay heat from 1 Effective Full Power Day) were adding more heat to the Reactor Coolant System than was being removed. Heat removal was basically being provided by the addition of cold Seal Injection water to the 4 Reactor Coolant Pumps (30-40 GPM total) and heat removal via the Steam Generators using the Auxiliary Feed Pump steam to run the Auxiliary Feed Pump Turbines; we were not dumping any steam manually using any steam dumps.

What we had was a PWR with no P (except what might have been on the front of someone’s pants). Again, there sits the strength of the previous B&W training on Pressurizer level; 5 Licensed Operators all trained exactly the same way and there is no discussion about turning on High Pressure Injection to refill the steam voided Reactor Coolant System. We just basically watched the indicated Pressurizer level and waited for it to tell us we were “allowed” to add more water to the system. Simply put we were waiting for the “actual real process” to move itself back into the realm of our pre-conditioned understanding of the “process.” This is amazing to me in light of the fact several minutes earlier I had announced in the Control Room exactly why the Pressurizer level indicated it was full. And for me it just begs the question of what exactly is an “Operator Error”? There is no doubt in my mind that turning off the High Pressure Injection in response to this Small Break Loss of Coolant Accident based on the Pressurizer level going full, is the wrong thing to do. But who exactly made the error? The simple fact is that before TMI, the “Institutional Arrogance” of the whole Nuclear Industry did not believe a core damage event was even possible. Events were postulated and consequences were analyzed because that was the licensing methodology that was used; but it was the belief (mindset) that core damage was really never going to happen… period. So when TMI became the “Elephant in the Room”, it had to be someone’s fault. It is my understanding that in complicated technology the principle applies that if it is working OK, and then something bad happens, whoever touched the technology last is the culprit (liable). I don’t see that as the case here, it was not exactly OK; there was a fundamental flaw in the understanding of the actual system response to a leak in the steam space of PWR Pressurizers. The only reason that the flaw was not apparent was that it had not happened in a US PWR. The only person who had it right was Murphy. And there were ignored warnings in Westinghouse European PWRs even before the Davis Besse event.

A full ten minutes elapsed after the PORV Block Valve was closed before Pressurizer level began to come back on scale (30 min post trip); the result of the effect of the Pressurizer heaters starting to raise pressure above the saturation pressure thereby collapsing the Reactor Coolant System steam bubbles. Twenty minutes after the PORV Block Valve was closed (40 min post trip), according to the Davis Besse NRC LER narrative, we started a second Make Up Pump to stop the rapid decrease in Pressurizer level. I can’t establish the Pressurizer level from the data graph at that time, as the graph time scale shifts at that end. Also the Pressurizer Level plot scale on the graph only goes down to ~190” and at sixteen minutes after Block Valve closure (36 min post trip) the data goes off the bottom of the plot. The narrative also says the increased makeup flow started a slow decrease in Reactor Coolant System temperature. The narrative further states at twenty two minutes (42 min post trip) we got the Low Pressurizer Level Heater Cut-Off (at 40”) which would de-energize the Pressurizer heaters. And at forty eight minutes (post trip) we started a High Pressure Injection pump, to recover the decreasing Pressurizer level, which allowed reenergizing the Pressurizer heaters. At fifty minutes post trip the AFPT 2 governor was discovered hung up again, when we again got the Steam Generator2 Low Main Steam Pressure Trip Block Permit alarm. I don’t even have any recall this second occurrence; but if I had to speculate I’d say the Operator attending the Auxiliary Feed Pumps and Steam Generator levels diverted his attention to help the Operator establishing High Pressure Injection flow, as it required coordination at both a back panel and a front council panel.  It would have been necessary to again establish a “throttled” High Pressure Injection flow to accomplish our goal of increasing Pressurizer level to recover the heaters, while not over cooling the Reactor Coolant System with High Pressure Injection flow to such an extent that the coolant water contraction decreased the Pressurizer level again (such is life in an Operator’s world). In simple terms the vary water we were adding to regain Pressurizer level was causing loss of Pressurizer level by coolant temperature decrease. This just points out a legitimate case requiring the throttling of High Pressure Injection flow by the Operators. I will also point out this recovery of stable Plant Conditions, from the conditions we had at the time, was well outside the bounds of any Operating Procedure (and may also still be today). It was done solely by “skill of the craft”, which I suspect is now a lost art in the current totally proceduralized mentality of the Nuke World. By fifty six minutes post trip we had the Pressurizer level back to normal control mode and were back on one Make Up Pump, the High Pressure Injection pump shut down, Reactor Coolant System pressure was about 1100PSI and increasing; indicating sub-cooled Reactor Coolant System conditions. We transitioned to a goal of establishing a normal Plant Cool Down.

When I consider our handling of the Make-up and High Pressure Injection system during the recovery at this point, what I see is a total fall back on our previous B&W training and experience, i.e. what’s the Pressurizer level doing? If it’s decreasing add water, if not don’t add more water and don’t let High Pressure Injection overfill.

I’ve recently had an additional thought on our indicated Pressurizer level during this event; what exactly might it have been indicating? The LER narrative states that the steam and water discharge from the blown rupture disk on the Pressurizer Quench Tank impinged on the lower shell of Steam Generator2 to the degree it removed a 10’ high by 20’ wide section of insulation (and also deposited enough mud on Containment floors and walkways to be “shoveled into drums”; something for Emergency Sump plugging scenarios to consider). But the Pressurizer is also in the immediate vicinity of the Quench Tank. At this point I know it’s just speculation because data is probably not available, but could the Quench Tank discharge stream also been influencing the Reference Leg of the Pressurizer level measuring circuit, e.g. boiling it down such that the indication would display much higher than actual level? If so, just what were we actually seeing both during our initial actions and also during our actions to recover Pressurizer level? It is an interesting question, but there probably is nothing to stimulate searching for an answer today. Except maybe the knowledge of what you don’t know can bite you in the ass; according to Murphy.

Data Graph

Event Timeline Plot/Data Graph

-----------------------------------------------------------------------------------------------------------------------------------------

George Kunder, superintendent of technical support at TMI-2, arrived at the Island about 4:45 a.m., summoned by telephone. Kunder was duty officer that day, and he had been told TMI-2 had had a turbine trip and reactor scram. What he found upon his arrival was not what he expected.

"I felt we were experiencing a very unusual situation, because I had never seen pressurizer level go high and peg in the high range, and at the same time, pressure being low," he told the Commission. "They have always performed consistently."

Kunder's view was shared by the control room crew. They later described the accident as a combination of events they had never experienced, either in operating the plant or in their training simulations.

----------------------------------------------------------------------------------------------------------------------------------------

Hi George, welcome to the club; a small group of similarly B&W trained Licensed Operators (about a dozen… at two different plants… independently eighteen months apart) who all independently agreed based on our training, that turning off the High Pressure Injection based on the indicated Pressurizer level was the correct thing to do. So we all made the same “Operator Error.” I’m really sorry about your sense of an “Unusual Situation” but I can clear that up in about a five minute conversation; something the rest of them couldn’t manage in eighteen months. It’s so pathetically simple that any licensed PWR Operator will easily get it; but it required simply looking at the event in real terms not fantasy terms. So… do you have a time machine? We need to talk, you pick the date.

----------------------------------------------------------------------------------------------------------------------------------------

-----------------------------------------------------------------------------------------------------------------------------------------

 

Well… at least somebody “got it.” Too bad they were never asked to identify just who had made an “error.”

 

-----------------------------------------------------------------------------------------------------------------------------------------

 

In the weeks following the accident, NRC apparently (apparently?) was confused as to what emergency procedures plant operators should follow. (I don’t understand the source of this confusion as the legal requirement is for the Operators to follow the approved Plant EOPs, not the written or verbal instructions of the NRC)Thus, within a short span of time, NRC issued and then either modified or contradicted its post-TMI emergency instructions.

 

--------------------------------------------------------------------------------------------------------------------------------------------

 

The above information would be pathetically amusing if it were not true. Unfortunately this is a snapshot in time, “in the weeks following the accident”, which has now expanded to “in the decades following the accident.” And it is only talking about one small issue in the grand scheme of Nuke Power; Reactor Coolant Pumps and High Pressure Injection. (Further discussion about this topic is beyond the scope of this document). This form of “regulation by hysteria” became particularly annoying to me, as by that time my job was involved with revising the Plant Emergency Operating Procedures. I remember on one occasion I even refused to make a change. I only include this information to point out a double standard in the use of the word “error”; there is obviously erroneous guidance in the above information. But does the Kemeny Report use the word “error” to describe any of it? It is my opinion that in the Nuke World only an Operator can make an error. There apparently is no word in the English language to describe such a thing for a non-Operator. And for me the very ultimate example of this phenomenon is the single most powerful error that literally terrorized our nation after TMI, and is likely the error that caused a permanent loss of public confidence in commercial nuclear power. It occurred when Walter Cronkite went on live national TV and reported the NRC was saying “… melted reactor + possibility of explosion…" What the public heard was… a nuke bomb. There are literally volumes of written material and taped discussions about this item available in public documents. See if you can find a single reference that states NRC’s Roger Mattson, the erroneous source of the Hydrogen bubble explosion fiasco, made an error. And then compare that to the number of times you’ve read Operator Error melted the TMI core.

 

To the Operators at TMI2, I’ve never met any of you guys, but I walked in your shoes, and none of us can change history. I tried to help in 1982 at the B&W vs. GPU law suit trial, but my testimony on what we were trained to do on the B&W Simulator was not allowed, because it was determined to be non-relevant. I refer to this as a “trick play by the defense and a bad call by the ref.”  I’d be willing to bet Captain Chesley Sullenberger, who ditched his commercial airliner in the Hudson River after total engine failure wouldn’t agree with that call. In fact I’d suspect if asked what single thing he thought contributed to his successful outcome of that event, he’d say his Flight Simulator Training. After all, it’s not as if he’d been given an actual plane to actually practice the event on the river. Well…duh… if the simulator training is not relevant, exactly what is? But what if the simulator training had been wrong?  I understand turning off High Pressure Injection early in your event is not the “total” of that event, but I know why you did it; it was the same reason I did it, we were told to do it. You guys got thrown under the bus because of the Institutionalized Arrogance and Cognitive Dissonance of the whole Nuclear Industry.

 

Prolog

For a long time it wasn’t even possible for me to think about the TMI accident without Burt Dunn’s remark echoing in my brain; “I can give you some scenarios where the situation would lead to possible fuel damage.” Had I just been lucky? (See Footnote 2 HERE) I knew TMI had been at about 100 EFPD and 97% power, we were only at 1 EFPD and 9% power, and that made all the difference in the world. The post reactor trip decay heat really drives the speed of the transient and we basically had none. So was it just luck that I had more time to think than the TMI Operators because things were moving slower? So I had “made it” but they didn’t? It’s not exactly the same thing, but suppose you lost control of your car at 97MPH verses 9MPH, which case has the better chance of success? And that bothered me. It has taken years of soak time and hours of pouring over transcripts to resolve some of that bother.

 

The earliest issue I can see that was treated differently was my response to the “pegged out high” high Pressurizer level indication. At both plants Operators responded to the increasing Pressurizer level the same way, and why not, we were trained the same and had the same basic procedures. So we both ended up with High Pressure Injection off early, and then had more than just a “strong reluctance” to not turn it back on. We damn well we not going to. From there our reactions diverged. As explained above in my event narrative we had High Pressure Injection off at about 220 inches and increasing, at the event 5 minute time frame. Then as Reactor Coolant System pressure continued to drop I watched Pressurizer level increase from ~200 inches to off scale high from about the 6 minute to 8 minute time frame. I was in total disbelief watching that happen. At that time we really weren’t pumping enough water in to make that happen. We only had one Makeup Pump on at 30-40GPM for Reactor Coolant Pump Seal Injection and had isolated the Letdown flow, so that wasn’t good for more than about an inch per minute of Pressurizer level increase. There was no doubt in my mind that we had not pumped that water in there as it was not physically possible in our pump configuration over the time frame that it happened. At the very time I watched it happen, I did not understand why it happened, and it alarmed me that the level was that high. As stated many times, it had been stressed in training not to let that happen. But there it was, and I never doubted the level reading as we had three front panel meters all saying the same, so it was real. As I stated above in the event narrative I definitely had the strong feeling something was going on that we had not been told about, and also the feeling that I was missing something to make everything I was seeing fit. The TMI Operators apparently had a stronger mindset than me to the training about not letting that happen, because they worked harder to make it “go away.” They returned Letdown to service post trip and had it maxed out at 140 – 160 GPM trying to lower Pressurizer level. We never returned Letdown flow to service post trip as I recall. I’ve also read testimony indicating they we doing a “tank review” searching for a way (flow path) that water might have gotten in there. As I said, we only had one pump running capable of pushing against that Reactor Coolant System pressure and it could not have physically caused it to happen. So my gut feeling rationalization is that I worked harder trying to understand the Pressurizer level response than to make it “go away.”

 

The next issue I can see that was treated differently was my response to changing Containment Vessel conditions. Obviously when I saw the Containment Vessel pressurizing it provided the answer to “what I was missing” and made all the pieces fit, and I ordered the PORV Block Valve closed. TMI Operators saw a different set of Containment Vessel conditions than I did, so some of this discussion is moot. For one thing their Containment drain “catch tank” automatically pumped water into their Auxiliary Building causing significant early additional problems to deal with in the Auxiliary Building. I didn’t have to deal with that distraction. Our Containment drain “catch” point (sump) could not have done that. It got automatically closed off by the same signal that started our High Pressure Injection pumps. But it also makes me wonder why your design didn’t isolate that flow path also when HPI started. Another Containment condition they reacted to was increasing Containment temperature, which testimony indicates they may have attributed to a steam leak from a Steam Generator inside the Containment vessel. A Steam Generator steam leak can also cause Containment pressure to increase, so I obviously didn’t go the steam leak route, but also other steam leak symptoms were not present earlier at our plant.

 

The final issue they had to deal with that I think would have really had an impact on me (had it happened) was when later in the event they saw the Nuclear Instrument Source Range Monitor counts increasing. I would have surely thought the Reactor was returning to critical. Truthfully this would have scared the crap out of me, to the point of likely totally consuming my attention and actions while ignoring everything else. I’m positive I would have ordered emergency boration as they did. But I’d like to think (speculate) that shortly I would have looked at that just like I looked at the Pressurizer level being full. This can’t happen, something else is going on. All the Reactor Control Rods were tripped fully in, and the Reactor Coolant System boron neutron poison still had to be in there, plus Xenon had to be peaking; so the Reactor core just had to be shutdown. The Source Range Monitors, BF3-proportional counters, count neutrons that leak out of the core. The only way they could see more neutrons is if the shield water between them and the core was gone, and that was the water in the Reactor Vessel down comer region. So that water had to be either really, really hot (lower density, thus more leakage), or it was gone.