Bench Degree·NUCLEAR POWERchapter
Chapter 15: Windscale and Three Mile Island
The first two of four, and neither is the failure the other was. A fire in a machine built for plutonium, with nothing above it to hold the smoke in. And a valve that lied about being shut, in a reactor whose physics never faltered for a second. Both are read here from the investigation report.
The temptation in a chapter like this is to argue. This chapter is going to describe mechanisms instead, and then say what each one changed, because the mechanisms are the part that transfers.
One organising idea before the four. Defence in depth means arranging independent barriers so that no single failure reaches the public: fuel that holds its own fission products, cladding around the fuel, a pressure vessel around the cladding, a containment building around the vessel, and an emergency plan around the site. Each of these four accidents found a different way to defeat that scheme, and each one changed it.
Section 1: Windscale, 1957. No Containment, and a Procedure Nobody Understood
The machine. Windscale Pile No. 1 in Cumberland was not a power station. It was a plutonium production reactor: natural uranium metal in aluminium cans, graphite moderator, cooled by air drawn in at one end and blown out of a 125 m (410 ft) chimney at the other, and also being used to make tritium in cartridges of a lithium-magnesium alloy.
The mechanism. Graphite under neutron bombardment accumulates Wigner energy: carbon atoms knocked out of their lattice positions, storing strain that can release suddenly. The remedy was to heat the pile deliberately and let the lattice relax, which is called annealing, and it was a routine procedure that was not well understood and not well instrumented.
On 7 October 1957 the ninth anneal was started. The temperature rise was uneven, and the operators, reading thermocouples that were not in the places that mattered, judged the anneal incomplete and applied a second heating cycle on 8 October. That overheated part of the core, and a fuel cartridge burst.
Uranium metal burns in air. Chapter 10 explained why power reactors use the oxide instead. The fire spread through neighbouring channels and about 11 tonnes (24,000 lb) of uranium eventually burned. It was not identified as a fire until stack monitors showed radioactivity on 10 October. Increasing the cooling airflow fanned it. Carbon dioxide did nothing. On 11 October the airflow was shut off and the pile was flooded with water, which was a genuine gamble because hot graphite and steam react to make carbon monoxide and hydrogen. It worked.
The release, and every figure here is an estimate that has been revised more than once: roughly 740 TBq of iodine-131, about 22 TBq of caesium-137, around 12,000 TBq of xenon-133, and about 8.8 TBq of polonium-210, which was not recognised as significant at the time and is now thought to have been the largest single contributor to dose.
Milk from about 500 km² (200 square miles) was banned for 44 days and roughly 3,000,000 litres, about 660,000 gallons, was poured away. There were no acute injuries. Modelled excess cancers have been estimated at 32 deaths in a 1983 assessment and revised upward to something like 240 additional cases in a 2007 reappraisal, largely because of the polonium reassessment. These are model outputs of the kind Chapter 7 warned about, they carry very wide bounds, and no epidemiological study has detected them.
And then the single best detail in the whole story. The chimneys had filters at the top, added late in construction at the insistence of John Cockcroft, over objections that they were an expensive afterthought. They were nicknamed Cockcroft’s Follies. They captured a large fraction of the particulate release, and without them the consequences would have been very much worse. A safety feature that had been derided as a waste of money was the reason a disaster was merely an accident.
What it taught. That a reactor without a containment building has no barrier left once the fuel fails. That a dual-purpose plant carries a weapons programme’s schedule pressure into its safety case. That a routine procedure nobody has modelled is not a routine procedure. And that the investigation report was suppressed for thirty years, which is a substantial part of why official reassurance about radiation carries so little weight in Britain, including in the cases where it happens to be correct.
Section 2: Three Mile Island, 1979. An Indicator That Told the Truth About the Wrong Thing
The machine. Unit 2, a pressurised water reactor, 2,772 MW thermal and 906 MW electrical. Nothing that follows is a failure of nuclear physics. The reactor behaved correctly throughout.
The mechanism, in order.
At 04:00 on 28 March 1979 a problem in the condensate polishing system tripped the main feedwater pumps. With no feedwater, the steam generators stopped removing heat, so primary pressure rose, so the pilot-operated relief valve on top of the pressuriser opened to relieve it, exactly as designed. The reactor scrammed. Pressure fell.
The relief valve should then have shut. It stuck open.
And the control room indicator showed it closed, because the indicator was wired to the signal sent to the valve’s solenoid rather than to the valve’s actual position. The lamp was telling the truth about the command and saying nothing about the valve.
Primary coolant now began escaping through an open valve at the top of the system, and over the next two hours roughly a third of the primary inventory left. Emergency high-pressure injection started automatically, as designed.
Then the operators throttled it back, within about four and a half minutes, and this is the part worth understanding rather than judging.
As the system depressurised, water in the reactor vessel began to boil. Steam expanding in the vessel pushed liquid water up into the pressuriser. So the pressuriser level indication read high, and climbing, at the very moment the core was starting to uncover. The operators had been trained, correctly and emphatically, that letting the pressuriser fill solid with water is dangerous. They acted on the training and on the instrument. The instrument was accurate and the inference it invited was fatal.
Two other things were wrong at the same time. Emergency feedwater valves had been left closed after maintenance, so the steam generators could not be refilled for eight minutes. And the alarm printer was running hours behind, so the record of what had happened was unavailable while it was happening.
The outcome. About 45 percent of the core melted, and roughly 19 tonnes (42,000 lb) of molten fuel relocated to the bottom of the reactor vessel. The vessel held. Nobody knew the extent of the damage until cameras were put inside from 1982 onward.
On 30 March the NRC raised the possibility that a hydrogen bubble in the vessel might explode. It could not, because there was no oxygen present to burn with it, but the fear was public before the analysis was. The state governor advised pregnant women and pre-school children within 8 km (5 miles) to leave and about 140,000 people left of their own accord.
Doses, from Chapter 7: an average of 0.01 mSv (1 mrem) to two million people, and a maximum offsite dose of about 1 mSv (100 mrem). No deaths and no detected health effects in four decades of follow-up.
And the fact that makes it an industry failure rather than a plant failure. The same relief valve failure, with the same misleading indication, had occurred at the Davis-Besse plant eighteen months earlier. The lesson existed and had not travelled.
What it taught. That the control room is a safety system. That procedures must be symptom-based, telling an operator what to do about low water level rather than what to do about a specific initiating event, because the operator cannot reliably identify the event. That instrument indications must show state rather than command. That operators need full-scope simulators. And that operating experience has to be exchanged industry-wide, which is why the Institute of Nuclear Power Operations was founded in 1979 and why an American plant now receives and is graded on other plants’ events.
ON THE BENCH: Build the lying level gauge
Parts: a 2 litre (0.5 gallon) clear plastic bottle; about 500 mm (20 in) of clear rigid tube, 10 to 15 mm bore, which is roughly 0.4 to 0.6 in; a length of flexible aquarium tubing; an aquarium air pump, $10, or a length of tube you can blow down; a small clamp; food colouring. Cost: about $15. Time: an hour to build. Hazards: none. No heat is needed, which is the point of using air instead of boiling. Method. The bottle is the reactor vessel. Stand the rigid tube upright beside it, connect its bottom to a fitting low down in the bottle so it acts as a level gauge, and that is your pressuriser. Fill both to a middle level. Punch a small hole high in the bottle for the stuck-open relief valve and pinch it shut with the clamp for now. Then feed air from the pump into the bottom of the bottle so it bubbles up through the water. Those bubbles are steam voids. Release the clamp so water and air escape from the high hole. What you should see: the bubbles displace liquid, so the level in the gauge tube rises while the bottle steadily loses its actual inventory out of the hole. The gauge goes up as the vessel empties. Every reading is arithmetically correct about the water in the gauge tube and completely wrong about the state of the system. Now do the operator’s job. Cover the bottle so only the gauge is visible, run the rig for a minute, and try to say whether you should be adding water or removing it. What this buys you. Three Mile Island is not a story about carelessness. It is a story about an accurate measurement, a reasonable inference, and a system whose state was not observable from anything in the room. Having built the rig you will never read an instrument again without asking what it is physically connected to. The industry’s answer after 1979 was core exit thermocouples and reactor vessel level instrumentation that had not previously been fitted.
ON THE BENCH: The alarm flood
Parts: a phone, a kitchen timer, a computer, and a friend. Cost: nothing. Time: twenty minutes. Hazards: none, unless someone in the house is asleep. Method: set forty separate alarms across at least three devices with different sounds, firing at irregular intervals over ninety seconds. Sit down with a page of two-digit additions and start working. Your job is to finish the arithmetic and to write down which alarm sounded in what order. What you should find: you will manage neither. Within about twenty seconds the alarms stop being individually distinguishable and become a single condition, which you either attend to entirely or ignore entirely. You cannot triage them, because triage needs to know which ones matter and that information is not in the sound. At Three Mile Island something over a hundred alarms activated in the first minutes with no prioritisation, and the printer logging them ran hours behind. The operators were in the state you have just been in, for two hours, with a reactor. The lesson is not about nuclear power. An alarm system with no prioritisation delivers zero information at exactly the moment it matters most. The redesigns after 1979 introduced prioritisation, suppression of consequential alarms, and a small set of always-visible critical safety function displays. If you work with any monitoring system at all, this is the most immediately useful box in the chapter.
Neither of these two is the accident most people mean when they use the word. The next chapter takes the other two, the ones everybody has heard of, and then sets all four side by side to see which barrier each one got through and what the industry added afterwards.
Bench Degree
Get the degree without the diploma.
Learn the material, not how to pass the exam.