NARAC also decided to use this source term to evaluate the potential doses in Japan as well, and that produced an alarming result. “You’ve got to evacuate [Tokyo] and everything else,” reported the NRC’s Jim Dyer.
This prompted the crew at White Flint to complain once again about the way the other agencies were continuing to engage in the source term exercise. “[W]e ought to just have realistic models, not these ultraconservative worst-case things,” said Bill Borchardt.
But even the “realistic” models weren’t simplifying matters. NARAC was also running the NRC’s “plausible realistic” scenarios, which assumed far less containment damage than the NRC’s MELCOR models and no releases from any of the spent fuel pools. According to these results, Japan’s twenty-kilometer evacuation zone was not too small, but rather larger than it needed to be. Then came another surprise: the NRC soon discovered that it had made yet another big mistake. Its “plausible” source term was too low, even for the “realistic” case. Although the NRC tried to cover its tracks by coming up with a post hoc justification for the error, its bungling of the math did not help the commission’s standing in the interagency debate.
Data would eventually show that the actual source term was greater than the NRC’s “plausible realistic” scenarios but far less than the more extreme cases evaluated by the White House and the other agencies. Radioactive iodine concentrations on the West Coast of the United States never reached the levels predicted by the MELCOR source term. Tokyo at large was never imperiled except for a few hot spots, presumably created by unlikely but unfavorable local weather conditions.
However, the dose rate data did support an evacuation zone of about thirty to forty miles (fifty to sixty-seven kilometers) from Fukushima Daiichi, still a much larger distance than the twelve-mile (twenty-kilometer) zone initially established by the Japanese government or the ten-mile emergency planning zone in existence in the United States for reactor accidents.
For the NRC, Fukushima Daiichi redefined “realistic”—something the agency had stubbornly resisted for decades. Its reluctance to seriously consider the likelihood of a severe accident with a large radiological release, even for planning purposes, reflected the commission’s propensity to view accident risks and consequences through rose-colored glasses.
Up until March 2011, for example, the NRC firmly believed that no realistic accident at a U.S. reactor could be serious enough to require more than a ten-mile emergency evacuation. The NRC had adopted that modest safety standard after an earlier reactor emergency provided the nation’s first reality check: the 1979 accident at Three Mile Island.
Since then, the ten-mile zone had remained inviolate. In the NRC’s mind, an accident like Three Mile Island—in which some fuel melted but the containment held, limiting the release of radioactivity—set the limit for the worst accident that needed to be rigorously prepared for at a U.S. nuclear plant. Now, as a result of Fukushima, the realism of this and other assumptions on safety would be severely tested.
7
ANOTHER MARCH, ANOTHER NATION, ANOTHER MELTDOWN
The March 2011 disaster at Fukushima Daiichi recalled another early spring meltdown more than three decades earlier. In March 1979, the Unit 2 reactor core at the Three Mile Island nuclear plant south of Harrisburg, Pennsylvania, suffered a partial meltdown as operators struggled over several days to establish control. The Three Mile Island accident proved much less serious than the crisis at Fukushima Daiichi, but the disasters shared much in common: design inadequacies, equipment failure, and human shortcomings. These led to inadequate cooling of the reactor cores with ensuing meltdowns, hydrogen explosions, releases of radioactivity to the air and water, and evacuations of more than one hundred thousand nearby residents.
There were also notable differences. Three Mile Island Unit 2 was a pressurized water reactor, unlike the boiling water reactors at Fukushima. Three Mile Island was precipitated by an “internal event” in industry parlance, in contrast to the “external” seismic and flooding events at Fukushima. And the challenges at Fukushima Daiichi were far more extreme, not only because of the greater scale of the crisis involving multiple reactors but because the operators had to cope with a sustained total loss of electrical power and the inability to obtain needed supplies because of damaged roads. The more extreme conditions led to a far worse outcome.
But the negligent regulatory and industrial practices that paved the way for both accidents were strikingly similar. The nuclear establishment worldwide had thirty-two years to learn from the mistakes of Three Mile Island and to find ways to avoid repeating them. Was the stage set for another disaster because Three Mile Island’s lessons were forgotten?
The short answers are both no and yes. Many of the mistakes that contributed to Three Mile Island were identified after the accident and addressed in a series of regulatory reforms, with varying degrees of effectiveness. In the United States, control room instrumentation was improved, reactor core cooling and containment isolation systems were enhanced, operator training was intensified, and emergency preparedness drills were beefed up. A number of these reforms were adopted elsewhere in the world. But some critical factors that contributed to the Three Mile Island accident were swept under the rug by regulators both in the United States and abroad. These unlearned lessons remained unheeded three decades later when the waves bore down on Fukushima. Both accidents followed from one common and dangerous belief: that an accident like Three Mile Island, or Fukushima Daiichi, just could not happen.
The March 28, 1979, accident at Three Mile Island began when a pump in the system providing cooling water to the Unit 2 steam generators unexpectedly stopped running, for reasons never determined. That triggered a series of events that caused the reactor to shut down automatically from nearly full power. It was the thirteenth time in a year that problems in this cooling system had forced a shutdown. In the push to restart the reactor and resume generating profitable electricity, nobody had gotten to the root of the problem. This time, luck ran out: a combination of equipment malfunctions, worker miscues, and design flaws transformed warning flags into disaster.
When the accident began at 4:01 a.m., Unit 2 was just thirty-six minutes shy of its first birthday. The reactor was a Babcock & Wilcox pressurized water design, capable of generating about nine hundred megawatts of electricity. Three Mile Island’s owner, Metropolitan Edison Company, was a small utility with little nuclear operating experience.
In a pressurized water reactor, the cooling water that flows through the core is maintained at a pressure high enough to keep it from boiling. To control the pressure, the reactor vessel is connected to a tank known as a pressurizer, which is normally about half filled with water and half with steam. The operators can heat the contents to increase steam pressure at the core, or they can add cooler water to achieve the reverse. Operators at Three Mile Island had been taught to make sure that the pressurizer never filled completely with water, a condition known as going solid, because then they might lose control of the reactor vessel pressure.
Seconds after Unit 2 shut down, three standby emergency pumps automatically started to restore the cooling water flow and resume the removal of heat through the steam generators. But a valve that had been closed for maintenance work two days earlier remained closed for reasons still unknown, blocking the needed water. The operators failed to notice the closed valve for eight minutes.
Absent heat removal by the new coolant, the temperature and pressure of the water inside the reactor vessel began to climb. The rising pressure caused a relief valve atop the pressurizer to open and discharge water to a collection tank in the containment building. Because the reactor had shut down, it was generating significantly less heat than usual. That, along with the open relief valve, allowed the pressure in the reactor vessel to drop below the point at which the valve was supposed to automatically close. But the valve stuck open, and cooling water kept flowing out of the vessel. Operators believed the valve had closed, however, beca
use the indicator light on the control panel went off.
On March 28, 1979, a pump providing cooling water to the Unit 2 reactor at the Three Mile Island nuclear plant south of Harrisburg, Pennsylvania, stopped. It was the thirteenth time problems in this system had forced a shutdown of the year-old reactor. Small quantities of radiation escaped and concerns grew about a hydrogen explosion. Over the next several days tens of thousands of Pennsylvanians fled for their safety. U.S. Nuclear Regulatory Commission
This was not a scenario without precedent. In September 1977 at the Davis-Besse Nuclear Power Station near Toledo, Ohio, a sister plant to Three Mile Island, the relief valve had stuck open under eerily similar circumstances. There was one notable difference: the Ohio reactor was operating then at a much lower power level, giving the operators more time to diagnose the problem and correct it. Unfortunately, information about that near miss was not shared with workers at the eight other reactors of similar design then operating, including Three Mile Island, or at five then under construction. The operators at Davis-Besse had failed to notice the stuck-open relief valve for about twenty minutes; at Three Mile Island it went unnoticed for more than two hours.
During this period, the open valve discharged tens of thousands of gallons of cooling water from the reactor vessel—more than half of what it held. Worse still, the operators were unaware of this because they had no means of directly observing the water level in the reactor vessel. Odd as it may seem, there was no simple gauge. Instead, they relied on the water level in the pressurizer, which was showing the amount to be rising. Something unexpected was happening to mislead them: the stuck-open valve had reduced pressure far enough that the water in the core could now boil and form steam bubbles. Much like what happens when the cap is removed from a bottle of soda that has been shaken, the expanding steam bubbles were causing the volume of the coolant to increase, forcing the pressurizer level upward even though the amount of water was decreasing.
Another set of standby emergency pumps had automatically started and were providing makeup water to the reactor vessel. This measure commonly occurred following a reactor shutdown as the rapid drop in power lowered the pressure and temperature of the water in the primary loop, causing its volume to decrease or “shrink.” But the misleading water-level indication tricked the operators into thinking the pressurizer was in danger of overfilling and going solid. They turned the emergency pumps off and opened valves to drain even more water from the reactor vessel.
Design weaknesses further impaired the operators’ response to the unfolding calamity. The control room computer dutifully printed out alarms and warnings, but the backlog of abnormal conditions grew so large that the printer fell more than two hours behind, jamming at one point and losing critical information. Within minutes of the start of the accident, one hundred alarms were sounding in the control room, adding to the operators’ stress but providing little useful information.
The design also failed to anticipate the magnitude of the event unfolding at Three Mile Island. Radiation detectors had been installed throughout the plant; however, many of them were scaled for relatively low radiation levels. As the reactor core experienced damage, the dials on these detectors moved as high as they could go, unable to provide any useful data as radiation continued to climb. Detection of the rising radiation would have helped the operators to diagnose what was happening and to see if their efforts were working. Instead, the off-scale instruments merely told the operators they had a problem—hardly news by then.
While the barrage of unreliable information impaired the operators’ ability to respond, an information vacuum hindered responses outside the plant. State and federal officials knew early on that there was trouble at Three Mile Island, but limited technology stymied their efforts to learn more. No computer links provided off-site officials with real-time data on plant conditions. Instead, they got strobe-light glimpses into the situation: a reactor pressure reading from twenty-five minutes ago, a core temperature value from ten minutes ago, and radiation levels from two minutes ago. It was like assembling a jigsaw puzzle using pieces from a dozen different puzzles. The dearth of reliable information prompted NRC chairman Joseph Hendrie to remark that he and Pennsylvania governor Richard Thornburgh were “like a couple of blind men staggering around making decisions” (prompting a strong rebuke from the National Federation of the Blind for reinforcing stereotypes).
Approximately two hours after the shutdown, the water level inside the reactor vessel dropped far enough to expose portions of the nuclear fuel rods. Some of the fuel overheated and began to melt. Its zirconium alloy cladding reacted with water to produce large quantities of hydrogen gas; some of the gas flowed through the stuck-open relief valve into the containment building. Molten fuel flowed like lava to the bottom of the reactor vessel, where it began burning through the six-inch-thick metal walls. Fortuitously, workers finally noticed that the relief valve had stuck open and closed another valve to stop the loss of cooling water.
But they found themselves struggling to replace the lost water and to restore forced cooling of the damaged core. The high pressure and the hydrogen bubbles now occupying the reactor vessel thwarted efforts to pump more water in. Finally, after several attempts and many hours, operators were able to depressurize the primary system enough to restart a coolant pump and refill the reactor vessel. They were too late to prevent about half the core from melting but in time to stop it from burning all the way through the bottom of the vessel and spilling onto the containment floor.
Around ten hours after the accident began, there was a pressure spike in the containment building—a hydrogen explosion had occurred. Fortunately, the spike was not strong enough to rupture the massive steel-and-concrete building, which retained most of the radioactivity released from the partially melted core. But radioactive material found other ways to get out.
The operators, fooled into thinking the system had too much water, had opened valves to drain more of it away. That water carried more and more radioactivity as the reactor core overheated and melted. As it moved toward four collection tanks, the water temperature and pressure decreased as it naturally cooled down, and radioactive gases dissolved in the water bubbled free. Vent lines connected the four tanks to two waste gas decay tanks. To keep the drain pathway open, the operators periodically discharged the contents of these two tanks to the atmosphere, and the radioactivity traveled along. In addition, some of the equipment leaked radioactivity into the auxiliary building, from which it later escaped outside.
The venting and other flow paths reportedly released 10 million curies of radioactivity into the air, nearly all in the form of the noble gases xenon-133 and krypton-85. (TEPCO currently estimates that Fukushima Daiichi released about 13.5 million curies of noble gases and about the same amount of iodine-131, along with about half a million curies of highly radioactive cesium isotopes. Compared with the noble gases, radioactive iodine and cesium are much more significant contributors to long-term health effects.)
It took about a month for the reactor core to become reasonably stable with its water temperature below 212°F, the boiling point. It took nearly a year for workers to be able to enter the highly radioactive containment building to ascertain the extent of the damage. It took more than a decade, and $973 million, to clean up the accident. Japanese companies and government agencies contributed $18 million and forty engineers to the cleanup effort. In about 150 minutes, a billion-dollar asset became a billion-dollar liability.
Well before that March day in 1979, American public opinion was deeply divided about nuclear power, given its safety concerns and cost overruns. The 1970s had seen a rise in protests in general, and nuclear energy triggered its own rallies. Although few Americans understood the technology, many knew it could be dangerous, and some objected loudly to its use. But by and large, even for those carrying “No Nukes” signs, the risks of nuclear power remained an abstract concept. Now, that would change.
At about 8:00 a.m. on M
arch 28, the traffic reporter for radio station WKBO in Harrisburg, Pennsylvania, heard on his car’s CB scanner that police and firefighters were mobilizing in Middletown, the river community that is home to the Three Mile Island plant. WKBO’s news director telephoned Three Mile Island and was connected directly to the reactor’s control room. “I can’t talk now, we’ve got a problem,” the control room operator told the newsman, and referred his caller to the plant’s owner, Metropolitan Edison Company, in Reading, Pennsylvania.
There, a spokesman for Met Ed, as the company was known locally, confirmed that a general emergency had been declared but dismissed it as a “red tape” type of thing required by the NRC when certain conditions existed. At 8:25 a.m. WKBO broadcast news of problems at the plant, relying on the utility’s explanation.
A short time later, Met Ed issued a brief press release: “At 4:00 a.m. Wednesday, the reactor at Three Mile Island Unit 2 was automatically tripped and shut down due to a mechanical malfunction in the system. . . . The reactor is being cooled according to design by the reactor coolant system and should be cooled by the end of the day. There is no danger of [a] meltdown.” Soon afterward, teletypes clattered in newsrooms around the United States with a short dispatch from the Associated Press: the Pennsylvania State Police had been advised of a general emergency at the Three Mile Island nuclear plant. There had been “no radiation leak,” but Met Ed officials had asked for a state police helicopter to “carry a monitoring team.”
In fact, by 8:00 a.m. it was clear to Three Mile Island’s station manager that Unit 2 had suffered some fuel damage, based on radiation readings in the containment building. By 9:00 a.m., NRC headquarters in Washington had been alerted. Fifteen minutes later, the White House was notified—precisely the same moment that a Boston radio station reporter called the mayor of Harrisburg to ask what the city was doing about the nuclear emergency. “What emergency?” asked a stunned Mayor Paul Doutrich.
Fukushima: The Story of a Nuclear Disaster Page 19