Clean Energy Prof

Tuesday, April 26, 2011

Chernobyl, 25 years later

Being that I teach, among other things, Fundamentals of Nuclear Engineering at the University, I have written extensively on Chernobyl, mostly in this post: The Fermi Chronicles - Part 22: Nuclear Events - Chernobyl, 1986. Here's a Discovery Channel documentary on Chernobyl:

Part 2
Part 3
Part 4
Part 5
Part 6

Despite the disaster, nuclear continues to be the safest large-scale technology known to man.

Current nuke news you can use: How to build a meltdown-proof reactor (original article at DVice)

Let’s just skip directly to the worst-case scenario, like in Japan, where failure of the coolant system caused the reactor to overheat uncontrollably. In terms of what would happen to a pebble bed reactor, this means that there’d no more helium coolant. So, okay, as you might expect, the reactor would start to get really, really hot. As nuclear fuel heats up, the uranium atoms start to move faster, making it harder for them to absorb extra neutrons and split, reducing the reactor’s power. This is what’s called negative feedback, and while it takes place in all reactors, the low fuel density of the pebbles magnifies it in a PBR. As the PBR continues to heat up, the negative feedback gets stronger and stronger until at about 1600 degrees Celsius, the core stabilizes at an “idle” temperature. This temperature is a solid 400 degrees short of what it would take to cause any damage to the fuel spheres or reactor vessel, which are made of a special kind of super strong graphite.

The upshot of all this is that a pebble bed reactor can have the entirety of its supporting infrastructure power down, blow up, get flooded, get stolen, run out of gas, or otherwise fail, all while the entire staff is on vacation, and the only thing that happens is that the PBR will warm up to its idle temperature and… Stay warm. No meltdowns, no explosions, no radiation leaks. The reactor will just sit there and radiate the heat it produces until you cool it back down or take the fuel out. This scenario was tried once, in a prototype PBR in Germany: they shut off the coolant and removed the control rods and watched, and nothing bad happened. A later inspection of the reactor and fuel pebbles showed no damage.

And from Instapundit: TED LECTURE: Kirk Sorensen: Can Thorium End Our Energy Crisis?

And from Next Big Future, this might surprise you: Deaths per TWH by energy source

Energy Source              Death Rate (deaths per TWh)

Coal – world average               161 (26% of world energy, 50% of electricity)
Coal – China                       278
Coal – USA                         15
Oil                                36  (36% of world energy)
Natural Gas                         4  (21% of world energy)
Biofuel/Biomass                    12
Peat                               12
Solar (rooftop)                     0.44 (less than 0.1% of world energy)
Wind                                0.15 (less than 1% of world energy)
Hydro                               0.10 (europe death rate, 2.2% of world energy)
Hydro - world including Banqiao)    1.4 (about 2500 TWh/yr and 171,000 Banqiao dead)
Nuclear                             0.04 (5.9% of world energy)

Like I said, the safest large-scale technology known to man.

UPDATE: Fast Nuclear Reactors: An Inexhaustible Source of Energy? It's not inexhaustible, but it will extend the available energy supply by a few millennia.

UPDATE: Remembering Chernobyl, 25 Years Later

UPDATE #2: Veronique de Rugy Discusses the Truth About Nuclear Power

Monday, October 25, 2010

The Fermi Chronicles - Part 26: Control Rods

As I discussed last time, fission poisons are both a necessary component of reactor design as well as a byproduct of the fission reaction. This has a large implication on control rod design, which is particular to the reactor type. Control rods must precisely control the reactivity of a nuclear reactor core. Boron and halfnium are common elements in control rods, but there may also be silver, indium, and cadmium. As a general rule, however, control rods should have a large absorption cross section, and should not burn up quickly. That is, they should last for a long time even though as the element absorbs neutrons it changes into something else. Control rods come in two basic varieties - gray and black. Black rods refer to perfect absorbers. they will absorb essentially all incident neutrons. Gray rods have a lower absorption cross-section and burn-up slower as a result.

Black rods are also known as safety rods as they will shut down all fission when inserted into the core. Gray rods are either shim rods that are used for course reactivity control, or regulating rods for fine control.

The most important function of control rods, however, is in an emergency shutdown procedure known as a reactor SCRAM, or trip. When a reactor is tripped, all fission must cease. In this case, control rods are inserted into the core immediately, and these safety rods tend to be black - quickly absorbing all neutrons.

It is interesting that the control rod design is significantly different between the pressurized water reactor (PWRs) and boiling water reactors (BWR). For the PWR, the control rods come in from the top of the fuel assembly as such:

Here's another that clearly shows the cradle assembled from the top down:

Monday, July 13, 2009

The Fermi Chronicles - Part 25: Fission Poisons

There are several kinds of what are called fission poisons in a nuclear reactor. Some are by design. Others a byproduct. Essentially, a fission poison is anything with a very large neutron absorption cross-section. If a materiel absorbs neutrons, those neutrons are then not available for fission and the reaction shuts down. The control rods are made specifically of neutron poisons (boron and hafnium) because their purpose is exactly to absorb and stop fission if need be. Some poison materials are included in the fuel rods because, at least at first, there is an overabundance of fissile material. These types of poisons are called burnable poisons because, as they absorb neutrons, they transform into substances that are not poisons (have a low neutron absorption cross-section) thus unlocking the remaining nuclear fuel as time goes on (clever, eh?). Some reactors use soluble poisons such as borated water used in PWRs (see my post below on the Davis Besse event). Soluble poisons are also called "chemical shims." They are most common as an emergency shutdown feature in most reactor designs. For instance, as a last resort in an emergency situation, the reactor can be flooded with borated water which will both coll and shut down the fission reaction in short order.

Other poisons are produced by the fission reaction itself. These are called fission product poisons. There are many of these, but the two most influential in reactors are Xenon-135 and Samarium-149, as both have a huge neutron absorption cross-section. A typical fission product is Telerrium-135, which becomes Iodine-135 almost immediately (19s half-life) with the emission of a beta particle. I-135 then gives off another beta particle and becomes Xe-135, a neutron poison. Only 5% of Xe-135 is a fission byproduct, while 95% comes from the decay of Iodine-135. The half-life of I-135 is 9.1 hrs, so it hangs around for a long time. Once I-135 absorbs a neutron, it becomes I-136 (and gives of gamma radiation) and is no longer a poison. In this process, it has just been "burned up." There is an equilibrium between I-135 created and burned up at some point, and it is dependent upon reactor power level.

When reactors go through a shutdown, Xe-135 is no longer produced by fission, but is still produced by radioactive decay. The concentration builds up and peaks at its half-life, then it decays into Cs-135. At its peak, however, it is almost impossible to start the reactor up again as there is such an abundance of Xe that it will essentially absorb all available neutrons and the reactor remains below its critical condition. In light of this phenomenon, re-read the module I wrote on the Chernobyl disaster as it is very relevant.

Samarium-149 is another fission fragment decay product that originally started out after fission from Promethium-149 and neodymium-149 (the one?). Unlike Xe-135, however, Sm-149 is stable, so it cannot be decayed out and must be burned up solely by neutron absorption. When a reactor is shut down, Sm-149 is still produced from radioactive decay, but does not itself simply peak and then decay. It peaks and remains. (in the strict technical sense, however, this would be referred to as a maximum, not a peak) Fortunately, Samarium poisoning is minor compared to Xenon poisoning.

Wednesday, July 8, 2009

The Fermi Chronicles - Part 24: Reaction k-Factor

This one is pretty important in the nuclear industry. Recall from prior posts (see below) that available neutrons are necessary to produce fission reaction. Each fission reaction should produce at least one more neutron that will strike another nucleus, produce fission, etc. Such as is illustrated here:

Now most fissions produce more than one extra neutron. Many fission processes produce and extra two or three. But some neutrons don't fission a nucleus. Some get absorbed by non-fissionable matter. Other simply "leak" out of the reactor. But at least one of the new neutrons (on average) have to cause one fission process in a nucleus for the fission to continue is a self-sustained chain reaction.

This simply must be self-sustaining. So there is a critical threshold that neutron availability must be kept at to keep the reaction going. In addition, recall that there are several types of neutrons. Fast neutrons are the product of fission, but if the fast neutrons strike a moderator with a large scattering cross-section, then their energy is dissipated and their speed is basically the same as the molecules of the moderator. Thus fast neutrons are slowed down and coverted into thermal neutrons. Fast neutrons are also called prompt neutrons as they are available immediately after fission. However, fission products are themselves unstable (and therefore radioactive) and themselves emit neutrons, but after-the-fact, from seconds to minutes after fission. These are called delayed neutrons. Most rectors depend on thermal neutrons to propagate the fission chain, but a few reactor types such as FBRs (see my prior post on reactor types below), depend upon fast neutrons and so are designed with a moderator with a very small scattering cross-section.

The ratio of neutron production in one generation, to the neutron absorption in a preceding generation, is called the k-factor. (also called the infinite k-factor as it is assumed that there is no neutron leakage) If the k-factor is less than unity (or less than one), the fission reaction will die off. If it is greater than one, the fission reaction will go out of control. A k-factor greater than one is essential in all nuclear weapons. In the nuclear power industry, the core is designed for the k-factor to be exactly one for the duration of the fuel burn process. This condition is called the critical condition. For nuclear weapons, critical won't do as teh reaction must be supercritical (k>1). For k<1, subcritical.

All of the above is called the neutron life cycle. Born in fission or by decay, they can only do a number of things - leak, be absorbed by fissionable material, or be absorbed by non-fissionable material. If the k-value changes in a reactor, that change is called the reactivity. There are many ways for this to happen. As an example, if the water temperature in a BWR decreases, the reactivity will be positive (and power levels will increase) simply because the colder water is denser than warmer water. Great care is taken to keep the water temperature constant. In fact, the change in reactivity per degree change in temperature is called the moderator coefficient of reactivity. (as opposed to the temperature coefficient of reactivity if the fuel changes temperature, which is termed the fuel temperature coefficient)

Tuesday, July 7, 2009

The Fermi Chronicles - Part 23: Davis Besse, Ohio, 2002

The Davis Besse event showed what complacency can do, and the ultimate responsibility that operators in a nuclear reactor power plant have. The Davis Besse nuclear facility is built around a PWR (see my prior post on rector types). One of the aspects of a PWR is that a small concentration of boric acid is present in the reactor coolant water. Boron absorbs neutrons readily and thus the boric acid has a similar effect on the reaction as control rods, but in small concentrations will act only to attenuate, rather than to stop, the fission reaction. Boric acid is highly corrosive however. Because of this, the vessel lining is made from Inconel that prevents the boric acid from literally eating away the carbon steel behind it.

During routine inspection during a refueling outage in 2002, it was discovered that boric acid had eaten almost entirely through the 6 1/2 inch thick reactor pressure vessel (RPV) head, as pictured to the right. A breach of the reactor head would have lead to a loss of coolant accident (LOCA), as massive amounts of the reactor coolant system (RCS) water would have partially filled the containment building. Although several safety procedures are in place specifically for such an event, it is a very precarious situation nonetheless.

As it turns out, there are nozzles at the top of the RPV that were cracked, allowing some of the borated coolant water to leak past the Inconel lining and eating away at the carbon steel directly. So extensive was the corrosion, that only a 1/4 inch-thick stainless steel cladding, which itself was damaged, prevented a loss of coolant accident. The reactor was taken off-line for 2 years at a huge cost to the utility in addition to $600 million in repairs and upgrades of many systems. But the nuclear industry was not rocked by the material problems of the plant, but rather the underlying cause of the problems.

As it turns out, Davis Besse management had gradually shifted from high-standards of safety to justifying the minimum standards. The result was a lack of management-level oversight, a focus on short-term production over safety, ineffective use of the Operating Experience (see my prior post on this in the "business model" module), lack of sensitivity towards nuclear safety and isolationism. All of the Davis Besse management at all levels were let go as the NRC lost confidence in the utility's ability to run the plant safely. It was this culture of complacency that led to the precarious corrosion incident. In fact, the nozzles at the top of the RPV head, called vessel head penetration, or VHP, nozzles, were slated to be inspected since the NRC had seen cracks in these at other facilities. The inspections were to be done by December 31, 2001 - several months before the refueling shutdown. The management at Davis Besse did not intend to comply, and thus false inspection reports were filed. The company ended up being charged with safety violations by the NRC and paid fines in excess of $30 million. In addition, several employees were indicted for making false statements.

Monday, July 6, 2009

The Fermi Chronicles - Part 22: Nuclear Events - Chernobyl, 1986

If Three Mile Island (TMI) was thought to be the worst nuclear accident in history (even though no one was injured or killed), Chernobyl drove a stake into the nuclear industry. Up to that point in time, only 3 people had been killed in a nuclear accident and that happened at the SL-1 event (see below). Chernobyl changed the nuclear safety statistic for all time. The Chernobyl reactor design was in a word horrendous. That, coupled with nothing short of shear stupidity, caused the disaster. The Chernobyl reactor design is like nothing in the U.S. The reactors were RBMK reactors, for which there is a Wikipedia entry:

RBMK is an acronym for the Russian reaktor bolshoy moshchnosti kanalniy (Russian: Реактор Большой Мощности Канальный) which means "High Power Channel TypeReactor", and describes a class of graphite-moderated nuclear power reactor which was built in the Soviet Union for use in nuclear power plants to produce nuclear power from nuclear fuel. The RBMK reactor was the type involved in the Chernobyl accident. In 2008, there are at least 12 RBMK reactors still operating in Russia and Lithuania, but there are no plans to build new RBMK type reactors (the RBMK technology was developed in 1950s and is now considered obsolete) and there is international pressure to close those that remain.

What makes the RBMK nothing short of dangerous is for one, they are graphite moderated, which itself is just a bad idea as I have mentioned before (see the Windscale event below), and also because at low power levels, the reactor tends to have a positive feedback aspect to it, meaning that it could run away with power excursions at any time.

This is in large part what resulted in the Chernobyl disaster.

At 1:23 am local time on 26 April 1986, reactor 4 at Chernobyl underwent a massive power excursion due to its positive-feedback tendencies at low power coupled with the circumvention of several safety systems by inexperienced engineers. This resulted in a steam explosion that blew the roof off the reactor building. It should be noted that the reactor building had no containment and was housed in a metal warehouse similar to Costco or Sam's Club. After the steam explosion, hydrogen generated by the unstable reactor exploded and exposed the reactor core to the atmosphere. The graphite moderator burned for some time and was largely responsible for radioactive material being discharged into the air by the resulting smoke. The radioactive particles were then carried by the wind well beyond the borders of Lithuania.

The entire series of events was initiated by a test that was to be run while the reactor was at low power. What made this event worse was that the reactor was at the end of its fuel cycle, which meant that there was a lot of highly radioactive fission products in the fuel assemblies. It was simply the worst possible time to risk anything going wrong. The test to be run was to see how much power the turbine could generate purely by its inertia should steam no longer flow into the turbine. This power was seen to be necessary to run cooling water pumps in the event of an external power failure. Thus, this simulated blackout test was to determine the adequacy of the voltage regulation system as the turbine spun down. In theory, power should have been available to drive the pumps for some 45 seconds, giving the backup diesel generators plenty of time to come up to full power.

Constant flowing water is a necessity of the RMBK design, even when the reactor is totally shut down. There was simply too much decay heat to be cooled by natural circulation alone, especially at the end of the fuel cycle when highly radioactive fission byproducts were at their maximum. This test was supposed to be performed before the reactor went commercial, but it was not done. This is a disturbing entry over at Wikipedia:

Apparently, the test had not been completed successfully by March 1984 when the unit was brought into commercial operation ahead of schedule and celebrated as a "labour victory". Under pressure, the director of the Chernobyl station Viktor Bryukhanov signed an acceptance document on the last day of 1983, in order to declare that works planned for that year had been fulfilled. Had he not done so, thousands of workers, engineers and his own superiors would have lost bonuses, awards and other extras. Records were falsified to hide this fact.

The Chernobyl power plant had been in operation for two years without this important safety feature. The station managers must have wished to correct this at the first opportunity. This could explain why they were so determined to carry out the test, even when serious problems arose, and why the requisite approval for the test was not sought from the Soviet nuclear oversight regulatory body.

The test was to be conducted by reducing the power level to 20% of normal, then the steam to the turbine was to be cut off temporarily to test the turbine spin down. However, when the reactor was gradually brought down to the 50% level, a regional power station went off line and a Kiev grid controller requested that power not be brought down further so that demand could be satisfied. The test was delayed into the night of April 25. The test crew were electrical engineers with no special nuclear training, and were likely exhausted by the time 11:00pm rolled around, when the Kiev controller gave the green light to continue the power down. The night shift of plant workers were set to come in at midnight, and had no knowledge of the test. The night crew, which was a skeleton crew at best, had little overall experience. Here is a disturbing entry over at Wikipedia on this aspect:

In Valeri Legasov's posthumous article, he maintains that the operators did not know what the test was about:

I have in my safe a transcript of the operators' telephone conversations on the eve of the accident. Reading the transcript makes one's flesh creep. One operator rings another and asks: What shall I do? In the programme there are instructions of what to do, and then a lot of things are crossed out. His counterpart thought for a while and then replied: Follow the crossed out instructions.
The operators of the power plant and the conductors of the experiment on the No. 4 reactor held too much faith in the reactor; to them, a catastrophe was simply inconceivable. Because of this, they had no qualms about disabling the safety features of the reactor and taking unnecessary risks to carry out the experiment.

Unfortunately, as the power-down commenced, the control rods were inserted too far too fast. This resulted in nuclear byproduction of Xenon-135, which is known as a fission poison since it absorbs neutrons. All of a sudden, instead of bringing the reactor down to 700 MW thermal (power output is about a third of that), it went down to a mere 30 MW. This output was far too low to run the test. The output had to be increased. However, the personnel were unaware of the level of Xe-135 poisoning. Control rods were pulled out of the core beyond the position necessary for 100% output, which had to be done manually to override safety systems. Even beyond any safety regulation. Even so, the reactor power only increased to 200 MW. Unbelievably, despite the low power, the test was actually continued by the operators!

At 1:05am, the water flow through the core was increased until it was beyond safety regulations. The core temperature decreased because of the increased water cooling and the high concentration of fission poisons. To overcome this, the operators pulled out all of the manual control rods. In addition, they disabled a backup emergency shutdown system that would have SCRAMmed the reactor under such conditions. At this point, the reactor was basically an cone standing straight up on its tip, a position that is inherently unstable.

At 1:23am, the steam to the turbine was shut off to conduct the test. The water flowrate to the core decreased as a result of the turbine spin down. Boiling started taking place. Because of the positive feedback aspect of the RBMK reactor, a bad situation was about to take place. The steam voids don't absorb neutrons like liquid water does, so the reaction rate increased. This lead to the fuel rods becoming hotter, which created more steam voids, which lead to the rods becoming hotter, etc. Positive feedback. At each feedback cycle, more and more neutrons were available for fission which eventually overcame the fixed amount of the fission poison Xe-135 in the coolant.

At 1:23:40, just 40 seconds into the test, the operators initiated a SCRAM, although the reason for this will never be fully known as the operators perished. However, damage to the core had already taken place as the fuel rods overheated resulting in a loss of geometry. Because of this, the control rods only went down 1/3 of the way before getting blocked by the distorted fuel elements. Worse yet was the fact that the tips of the control rods were made of graphite, a fission moderator, which increased the reaction rate and at the same time displaced water that absorbed neutrons. A mere 7 seconds later, at 1:23:47, the reactor thermal power was at 30 GW (that's right - 30,000 MW!). The huge thermal load vaporized water, increasing the pressure so fast that pipes ruptured. The fuel rods melted and reached the cooling water in the now flooded basement. The first steam explosion occurred at 1:24:00, blowing the lid off of the reactor. Two seconds later a more powerful hydrogen explosion occurred that blew the entire roof off the building, discharging material with it, including red-hot graphite chunks.

Radiation dosimeters were not available that were capable of large-dose readings, so workers couldn't have known the danger they were really in. By 4:30am, a dosimeter that gave an extremely high reading was dismissed as faulty. (ignorance can be bliss, no?) The firefighter that arrived on scene were also unaware of the danger. Amazingly and unfortunately the graphite fire in Chernobyl reactor 4 burned until May 10! That despite the fire suppression techniques including the injection of liquid nitrogen and the helicopter dropping of boron and lead onto the fire.

The aftermath of the disaster was nothing short of calamity, especially since the USSR kept it a secret, not warning of the radiation cloud that was spreading throughout the atmosphere. It wasn't until several days later that the scale of the disaster was to be discovered by the world. By that time, radioactivity had spread across much of Europe and even some over the U.S.

Here's a Discovery Channel documentary on Chernobyl:

Part 2
Part 3
Part 4
Part 5
Part 6

Here's a video made by a cameraman shortly after the accident. The cameraman died a few weeks later from radiation poisoning:

And video of the first helicopter flyover showing the glowing core (I don't see how this crew wasn't exposed to a lethal dose):

Some good animations in this series of vids:

Part 2
Part 3
Part 4
Part 5
Part 6
Part 7
Part 8

Much more on Chernobyl at YouTube and elsewhere.

UPDATE (12/14/2010): Visit Chernobyl: Ukraine to open exploded reactor for tours

Want a better understanding of the world's worst nuclear disaster? Tour the Chernobyl nuclear power plant.

Beginning next year, Ukraine plans to open up the sealed zone around the Chernobyl reactor to visitors who wish to learn more about the tragedy that occurred nearly a quarter of a century ago, the Emergency Situations Ministry said Monday.

...The so-called exclusion zone, a highly contaminated area within a 30-mile radius of the exploded reactor, was evacuated and sealed off in the aftermath. All visits were prohibited.

Today, about 2,500 employees maintain the remains of the now-closed nuclear plant, working in shifts to minimize their exposure to radiation. Several hundred evacuees have returned to their villages in the area despite a government ban. A few firms now offer tours to the restricted area, but the government says those tours are illegal and their safety is not guaranteed.

Emergency Situations Ministry spokeswoman Yulia Yershova said experts are developing travel routes that will be both medically safe and informative for Ukrainians and foreign visitors. She did not give an exact date when the tours were expected to begin.

"There are things to see there if one follows the official route and doesn't stray away from the group," Yershova said. "Though it is a very sad story."

United Nations Development Program Chief Helen Clark toured the Chernobyl plant Sunday and said she supported the plan because it could help raise money and tell an important lesson about nuclear safety.

"Personally, I think there is an opportunity to tell a story here, and of course the process of telling a story, even a sad story, is something that is positive in economic terms and positive in conveying very important messages," said Clark, according to her office.

The ministry also said Monday that it hopes to finish building a new, safer shell for the exploded reactor by 2015. The new shelter will cover the original iron-and-concrete structure hastily built over the reactor that has been leaking radiation, cracking and threatening to collapse.

The new shell weighs 20,000 tons and will be slid over the old shelter. The new structure will be big enough to house the Notre Dame Cathedral in Paris or the Statue of Liberty in New York.

The overall cost of the project, financed by international donors, has risen from $505 million to $1.15 billion because of stricter safety requirements, according to Ukrainian officials.

Friday, July 3, 2009

The Fermi Chronicles - Part 21: Nuclear Events - Three Mile Island, 1979

For the nuclear industry, this was the big kahuna that put the kibosh on nuclear power in the U.S., even though no one was injured or killed. It appears that it is now turning around after nearly 2 generations. Three Mile Island had two nuclear reactors, both PWRs. On March 28, 1979, the feedwater pumps on the TMI-2 reactor stopped working. Emergency backup feedwater pumps didn't deliver water to the steam generators due to valves being manually closed for maintenance and testing (against procedure and NRC regulations by the way). Without water feeding the generators, there was no way to remove the thermal energy from the core. The reactor coolant started to increase in temperature.

If you recall from my prior post on reactor types (part 13 below). the PWRs maintain the high pressure in the reactor loop via a pressurizer tank. That pressurizer tank has a volume of gas that cushions the primary loop and regulates the pressure. If the pressure gets too low, more gas makes it up. If too high, then some gas can be vented through a pilot-operated relief valve, or PORV, into storage. At Three Mile Island, once the temperature of the reactor coolant started to increase, the liquid expanded (the density decreased). That forced the PORV to open to maintain a constant pressure. Pressure, however, continued to rise and the reactor was SCRAMmed (now called 'tripped').

Now when a reactor is tripped, it shuts down the nuclear fission, but the fuel rods remain hot for some time as radioactive decay of fission products continues. This is called decay heat. Thing was, that PORV that opened to lower the pressure never closed gain. It was stuck open. In this case, pressure continued to decrease. In a PWR, the very worst thing that can happen is bubble formation in the core as it is designed to be cooled by only liquid. What keeps the water from boiling is exactly the high pressure in the system. The higher the pressure, the higher the boiling point (think what a pressure cooker is for). In any case, the PORV was the problem here. Unfortunately, there was no indication that it was stuck open. In fact, in an engineering blunder of gigantic proportion, a lamp in the control room that would have indicated the true position of the PORV was never installed to save time on construction. Bad move. Instead, there was a single indicator light in the control that indicated when power was being applied to open the valve, but did not indicate the true position of the valve itself. The pressure continued to decrease through what was in effect an unknown leak. A Wikepedia entry has more detail on the PORV fault:

The design of the PORV indicator light was fundamentally flawed, because it implied that the PORV was shut when it went dark. When everything was operating correctly this was true, and the operators became habituated to rely on it. However, when things went wrong and the main relief valve stuck open, the dark lamp was actually misleading the operators by implying that the valve was shut. This caused the operators considerable confusion, because the pressure, temperature and levels in the primary circuit, so far as they could observe them via their instruments, were not behaving as they would have done if the PORV was shut — which they were convinced it was. This mental confusion contributed to the severity of the accident: because the operators were unable to break out of a cycle of assumptions which conflicted with what their instruments were telling them, it was not until a fresh shift came in who did not have the mind-set of the first set of operators that the problem was correctly diagnosed. But by then, major damage had been done.

The operators had not been trained to understand the ambiguous nature of the PORV indicator and look for alternative confirmation that the main relief valve was closed. There was in fact a temperature indicator downstream of the PORV in the tail pipe between the PORV and the pressurizer that could have told them the valve was stuck open, by showing that the temperature in the tail pipe remained high after the PORV should have, and was assumed to have, shut. But this temperature indicator was not part of the "safety grade" suite of indicators designed to be used after an incident, and the operators had not been trained to use it. Its location on the back of the desk also meant that it was effectively out of sight of the operators.

Another engineering blunder here was that there was no instrument at all that directly measured the water level in the reactor core.

This level was instead determined from the water level in the pressurizer - an indirect measurement. The operators thus assumed the core was covered since the water level in the pressurizer remained high. Because of this, the operators also halted the use of high-pressure safety injection (HPSI) pumps that could have overpressurized the system. Unbeknownst to the operators, boiling was occurring in the core as the pressure continued to decrease. The boiling forced water out of the pressurizer through the PORV as steam displaced water. The top of the core was now exposed to gas which by its nature is simply incapable of cooling the hot fuel rods. A meltdown thus ensued. The water pouring out of the PORV filled a sump in the containment building and triggered another alarm (more than 100 alarms went off during this time and it was impossible for operators to discern which were the most important). Also, the pressure in the containment building was increasing as steam was being discharged also through the PORV. These were clear indications that the PORV was stuck open, but it was simply not recognized by the overwhelmed operators.

Because of the continuous discharge of coolant through the PORV, a quench tank relief diaphragm gave out and ruptured and the contaminated coolant water now began to seep into the containment building. The event began at 4:00am. By 7:00am, a Site Area Emergency was declared and upgraded to a General Emergency by 7:24am. By this time, half the core was exposed to steam rather than water. A meltdown of the core was already occurring. It wasn't until 7 hours after the event that new water was pumped into the core. The primary loop pumps finally started pumping coolant through the reactor almost 16 hours after the event and it wasn't until then that the core temperature started to decrease. However, those pumps cavitated because of the steam still present and had to be shut down to to excess vibration. Too bad they didn't have the Holiday Inn guy when the PORV got stuck:

The event itself was magnified several times over by the interaction of several officials form the power company, the NRC and the local, state and federal government, many of which contradicted each other. For instance, and probably worst of all, were the statements regarding the possibility of off-site radioactive release. Some officials said not at all, others said yes, yet others said it was minor. In fact, very little radiation was released, giving an average dose of 1 mrem, a fraction of what is received during an x-ray at a hospital. In any case, it led to much confusion and distrust in the public. The Governor suggested that pregnant women and small children evacuate the area (radiation affects you more the younger you are - all the way back to the moment of conception - as it is dependent upon cell division). The Governor didn't do this based on what had happened at TMI-2, but rather what he and other thought might happen. The politics of fear had taken over. 140,000 people left the area in an exodus rather than an evacuation.

The media frenzy ensued. Anti-nuclear protests were launched. Worst yet was the event at Three Mile Island Occurred less than 2 weeks after the movie The China Syndrome was released. All these things together made nuclear a dirty word in the mind of the public. That has persisted for 2 generation. Since the TMI event, no new nuclear power plants were licensed to operate. That is hopefully now changing. Finally.

After the event at TMI-2, TMI-1 was shut down, but restarted in 1985. TMI-1 is still running today, more than 30 years after the TMI-2 event, and is licensed to do so by the NRC until 2014. An application for an extension until 2034 is pending. It remains one of the best performing reactors in America. As for TMI-2, the NRC notes that today, the TMI‑2 reactor is permanently shut down and defueled, with the reactor coolant system drained, the radioactive water decontaminated and evaporated, radioactive waste shipped off‑site to an appropriate disposal site, reactor fuel and core debris shipped off‑site to a Department of Energy facility, and the remainder of the site being monitored.

Probably the biggest lesson learned from Three Mile Island is that the entire nuclear industry is in this together, and that one major event affects the entire fleet of nuclear plants. INPO was formed (see my former post in the nuclear business - part 15 below). Information is now shared continuously between plants on any event no matter how insignificant. Also, several times every year there are drills for the testing of emergency response plans. Operators here at Fermi 2 have an identical control room that is a simulator (it's pretty darned cool) where shutdown, start-up and any scenario imaginable can be (and likely is) produced.

In addition, proper training is a huge aspect of the nuclear industry. Here at Fermi 2, they built an entire building that does nothing but training. Employees here are trained all the time, with some classes being refreshers for recertification, while other are extensive to the point of being several months long. Education is the key to everyone understanding what this plant is all about.
On the technical side, all nuclear reactor cores must have direct instrumentation that monitor the reactor core under the worst possible conditions imaginable. Risk assessment is a big part of the industry now, with statistics gurus planning for every scenario. The NRC also has this list of changes that took place after TMI:

Upgrading and strengthening of plant design and equipment requirements. This includes fire protection, piping systems, auxiliary feedwater systems, containment building isolation, reliability of individual components (pressure relief valves and electrical circuit breakers), and the ability of plants to shut down automatically;
Identifying human performance as a critical part of plant safety, revamping operator training and staffing requirements, followed by improved instrumentation and controls for operating the plant, and establishment of fitness-for-duty programs for plant workers to guard against alcohol or drug abuse;
Improved instruction to avoid the confusing signals that plagued operations during the accident;
Enhancement of emergency preparedness to include immediate NRC notification requirements for plant events and an NRC operations center which is now staffed 24 hours a day. Drills and response plans are now tested by licensees several times a year, and state and local agencies participate in drills with the Federal Emergency Management Agency and NRC;
Establishment of a program to integrate NRC observations, findings, and conclusions about licensee performance and management effectiveness into a periodic, public report;
Regular analysis of plant performance by senior NRC managers who identify those plants needing additional regulatory attention;
Expansion of NRC's resident inspector program – first authorized in 1977 – whereby at least two inspectors live nearby and work exclusively at each plant in the U.S. to provide daily surveillance of licensee adherence to NRC regulations;
Expansion of performance‑oriented as well as safety‑oriented inspections, and the use of risk assessment to identify vulnerabilities of any plant to severe accidents;
Strengthening and reorganization of enforcement as a separate office within the NRC;
The establishment of the Institute of Nuclear Power Operations (INPO), the industry's own "policing" group, and formation of what is now the Nuclear Energy Institute to provide a unified industry approach to generic nuclear regulatory issues, and interaction with NRC and other government agencies;
The installing of additional equipment by licensees to mitigate accident conditions, and monitor radiation levels and plant status;
Employment of major initiatives by licensees in early identification of important safety‑related problems, and in collecting and assessing relevant data so lessons of experience can be shared and quickly acted upon;
Expansion of NRC's international activities to share enhanced knowledge of nuclear safety with other countries in a number of important technical areas.

Here's Part 1 of the PBS documentary on 3-mile island (take it with a grain of salt):