The Three Mile Island accident was a partial nuclear meltdown of the Unit 2 reactor (TMI-2) of the Three Mile Island Nuclear Generating Station, located on the Susquehanna River in Londonderry Township, Dauphin County, near Harrisburg, Pennsylvania. The reactor accident began at 4:00 a.m. on March 28, 1979, and released radioactive gases and radioactive iodine into the environment. It is the worst accident in U.S. commercial nuclear power plant history, although its small radioactive releases had no detectable health effects on plant workers or the public. The accident was the largest release of radioactive material in U.S. history until the Church Rock uranium mill spill four months later. On the seven-point logarithmic International Nuclear Event Scale, the TMI-2 reactor accident is rated Level 5, an "Accident with Wider Consequences".
The accident began with failures in the non-nuclear secondary system, followed by a stuck-open pilot-operated relief valve (PORV) in the primary system, which allowed large amounts of water to escape from the pressurized isolated coolant loop. The mechanical failures were compounded by the initial failure of plant operators to recognize the situation as a loss-of-coolant accident (LOCA). TMI training and operating procedures left operators and management ill-prepared for the deteriorating situation caused by the LOCA. During the accident, those inadequacies were compounded by design flaws, such as poor control design, the use of multiple similar alarms, and a failure of the equipment to indicate either the coolant-inventory level or the position of the stuck-open PORV.
The accident heightened nuclear safety concerns among the general public and led to new regulations for the nuclear industry. It accelerated the decline of efforts to build new reactors. Anti-nuclear movement activists expressed worries about regional health effects from the accident. Some epidemiological studies analyzing the rate of cancer in and around the area since the accident did determine that there was a statistically significant increase in the rate of cancer, while other studies did not. Due to the nature of such studies, a causal connection linking the accident with cancer is difficult to prove. Cleanup at TMI-2 started in August 1979 and officially ended in December 1993, with a total cost of about $1 billion (equivalent to $2 billion in 2025). TMI-1 was restarted in 1985, then retired in 2019 due to operating losses. It is expected to return to service in either 2027 or 2028 as part of a deal to power Microsoft data centers.
Accident
Background
In the night hours before the incident, the TMI-2 reactor was running at 97% power while the companion TMI-1 reactor was shut down for refueling. The main chain of events leading to the partial core meltdown on Wednesday, March 28, 1979, began at 4:00:36 a.m. EST in TMI-2's secondary loop, one of the three main water/steam loops in a pressurized water reactor.
The initial cause of the accident happened 11 hours earlier, during an attempt by operators to fix a blockage in one of the eight condensate polishers, the sophisticated filters cleaning the secondary loop water. These filters are designed to stop minerals and other impurities in the water from accumulating in the steam generators and to decrease corrosion rates on the secondary side.
Blockages are common with these resin filters and are usually fixed easily, but in this case, the usual method of forcing the stuck resin out with compressed air did not succeed. The operators decided to blow compressed air into the water and let the force of the water clear the resin. When they forced the resin out, a small amount of water forced its way past a stuck-open check valve and found its way into an instrument air line. This would eventually cause the feedwater pumps, condensate booster pumps, and condensate pumps to turn off around 4:00 a.m., which would, in turn, cause a turbine trip.
Reactor overheating and malfunction of relief valve
Given that the steam generators were no longer receiving feedwater, heat transfer from the reactor coolant system (RCS) was greatly reduced, and RCS temperature rose. The rapidly heating coolant expanded and surged into the pressurizer, compressing the steam bubble at the top. When RCS pressure rose to 2,255 psi (155.5 bar), the pilot-operated relief valve (PORV) opened, relieving steam through piping to the reactor coolant drain tank in the containment building basement. RCS pressure continued to rise, reaching the reactor protection system high-pressure trip setpoint of 2,355 psi (162.4 bar) eight seconds after the turbine trip. The reactor automatically tripped, its control rods falling into the core under gravity, halting the nuclear chain reaction and stopping the heat generated by fission. However, the reactor continued to generate decay heat, initially equivalent to approximately 6% of the pre-trip power level. Because steam was no longer being used by the turbine and feed was not being supplied to the steam generators, heat removal from the reactor's primary water loop was limited to steaming the small amount of water remaining in the secondary side of the steam generators to the condenser using turbine bypass valves.
When the feedwater pumps tripped, three emergency feedwater pumps started automatically. An operator noted that the pumps were running but did not notice that a block valve was closed in each of the two emergency feedwater lines, blocking emergency feed flow to both steam generators. The valve position lights for one block valve were covered by a yellow maintenance tag. The reason why the operator missed the lights for the second valve is not known, although one theory is that his own large belly hid it from his view. The valves may have been left closed during a surveillance test two days earlier. With the block valves closed, the system was unable to pump water. The closure of these valves was a violation of a key Nuclear Regulatory Commission (NRC) rule, according to which the reactor must be shut down if all auxiliary feed pumps are closed for maintenance. This was later singled out by NRC officials as a key failure.
After the reactor tripped, secondary system steam valves operated to reduce steam generator temperature and pressure, cooling the RCS and lowering RCS temperature, as designed, resulting in a contraction of the primary coolant. With the coolant contraction and loss of coolant through the open PORV, RCS pressure dropped as did pressurizer level after peaking 15 seconds after the turbine trip. Also, 15 seconds after the turbine trip, coolant pressure had dropped to 2,205 psi (152.0 bar), the reset setpoint for the PORV. Electric power to the PORV's solenoid was automatically cut, but the relief valve was stuck open with coolant water continuing to be released.
In post-accident investigations, the indication for the PORV was one of many design flaws identified in the operators' controls, instruments and alarms. There was no direct indication of the valve's actual position. A light on a control panel, installed after the PORV had stuck open during startup testing, came on when the PORV opened. When that light - labeled Light on - RC-RV2 open - went out, the operators believed that the valve was closed. In fact, the light when on only indicated that the PORV pilot valve's solenoid was powered, not the actual status of the PORV. While the main relief valve was stuck open, the operators believed the unlit lamp meant the valve was shut. As a result, they did not correctly diagnose the problem for several hours.
The operators had not been trained to understand the ambiguous nature of the PORV indicator and to look for alternative confirmation that the main relief valve was closed. A downstream temperature indicator, the sensor for which was located in the tail pipe between the pilot-operated relief valve and the pressurizer relief tank, could have hinted at a stuck valve had operators noticed its higher-than-normal reading. It was not, however, part of the "safety grade" suite of indicators designed to be used after an incident, and personnel had not been trained to use it. Its location behind the seven-foot-high instrument panel also meant that it was effectively out of sight.
Depressurization of primary reactor cooling system
Less than a minute after the beginning of the event, the water level in the pressurizer began to rise, even though RCS pressure was falling. With the PORV stuck open, coolant was being lost from the RCS, a loss-of-coolant accident (LOCA). Expected symptoms for a LOCA were drops in both RCS pressure and pressurizer level. The operators' training and plant procedures did not cover a situation where the two parameters went in opposite directions. The water level in the pressurizer was rising because the steam in the space at the top of the pressurizer was being vented through the stuck-open PORV, lowering the pressure in the pressurizer because of the lost inventory. The lowering of pressure in the pressurizer made water from the coolant loop surge in and created a steam bubble in the reactor pressure vessel head, aided by the decay heat from the fuel.
This steam bubble was invisible for the operators, and this mechanism had not been trained. Indications of high water levels in the pressurizer contributed to confusion, as operators were concerned about the primary loop "going solid", (i.e., no steam pocket buffer existing in the pressurizer) which in training they had been instructed to never allow. This confusion was a key contributor to the initial failure to recognize the accident as a LOCA and led operators to turn off the emergency core cooling pumps, which had automatically started after the PORV stuck and core coolant loss began, due to fears the system was being overfilled.
With the PORV still open, the pressurizer relief tank that collected the discharge from the PORV overfilled, causing the containment building sump to fill and sound an alarm at 4:11 a.m. This alarm, along with higher than normal temperatures on the PORV discharge line and unusually high containment building temperatures and pressures, were clear indications that there was an ongoing LOCA, but these indications were initially ignored by operators. At 4:15 a.m., the relief diaphragm of the pressurizer relief tank ruptured, and radioactive coolant began to leak into the general containment building. This radioactive coolant was pumped from the containment building sump to an auxiliary building, outside the main containment, until the sump pumps were stopped at 4:39 a.m.
Partial meltdown and further release of radioactive substances
At about 5:20 a.m., after almost 80 minutes with a growing steam bubble in the reactor pressure vessel head, the primary loop's four main reactor coolant pumps began to cavitate as a steam bubble/water mixture, rather than water, passed through them. The pumps were shut down, and it was believed that natural circulation would continue the water movement. Steam in the system prevented flow through the core, and as the water stopped circulating it was converted to steam in increasing amounts. Soon after 6:00 a.m., the top of the reactor core was exposed, and the intense heat caused a reaction to occur between the steam forming in the reactor core and the zircaloy nuclear fuel rod cladding, yielding zirconium dioxide, hydrogen, and additional heat. This reaction melted the nuclear fuel rod cladding and damaged the fuel pellets, which released radioactive isotopes to the reactor coolant and produced hydrogen gas that is believed to have caused a small explosion in the containment building later that afternoon.
At 6:00 a.m. there was a shift change in the control room. A new arrival noticed that the temperatures in the PORV tail pipe and the holding tanks were excessive, and used a backup—called a block valve—to shut off the coolant venting via the PORV, but around 32,000 US gal (120,000 L) of coolant had already leaked from the primary loop. It was not until 6:45 a.m., 165 minutes after the start of the problem, that radiation alarms activated when the contaminated water reached detectors; by that time, the radiation levels in the primary coolant water were around 300 times expected levels, and the general containment building was seriously contaminated with radiation levels of 800 rem/h.
At 6:56 a.m. a plant supervisor declared a site area emergency, and less than 30 minutes later station manager Gary Miller announced a general emergency. Metropolitan Edison (Met Ed) notified the Pennsylvania Emergency Management Agency, which in turn contacted state and local agencies, Pennsylvania Governor Richard L. Thornburgh and Lieutenant Governor William Scranton III, to whom Thornburgh assigned responsibility for collecting and reporting on information about the accident. The uncertainty of operators at the plant was reflected in fragmentary, ambiguous, or contradictory statements made by Met Ed to government agencies and to the press, particularly about the possibility and severity of off-site radioactivity releases.
Scranton held a press conference in which he was reassuring, yet confused, about this possibility, stating that though there had been a "small release of radiation...no increase in normal radiation levels" had been detected. These were contradicted by another official, and by statements from Met Ed, who both claimed that no radioactivity had been released. Readings from instruments at the plant and off-site detectors had detected radioactivity releases, albeit at levels that were unlikely to threaten public health as long as they were temporary, and providing that containment of the then highly contaminated reactor was maintained.
Angry that Met Ed had not informed them before conducting a steam venting from the plant, and convinced that the company was downplaying the severity of the accident, state officials turned to the NRC. After receiving word of the accident from Met Ed, the NRC had activated its emergency response headquarters in Bethesda, Maryland, and sent staff members to Three Mile Island. NRC chairman Joseph Hendrie and commissioner Victor Gilinsky initially viewed the accident as a "cause for concern but not alarm".