A high reliability organization ( HRO ) is an organization that has succeeded in avoiding catastrophes in an environment where normal accidents can be expected due to risk factors and complexity .
93-857: Important case studies in HRO research include both studies of disasters (e.g., Three Mile Island nuclear incident , the Challenger Disaster and Columbia Disaster , the Bhopal chemical leak , the Chernobyl Disaster , the Tenerife air crash , the Mann Gulch forest fire , the Black Hawk friendly fire incident in Iraq ) and HROs like the air traffic control system, naval aircraft carriers, and nuclear power operations. HRO theory
186-505: A respirator —the two navigated the reactor auxiliary building to draw the sample. However, Houser had lost his pocket dosimeter while taking measurements. Houser had noted the sample he drew looked "like Alka-Seltzer " and was highly radioactive, with readings as high as 1,000 rem/h. The two spent five minutes in the building, then withdrew. Houser had gone past the NRC's quarterly dose limit for radiation exposure (3 rem/qtr in 1979) by one and
279-452: A "small release of radiation...no increase in normal radiation levels" had been detected. These were contradicted by another official, and by statements from Met Ed, who both claimed that no radioactivity had been released. Readings from instruments at the plant and off-site detectors had detected radioactivity releases, albeit at levels that were unlikely to threaten public health as long as they were temporary, and providing that containment of
372-408: A HRO has presented some challenges. Roberts initially proposed that high reliability organizations are a subset of hazardous organizations that have enjoyed a record of high safety over long periods of time. Specifically she argued that: “One can identify this subset by answering the question, “how many times could this organization have failed resulting in catastrophic consequences that it did not?” If
465-494: A backup—called a block valve—to shut off the coolant venting via the PORV, but around 32,000 US gal (120,000 L) of coolant had already leaked from the primary loop. It was not until 6:45 a.m., 165 minutes after the start of the problem, that radiation alarms activated when the contaminated water reached detectors; by that time, the radiation levels in the primary coolant water were around 300 times expected levels, and
558-425: A basis for individuals to interact continuously as they develop, refine and update a shared understanding of the situation they face and their capabilities to act on that understanding. Mindful organizing proactively triggers actions that forestall and contain errors and crises and requires leaders and employees to pay close attention to shaping the social and relational infrastructure of the organization. They establish
651-405: A clear command structure and did not have the authority either to tell the utility what to do or to order an evacuation of the local area. In a 2009 article, Gilinsky wrote that it took five weeks to learn that "the reactor operators had measured fuel temperatures near the melting point". He further wrote: "We didn't learn for years—until the reactor vessel was physically opened—that by the time
744-463: A factor of 100 to 1,000". Gundersen offers evidence, based on pressure monitoring data, for a hydrogen explosion shortly before 2:00 p.m. on March 28, 1979, which would have provided the means for a high dose of radiation to occur. Gundersen cites affidavits from four reactor operators according to which the plant manager was aware of a dramatic pressure spike, after which the internal pressure dropped to outside pressure. Gundersen also claimed that
837-485: A fire incident command system, Loma Linda Hospital's Pediatric Intensive Care Unit, and the California Independent System Operator were all studied as examples of HROs. Although they may seem diverse, these organizations have a number of similarities. First, they operate in rigid social and political environments. Second, their technologies are high-risk and present the potential for error. Third,
930-413: A maximum of 480 PBq (13 MCi) of radioactive noble gases, primarily xenon , were released by the event. These noble gases were considered relatively harmless, and only 481–629 GBq (13.0–17.0 Ci) of thyroid cancer -causing iodine-131 were released. Total releases according to these figures were a relatively small proportion of the estimated 370 EBq (10 GCi) in the reactor. It
1023-451: A panel of 12 people, specifically chosen for their lack of strong pro- or anti-nuclear views, and headed by chairman John G. Kemeny , president of Dartmouth College . It was instructed to produce a final report within six months, and after public hearings, depositions, and document collection, released a completed study on October 31, 1979. According to the official figures, as compiled by the 1979 Kemeny Commission from Met Ed and NRC data,
SECTION 10
#17328631041801116-579: A ruined reactor vessel and a containment building that was unsafe to walk in. Cleanup started in August 1979 and officially ended in December 1993, with a total cleanup cost of about $ 1 billion. Benjamin K. Sovacool , in his 2007 preliminary assessment of major energy accidents, estimated that the TMI accident caused a total of $ 2.4 billion in property damages. Efforts focused on the cleanup and decontamination of
1209-527: A set of interrelated organizing processes and practices, which jointly contribute to the system's (e.g., team, unit, organization) overall safety culture . Successful organizations in high-risk industries continually "reinvent" themselves. For example, when an incident command team realizes what they thought was a garage fire has now changed into a hazardous material incident, they completely restructure their response organization. There are five characteristics of HROs that have been identified as responsible for
1302-406: A situation where the two parameters went in opposite directions. The water level in the pressurizer was rising because the steam in the space at the top of the pressurizer was being vented through the stuck-open PORV, lowering the pressure in the pressurizer because of the lost inventory. The lowering of pressure in the pressurizer made water from the coolant loop surge in and created a steam bubble in
1395-440: A system accident. However, they hold different opinions on whether those system accidents are inevitable or are manageable. Serious accidents in high risk, hazardous operations can be prevented through a combination of organizational design, culture, management, and human choice. Theorists of both schools place a lot of emphasis on human interaction with the system as either cause (Normal Accident Theory - NAT) or prevention (HRO) of
1488-631: A systems accident. High reliability organization theory and HROs are often contrasted against Charles Perrow 's Normal Accident Theory (see Sagan for a comparison of HRO and NAT). NAT represents Perrow's attempt to translate his understanding of the disaster at Three Mile Island nuclear facility into a more general formulation of accidents and disasters. Perrow's 1984 book also included chapters on petrochemical plants, aviation accidents, naval accidents, "earth-based system" accidents (dam breaks, earthquakes), and "exotic" accidents (genetic engineering, military operations, and space flight). At Three Mile Island
1581-435: A widely distributed sense of responsibility and accountability for reliability, concern about misperception, misconception and misunderstanding that is generalized across a wide set of tasks, operations, and assumptions, pessimism about possible failures, redundancy and a variety of checks and counter checks as a precaution against potential mistakes are more distinctive. Defining high reliability and specifying what constitutes
1674-468: A year." According to health researcher Joseph Mangano, early scientific publications estimated no additional cancer deaths in the 10 mi (16 km) area around TMI, based on these numbers. Disease rates in areas farther than 10 miles from the plant were not examined. Local activism in the 1980s, based on anecdotal reports of negative health effects, led to scientific studies being commissioned. A variety of epidemiology studies have concluded that
1767-444: A yellow maintenance tag. The reason why the operator missed the lights for the second valve is not known, although one theory is that his own large belly hid it from his view. The valves may have been left closed during a surveillance test two days earlier. With the block valves closed, the system was unable to pump water. The closure of these valves was a violation of a key Nuclear Regulatory Commission (NRC) rule, according to which
1860-527: Is derived from normal accident theory, which led a group of researchers at the University of California, Berkeley (Todd LaPorte, Gene Rochlin, and Karlene Roberts) to study how organizations working with complex and hazardous systems operated error free . They researched three organizations: United States nuclear aircraft carriers (in partnership with Rear Admiral (ret.) Tom Mercer on the USS Carl Vinson),
1953-513: The American Nuclear Society , using the official radioactivity emission figures, "The average radiation dose to people living within 10 miles of the plant was eight millirem (0.08 mSv ), and no more than 100 millirem (1 mSv) to any single individual. Eight millirem is about equal to a chest X-ray , and 100 millirem is about a third of the average background level of radiation received by US residents in
SECTION 20
#17328631041802046-575: The Federal Aviation Administration 's Air Traffic Control system (and commercial aviation more generally), and nuclear power operations (Pacific Gas and Electric's Diablo Canyon reactor). The result of this initial work was the defining characteristics of HROs hold in common: While many organizations display some of these characteristics, HROs display them all simultaneously. Normal Accident and HRO theorists agreed that interactive complexity and tight coupling can, theoretically, lead to
2139-419: The core under gravity, halting the nuclear chain reaction and stopping the heat generated by fission. However, the reactor continued to generate decay heat , initially equivalent to approximately 6% of the pre-trip power level. Because steam was no longer being used by the turbine and feed was not being supplied to the steam generators, heat removal from the reactor's primary water loop was limited to steaming
2232-612: The corium layers on the bottom of the reactor vessel and analyzed. On Wednesday, March 28, hours after the accident began, Lieutenant Governor Scranton appeared at a news briefing to say that Met Ed had assured the state that "everything is under control". Later that day, Scranton changed his statement, saying that the situation was "more complex than the company first led us to believe". There were conflicting statements about radioactivity releases. Schools were closed, and residents were urged to stay indoors. Farmers were told to keep their animals under cover and on stored feed. Based on
2325-405: The feedwater pumps , condensate booster pumps, and condensate pumps to turn off around 4:00 a.m., which would, in turn, cause a turbine trip . Given that the steam generators were no longer receiving feedwater, heat transfer from the reactor coolant system (RCS) was greatly reduced, and RCS temperature rose. The rapidly heating coolant expanded and surged into the pressurizer, compressing
2418-472: The rate of cancer in and around the area since the accident did determine that there was a statistically significant increase in the rate of cancer, while other studies did not. Due to the nature of such studies, a causal connection linking the accident with cancer is difficult to prove. Cleanup at TMI-2 started in August 1979 and officially ended in December 1993, with a total cost of about $ 1 billion (equivalent to $ 2 billion in 2023). TMI-1
2511-622: The "mindfulness" that keeps them working well when facing unexpected situations. Although the original research and early application of HRO theory into practice occurred in high risk industries, research covers a wide variety of applications and settings. Health care has been the largest practitioner area for the past several years. The applications of Crew Resource Management is another area of focus for leaders in HROs requiring competent behavior systems measurement and intervention. Wildfires create complex and very dynamic mega-crisis situations across
2604-458: The EPA found no contamination in water, soil, sediment, or plant samples. Researchers at nearby Dickinson College —which had radiation monitoring equipment sensitive enough to detect Chinese atmospheric atomic weapons-testing—collected soil samples from the area for the ensuing two weeks and detected no elevated levels of radioactivity, except after rainfalls (likely from natural radon plate-out, not
2697-477: The NRC for lapses in quality assurance and maintenance, inadequate operator training, lack of communication of important safety information, poor management, and complacency, but avoided drawing conclusions about the future of the nuclear industry. The heaviest criticism from the Kemeny Commission said that "... fundamental changes will be necessary in the organization, procedures, and practices—and above all—in
2790-408: The PORV discharge line and unusually high containment building temperatures and pressures, were clear indications that there was an ongoing LOCA, but these indications were initially ignored by operators. At 4:15 a.m., the relief diaphragm of the pressurizer relief tank ruptured, and radioactive coolant began to leak into the general containment building . This radioactive coolant was pumped from
2883-519: The PORV indicator and to look for alternative confirmation that the main relief valve was closed. A downstream temperature indicator, the sensor for which was located in the tail pipe between the pilot-operated relief valve and the pressurizer relief tank, could have hinted at a stuck valve had operators noticed its higher-than-normal reading. It was not, however, part of the "safety grade" suite of indicators designed to be used after an incident, and personnel had not been trained to use it. Its location behind
High reliability organization - Misplaced Pages Continue
2976-404: The accident as a "cause for concern but not alarm". Gilinsky briefed reporters and members of Congress on the situation and informed White House staff, and at 10:00 a.m. met with two other commissioners. However, the NRC faced the same problems in obtaining accurate information as the state and was further hampered by being organizationally ill-prepared to deal with emergencies, as it lacked
3069-675: The accident had no observable long-term health effects. A peer-reviewed research article by Dr. Steven Wing found a significant increase in cancers between 1979 and 1985 among people who lived within ten miles of TMI. In 2009, Dr. Wing stated that radiation releases during the accident were probably "thousands of times greater" than the NRC's estimates. A retrospective study of the Pennsylvania Cancer Registry found an increased incidence of thyroid cancer in some counties south of TMI (although, notably, not in Dauphin County where
3162-654: The accident). Also, the tongues of white-tailed deer harvested over 50 mi (80 km) from the reactor subsequent to the accident were found to have significantly higher levels of cesium-137 than in deer in the counties immediately surrounding the power plant. Even then, the elevated levels were still below those seen in deer in other parts of the country during the height of atmospheric nuclear weapons testing. Had there been elevated releases of radioactivity, increased levels of iodine-131 and cesium-137 would have been expected to be detected in cattle and goat's milk samples. Elevated levels were not found. A later study noted that
3255-402: The accident. The uncertainty of operators at the plant was reflected in fragmentary, ambiguous, or contradictory statements made by Met Ed to government agencies and to the press, particularly about the possibility and severity of off-site radioactivity releases. Scranton held a press conference in which he was reassuring, yet confused, about this possibility, stating that though there had been
3348-546: The advice of NRC chairman Joseph Hendrie, advised the evacuation "of pregnant women and pre-school age children...within a five-mile radius of the Three Mile Island facility". The evacuation zone was extended to a 20-mile radius on March 30. Within days, 140,000 people had left the area. More than half of the 663,500 population within the 20-mile radius remained in that area. According to a survey conducted in April 1979, 98% of
3441-516: The advice of the Chairman of the NRC and in the interest of taking every precaution, I am advising those who may be particularly susceptible to the effects of any radiation, that is, pregnant women and pre-school aged children, to leave the area within a five-mile radius of the Three Mile Island facility until further notice. We've also ordered the closings of any schools within this area. Governor Thornburgh, on
3534-742: The answer is on the order of tens of thousands of times the organization is “high reliability”” (p. 160). More recent definitions have built on this starting point but emphasized the dynamic nature of producing reliability (i.e., constantly seeking to improve reliability and intervening both to prevent errors and failures and to cope and recover quickly should errors become manifest). Some researchers view HROs as reliability-seeking rather than reliability-achieving. Reliability-seeking organizations are not distinguished by their absolute errors or accident rate , but rather by their “effective management of innately risky technologies through organizational control of both hazard and probability” (p. 14). Consequently,
3627-496: The attitudes" of the NRC and the nuclear industry. Kemeny said that the actions taken by the operators were "inappropriate" but that the workers "were operating under procedures that they were required to follow, and our review and study of those indicates that the procedures were inadequate" and that the control room "was greatly inadequate for managing an accident". The Kemeny Commission noted that Babcock & Wilcox's PORV had previously failed on 11 occasions, nine of them in
3720-405: The cladding was damaged while the PORV was still stuck open. Fission products were released into the reactor coolant. Since the PORV was stuck open and the loss of coolant accident was still in progress, primary coolant with fission products and/or fuel was released and ultimately ended up in the auxiliary building. The auxiliary building was outside the containment boundary. This was evidenced by
3813-509: The cleanup was completed in 1990, when workers finished shipping 150 short tons (140 t) of radioactive wreckage to Idaho for storage at the Department of Energy's National Engineering Laboratory. However, the contaminated cooling water that leaked into the containment building had seeped into the building's concrete, leaving the radioactive residue too impractical to remove. Accordingly, further cleanup efforts were deferred to allow for decay of
High reliability organization - Misplaced Pages Continue
3906-440: The containment building sump to an auxiliary building, outside the main containment, until the sump pumps were stopped at 4:39 a.m. At about 5:20 a.m., after almost 80 minutes with a growing steam bubble in the reactor pressure vessel head, the primary loop's four main reactor coolant pumps began to cavitate as a steam bubble/water mixture, rather than water, passed through them. The pumps were shut down, and it
3999-403: The control room shook and doors were blown off hinges. However, official NRC reports refer merely to a "hydrogen burn". The Kemeny Commission referred to "a burn or an explosion that caused pressure to increase by 28 pounds per square inch (190 kPa) in the containment building", while The Washington Post reported that "At about 2:00 pm, with pressure almost down to the point where
4092-406: The coolant-inventory level or the position of the stuck-open PORV. The accident heightened anti-nuclear safety concerns among the general public and led to new regulations for the nuclear industry. It accelerated the decline of efforts to build new reactors. Anti-nuclear movement activists expressed worries about regional health effects from the accident. Some epidemiological studies analyzing
4185-456: The demise of the U.S. nuclear power industry, but it did halt its historic growth. Additionally, as a result of the earlier 1973 oil crisis and post-crisis analysis with conclusions of potential overcapacity in base load , 40 planned nuclear power plants already had been canceled before the accident. At the time of the incident, 129 nuclear power plants had been approved, but of those, only 53 which were not already operating were completed. During
4278-406: The end of the increase in nuclear power plant construction came with the more catastrophic Chernobyl disaster in 1986 (see graph). Initially, GPU planned to repair the reactor and return it into service. However, TMI-2 was too badly damaged and contaminated to resume operations; the reactor was gradually deactivated and permanently closed. TMI-2 had been online for only three months but now had
4371-419: The environment at the three stations closest to the plant. Continuous monitoring at 11 stations was established on April 1 and was expanded to 31 stations on April 3. An inter-agency analysis concluded that the accident did not raise radioactivity far enough above background levels to cause even one additional cancer death among the people in the area, but measures of beta radiation were not included because
4464-497: The evacuees had returned to their homes within three weeks. Post-TMI surveys have shown that less than 50% of the American public were satisfied with the way the accident was handled by Pennsylvania state officials and the NRC, and people surveyed were even less pleased with the utility (General Public Utilities) and the plant designer. According to the IAEA, the Three Mile Island accident
4557-683: The general containment building was seriously contaminated with radiation levels of 800 rem / h . At 6:56 a.m. a plant supervisor declared a site area emergency , and less than 30 minutes later station manager Gary Miller announced a general emergency . Metropolitan Edison (Met Ed) notified the Pennsylvania Emergency Management Agency , which in turn contacted state and local agencies, Pennsylvania Governor Richard L. Thornburgh and Lieutenant Governor William Scranton III , to whom Thornburgh assigned responsibility for collecting and reporting on information about
4650-481: The globe every year. U.S. wildland firefighters, often organized using the Incident Command System into flexible inter-agency incident management teams , are not only called upon to "bring order to chaos" in today's mega-fires, they also are requested on "all-hazard events" like hurricanes , floods and earthquakes. The U.S. Wildland Fire Lessons Learned Center has been providing education and training to
4743-506: The huge cooling pumps could be brought into play, a small hydrogen explosion jolted the reactor." Work performed for the Department of Energy in the 1980s determined that the hydrogen burn ( deflagration ), which went essentially unnoticed for the first few days, occurred 9 hours and 50 minutes after initiation of the accident, had a duration of 12 to 15 seconds and did not involve a detonation . The investigation strongly criticized Babcock & Wilcox , Met Ed, General Public Utilities, and
SECTION 50
#17328631041804836-407: The indication for the PORV was one of many design flaws identified in the operators' controls, instruments and alarms . There was no direct indication of the valve's actual position. A light on a control panel, installed after the PORV had stuck open during startup testing, came on when the PORV opened. When that light—labeled Light on – RC-RV2 open —went out, the operators believed that the valve
4929-475: The initial failure of plant operators to recognize the situation as a loss-of-coolant accident (LOCA). TMI training and operating procedures left operators and management ill-prepared for the deteriorating situation caused by the LOCA. During the accident, those inadequacies were compounded by design flaws, such as poor control design, the use of multiple similar alarms, and a failure of the equipment to indicate either
5022-709: The integrity of the reactor vessel. In order to do this, someone needed to draw a boron concentration sample in order to ensure there was enough of it in the primary system to shut down the reactor entirely. Unit 2's chemistry supervisor, Edward "Ed" Houser, volunteered to draw the sample after his co-workers were hesitant. Shift supervisor Richard Dubiel asked Pete Velez, the radiation protection foreman for Unit 2, to join Houser. Velez would monitor airborne radiation levels and ensure that no overexposure would occur for either of them. Wearing excessive amounts of protective clothing—three pairs of gloves, one pair of rubber boots and
5115-466: The lengthy review process, complicated by the Chernobyl disaster seven years later, Federal requirements to correct safety issues and design deficiencies became more stringent, local opposition became more strident, construction times were significantly lengthened and costs skyrocketed. Until 2012, no U.S. nuclear power plant had been authorized to begin construction since the year before, 1978. Globally,
5208-493: The literature on high reliability. These researchers systematically reviewed the case study literature on HROs and illustrated how the infrastructure of high reliability was grounded in processes of collective mindfulness which are indicated by a preoccupation with failure, reluctance to simplify interpretations, sensitivity to operations, commitment to resilience, and deference to expertise. In other words, HROs are distinctive because of their efforts to organize in ways that increase
5301-424: The nuclear fuel rod cladding and damaged the fuel pellets, which released radioactive isotopes to the reactor coolant and produced hydrogen gas that is believed to have caused a small explosion in the containment building later that afternoon. At 6:00 a.m. there was a shift change in the control room. A new arrival noticed that the temperatures in the PORV tail pipe and the holding tanks were excessive, and used
5394-548: The official emission figures were consistent with available dosimeter data, though others have noted the incompleteness of this data, particularly for releases early on. Several state and federal government agencies mounted investigations into the crisis, the most prominent of which was the President's Commission on the Accident at Three Mile Island , created by U.S. President Jimmy Carter in April 1979. The commission consisted of
5487-427: The open PORV, RCS pressure dropped as did pressurizer level after peaking 15 seconds after the turbine trip. Also, 15 seconds after the turbine trip, coolant pressure had dropped to 2,205 psi (152.0 bar), the reset setpoint for the PORV. Electric power to the PORV's solenoid was automatically cut, but the relief valve was stuck open with coolant water continuing to be released. In post-accident investigations,
5580-533: The open position, allowing coolant to escape. The initial causal sequence of events at TMI had been duplicated 18 months earlier at another Babcock & Wilcox reactor, the Davis–Besse Nuclear Power Station . The only differences were that the operators at Davis–Besse identified the valve failure after 20 minutes, where at TMI it took 80 minutes, and the fact that the Davis–Besse facility
5673-446: The phrase "high reliability" has come to mean that high risk and high effectiveness can co-exist, for organizations that must perform well under trying conditions, and that it takes intensive effort to do so. While the early research focused on high risk industries, other expressed interest in HROs and sought to emulate their success. A key turning point was Karl Weick, Kathleen M. Sutcliffe , and David Obstfeld's reconceptualization of
SECTION 60
#17328631041805766-406: The plant operator called the NRC at about 8:00 a.m., roughly half of the uranium fuel had already melted." It was still not clear to the control room staff that the primary loop water levels were low and that over half of the core was exposed. A group of workers took manual readings from the thermocouples and obtained a sample of primary loop water. Seven hours into the emergency, new water
5859-516: The quality of attention across the organization, thereby enhancing people's alertness and awareness to details so that they can detect subtle ways in which contexts vary and call for contingent responding (i.e., collective mindfulness). This construct was elaborated and refined as mindful organizing in Weick and Sutcliffe's 2001 and 2007 editions of their book Managing the Unexpected. Mindful organizing forms
5952-591: The radiation alarms that eventually sounded. However, since very little of the fission products released were solids at room temperature, very little radiological contamination was reported in the environment. No significant level of radiation was attributed to the TMI-2 accident outside of the TMI-2 facility. According to the Rogovin report, the vast majority of the radioisotopes released were noble gases xenon and krypton resulting in an average dose of 1.4 mrem (14 μSv) to
6045-414: The radiation levels and to take advantage of the potential economic benefits of retiring both Unit 1 and Unit 2 together. In the aftermath of the accident, investigations focused on the amount of radioactivity released. In total, approximately 2.5 megacuries (93 PBq) of radioactive gases and approximately 15 curies (560 GBq) of iodine-131 were released into the environment. According to
6138-425: The radioactive isotopes in the core. Anti-nuclear political groups disputed the Kemeny Commission's findings, claiming that other independent measurements provided evidence of radiation levels up to seven times higher than normal in locations hundreds of miles downwind from TMI. Arnie Gundersen , a former nuclear industry executive and anti-nuclear advocate, said "I think the numbers on the NRC's website are off by
6231-483: The reactor must be shut down if all auxiliary feed pumps are closed for maintenance. This was later singled out by NRC officials as a key failure. After the reactor tripped, secondary system steam valves operated to reduce steam generator temperature and pressure, cooling the RCS and lowering RCS temperature, as designed, resulting in a contraction of the primary coolant. With the coolant contraction and loss of coolant through
6324-445: The reactor pressure vessel head, aided by the decay heat from the fuel. This steam bubble was invisible for the operators, and this mechanism had not been trained. Indications of high water levels in the pressurizer contributed to confusion, as operators were concerned about the primary loop "going solid", (i.e., no steam pocket buffer existing in the pressurizer) which in training they had been instructed to never allow. This confusion
6417-513: The reactor was located) and in high-risk age groups but did not draw a causal link between these incidences and the accident. The Talbott lab at the University of Pittsburgh reported finding a few, small increased cancer risks within the TMI population. A more recent study reached "findings consistent with observations from other radiation-exposed populations," raising "the possibility that radiation released from [Three Mile Island] may have altered
6510-486: The secondary side. Blockages are common with these resin filters and are usually fixed easily, but in this case, the usual method of forcing the stuck resin out with compressed air did not succeed. The operators decided to blow compressed air into the water and let the force of the water clear the resin. When they forced the resin out, a small amount of water forced its way past a stuck-open check valve and found its way into an instrument air line . This would eventually cause
6603-472: The seven-foot-high instrument panel also meant that it was effectively out of sight. Less than a minute after the beginning of the event, the water level in the pressurizer began to rise, even though RCS pressure was falling. With the PORV stuck open, coolant was being lost from the RCS, a loss-of-coolant accident (LOCA). Expected symptoms for a LOCA were drops in both RCS pressure and pressurizer level. The operators' training and plant procedures did not cover
6696-452: The seven-point logarithmic International Nuclear Event Scale , the TMI-2 reactor accident is rated Level 5, an "Accident with Wider Consequences". The accident began with failures in the non-nuclear secondary system, followed by a stuck-open pilot-operated relief valve (PORV) in the primary system, which allowed large amounts of water to escape from the pressurized isolated coolant loop. The mechanical failures were compounded by
6789-526: The severity and scale of possible consequences from errors or mistakes precludes learning through experimentation . Finally, these organizations all use complex processes to manage complex technologies and complex work to avoid failure . HROs share many properties with other high-performing organizations including highly trained-personnel, continuous training, effective reward systems, frequent process audits and continuous improvement efforts. Yet other properties such as an organization-wide sense of vulnerability,
6882-536: The site, especially the defueling of the damaged reactor. Starting in 1985, almost 100 short tons (91 t) of radioactive fuel were removed from the site. Planning and work was partially hampered by too-optimistic views about the damage. In 1988, the NRC announced that, although it was possible to further decontaminate the Unit ;2 site, the remaining radioactivity had been sufficiently contained as to pose no threat to public health and safety. The first major phase of
6975-479: The small amount of water remaining in the secondary side of the steam generators to the condenser using turbine bypass valves. When the feedwater pumps tripped, three emergency feedwater pumps started automatically. An operator noted that the pumps were running but did not notice that a block valve was closed in each of the two emergency feedwater lines, blocking emergency feed flow to both steam generators. The valve position lights for one block valve were covered by
7068-485: The steam bubble at the top. When RCS pressure rose to 2,255 psi (155.5 bar), the pilot-operated relief valve (PORV) opened, relieving steam through piping to the reactor coolant drain tank in the containment building basement. RCS pressure continued to rise, reaching the reactor protection system high-pressure trip setpoint of 2,355 psi (162.4 bar) eight seconds after the turbine trip. The reactor automatically tripped , its control rods falling into
7161-602: The technology was tightly coupled due to time-dependent processes, invariant sequences, and limited slack. The technological deficiencies were a result of unforeseen concatenations, that ultimately resulted in the conjoined collapse of a complex system. Perrow hypothesized that regardless of the effectiveness of management and operations, accidents in systems that are characterized by tight coupling and interactive complexity will be normal or inevitable as they often cannot be foreseen or prevented. This view, described by some theorists as boldly technologically deterministic, contrasts with
7254-567: The then highly contaminated reactor was maintained. Angry that Met Ed had not informed them before conducting a steam venting from the plant, and convinced that the company was downplaying the severity of the accident, state officials turned to the NRC. After receiving word of the accident from Met Ed, the NRC had activated its emergency response headquarters in Bethesda, Maryland , and sent staff members to Three Mile Island. NRC chairman Joseph Hendrie and commissioner Victor Gilinsky initially viewed
7347-439: The three main water/steam loops in a pressurized water reactor . The initial cause of the accident happened 11 hours earlier, during an attempt by operators to fix a blockage in one of the eight condensate polishers , the sophisticated filters cleaning the secondary loop water. These filters are designed to stop minerals and other impurities in the water from accumulating in the steam generators and to decrease corrosion rates on
7440-518: The two million people near the plant. In comparison, a patient receives 3.2 mrem (32 μSv) from a chest X-ray—more than twice the average dose of those received near the plant. On average, a U.S. resident receives an annual radiation exposure from natural sources of about 310 mrem (3,100 μSv). Within hours of the accident, the United States Environmental Protection Agency (EPA) began daily sampling of
7533-416: The view of HRO proponents, who argued that high-risk, high-hazard organizations can function safely despite the hazards of complex systems. Despite their differences, NAT and HRO theory share a focus on the social and organizational underpinnings of system safety and accident causation/prevention. As research continued, a body of knowledge emerged based on the studying of a variety of organizations. For example,
7626-419: The wildland fire community on high reliability since 2002. HRO behaviors can be developed into high-functioning skills of anticipation and resilience. Learning organizations that strive for high performance in things they can plan for, can become HROs that are able to better manage unexpected events that by definition cannot be planned for. Three Mile Island accident The Three Mile Island accident
7719-530: Was a key contributor to the initial failure to recognize the accident as a LOCA and led operators to turn off the emergency core cooling pumps, which had automatically started after the PORV stuck and core coolant loss began, due to fears the system was being overfilled. With the PORV still open, the pressurizer relief tank that collected the discharge from the PORV overfilled, causing the containment building sump to fill and sound an alarm at 4:11 a.m. This alarm, along with higher than normal temperatures on
7812-700: Was a partial nuclear meltdown of the Unit 2 reactor (TMI-2) of the Three Mile Island Nuclear Generating Station . It happened on the Susquehanna River in Londonderry Township , near Harrisburg, Pennsylvania . The reactor accident began at 4:00 a.m. on March 28, 1979, and released radioactive gases and radioactive iodine into the environment. It is the worst accident in U.S. commercial nuclear power plant history. On
7905-565: Was a significant turning point in the global development of nuclear power. From 1963 to 1979, the number of reactors under construction globally increased every year except in 1971 and 1978. However, following the event, the number of reactors under construction in the U.S. declined from 1980 to 1998, with increasing construction costs and delayed completion dates for some reactors. Many similar Babcock & Wilcox reactors on order were canceled. In total, 52 U.S. nuclear reactors were canceled between 1980 and 1984. The accident did not initiate
7998-507: Was believed that natural circulation would continue the water movement. Steam in the system prevented flow through the core, and as the water stopped circulating it was converted to steam in increasing amounts. Soon after 6:00 a.m., the top of the reactor core was exposed, and the intense heat caused a reaction to occur between the steam forming in the reactor core and the zircaloy nuclear fuel rod cladding, yielding zirconium dioxide , hydrogen , and additional heat. This reaction melted
8091-403: Was closed. In fact, the light when on only indicated that the PORV pilot valve's solenoid was powered, not the actual status of the PORV. While the main relief valve was stuck open, the operators believed the unlighted lamp meant the valve was shut. As a result, they did not correctly diagnose the problem for several hours. The operators had not been trained to understand the ambiguous nature of
8184-404: Was determined that there was no oxygen present in the pressure vessel, a prerequisite for hydrogen to burn or explode. Immediate steps were taken to reduce the hydrogen bubble, and by the following day it was significantly smaller. Over the next week, steam and hydrogen were removed from the reactor using a catalytic recombiner and by venting directly into the open air. The release occurred when
8277-430: Was later found that about half the core had melted, and the cladding around 90% of the fuel rods had failed, with 5 ft (1.5 m) of the core gone, and around 20 short tons (18 t ) of uranium flowing to the bottom head of the pressure vessel, forming a mass of corium . The reactor vessel—the second level of containment after the cladding—maintained integrity and contained the damaged fuel with nearly all of
8370-418: Was only admitted back to work the following quarter. On the third day following the accident, a hydrogen bubble was discovered in the dome of the pressure vessel and became the focus of concern. A hydrogen explosion could breach the pressure vessel and, depending on its magnitude, might compromise the integrity of the containment building leading to a large-scale release of radioactive material. However, it
8463-457: Was operating at 9% power, against TMI's 97%. Although Babcock engineers recognized the problem, the company failed to clearly notify its customers of the valve issue. The Pennsylvania House of Representatives conducted its own investigation, which focused on the need to improve evacuation procedures. In 1985, a television camera was used to see the interior of the damaged reactor. In 1986, core samples and samples of debris were obtained from
8556-415: Was pumped into the primary loop and the backup relief valve was opened to reduce pressure so that the loop could be filled with water. After 16 hours, the primary loop pumps were turned on once again, and the core temperature began to fall. A large part of the core had melted, and the system was dangerously radioactive. On the day following the accident, March 29, control room operators needed to ensure
8649-486: Was restarted in 1985, then retired in 2019 due to operating losses. It is expected to go back into service by 2028 as part of a deal with Microsoft to power its data centers. In the night hours before the incident, the TMI-2 reactor was running at 97% power while the companion TMI-1 reactor was shut down for refueling. The main chain of events leading to the partial core meltdown on Wednesday, March 28, 1979, began at 4:00:36 a.m. EST in TMI-2's secondary loop, one of
#179820