PWR Operator Manual · Open the simulator

08 — Accident Study: Three Mile Island Unit 2 (1979)

Document: PWR-X01
Title: Three Mile Island Unit 2 — the four hours in the control room
Revision: 24
Category: Accident case study (sourced narrative + walkthrough)

1.0 The plant and the night

What this chapter is. The TMI-2 accident as it can be lived on this plant: what the crew saw, what they believed, what they did — and what happens when the same actions are taken on this board. Every historical clock and every operator-reasoning claim below is quoted from the primary listed in §7.0. Every plant number is a measurement taken on this plant through the full stack (service → control layer → engine) on 2026-09-08; where the model departs from the history, the departure is stated in the same row rather than smoothed over.

How to run it. Open Main Menu → Walkthroughs and press Start on the Three Mile Island row, under Incidents. The walkthrough starts at full power and injects the failures behind the scenes, on the step that needs them; you operate the board. It is on the preview channel while the two playthrough reviews are open. Free play alternative: start Hot Full Power and inject Loss of Main Feedwater, **Auxiliary Feedwater Failure, PORV Stuck Open and PORV Indicator Stuck Closed** together (07 PWR-E01, PWR-E12, PWR-E07, PWR-E08).

The first minute arrives as five beats, not one. Steps 2-6 are the cascade, one event to a step and each on its own clock: the condensate polisher goes off line (told, not simulated, §6.0), the condensate and main feed pumps trip, the turbine trips after them, the auxiliary feed pumps start into shut valves, and the relief valve lifts and does not reseat. **On two of those beats the walkthrough stops the clock** — the feed-pump trip and the relief valve — because the events are seconds wide and are not the player's to control: the primary pressure spike peaks about six seconds in and is over by thirty-five. The sim resumes when you press Continue; Rewind step and Stop release it too. Steps 2, 3 and 6 ask for no action at all — read the board, then press Continue.

**One thing is armed earlier than it is narrated, and it is a plant fact rather than an authoring choice.** The stuck relief valve is armed with the feed-pump trip on step 3, three steps before the beat that tells you about it. The stick does nothing to a shut valve: it latches on the first lift, the valve lifts about five seconds in and reseats near twenty-five, and measured full-stack the accident happens if the failure is armed at or before 21 seconds and does not happen at all at 22 — the plant settles at 1989 psi (13.71 MPa) with pressurizer level 41.5 % and the valve shut. A narrated chain cannot spend that budget, so the arming rides with the initiating event and only the lamp failure — which is timing-insensitive — lands on the relief-valve step.

1.1 Two different plants

Why the walkthrough defeats this plant's anticipatory trip (ruled 2026-09-08). At TMI-2 the turbine tripped and the reactor kept running for eight seconds; primary pressure climbed into the relief valve, which is the event the whole accident hangs from. The report is explicit about what the missing feature cost and what a fitted one would have done:

*"The anticipatory trip prevents, in most instances, the opening of the PORV… The influence of the lack of such a feature is to decrease the time available to the operating crew to cope with the event."* — Vol. II Pt 2

That is exactly this plant's behaviour: a turbine trip above P-9 scrams the reactor at once, the pressure turns before it reaches the valve, and there is no stuck valve to find. The walkthrough therefore injects Anticipatory Trip Failure on its first step and says so to the player in one sentence. It is a declared departure from this plant's own sourced behaviour, taken so the accident can happen at all — and the departure is itself the first lesson: one relay decides whether this night is a routine trip or an accident.

The consequence of the bigger relief valve. Per megawatt this plant loses inventory through a stuck-open valve faster than TMI-2 did. Read the shape of the ride below — the plateau, the level that rises while mass falls, the margin that pegs — and not the minutes as real-plant figures.

2.0 The first minutes — 04:00:36 to 04:02:39

NOTE — how to read the clocks. The source quotes a wall clock for the first two events only (04:00:36 and 04:00:37) and gives elapsed time after initiation for everything after. **Every other wall clock in this chapter is derived** by adding the elapsed time to 04:00:37 — arithmetic on the source, not a quote from it.

The lesson of these two minutes. Nothing on either board was lying about itself. The lamp reported the signal it was wired to report; the tailpipe alarm reported a hot pipe; the pressurizer reported its own level. What was missing at TMI-2 is missing here too — a direct reading of how much water is in the vessel.

3.0 The deception — 04:03:50 to 04:06:28

3.1 What the crew knew

The standing condition, in the report's own words:

"No instruments are provided for reading the level of water in the reactor vessel." — Vol. II Pt 2 §II.A, Figure II-6 caption

*"Their training on this particular equipment has taught the operators that the only credible check on the amount of coolant in the system is the indicator showing water level in the pressurizer… If the pressurizer level remains high, the operators are not trained to anticipate that coolant water may be leaking out of the primary system."* — Vol. I

*"the operator training at Met Ed, at B&W, even back in the navy, tells these men that the condition to avoid at all costs is 'going solid'"* — Vol. I

3.2 What they did

3.3 The coupling, on this plant's numbers

They throttled on a level that was still rising, not on a pegged gauge. The sourced order is throttle at 4 min 30 s → level peaks at 5 min → off scale at 5 min 51 s. The reaction was to the rate.

On this plant the same divergence is emergent physics, not a script: at 4.5 minutes the pressurizer reads 100 % on 97.2 % of the plant's water, while pressure has fallen from 2235 psi (15.41 MPa) to 1045 psi (7.205 MPa). Steam forming in the hot leg pushes liquid up the surge line; the gauge measures the surge, not the inventory. Rising level with falling pressure is the signature — one of those two indications is about water and the other is about heat, and only their disagreement carries the diagnosis.

WARNING: Do not throttle or secure injection on rising pressurizer level alone. Read the subcooling margin and the pressure trend with it.

4.0 Boiling and the pumps — 04:06 to 05:41

The pumps are the hard lesson. Vibration, falling flow and falling amperage all said the same thing — the pumps were passing a froth and had no suction head. Securing them was the correct equipment decision and it removed the last forced circulation from a core that could not set up natural circulation, because the loops were full of steam.

5.0 The block valve and the recovery — 06:18 onward

The recovery is one valve. Everything upstream of 06:18 is diagnosis; the action itself was available from the first minute. This is the step to take away from the chapter: an open relief path is stopped by the block valve whether or not the relief valve can be commanded shut, and whether or not its lamp agrees.

5.1 Correct recovery on this board

CAUTION: The spring safety valves are a separate path. The block valve isolates the relief line only (03 §6.3).

6.0 What the model does not show

Each gap below carries the measurement or the file that declares it, so the departure is checkable rather than asserted.

Where the numbers come from, and how far they carry. Every plant figure in §2.0–§5.0 was taken on one continuous full-stack ride from Hot Full Power on 2026-09-08. To 15 minutes that ride and the engine-direct rides agree within 3 %; at 30 minutes within 3.4 %. **Past 50 minutes the figures are the shipped plant's alone** — the auxiliary-feed level-hold channel throttles feed there, which holds the primary near 1020 psi (7.033 MPa) instead of letting it fall, and it is the reason the accumulators never dump. Numbers past 30 minutes were taken on a scripted ride whose holds are not a player's route; treat them as the shape of the ride, not as step targets.

7.0 Sources

Primary — the chronology and the operator reasoning.

Why Appendix II.1 and not NUREG-0600 or NSAC-1. The appendix states in its own introduction that it is the reconciliation of those two plus the utility's own sequence: *"An attempt has been made to reconcile discrepancies found in other published sequences."* It also flags the disagreements it could not reconcile and names which reference it believes.

NOT in this project's source corpus, stated plainly: the Kemeny Commission report and NUREG-0600 were both sought and neither was obtained — NUREG-0600's full text 404s at its public identifier and it is not in the NRC's web document store; the Kemeny report is not carried by the archive the others came from. Nothing in this chapter rests on either.

A trap for anyone re-extracting the appendix. pdftotext -layout **mis-assigns Appendix II.1's Event column by one row**, printing "Reactor trips on high pressure" against the 3-second event instead of the 8-second one — exactly the distinction §2.0 turns on. Both documents are laid out in columns, so grepping a text rendering for a quote returns zero even when the quote is right; read down the column by its x-offset.

7.1 Related documents in this set

These manuals are licensed CC BY 4.0 — see Legal. Training documents for an educational simulator, not licensing-basis documents for a real plant.