Four Hundred Inches

At twenty past five on the morning of Wednesday 28 March 1979, in the control room of the second unit of the Three Mile Island nuclear station, on an island in the Susquehanna River ten miles south of Harrisburg, Pennsylvania, an operator asked the plant computer for five temperatures. The machine typed them out on its utility printer. The surge line into the pressuriser: 514 degrees. The outlet of the electromatic relief valve on top of the pressuriser: 283 degrees. The outlets of the two code safety valves beside it: 211 and 218 degrees. The spray line: 497 degrees.

The relief valve had opened at four o’clock, as it was meant to, and a light on panel 4 had gone out thirteen seconds later, as it was meant to. By the light, the valve had been shut for an hour and twenty minutes. The pipe beneath it was 283 degrees Fahrenheit, sixty-five degrees hotter than the pipes beneath the two valves that had never opened. An emergency procedure in that room said that 200 degrees in the pipe meant the valve was open; another said that at 130 degrees the block valve beneath it should be closed. The printout was read, and set aside, and the block valve stayed open for another hour.

One number on the panel was read all morning and believed. The water level in the pressuriser, the tank whose steam cushion holds the pressure of the whole reactor, stood at 400 inches, the top of its scale, and had been there since six minutes past four. The men in the room had been taught that this number was the measure of how much water the reactor held, and that the thing to fear was its going higher. They acted on the number. Nobody asked the second question, which was where the water had gone.

Who ran it

Three Mile Island had two plants. Unit 1 had run since 1974. Unit 2, beside it, was the newer and larger: a pressurised water reactor supplied by the Babcock & Wilcox Company of Lynchburg, Virginia, rated at about 880 megawatts of electricity, owned by the General Public Utilities group and operated by one of its companies, Metropolitan Edison of Reading, Pennsylvania. The reactor had first gone critical on 28 March 1978 and had gone into commercial operation on 30 December 1978, three months before the morning this entry is about. The NRC’s special inquiry found its first year “bedeviled by a series of mishaps—mostly minor, but troublesome.”

The licence to run it was the Nuclear Regulatory Commission’s, which wrote the rules, examined and licensed the operators, and inspected the plant from a regional office at King of Prussia. Between October 1978 and March 1979 its inspectors made twenty-five visits to Unit 2.

Four licensed men had the plant at four in the morning. William Zewe was shift supervisor for both units, a licensed senior operator, in a glass-walled office at the back of the control room with his paperwork. Fred Scheimann was shift foreman for Unit 2, and was down in the turbine building with two auxiliary operators, trying to clear a plug of resin from a pipe on the number 7 condensate polisher, one of the water-softeners on the feedwater side. Edward Frederick and Craig Faust were the two control room operators at the panels. All four had come through the Navy’s nuclear programme and had at least five years in it; all had been through Metropolitan Edison’s own training and between five and nine weeks on Babcock & Wilcox’s simulator in Lynchburg; all had passed the NRC’s examinations with scores above the national average. The special inquiry judged their training “typical of the industry and, in certain respects, was above average.”

Three investigations followed them through the morning: the President’s Commission under John Kemeny, the president of Dartmouth College, which reported in October 1979; the NRC’s own Special Inquiry Group under the Washington lawyer Mitchell Rogovin, in January 1980; and a special investigation for the United States Senate, in June 1980. The NRC’s inspectors had published their own account, with the trace of every instrument and the timing of every alarm, in August 1979. The operators’ words here are as those reports give them.

What they were trying to find out

A nuclear power plant is not usually called an experiment, but each one is a trial of the propositions its designers and its regulator hold about it, and Unit 2 was carrying one proposition that had never been tested. The accidents the industry had studied hardest were the large ones, a main coolant pipe breaking in two, which happen in seconds and must be answered by machinery; and the machinery had been built in depth. “Large-break accidents require extremely fast reaction, which therefore must be automatically performed by the equipment,” the Commission wrote. “Lesser accidents may develop much more slowly and their control may be dependent on the appropriate actions of human beings. This was the tragedy of Three Mile Island, where the equipment failures in the accident were significantly less dramatic than those that had been thoroughly analyzed, but where the results confused those who managed the accident.”

The hypothesis, then, was two claims wearing one coat. The first was that the automatic systems would cover the fast accidents, and on 28 March they did: the turbine tripped, the reactor scrammed, the emergency feedwater pumps started and the high pressure injection pumps came on, each within seconds of the condition that called for it. The second was that for the slow accidents the man at the panel would see what was happening from the instruments he had been given, and do the right thing. That claim rested on two instruments. One was the water level in the pressuriser. The other was a light.

On the first instrument the training was explicit. In a Babcock & Wilcox plant the pressuriser is a tank forty-two feet high standing beside the reactor, normally holding 800 cubic feet of water with a cushion of 700 cubic feet of steam above it; the cushion sets the pressure of the whole primary system. If the tank fills with water, the cushion is gone, the system is “solid”, and a small change in volume becomes a large change in pressure that can damage the pipes. The operators’ emergency procedure for a loss of coolant told them to bypass the safety injection and throttle the injection valves “as necessary to maintain” a pressuriser level of 220 inches. Michael Ross, the supervisor of operations for Unit 1, put it to the station manager two weeks after the accident: “We’ve taught our operators, and we have a B&W written caution to never take the plant solid. Unconsciously we have told them all the time, ‘never’ take the plant solid.” At the simulator in Lynchburg, the special inquiry found, when the pressuriser went solid “the simulator program came to a halt; the ‘game was over.’”

What nobody had taught them was the case in which the pressuriser could be full while the reactor was emptying. No instrument in a Babcock & Wilcox plant measured the water in the reactor vessel itself, “as a gas gauge does in an automobile,” the special inquiry wrote. The level in the pressuriser was the only gauge there was, and the second claim of the hypothesis was that it told the truth.

What they built

A black and white schematic of the Three Mile Island Unit 2 containment and auxiliary buildings, showing the reactor vessel, the two steam generators, the pressuriser with the pilot-operated relief valve and block valve on top, the drain tank, the let-down line and the high pressure injection make-up pump — Unit 2 as the Senate's investigation drew it in 1980: the pressuriser with the relief valve and the block valve on top of it, the drain tank it discharged into, the let-down line out to the auxiliary building and the high pressure injection pump that fed water back. Adapted by the Senate staff from the President's Commission's report; a United States government work.

The reactor’s core held about a hundred tons of uranium oxide in 36,816 fuel rods, twelve feet long, in a steel vessel forty feet high. Four pumps of 9,000 horsepower each drove the cooling water through it and up through two “candy cane” loops into the two steam generators, at a pressure of 2,155 pounds per square inch and a temperature near 600 degrees. The pressuriser stood off one of the hot legs. On top of it were two code safety valves, spring-loaded and beyond anyone’s control, and a third, smaller valve that could be opened by an electrical signal: the pilot-operated relief valve, made by Dresser Industries, which the plant’s people called the electromatic. It was set to open at 2,255 pounds and to shut again when the pressure fell to 2,205. Beneath it was a block valve, operated from the control room, for the case in which it did not shut. All three discharged down a pipe to a drain tank on the floor of the containment building. Water was drawn off the primary system through a let-down line into the auxiliary building next door, and put back by the make-up pumps, which doubled, when the pressure fell to about 1,600 pounds, as the high pressure injection pumps of the emergency core cooling system, able to push about 1,000 gallons a minute into the reactor.

The relief valve had a history before the plant had a licence. It leaked during the hot functional test of 1977, and was repaired and bench-tested. On 29 March 1978, the day after the reactor first went critical and with the unit at less than one percent power, a fuse blew and power was lost to the valve’s control circuit, which had been wired so that the valve opened when its power failed. It opened; the primary pressure fell from 2,188 pounds to 1,173; the high pressure injection pumps started themselves; and for four minutes, until the power came back and the valve shut itself, the operators did not know it was open, because the control room had no indicator of the valve’s position at all.

What the plant did about this is the hinge of the story. The circuit was rewired so that the valve would stay shut on a loss of power, and a light was put in. James Floyd, the supervisor of operations for Unit 2, told the Senate’s investigators what he had asked for and what he got. “Met Ed put in the problem report. We asked for valve position indication, the decision comes back from bosses that all we’re going to get is command valve command signal light. And he comes into the control room and he has to sell me on that, and if he can’t sell me, then I’m going to raise a stink and push for what I wanted in the first place, or some compromise in between his position and mine.” He did not raise a stink. The NRC’s inspectors described the modification exactly: it allowed “visual control room indication of power across the pilot operator solenoid. This does not provide the operator with valve position, only demand position.” The shift foreman’s log for 6 May 1978 records the instrument technicians checking out the “RC-R2 indicating light on Panel 4.” The inspectors could find no work request for the change, and it was the work request that would have said whether the change had to go into the operators’ training.

The special inquiry’s account of the light is worth setting beside the morning it describes. “When electric power is passed to the solenoid, permitting the valve to open, the light goes on; when diminished pressure in the pressurizer cuts off power to the solenoid, permitting the valve to shut, the light goes off. Unfortunately, the light is proof only that power is reaching the valve-opening mechanism; it is only circumstantial evidence of the actual state of the valve itself.”

In January 1979 the plant’s own engineers tried again. Joseph Logan, the unit superintendent, Richard Bensel, a lead engineer, and Daniel Shovlin, the maintenance supervisor, signed a request that the light be driven instead by a limit switch on the valve’s solenoid, nearer to the valve’s position if not a guarantee of it. The request went to Metropolitan Edison’s generation engineering department in Reading. On 16 March 1979, twelve days before the accident, R. C. Noll of that department wrote to Shovlin: “After discussing this modification with the TMI-2 staff, it has been agreed that this modification is not necessary or required.” Bensel told the Senate that he and George Kunder, the unit’s superintendent for technical support, had concluded that “the added indication . . . wouldn’t have been that much better.”

By then the valve was leaking again. Since October 1978 the temperature in the discharge pipe, which should have been a little below 130 degrees, had run at 170 or 180, a little under the 200 degrees at which an alarm would sound. The operators were adding about 2,400 gallons of make-up water a shift to replace what went down the pipe. The emergency procedure said that a suspected leak through the relief valve should be answered by closing the block valve. It was not closed, because, Frederick said, of the possibility of its sticking shut. Minutes before four o’clock on 28 March, Faust had taken a set of readings that put the pipe at 180 degrees, and Frederick was diluting the boron in the primary coolant, which a leaking valve concentrates as a boiling pot concentrates salt.

There was one more thing the designers had built, and it was a precedent. On 24 September 1977, at Toledo Edison’s Davis-Besse plant in Ohio, a Babcock & Wilcox reactor of the same lineage running at nine percent power, a loss of feedwater had lifted the relief valve, the valve had failed to shut, the pressuriser level had risen while the pressure fell, and the operators, reading the level, had turned off the high pressure injection after about four minutes. They found the open valve and closed its block valve after twenty-one minutes. The Commission’s chief counsel called it “an almost exact duplication of what would happen 18 months later at Three Mile Island.”

The manufacturer’s engineers wrote to each other about Davis-Besse for sixteen months. On 9 February 1978 Bert Dunn, who managed Babcock & Wilcox’s emergency core cooling analysis, wrote to the manager of licensing: “Had this event occurred in a reactor at full power with other than insignificant burnup it is possible, perhaps probable, that core uncovery and possible fuel damage would have resulted. . . . I believe this is a very serious matter and deserves our prompt attention and correction.” He was told, after the accident, that the memorandum had been “misdirected”, because it was not on the company’s form for safety concerns. A draft instruction to the company’s customers was argued over in Lynchburg through 1978 and never sent. An engineer of the Tennessee Valley Authority, Carlyle Michelson, concluded in 1977 that “a full pressurizer is not considered a reliable indication for prescribing certain operator actions such as HPI pump trip”; a note to the same effect at the NRC went to fifteen people and no further. None of it reached the four men on the night shift. The paper trail is in The memoranda.

Two hours and twenty-two minutes

At thirty-six seconds past four, a year to the day and the hour after the reactor first went critical, the valves on the condensate polishers shut. Water had got into the compressed-air system that worked them, as it had at least twice before. The condensate pumps lost their suction and tripped; at 4:00:37 both main feedwater pumps tripped, and the turbine with them. In the control room Faust heard the alarms and said to Frederick, “Something’s going wrong in the plant.” Zewe came out of his office.

With no feedwater the steam generators stopped taking heat out of the primary system. The water in it expanded, the pressuriser level rose, and at three to six seconds the pressure reached 2,255 pounds and the electromatic relief valve opened, as designed. The pressure went on rising, and at eight seconds, at 2,355 pounds, the reactor scrammed, as designed: the control rods dropped and fission stopped. The three emergency feedwater pumps started, as designed. At about thirteen seconds the pressure fell through 2,205 pounds, the signal to the valve’s solenoid was cut, and the light on panel 4 went out. The valve stayed open. Steam went down the pipe at a rate the special inquiry put at some 110,000 pounds an hour, the equivalent of about 220 gallons of water a minute, and would go on doing so for more than two hours.

Nobody could know it from the panel. What the panel showed, the inspectors wrote, was pressure and pressuriser level “trending together and decreasing as was expected after a reactor trip.” At about fourteen seconds an operator saw that the emergency feedwater pumps were running. He did not see the two lights showing that a valve on each of the two emergency feedwater lines was shut, so that no water was reaching the steam generators; one light was behind a yellow maintenance tag. At forty-one seconds the operators started a second make-up pump, as they had been trained to do after a scram, to catch the fall in the pressuriser level. It fell to 158 inches and turned at fifty-four seconds, sooner than they expected. Then it rose, and did not stop rising.

The steam generators boiled dry at about a minute and three-quarters, and the primary water heated and pushed more of itself up into the pressuriser. At two minutes and two seconds the pressure fell through 1,600 pounds and the high pressure injection pumps started themselves, two of them, about a thousand gallons a minute. The level went on up: 225 inches at two and a half minutes, 266 and in high alarm at three and a half. At 4:03:49 the operators bypassed the safety actuation and took the injection under manual control, which the procedure allowed once pressure and level had recovered; the pressure had not. At 4:05:14 they shut one injection pump down and throttled the other, by the Senate’s reading of the record to about twenty-five gallons a minute, and opened up the let-down line to drain water out of the primary system at more than 160 gallons a minute. The order was Scheimann’s, who had come up from the turbine building; the hand was Frederick’s. “The rapidly increasing pressurizer level at the onset of the accident led me to believe that the high pressure injection was excessive, and that we were soon going to have a solid system,” Frederick told the Commission.

At about five and a half minutes the water in the hot legs reached saturation and began to boil. The steam collected at the high points of the loops and pushed water ahead of it into the pressuriser, which, the special inquiry wrote, “now is no longer a pressure regulating device but merely a conduit for passing coolant from the primary system out of the stuck-open valve.” At six minutes the level reached the top of the scale, 400 inches; the computer’s memory review would later record 404.9. It stayed at or near 400 for the next two hours. The pressure, which should have gone up with it, went down to about 1,100 pounds and stayed there.

At eight minutes a Unit 1 supervisor, Ken Bryan, came into the room to see a trip handled and noticed the lights for the emergency feedwater block valves, the “twelves”. Faust lifted the tag and found both shut, and Zewe shouted to open them. Why they were shut has never been settled. The eight minutes did not change the outcome. They added to the confusion.

At fifteen minutes the drain tank’s rupture disc burst, at about 200 pounds, and the water the relief valve was passing began to spill across the containment floor into the sump, from which two pumps sent it next door to the auxiliary building. At 4:11 the sump alarm came in. At about 4:24 Zewe had Bryan ask the computer for the temperatures on the discharge pipes: 285 degrees under the relief valve, 275 and 263 under the safeties. At about 4:38 an auxiliary operator reported both sump pumps running and the tank in the auxiliary building overflowing; Frederick asked the computer for the sump level and got 5.999 feet, the top of the scale, and Zewe had him stop the pumps. By then as much as 8,000 gallons of slightly radioactive water had gone out of the containment. From about 4:20 until nearly five o’clock Zewe was in the turbine building, trying to get the polishers working.

Kunder, the duty officer, arrived at about 4:50, having been told of a turbine trip and a scram. The containment pressure chart read about two pounds, and the temperature in the building was climbing from 120 degrees towards 170. A sample of the coolant at 5:15 showed less boron in it than before the shutdown, and with the neutron counts rising the room’s fear turned for a time to the reactor starting itself again; the real cause, condensed steam diluting the sample, was not read. Shortly after five o’clock the four main coolant pumps began to shake, because they were pumping steam as well as water. At 5:14 the two pumps on the B loop were shut down, to save them. At 5:20 the computer printed the five temperatures with which this entry opens. At 5:27 the B steam generator was isolated on a theory that its steam line had broken into the building, and when the building pressure happened to ease, the theory seemed confirmed.

At 5:41 the last two pumps were shut down. “Once the pumps were stopped,” the Senate’s report says, “the steam separated from the water and rose to the top of the hotlegs—the so-called ‘candy canes’—and the water level in the reactor vessel dropped.” The operators waited for natural circulation to take over, as it would have done in a system full of water. The system was not full of water. Nothing moved. The top of the core was uncovered by about 6:15.

Brian Mehler, the shift supervisor coming on for the day, had reached the control room at about six. “What I saw was the pressurizer being solid and no pressure in the system, pressure going down,” he said later. “It would indicate to me at that particular time that either the [pressurizer] heaters were not functioning or that we had a leak.” He asked whether the heaters were on. Then he asked the computer for the valve temperatures. At 6:17 it gave 229 degrees for the relief valve, about thirty hotter than the safeties. “From that point,” he said, “I assumed that the electromatic was partially opened because of the temperature.” He told Scheimann to close the block valve. The Commission and the Senate put the closing at 6:22, two hours and twenty-two minutes after the valve opened; the inspectors’ record puts it at 6:18 or 6:19. In the first hundred minutes, the Commission estimated, some 32,000 gallons had gone out, more than a third of what the primary system held.

At the same moment Gary Miller, the station manager, was on a conference call from his home with John Herbein, Metropolitan Edison’s vice president for generation, in Philadelphia; with Kunder in the control room; and with Leland Rogers, Babcock & Wilcox’s site manager, at his home. Rogers asked whether the block valve had been closed. Kunder sent someone to find out, and the answer came back that it had. “No one asks the followup question,” the special inquiry wrote: “When was the block valve closed? The answer is that it has just been closed.” Frederick remembered the closing as “somewhat out of desperation. In other words, there seemed to be no other possible cause … It [was] a last ditch effort.” Scheimann called it “pretty much as [a] last resort.” Nobody in the room, with the valve shut, turned the high pressure injection back on. The Commission could find no reason why. It was not restored in any measure for an hour, and not sustained until 8:26.

What it looked like from inside

More than a hundred alarms came in within minutes. “I would have liked to have thrown away the alarm panel,” Faust told the Commission. “It wasn’t giving us any useful information.” Zewe silenced them and tried, he said, “to handle the casualty based on plant parameters, more so than alarm responses.” The computer’s alarm printer fell an hour and a half behind, and jammed. The instruments for the drain tank, which would have shown the tank fill, rupture and empty, were on the back of a panel, out of sight of the main console, with no chart to record them.

The parameters, read one at a time, each had an innocent explanation, and the room found one for each. The level was high: so the system was full. The pressure was low: but it had stopped falling. “It would have concerned me a heck of a lot more if it [the pressure] was still going down,” Scheimann said. The pipe under the relief valve was hot: but it had been hot for months, and the valve had lifted at four o’clock. Zewe told the Commission that in the logs he had seen 198 degrees, “but I can remember instances before . . . just over 200 degrees,” and that “knowing that the relief valve had lifted, the downstream temperature I would expect to be high and that it would take some time for the pipe to cool down below the 200-degree set point.” He remembered the readings that morning as in the 230s; the record shows 285. The drain tank had burst: so the relief valve had lifted hard. The containment was warm and wet: so the tank had burst. The sump was full: so the containment was wet. The chain ran back one link at a time to a valve that had opened for a few seconds at four o’clock, and stopped there, because the light said so.

What did not fit was the thing the training had no place for. “The pressurizer went full and we believed it [the reactor coolant system] was full,” Frederick said. “It must have been full of water, but the next confusing thing was the system wasn’t reacting as if it was solid. We weren’t seeing pressure spikes, so I don’t know if anyone concluded that there was steam building someplace else. It was happening so fast, but we knew that we weren’t solid.” “I didn’t know where the water could be coming from,” Zewe said, “except that if [maybe] we had some high-pressure injection valves leaking; that were still feeding water, even though we were throttling back—I did not know where the water was from.” Kunder, arriving, “had never seen pressurizer level go high and peg in the high range, and at the same time, pressure being low. They have always performed consistently.”

When Zewe came back from the turbine building just before five, “all of us were talking together . . . trying to come up with why the strange indication. Everything looked very good except pressure was low, and level was high.” For half an hour they went through the emergency procedures for the accidents that matched some of the symptoms: a steam line break, a leak through the generator tubes, a break in the emergency feed line, and a loss of coolant. Faust and Frederick remembered the last being considered and rejected, because its symptoms had not arrived together as the procedure assumed they would. Zewe did not consider it. “It really did not enter my mind that we had a loss-of-coolant accident. I didn’t fully understand what I had, but I always think, in terms of a loss-of-coolant accident . . . that your pressurizer level is a big key. But I had the reverse of what it would have been for a loss of [coolant] level.” The automatic start of the injection pumps, which at most plants is the signature of a loss of coolant, he put down to the feedwater transient; at Unit 2 the pumps had come on before for lesser things.

The inspectors’ sequence notes that the shift supervisor “noted that the rate of pressurizer level increase appeared to be wrong for the reactor trip that had occurred.” He noticed. The instrument he had been given could not tell him what it meant, and the one that could, the hot pipe, had been crying wolf since October.

What happened

With the block valve shut the pressure rose, and the damage went on. Between about 5:41 and 7:00, with the top of the core bare and the pumps still, the zirconium alloy of the fuel cladding reacted with steam, making hydrogen by the hundredweight and releasing the gases inside the rods into the water. At about 6:40 a sample of the coolant showed radioactivity about 350 times normal; in the auxiliary building an operator saw the sump overflowing, and a technician ran through shouting to get out. Richard Dubiel, the supervisor of radiation protection, called Kunder over the plant page: the sample line was reading 600 millirems an hour. “At that point,” Kunder said later, “I realized, ‘Oh my God, we’re failing fuel.’” At 6:56 Zewe declared a site emergency. At 7:20 the dome monitor high in the containment, behind lead shielding that cut what reached it a hundredfold, read eight rems an hour, which the room took to mean about 800 in the building; the injection pumps were turned on, for eighteen minutes. Miller, the station manager, now in the room and in charge, declared a general emergency at 7:24. The Commission’s calculation was that at 6:48 as much as two-thirds of the twelve-foot core stood uncovered, at temperatures in parts of 3,500 to 4,000 degrees. At 8:26 the injection was turned on and kept on; the core was probably covered again by about 10:30.

Between 11:38 in the morning and 3:08 in the afternoon the plant was depressurised with the block valve open again and the injection cut, and the core was uncovered a second time for a period nobody has been able to fix. At 1:50 a thud was heard in the control room, and the containment pressure chart recorded a spike of twenty-eight pounds: the hydrogen that had been made that morning, burning. Ross looked at the chart within a minute or two and “we kind of wrote it off . . . [as] possibly instrument malfunction.” Rogers took the noise for a ventilation damper slamming. The spike was not understood as an explosion until late the next day.

Thursday was calm. Friday was not: a release from a leaking tank, a reading of 1,200 millirems an hour over the vent stack, a calculation in Bethesda that happened to give the same number, an evacuation recommendation sent and withdrawn within the hour, and at 12:30 the governor’s advice that pregnant women and preschool children within five miles should leave. The weekend belonged to the hydrogen bubble in the top of the reactor vessel, which the NRC’s headquarters came to believe might explode within days and the NRC’s men at the plant did not; the President walked through the control room on Sunday afternoon while the two sides were still arguing, and that evening the bubble began to break up. Those five days are in Friday.

After

Nobody died. The Commission’s estimate of the dose to the two million people within fifty miles gave a projected number of extra cancer deaths of 0.7, which it took care to explain meant a roughly even chance of none; the health effect it could measure was “severe mental stress, which was short-lived.” The NRC fined Metropolitan Edison $155,000. In November 1983 a federal grand jury indicted the company for the way the leak rate from the primary system had been tested and reported in the months before the accident, the months in which the relief valve was leaking; on 29 February 1984 it pleaded guilty to one count and no contest to six, and paid $45,000. Its parent company sued Babcock & Wilcox and settled in January 1983 for up to $37 million in rebates.

The vessel head came off in July 1984, and the fuel came out between October 1985 and January 1990; in December 1993 the plant went into monitored storage. What was found inside was worse than any of the three inquiries had supposed. At least 45 percent of the core, some sixty-two tonnes, had melted, and about nineteen tonnes of it had run down into the bottom of the vessel, where a crust of its own and the water beneath it had kept it from going through the steel. Unit 1, which had been starting up again from refuelling on the morning of the accident, ran until September 2019.

The industry’s own answer to the memoranda came first. Seven days after the accident Babcock & Wilcox sent its customers an instruction on keeping the high pressure injection running that was, the Commission’s chief counsel found, “essentially what Bert Dunn had proposed 14 months earlier.” The NRC’s Bulletin 79-05A said the same to every operator of a Babcock & Wilcox plant. The agency’s action plan after the accident required every plant to install “positive indication of valve position” for its relief and safety valves, and automatic closing of the block valve on low pressure; saturation meters, to show the operator in one number whether the water in his reactor was boiling, were ordered for every control room.

The Commission’s report, delivered on 30 October 1979, went further than the valve. “Other investigations have concluded that, while equipment failures initiated the event, the fundamental cause of the accident was ‘operator error,’” it wrote. “While we agree that this statement is true, we also feel that it does not speak to the fundamental causes of the accident.” It found the training “greatly deficient”, the procedures “at least very confusing”, and in the whole system “a lack of ‘closure’”: safety issues “are frequently raised and may be studied to some degree of depth, but are not carried through to resolution; and the lessons learned from these studies do not reach those individuals and agencies that most need to know about them.” It was “convinced that an accident like Three Mile Island was eventually inevitable.”

What it taught

Start with what the room had. It had a reactor that behaved, in its first thirteen seconds, exactly as its designers had promised. It had four men, trained above the average of their trade, who throttled the emergency cooling at four minutes and thirty-eight seconds because that is what they had been taught to do when the level in the pressuriser went high. And it had a chain of signs that the valve was open: a pipe at 285 degrees at twenty-four minutes, a drain tank that burst at fifteen, a containment that warmed and wetted, a sump that filled, a pressure that would not come up, neutron counts that rose, pumps that shook. Every one was read, and every one was explained by something else.

An instrument that shows the command is not an instrument that shows the state. The light on panel 4 showed that the solenoid had been de-energised. The operators read it as the valve being shut, because that is what a light beside a valve means to the person who looks at it. The plant’s own supervisor of operations had asked for position indication and been given demand indication, and had let it go; the plant’s engineers had asked again and been told, twelve days before, that it was “not necessary or required.” When the question is whether a thing has happened, the instrument has to be on the thing.

The number everyone reads will be believed, so it had better mean what they think it means. The pressuriser level was the one number the training had made central, and it was, that morning, the one number that lied. It was accurate: the tank was full. It was wrong as a measure of the reactor, because the water it was measuring had been pushed up from a core that was boiling. Michelson had written in 1977 that a full pressuriser was not a reliable indication for deciding to stop the injection, and the operators’ procedure, in the spring of 1979, still told them to throttle at 220 inches. The gauge that would have settled it, a water level in the vessel, did not exist. In Thirty-Six Seconds, at Chernobyl seven years later, the one number that determined what the stop button would do was computed fifty metres from the console and nobody could see it. At Three Mile Island the number was in front of everyone, and it was the wrong number.

A warning that stays in the building that wrote it is not a warning. Davis-Besse was analysed by its owner, by the manufacturer and by the regulator, and each found the lesson and kept it. Dunn wrote in February 1978 that core uncovery was “possible, perhaps probable” at full power, and was told his memorandum was on the wrong form. The Commission’s name for this was the lack of closure. The instruction that would have kept the pumps on was sent seven days after the core melted, in the words of the man who had written it fourteen months before.

Training is the hypothesis the operators carry into the room. “Never go solid” was good advice for a plant with a steam cushion and a leak somewhere else. It was the exact opposite of the right advice for a leak at the top of the pressuriser, and the simulator on which the four men had learnt their plant stopped the game at the moment the question arose. “Each was a product of his training,” the Commission wrote, “training that did not adequately prepare them to cope with the accident at TMI-2. Indeed, their training was partly responsible for escalating what should have been a minor event into a potentially devastating accident.” A well-trained crew will do what its training says, quickly and together, which is the point of training, and the reason it has to be right.

A sign that has been crying wolf cannot cry wolf. The pipe under the relief valve had read 170 and 180 degrees for five months, against a procedure that said 130. The operators had learnt to live with it, and the twenty-five inspections of that winter had not noticed it, because the alarm at 200 never sounded. When it read 285, the only reading that could have told the room the truth had already been discounted by habit. The leak was not the accident. It was the thing that made the accident unreadable. The Commission wrote that had the valve closed, or had the operators found it open and shut the block valve, or had they “simply left on the plant’s high pressure injection pumps, the accident at Three Mile Island would have remained little more than a minor inconvenience for Met Ed.” Each of those was a matter of one instrument being believed.

Sources

President’s Commission on the Accident at Three Mile Island (John G. Kemeny, chairman), The Need for Change: The Legacy of TMI, Washington, October 1979. The overview and findings (the “tragedy of Three Mile Island”, “mindset”, “lack of closure”, “eventually inevitable”); the “Account of the Accident” (the 36 seconds past four, the light, the 2 hours and 22 minutes, the 32,000 gallons, the training, Faust’s, Frederick’s, Zewe’s, Kunder’s, Rogers’s, Ross’s and Thornburgh’s words, the 6:22 closing, the site and general emergencies, the 1,200 millirems, the bubble, the President’s visit, the epilogue); the health estimates. A United States government work. archive.org
Mitchell Rogovin and George T. Frampton, Jr., Three Mile Island: A Report to the Commissioners and to the Public, NRC Special Inquiry Group, NUREG/CR-1250, Volume I, January 1980. The narrative (the plant’s first year, the light as “circumstantial evidence”, the 110,000 pounds an hour, “going solid”, the simulator, Mehler’s reasoning, “No one asks the followup question”, Kunder’s “we’re failing fuel”, the core slump at 7:45); the chapter on operating experience (Beznau, Davis-Besse, Michelson, the memo “simply filed away”); the chapter on training. Read in the Idaho National Laboratory’s TMI-2 archive copy, through the Wayback Machine. web.archive.org
US Nuclear Regulatory Commission, Office of Inspection and Enforcement, Investigation into the March 28, 1979 Three Mile Island Accident, NUREG-0600, August 1979. The modification of the relief valve’s circuit after 29 March 1978 (“only demand position”; the log entry for the light on panel 4; the missing work request); the operational sequence of events with its times, pressures, levels and temperatures (the 283-degree printout at 81 minutes, the 404.9 inches, the throttling, the 12 valves); the block valve closed at 0618 to 0619. Read in the INL archive copy, through the Wayback Machine. web.archive.org
Subcommittee on Nuclear Regulation, Committee on Environment and Public Works, US Senate, Nuclear Accident and Recovery at Three Mile Island: A Report, Serial No. 96-14, June 1980. Chapter 3 (the plant and its schematic); chapter 6 (the hot functional test, the 29 March 1978 event, Floyd on the light, the January 1979 request and the Noll memo of 16 March 1979, the leak since October 1978, the twenty-five inspections, Oconee, Davis-Besse, Creswell, Michelson, Israel and Novak); chapter 7 (the first day minute by minute, with the operators’ words from their interviews: Faust’s “Something’s going wrong”, Scheimann’s “low and stable”, Ross’s caution, Frederick on the solid system, Zewe on the water and the LOCA, Bryan on the drain tank, Mehler on the leak, the temperatures of 4:24, 5:20 and 6:17, the 5:41 decision, the “last ditch effort”); the $155,000 fine. archive.org
Subcommittee on Nuclear Regulation, Nuclear Accident and Recovery at Three Mile Island: Staff Studies, June 1980. The NRC’s action plan, Task II.D, requiring positive indication of relief and safety valve position and automatic closure of the block valve. archive.org
Stanley M. Gorinson and Kevin P. Kane, Report of the Office of Chief Counsel on the Role of the Managing Utility and Its Suppliers, President’s Commission on the Accident at Three Mile Island, October 1979. The Davis-Besse transient of 24 September 1977 and its “almost exact duplication”; the Kelly, Walters, Dunn and Hallman memoranda, quoted verbatim; Taylor’s “misdirected”; Karrasch and the soda machine; the instruction sent seven days after the accident and Bulletin 79-05A; North Anna. Read in the INL archive copy, through the Wayback Machine. web.archive.org
A. M. Rubin and E. Beckjord, “Three Mile Island—New Findings 15 Years After the Accident,” Nuclear Safety 35 (2), July to December 1994, prepared for the NRC at Oak Ridge. The 45 percent and sixty-two tonnes melted, and the nineteen tonnes on the lower head. Read in the INL archive copy, through the Wayback Machine. web.archive.org
US Nuclear Regulatory Commission, “Backgrounder on the Three Mile Island Accident.” The cleanup chronology (the vessel head in July 1984, fuel removal from October 1985 to January 1990, the accident water, monitored storage in December 1993), the list of regulatory changes, and Unit 1’s closure in September 2019. nrc.gov
United Press International, “Judge accepts TMI plea bargain,” 29 February 1984, and ABA Journal, “Feb. 29, 1984: Guilty plea in Three Mile Island disaster.” The November 1983 indictment over the leak-rate tests, the plea to one count and no contest to six, the $45,000 and the million-dollar fund. upi.com, abajournal.com
The Christian Science Monitor, “Three Mile Island suit resolved out of court,” 26 January 1983. The settlement with Babcock & Wilcox for up to $37 million in rebates over ten years. csmonitor.com

How this entry came about

Written in the overnight run of 21 October 2026 under the standing rules in the backlog's notes. The primary sources are the four government investigations, all United States government works: the President's Commission's report (archive.org's full-view scan), the NRC inspectors' NUREG-0600, the Rogovin Special Inquiry's Volume I, the Commission's chief counsel's staff report, and the Senate subcommittee's report and staff studies (archive.org). The Idaho National Laboratory's TMI-2 archive, which holds the NRC documents, answers a Cloudflare challenge to scripts, and nrc.gov's own copies answer 403, so NUREG-0600, the Rogovin report, the chief counsel's report and the 1994 *Nuclear Safety* paper were read from the Wayback Machine's copies of the INL files, and the Sources link to those. Not reached: the Commission's own hearing transcripts and depositions, the NRC's interview transcripts, and the Rogovin report's Volume II; every word of the operators, of Mehler, Bryan, Kunder, Rogers, Ross, Floyd, Bensel and Thornburgh is at second hand, as the Commission's report, the Senate's report or the Rogovin report quotes it from testimony, deposition or interview, and the Sources say which. The B&W memoranda are quoted as the chief counsel's report reproduces them. The UPI report of the 1984 plea answers a Cloudflare block to scripts; its content was confirmed through the *ABA Journal*'s account and the Sources give both. Where the sources disagree: the block valve was closed at 6:22 by the Commission and the Senate and at 0618 to 0619 by the inspectors' record (the Rogovin narrative says 6:18), and the entry gives both; the throttled injection flow is "less than 100 gallons per minute" in the Commission's report, "about 25" in the Senate's and the Rogovin narrative's, and the inspectors note the operators' claim of a 100-gallon minimum "cannot be supported", so the entry uses the Senate's figure; the relief valve opened at "3-6 seconds" by the inspectors and 4:00:39 by the Senate, and the light went out at 13 seconds by the Commission and the inspectors and at about 16 by the Senate; Kunder's arrival is 4:45 in the Commission's account and 4:50 in the Senate's and the inspectors'; the 5:20 printout is given as 5:21 in one passage of NUREG-0600 and its safety-valve temperatures as 218 or 219 degrees; the drain tank's rupture disc burst at "about 200 psi" (Senate) or 192 (Rogovin); the B&W settlement is reported by the *Monitor* against a "$4 billion lawsuit" without saying which suit. Decisions under the rules: one figure, the Senate report's schematic of Unit 2, cropped from archive.org's scan of the committee print, because it is a United States government work adapted by Senate staff from the Commission's own drawing; the Commission's photographs were left out because its credits page attributes most of them to Wide World Photos and one to a DOE contractor, and the Carter control-room photograph on Wikimedia Commons is sourced only to the INL archive without an author, which is not public domain beyond doubt (rule 1). An 8,200-word first draft was cut to the limit by moving the paper trail from Oconee and Davis-Besse to the accident into one companion piece and the five days from Thursday to Monday outside the plant into a second (rule 2); the Senate's 1,200-millirem and bubble accounts were not read beyond what the Commission's report covers. The title "Four Hundred Inches" is not used before (rule 5). The date was set by rule 4 at 04:30 on 21 October, with minutes, because every whole hour of that day up to 10:00 already carried an entry on main and a later hour would have been future-dated; the entry was pushed after 04:30. The checker's remaining WARN lines, if any, are listed in the run log.

This is the same story as the full entry, told more plainly. The button at the top switches back to the full version, which gives the sources for everything here.

The plant

Three Mile Island is an island in the Susquehanna River in Pennsylvania, about ten miles from Harrisburg. In 1979 it had two nuclear power plants on it. The newer one, Unit 2, had started making electricity only three months before, on December 30th 1978. It was built by a company called Babcock & Wilcox and run by a company called Metropolitan Edison.

A nuclear plant like this one is, at heart, a very large kettle. Uranium fuel in the reactor gives off heat. Water is pumped through the reactor to carry the heat away, and that water is kept under enormous pressure so that it cannot boil, even at nearly 600 degrees Fahrenheit. The hot water boils a separate supply of water into steam, and the steam turns a turbine, and that makes the electricity.

The pressure in the reactor’s water is set by a tall tank called the pressuriser. The pressuriser is about half full of water, with a cushion of steam on top. Squeezing or expanding that steam cushion raises or lowers the pressure in the whole system. The operators were taught one rule about it above all others: never let the pressuriser fill up completely with water. If it did, the steam cushion would be gone, and the system would be “solid”, and a small change could send the pressure shooting up and damage the pipes.

On top of the pressuriser were three valves to let steam out if the pressure got too high. Two of them were plain spring-loaded safety valves. The third was smaller and worked by an electric signal: it was called the pilot-operated relief valve, and it opened on its own when the pressure rose too high and was supposed to close again on its own when the pressure came back down. Underneath it was a second valve, called the block valve, which the operators could close from the control room if the relief valve ever stuck open.

The light

A year before the accident, on March 29th 1978, the day after the reactor was first started, a fuse blew and the relief valve lost its electric power. The way it was wired, losing power made it open. It stayed open for four minutes, and the operators did not know, because the control room had no indicator to show whether the valve was open or shut.

Afterwards the plant’s staff asked for a proper position indicator: something that would show where the valve actually was. What they were given was a light that showed whether the valve was being told to open. When the signal to open was on, the light was on. When the signal went off, the light went off. The supervisor of operations, James Floyd, said later that “all we’re going to get is command valve command signal light,” and he did not make a fuss. In January 1979 the plant’s engineers asked again for something better. On March 16th 1979, twelve days before the accident, the company’s head office wrote back that the change was “not necessary or required.”

By then the relief valve had been leaking for five months. The pipe below it, which should have been cooler than 130 degrees, was usually around 170 or 180. The operators had got used to that, and they did not close the block valve, because they were afraid it might stick shut.

The warning nobody passed on

The same thing had already nearly happened at another plant. On September 24th 1977, at the Davis-Besse plant in Ohio, which had a reactor of the same design, the relief valve opened and stuck. The water level in the pressuriser went up while the pressure went down, and the operators, watching the level, turned off the emergency pumps that were putting water in. They found the open valve after twenty-one minutes and closed the block valve, before any harm was done.

An engineer at Babcock & Wilcox named Bert Dunn wrote a memo about it in February 1978. He said that if the same thing happened at a plant running at full power, it was “possible, perhaps probable” that the core would be left uncovered and the fuel damaged. “I believe this is a very serious matter,” he wrote, “and deserves our prompt attention and correction.” The man he sent it to decided it had gone to the wrong place, because it was not on the right form. Nobody told the operators at Three Mile Island. The companion piece “The memoranda” follows that paper trail.

Four in the morning, March 28th 1979

Four licensed men were running Unit 2 that night: William Zewe, the shift supervisor; Fred Scheimann, the shift foreman; and two control room operators, Edward Frederick and Craig Faust. All four had learnt their trade in the United States Navy’s nuclear programme, and all four had passed the government’s examinations with scores above the national average. Scheimann was down in the turbine building, working on one of the machines that cleans the feedwater.

At 36 seconds past four o’clock, a year to the day and the hour after the reactor first started, some valves in that cleaning system shut by mistake. The pumps that fed water to the steam generators stopped, so the steam generators could not take heat away from the reactor. The turbine shut itself down. The water in the reactor got hotter and expanded, the pressure rose, and the relief valve on top of the pressuriser opened, exactly as it was designed to. Eight seconds in, the reactor shut itself down too: its control rods dropped into the core and stopped the nuclear reaction. All of this was right.

At about thirteen seconds the pressure fell back to the point where the relief valve should have closed. The signal to it was cut off, and the light on the panel went out. But the valve did not close. It stayed open, and steam began pouring out of the top of the reactor’s water system at the rate of about 220 gallons of water a minute. It would stay open for more than two hours. Nobody in the room knew. The light said it was shut.

The gauge that read four hundred

At first everything looked like a normal shutdown. The pressure fell, and the water level in the pressuriser fell with it. Then, within a minute, the level turned round and began to rise, fast, while the pressure kept falling. Normally the two move together.

At two minutes, the pressure had dropped so far that the emergency core cooling system switched itself on. Two big pumps began pouring about a thousand gallons a minute into the reactor, more than enough to replace what was going out through the open valve. But the level in the pressuriser kept climbing, and the operators had been trained to fear a full pressuriser. At four minutes and 38 seconds they turned one of the emergency pumps off and cut the other back to a trickle, about 25 gallons a minute, and opened a drain line to take water out. They were trying to stop the pressuriser going solid. “The rapidly increasing pressurizer level at the onset of the accident led me to believe that the high pressure injection was excessive,” Frederick said afterwards, “and that we were soon going to have a solid system.”

At six minutes the pressuriser gauge reached the top of its scale: 400 inches. It stayed there for two hours. What was really happening was this. With the pressure gone, the water in the reactor had started to boil. Steam collected at the high points of the pipes and pushed the water ahead of it up into the pressuriser. The tank was full because the reactor was emptying. There was no gauge in the plant that measured the water in the reactor itself, and that morning the only gauge there was meant the opposite of what the operators had been taught.

Two hours of clues

There were plenty of signs that the valve was open, and the operators saw most of them. A drain tank in the containment building, which caught what came out of the valve, filled up and burst at fifteen minutes, and water spread across the floor. The containment building got warmer and its pressure rose. At about 4:24, Zewe had the computer print the temperature of the pipe under the relief valve: 285 degrees. At 5:20 it was printed again: 283 degrees, more than sixty degrees hotter than the pipes under the two safety valves. One of the plant’s emergency procedures said that 200 degrees in that pipe meant the valve was open.

Every clue got explained away. The pipe was hot, but it had been hot for months because of the leak, and the valve had opened for a few seconds at four o’clock, so of course it was warm. The drain tank had burst, so the valve must have opened hard. The building was warm because the tank had burst. The pressure was low, but at least it had stopped falling. “It would have concerned me a heck of a lot more if it [the pressure] was still going down,” Scheimann said. And the light said the valve was shut.

The one thing that did not fit, the operators knew, was the full pressuriser. “The pressurizer went full and we believed it [the reactor coolant system] was full,” Frederick said. “It must have been full of water, but the next confusing thing was the system wasn’t reacting as if it was solid.” Zewe said: “I didn’t know where the water could be coming from.” More than a hundred alarms had gone off in the first minutes. “I would have liked to have thrown away the alarm panel,” Faust said. “It wasn’t giving us any useful information.”

They went through the emergency procedures looking for an accident that matched. One of the four they considered was a loss of coolant, which is exactly what they had. They rejected it. “It really did not enter my mind that we had a loss-of-coolant accident,” Zewe said. “I always think, in terms of a loss-of-coolant accident . . . that your pressurizer level is a big key. But I had the reverse of what it would have been.”

The pumps

Just after five o’clock the four huge pumps that drive water through the reactor began to shake violently. They were pumping steam as well as water, which is another sign that the water was boiling. The operators, following their training, shut two of them down at 5:14 to save them from damage, and the other two at 5:41.

That was the worst moment. While the pumps ran, the mix of water and steam going through the core had still carried enough heat away to protect the fuel. When they stopped, the steam rose into the top of the pipes, and the water level in the reactor dropped. With the valve still open and almost no water going in, the top of the core was uncovered by about 6:15. The fuel rods got hotter and hotter, and at those temperatures their metal reacts with steam, makes hydrogen, and splits open.

At about six o’clock a new shift supervisor, Brian Mehler, came in from outside. He looked at a full pressuriser and a falling pressure and decided that there must be a leak. He asked the computer for the pipe temperatures again, and the pipe under the relief valve was still the hottest. “From that point,” he said, “I assumed that the electromatic was partially opened because of the temperature.” He told Scheimann to close the block valve. It was 6:22, two hours and twenty-two minutes after the relief valve had opened. In the first hundred minutes, about 32,000 gallons of water had gone out, more than a third of everything in the system.

Even then, nobody turned the emergency pumps back up properly until 8:26. The investigators could never find out why.

What happened next

By 6:40 the radiation alarms were going off. A sample of the reactor’s water was 350 times more radioactive than normal, which meant the fuel was breaking. “At that point,” said George Kunder, the duty engineer, “I realized, ‘Oh my God, we’re failing fuel.’” At 6:56 the plant declared a site emergency, and at 7:24 a general emergency. By then, the investigators calculated, as much as two-thirds of the twelve-foot-tall core was standing out of the water, at temperatures of 3,500 to 4,000 degrees.

Nobody died, and nobody was hurt by the radiation that leaked out, which was very small. But the next five days were frightening for the people who lived nearby. On Friday a helicopter over the plant measured 1,200 millirems an hour, and officials in Washington recommended that everyone within ten miles be evacuated, then withdrew the recommendation within the hour. At lunchtime the governor of Pennsylvania advised pregnant women and small children within five miles to leave, and many more people left than were asked to. Over the weekend the government’s experts argued about whether a bubble of hydrogen inside the reactor could explode. The President, Jimmy Carter, walked through the control room on Sunday afternoon. By that evening the bubble was shrinking, and it had never been able to explode at all. The companion piece “Friday” tells that part.

It took eleven years to take the damaged fuel out of the reactor. Nearly half of the core, about sixty-two tonnes, had melted, and about nineteen tonnes of it had run down into the bottom of the reactor vessel. It had not got through.

What changed

The President appointed a commission, led by John Kemeny, the president of Dartmouth College, to find out what had happened. It reported in October 1979. Other investigations had said the cause was “operator error”. The commission agreed that if the operators had left the emergency pumps on, there would have been no accident. But it said that was not the real cause. The training was “greatly deficient”, the procedures were confusing, and the warnings from Davis-Besse had never reached the people who needed them. Given all that, it wrote, “we are convinced that an accident like Three Mile Island was eventually inevitable.”

Seven days after the accident, Babcock & Wilcox finally sent its customers the instruction Bert Dunn had asked for fourteen months earlier: do not turn off the emergency cooling just because the pressuriser is full. The government ordered every nuclear plant in the country to fit a real position indicator on its relief valves, and a meter that tells the operators whether the water in the reactor is boiling.

What it teaches

What does this story teach? A few plain things.

A light that shows an order is not a light that shows what happened. The light on the panel showed that the valve had been told to close. It did not show that the valve had closed. Everyone who looked at it read it the second way, because that is what a light next to a valve seems to mean. If you want to know whether something has happened, look at the thing itself, not at the instruction that was sent to it.

The number everyone trusts had better mean what they think it means. The operators had been taught that the pressuriser level told them how much water was in the reactor. That morning the pressuriser was full because the reactor was boiling dry. The gauge was not broken. It was measuring the wrong thing, and there was no gauge for the right thing.

A warning that stays in the office that wrote it is not a warning. Engineers at the manufacturer worked out, more than a year before, exactly what would go wrong, and wrote it down. The memo went to the wrong person, on the wrong form, and sat there. Knowing about a danger is not the same as telling the people who will face it.

An alarm you have learnt to ignore cannot warn you. The pipe under the valve had been too hot for five months, and the operators had got used to it. When it finally read 285 degrees, the one reading that could have told them the truth was the one they had been ignoring all winter.

So the lesson is simple. Before you trust an instrument, ask what it is really measuring. And when you learn how something could go wrong, make sure the people who will be standing in front of the panel know it too.

Go deeper

These pieces take this entry's turns further. Read them in order, or go to the one that caught you.

The memorandaThe paper trail from Oconee and Davis-Besse to Three Mile Island, 1975 to 1979: a valve that stuck twice before, the engineers at Lynchburg who wrote to each other about it, the reviewer at the NRC who filed a note, and the instruction sent seven days after the core melted.
FridayThe five days outside the plant, 29 March to 2 April 1979: a reading of 1,200 millirems, a calculation that gave the same number, an evacuation recommended and withdrawn in an hour, the governor's advisory, the hydrogen bubble, and the President in the control room.

Journal of Experiments