A light showed the command, not the valve
At Three Mile Island in 1979, a relief valve opened to let pressure escape from the reactor’s cooling system. It should have closed again when pressure fell, but it remained physically open. Water continued leaking out.
The control-room indicator did not directly sense whether the valve was shut. It showed that the system had sent a command for it to close. Because the light changed as if the command had worked, operators could believe the valve was closed even while coolant was escaping. The display blurred a crucial distinction: what the controls asked a component to do was not what the component had actually done.
Why the mistake mattered
With coolant leaving the system, the reactor was becoming harder to cool. But the instruments did not provide a simple, unmistakable picture of that loss. Operators saw high water level in the pressurizer—a vessel that helps regulate pressure—and worried that the system was becoming too full. They reduced emergency water injection, which was intended to restore cooling, while trying to manage the pressure and level readings.
The open valve and the operators’ response interacted: the leak continued, and less replacement water entered the system. The reactor core overheated and was severely damaged. The interface did not act alone; equipment failure, confusing indications, alarms, procedures, and training all shaped the crisis.
The design lesson
A command indicator is useful, but it cannot substitute for feedback from the equipment itself. Operators need to know whether a valve received an instruction and whether it actually moved—and they need enough context to understand what the readings mean together. At Three Mile Island, the difference between a requested action and a real physical state was not just a technical detail. It was a difference the control room had to infer while the accident was unfolding.
