The steps of Chernobyl and effects of radiation

[Astronuc]

A reasonable description and image of PWR NPP.
http://americanhistory.si.edu/tmi/02-10.htm

Discussion of fuel assembly (reasonably accurate)
http://americanhistory.si.edu/tmi/02-08.htm

Schematic of reactor and core
http://americanhistory.si.edu/tmi/02-07.htm

 

[Astronuc]

As the Kemeny report states at the bottom of page 8; the accident could
have been terminated at any time in the first 100 minutes if the operators
had closed the block valve which backs up the stuck relief valve.

The irreversible road to a meltdown was initiated at 100 minutes when the
operators stopped the main coolant pumps because they were vibrating.

The pumps were vibrating because they were pumping not water but a
mix of water and steam. If the operators had known that the coolant
was boiling; they would have known that the pumps were vibrating due
to pumping a 2-phase steam/water mix. The vibrating pumps were an
additional indication of boiling; but the operators didn't pick up on it.

As I recall, that was another of Kemeny's points in the seminar; the
operators concerned themselves with a host of individual problems; they
didn't take an overall "system view" of what was going on. To them it
was a series of small problems; they missed the big problem, the core
was BOILING!

When they shutdown the main coolant pumps; they set the reactor on
an irreversible course to destruction.

Hence the rigorous training, particularly with advanced simulators that the operators can experience real emergency scenarios without putting a real reactor/plant at risk. The simulators, like aircraft simulators, replicate the real physics of the plant.

 

[Morbius]

Hence the rigorous training, particularly with advanced simulators that the operators can experience real emergency scenarios without putting a real reactor/plant at risk. The simulators, like aircraft simulators, replicate the real physics of the plant.

Astronuc,

See Vol III, page 5. The simulator at Babcock and Wilcox couldn't simulate
a TMI-type accident. It couldn't simulate conditions in which the coolant
had voiding [steam] outside of the pressurizer.

The operator training was one of the things that the Kemeny study focused
on; and they concluded it was whoefully inadequate. They stated the
training in the simulator, "...lacked depth", and was limited to only the
immediate actions following rather simple failures.

The operators didn't have a good understanding of the basics.

They were just taught "If 'W' happens, do 'X', and if 'Y' happens, do 'Z'"

There was no "understanding" of the reactor plant. Therefore, if they
hadn't seen the situation before in their training; they were ill-equipped
to figure out what was happening. Vol III, pages 5-7 are damning of the
training program.

Their training also focussed more on how to optimize a properly operating
plant; as opposed to recognizing and dealing with an accident.

Dr. Gregory Greenman
Physicist

 

[Astronuc]

See Vol III, page 5. The simulator at Babcock and Wilcox couldn't simulate
a TMI-type accident. It couldn't simulate conditions in which the coolant
had voiding [steam] outside of the pressurizer.

The operator training was one of the things that the Kemeny study focused
on; and they concluded it was whoefully inadequate. They stated the
training in the simulator, "...lacked depth", and was limited to only the
immediate actions following rather simple failures.

Looking further down page 5, the folks at Davis Besse had experienced a similar event on Sept 24, 1977. The people at B&W knew that, but the information had not been conveyed to the other operators. There is not excuse for this. An advisory should have been transmitted to other operators within 30 days or less!

Although things are better these days, I still encounter some of this today in my work.

The simulators these days are a lot better than they were prior to 1980, and the training is vastly superior. But things still happen that shouldn't.

 

[Morbius]

Looking further down page 5, the folks at Davis Besse had experienced a similar event on Sept 24, 1977. The people at B&W knew that, but the information had not been conveyed to the other operators. There is not excuse for this. An advisory should have been transmitted to other operators within 30 days or less!

Astronuc,

Yes - there was NO EXCUSE for B&W not to highlight the experience of
the Davis-Besse incident. They had about a year and a half!

Around the time of the Kemeny seminar at MIT, we also had a seminar
by the then President of either the American Nuclear Society or the
Atomic Industrial Forum.

Managers at electric utilities hadn't learned the lessons a child learns
when they adopt a pet; with the pleasures of owning a pet also comes
responsibility for the proper care and feeding of the pet.

Utility executives only saw the $$$ advantages in owning a nuclear
power plant. The didn't concern themselves with its proper "care and
feeding".

According to the seminar; first you have to get their attention: "An
accident at your nuclear power plant can BANKRUPT your company".

"Now that we have your attention; it doesn't have to happen; we can
help you".

Nuclear power plants are NOT toys!

Dr. Gregory Greenman
Physicist

 

[Morbius]

from Muller's page cited by Morbius. I was thinking of exactly this incident.

Astronuc,

As I recall, this incident, or a similar occurence in Mexico; was discovered
because a truck set off the radiation detector alarms as it was leaving
Los Alamos.

The truck had contained everyday products that had been manufactured
with reclaimed metals, which included radioactive metals from a disassembled
radiotherapy machine.

Dr. Gregory Greenman
Physicist

 

[Astronuc]

If one visists the NRC website, the vast majority of reportable incidents have to do with misused, missing or misplaced radioactive sources.

Once in a while, something notable from a nuclear power plant is reported. The people at NPPs take their work very seriously. I know because I work with these folks.

 

[Morbius]

If one visists the NRC website, the vast majority of reportable incidents have to do with misused, missing or misplaced radioactive sources.

Astronuc,

Yes - the vast majority of the incidents have to do with old medical
devices. Nuclear power plants are much more highly controlled and
regulated.

Dr. Gregory Greenman
Physicist

 

[Homer Simpson]

The operators didn't have a good understanding of the basics.
They were just taught "If 'W' happens, do 'X', and if 'Y' happens, do 'Z'"
There was no "understanding" of the reactor plant. Therefore, if they
hadn't seen the situation before in their training; they were ill-equipped
to figure out what was happening. Vol III, pages 5-7 are damning of the
training program.
Their training also focussed more on how to optimize a properly operating
plant; as opposed to recognizing and dealing with an accident.

If the operators had consulted their steam tables, and realized the coolant
was boiling away, and turned the emergency core cooling system back on
[they had turned it off] ALL of those other problems would have been avoided.

As the Kemeny report states at the bottom of page 8; the accident could
have been terminated at any time in the first 100 minutes if the operators
had closed the block valve which backs up the stuck relief valve.

Ed Frederick was one of the reactor control room ops involved with TMI incident, and has a presentation about the issues. According to the presentation, the ops were actually heavily trained on system design and interaction information under the belief that if something went wrong, the operators would be able to improvise a solution. There procedures were all based on identifing the failure, not symptoms. The operators at TMI were forced to make a bunch of 'knowledge based' decisions, as opposed to procedure based, and so had a high likelyhood of error. This is what happened when they saw high pressurizer level, they assumed there was plenty of water in the core and shut down the emergency pumps. It was the coolant voiding that caused the high level, but they made a mental error under stress. The procedures were written for a large LOCA which would have much different

also from the presentation:
There were several engineering problems with TMI as well. Firstly was the indication for the pressurizer PV, which indicated closed in the control room. This close indication light was only indication of the demand signal, not a limit switch actual postion. This obviously is a set-up. Also inadequate temperature instrumentation (not ranged for boiling conditions), lack of backup boiler feedwater flow indication, bad alarm system which blazed in 800 non prioritized alarms in the first 14 minutes of the event printed to a printer which did 6 lines per minute. It must have been really hectic, clearly one can see that an operator might not have the oportunity to dust off the old steam tables unless they were in the procedures. (now sub-cooling margin is easily displayed)

Tons of industry changes (design, instrumentation, training, procedures, culture) came about due to the problems recognized at TMI. While its true that TMI had such serious results due to operator action, it was the underlying industry and safety culture problems and deficiancies to cause it that just had not surfaced yet at the time, not a couple individuals.

 

[Morbius]

Tons of industry changes (design, instrumentation, training, procedures, culture) came about due to the problems recognized at TMI. While its true that TMI had such serious results due to operator action, it was the underlying industry and safety culture problems and deficiancies to cause it that just had not surfaced yet at the time, not a couple individuals.

Homer,

When I was in graduate school at MIT, we had a seminar by Prof. Kemeny
who headed up the investigation.

As I recall, Kemeny stated this was first and foremost a failure of INDIVIDUALS
and not the system. There was certainly room for improvement in the
system, and those changes were made.

However, one of the operator's main concerns is whether there is ample
cooling water covering the core. If one has a pressurized system, where
the pressure is varying, as in the TMI core; I don't see how ANYONE could
have failed to consider how far away from the saturation line one was.

When I read the account in the paper the day after, and it said the reactor
was stabilized at a certain temperature and pressure - that's the first thing
I though of - how far away from the saturation line. It turns out, those
conditions were ON the saturation line. They didn't stabilize the reactor;
it was BOILING! [Prof. Kemeny noted this also in his seminar.]

Prof. Kemeny pointed this out as an egregious FAILURE by the operators.
Additionally, the core damage was initiated by the operators turning off the
coolant pumps because they were vibrating.

Prof. Kemeny pointed out that the operators took actions before they
understood the situation, and without considering the consequences of
those actions. The operators were like automatons - they just reacted -
they didn't "THINK"!

You are incorrect that the temperature was out of range. The reactor was
at LOWER pressure than the nominal pressure of the reactor due to the
failure of the PORV to close. Because of the lower pressure, the coolant
temperature was LOWER than nominal, and the instrumentation can certainly
read nominal temperatures in a PWR. Even though the coolant was boiling,
it boiled at temeratures LOWER than nominal PWR temps due to the lower
pressure. Additionally, the printer is a logging device, NOT to be used to
ascertain current conditions.

The take-away message from Kemeny was that these were operators that
didn't THINK.

Dr. Gregory Greenman
Physicist

 

[massspectromete]

The cause of the accidnt

Hi there,

Can anyone answer a few questions I have about chernobyl and related. I am doing some research on something related, and its hard to get good information about this. Here they are.

1) - Can someone explain the steps of the disaster? I mean, let's say is the cooling system failed, what were the physical factors that happened. Did the core heat WAY up? I thought it had something to do with steam bubbles?

2) - This is a question based on the answer to the first question - How is radiation released, what causes the Uranium to release this radiation, and how come it is not released under normal opperation conditions?

3) - Can anyone explain any extraordinary effects this radiation had? Can you explain how this type of radiation effects humans? And how it effects/kills them so fast (They said direct exposure kills under 1 hour! ? )

That would be great if you could answer these. Thank you and take care.

The causes of the accedint concern on the personal error category of the
operator in the control room in which that error is:
Experimental test by lower ans shutdown the reactor(onsite) and depend on
the inertia of the generator to contintue operation the reactor until the
off site source of the electricity will work--so he shutdown but the inertia not help----
one important reason for release the radiation is the error in the defence in
depth methadology (safety analysis) the defect in the barries requied to
protect the station against any release.

 

[curie]

A comment on NPP operators (which may or may not be considered OT, & rambling) : such operators do take their work seriously & are very competent etc etc but they cannot be expected to perform at a high level all the time. They can have as much training & assessment as deemed by the regulators/whoever, but that does not guarantee they will take the correct action at all times and plant is designed to take into account that as far as possible. It is very easy in hindsight to see what could have been done. The wording in the previous posts saying the operators did not think or were stupid comes across as very harsh & implying they were actually incompetent. It is indeed true that at certain times their actions were the cause of or contributed to accidents, but I don't think this warrants calling them generally unthinking or labelled as stupid. They were acting in unplanned (leading into extreme) conditions & no matter how much training one has in so-called "dynamic risk assessment",emergency response, whatever the latest fad is, etc, under those conditions nothing can be guaranteed, including even the operators' own recognition that nothing is guaranteed. Now if "operator" is meant in the sense of plant operator as a whole, the organisation, then that is different, and it is clear that the set up in the FSU at the time of Chernobyl was ludicrous, even given the contemporary ideas of safety.

I have visited Chernobyl and found that the remediation of the affected Unit is progressing barely satisfactorily, but only due to Western input. Anything that does not have Western input is frankly a mess (by Western standards though!). It was very clear that the psychological affect was/is far more damaging and far-reaching. The Chernobyl museum in Kiev is a masterpiece of propoganda. Don't expect many facts if you visit.

 

[Homer Simpson]

Curie: Well said. Operating a NPP is very different from engineering one. When it hits the fan, you can't sit back with a team and engineer the perfect response. That is why it is the organizations responsibility to have perfect procedures and practices to follow in the event of an incident. All these events are drilled into the operator these days, and regularly tested in the simulators.

Every time a transient occurs at a plant now, a transient review team will gather for weeks with fine tooth comb and critique every action the operator took. This leads to OPEX and betters the industry as a whole. In most cases what appeared to be an excellent operator response to a transient will be picked to pieces by the review team and as crap rolls down hill, it always lands right in the operators lap.

Certainly operators do make mistakes, it will happen. However the large picture processes and event training now in place, sparked by past events, ensure that these types of events do not occur. There are procedural paths in place that ensure things like shutting down core cooling pumps (TMI) or interfering with shutdown systems (chern) don't happen. Critical decisions are based on Safety, ALWAYS.

 

[Paulanddiw]

Homer Simpson Movie

I was wondering if you got a cameo in the movie.

 

[Morbius]

Curie: Well said. Operating a NPP is very different from engineering one. When it hits the fan, you can't sit back with a team and engineer the perfect response. That is why it is the organizations responsibility to have perfect procedures and practices to follow in the event of an incident. All these events are drilled into the operator these days, and regularly tested in the simulators.

Homer Simpson,

Yes - but one of the problems with Chernobyl is that the operators were improvising
because they didn't have procedures.

The operators reduced power in the Chernobyl reactor prior to conducting an experiment
as to how much energy they could extract to run cooling pumps in an emergency.

However, the load controller in Kiev called and asked them to remain online a few hours
more because they needed the output from the plant. So Chernobyl stayed on line
about 12 hours more at reduced power.

However, they had been at a higher power, and had equilibrium Iodine-135 levels
corresponding to the higher power. Because they were at lower power than what
the Iodine-135 level was in equilibrium with; the reactor underwent a Xenon transient.

The Iodine-135 decays to Xenon-135; and the reactor power was too low for the
burnup of Xe-135 to match the production due to Iodine-135 decay. So Xe-135
built up in the reactor; just as it does after a shutdown.

After 12 hours at reduced power, the load controller released the plant to go offline.
That's when the operators started their previously planned experiment. However,
they were right in the middle of the reactor's Xenon transient. The core was heavily
Xenon-poisoned and the operators were having trouble maintaining criticality.

That's why the operators did all sorts of things they should not have; like withdrawing
control rods more than what is normally allowed. They were trying to do their experiment
with the reactor in condition that had not been anticipated - namely heavily Xenon
poisoned.

The smart thing for the operators to have done was to realize that they were in abnormal
conditions that had not been anticipated when the experiment was planned. They should
have just shutdown the reactor and saved the experiment for another day. Unfortunately,
they ventured into unknown territory - and the result is history.

Dr. Gregory Greenman
Physicist

 

[Homer Simpson]

Yes - but one of the problems with Chernobyl is that the operators were improvising
because they didn't have procedures.

My above points are relating to the TMI event, not Chernobyl.

Chernobyl was entirely different. Several extreme example of non-conservative decisions by the operators, all done in a reactor which was very intolerant to mistakes. (positive void coefficient, graphite tipped rods, no spatial control) This is a pretty solid example of why 'cowboying' at the controls is a bad idea.


And yes Paulanddiw, I'm Homers ass double.

 

[Morbius]

My above points are relating to the TMI event, not Chernobyl.

Homer,

TMI was another case where the accident was initiated by "unthinking" operators.

When I was a student at MIT; Professor Kemeny, who led the investigation of the TMI
accident gave a seminar about the findings of his commission.

At one point in the seminar, Professor Kemeny stated when he toured the TMI control
room, he asked the operators for a "steam table" - a book that gives the equation of state
for water at various conditions and whether the water is in the liquid or gaseous phase or
mixed at the specified conditions.

It took the operators about 30 - 45 minutes to find a steam table!

Professor Kemeny stated that the operators at TMI were absolutely CLUELESS about
what part of phase space of the equation of state for water the reactor coolant was in.

He asked if anyone had read the chronology of the accident in the newspaper. He said
then you know exactly how clueless the operators were.

I knew EXACTLY what he meant. I remember reading the account of the TMI accident
in my morning copy of the Boston Globe. They listed a chronology of events by time.
At one point, the chronology stated that the operators had stabilized the reactor
at a pressure "X" and temperature "Y".

I wondered how far from boiling conditions they were when they stabilized the reactor.
After all, that's what you are trying to prevent in a PWR like TMI; you don't want the
coolant to boil. It creates regions of vapor that won't cool the fuel properly; and hence
the reactor is subject to meltdown.

I reached for my copy of Keenan & Keyes Steam Tables sitting on the filing cabinet that
adjoined by office desk. When I checked the specified conditions of pressure "X" and
temperature "Y" - I found that those conditions were right ON the saturation line.

The operators hadn't "stabilized" the reactor at all. The pressure and termperature weren't
changing because the coolant was boiling - the condition that the operators should be
attempting to prevent. [ Prof. Kemeny confirmed that was EXACTLY what he was
talking about ].

It was 90 minutes after the onset of the accident, and the operators STILL had NOT
consulted a steam table when they noted vibration of the primary coolant pumps.

The vibration of the pumps was an important CLUE - the pumps were vibrating because
they were pumping a two-phase mixture of steam and water. This two-phase mixture
was cooling the core and preventing a meltdown.

However, the operators didn't realized the significance of this clue - they didn't ask why
the pumps might be vibrating. The operator's response was to shutdown the pumps
without thinking about the implication of what that shutdown might do.

It was when the pumps were shutdown that the fate of the reactor was sealed. Without
the circulation of even the two-phase steam / water mixture - the zirconium cladding
tubes melted - and the reactor core was destroyed, and the accident became the
severe event it was.

The Three Mile Island accident was caused by operators that didn't THINK!

Prior to TMI, the philosophy was that all one had to do was to give the operators the
information they needed on their displays, as well as total command of the system,
including the ability to over-ride any of the automatic systems; and the operators would
do the right thing.

That proved to be a faulty philosophy. We had operators that were reacting, and taking
actions WITHOUT being cognizant of the current state of the system or what the
consequences would be of their actions. They just DID; they didn't THINK!

Yes - there were some mechanical failures at TMI; a sticking pressure relief valve, and
some faulty indicators. However, Professor Kemeny stated that the accident was
recoverable even with these mechanical problems.

According to Professor Kemeny, what turned what should have been a minor accident
into a major calamity were the actions of operators that acted WITHOUT THINKING!

Dr. Gregory Greenman
Physicist

 

[Morbius]

It is very easy in hindsight to see what could have been done. The wording in the previous posts saying the operators did not think or were stupid comes across as very harsh & implying they were actually incompetent. It is indeed true that at certain times their actions were the cause of or contributed to accidents, but I don't think this warrants calling them generally unthinking or labelled as stupid.

curie,

It was clear from the seminar by Professor Kemeny that I attended, that he DID
consider them UNTHINKING! He didn't go as far as to say they were incompetant -
but I would.

As far as the safety of a PWR; "Job 1" has to be to ensure that there is liquid water
covering the core at all times. For the operators to be unaware of what the current
state of the coolant was because they hadn't bothered to consult a steam table, is
INCOMPETENT, at least in my book.

They were acting in unplanned (leading into extreme) conditions & no matter how much training one has in so-called "dynamic risk assessment",emergency response, whatever the latest fad is, etc, under those conditions nothing can be guaranteed, including even the operators' own recognition that nothing is guaranteed.

It's their JOB to be ready to respond to unplanned conditions. I expect a nuclear power
plant operator to be on par with a airline pilots.

Contrast the performance of the operators at Three Mile Island with the performance of
the flight crew of United Airlines Flight 232 that crashed at Sioux City in 1991:

http://en.wikipedia.org/wiki/United_Airlines_Flight_232

Due to the catastrophic failure of the turbine disk in the #2 engine in the tail; the resultant
shrapnel severed lines in all the hydraulic systems that control the aircraft. The flight
crew was left with only the throttles for engines #1 and #3.

They were able to improvise a way of controlling and navigating the aircraft to the nearest
airport; and they were ALMOST totally successful at landing. The aircraft rolled right
just prior to touchdown and the right wing tip hit the ground. The subsequent events
resulted in the breakup of the aircraft.

However, the heroic actions of the flight crew resulted in 62% of those aboard surviving;
when this situation could easily have resulted in the loss of all aboard.

That's the type of performance that I would expect from nuclear power plant operators.

Unfortunately, we can't expect airline flight crew class performance from nuclear power
plant operators; and the plants have been modified to prevent operators from makng
egregious mistakes. We now rely more on the engineered control systems than we
do on thinking operators.

Dr. Gregory Greenman
Physicist

 

[Homer Simpson]

Morbius, Try Googling "pilot error"... turns out your example might be a bit biased.

American Airlines Flight 587 lost its tail and plummeted into a New York City neighborhood in November 2001, killing 265 people, because the co-pilot improperly used the rudder to try to steady the plane, federal safety investigators ruled Tuesday.

Your words:

Unfortunately, we can't expect airline flight crew class performance from nuclear power plant operators;

Look friend, it's people like you that incite groundless fears about the nuclear power industry. Operators are tested extensively and repeated times per year, and if they fail, their license is taken away. Unlike your jet pilot example, operators are not encouraged to do all they can to keep "it up in the air", as usually the safest and most conservative thing to do is shut down and then figure out the problem. Operator heroics tend to lead them into a knowledge based decision-making process outside of procedures and that's when mistakes happen. Example: Chernobyl!

Morbius, I'm sure you are borderline genius on engineering and science of a NPP, but you are about 20 years behind the times in your thinking about operating a nuclear power plant. Your expectation that the cores safety should lie in the "improvisational skills" of an operator demonstrates the same flawed approach as the industry viewed things back in the day of Three mile island. Thankfully the industry has come a long way.

 

[Morbius]

Morbius, I'm sure you are borderline genius on engineering and science of a NPP, but you are about 20 years behind the times in your thinking about operating a nuclear power plant. Your expectation that the cores safety should lie in the "improvisational skills" of an operator demonstrates the same flawed approach as the industry viewed things back in the day of Three mile island. Thankfully the industry has come a long way.

Homer,

WRONG! WRONG! WRONG!

Where did you EVER get the idea that I wanted to put my trust in the operators?

When I was at Argonne; I was on the team that designed the Integral Fast Reactor
to be "inherently safe"!

Where did you get the idea that I was making the operators the first line of defense?

The Kemeny seminar I attended had the effect on me that I would NOT TRUST a
nuclear power plant operator any farther than I could throw him/her. That's why I
worked on inherently safe reactors.

I'm NOT 20 years behind the times - I was at the FOREFRONT of the inherently safe
movement.

Just because I expect more from the operators - does NOT mean I want to rely on them.

You TOTALLY MISREAD my philosophy of nuclear safety.

I don't want to rely on operators for safety - but I expect that they would be better than
what they are. They do NOT have the professionalism that one expects from airline
pilots.

Besides, the DC-10 is a very safe aircraft; but when an unpredicated catastrophic
failure befell one; it was good that United had very good pilots aboard.

McDonnell-Douglas wasn't counting on the pilots either.

Dr. Gregory Greenman
Physicist

 

[Morbius]

Morbius, Try Googling "pilot error"... turns out your example might be a bit biased.

Homer,

I'm well familiar with the existence of pilot error. In fact, the majoirity of aircraft accidents
are pilot error not mechanical error.

Nuclear power plants in the past where much less dependent on the skills of the operator
for their safety than airliners - and over the last 20 years - it has moved further in that
same direction.

The pilot of an aircraft has much more control over the system, as well as having a
more "dynamic" job in the sense that although flights are fairly routine; they are never
as routine as the operation of a power plant.

However, is it unreasonable for the operators of a nuclear power plant to understand
the equation of state of water? The operators at Three Mile Island showed less
understanding of the system than what I would expect from someone that operates
the steam heating plant for a large building.

Designers of nuclear power plants do all they can to design safety into the system.

What's wrong with having trained operators that are allies in that mission; as opposed
to the fools at Three Mile Island who didn't know enough to look at a steam table when
the pressure and temperature of the system "stabilized"?

Dr. Gregory Greenman
Physicist

 

[russ_watters]

Ironically, you guys are arguing against each other using examples that cover both sides of the equation - which I guess is fitting since you are really on the same team anyway! For the plane crashes as well as the nuclear plant accidents, they are almost always combination of operator error, procedures, and design issues. Both are so safe, they virtually require multiple simultaneous failures for accidents to occur.

-The Airbus with the tail ripped off was a combination of bad procedures/training and bad design (either the tail should have been stronger or the fly-by-wire control envelope tighter).
-The Soux City crash was caused by a design failure, but Morbius, it was kept aloft mostly by an instructor who was not part of the flight crew, but happened to be aboard at the time. Had the plane frisbee-d in and killed everyone, no one would have blamed the pilots, the situation was so far from what should have been survivable.

The bottom line - for both planes and nuclear plants - is that so much engineering and training goes into their construction and operation that for major accidents to occur usually requires a combination of major, simultaneous failures in operation, training (procedures), design, etc.

So please take a deep breath here and remember that we're all on the same team.

 

[Morbius]

The Soux City crash was caused by a design failure, but Morbius, it was kept aloft mostly by an instructor who was not part of the flight crew, but happened to be aboard at the time. Had the plane frisbee-d in and killed everyone, no one would have blamed the pilots, the situation was so far from what should have been survivable.

Russ,

Both Captain Haynes, pilot in command; and Captain Fitch, the training instructor who
handled the throttles share the credit for limiting the loss of life; it really took ALL 3
members of the flight crew working as a team to save that craft. It would be erroneous
to single one out.

I agree that the situation was grave; and by "all rights" everyone on that flight "should"
be dead. However, even in the face of such seemingly impossible odds - a failed
hydraulic system, the rudder stuck in a turn, so that the plane had to maneuver by
a series of loops - the pilots were able to limit the loss of life in this all but impossible
situation.

That's why it contrasts nicely with the Three Mile Island accident, which by rights should
have been a non-event. At Three Mile Island, the automatic systems were doing the
right things to mitigate the accident; until the operators overrode the automatic systems.

When the operators overrode the automatic systems; they did so without a good
understanding of what was transpiring in the system. Their cardinal rule is to keep
the coolant from boiling - yet they never consulted the tables that would have told
them how close to the "abyss" they were.

So in one case, we have an almost impossible problem, that was greatly mitigated by
fine work of the flight crew. The other was a recoverable problem that the operators
was aggrevated into a full scale catastrophe by operators that were clueless as to
what they were doing.

One is a very good example of how operators can help and save the day; the other
is how operators can BE the problem.

Dr. Gregory Greenman
Physicist

 

[curie]

curie,

... I expect a nuclear power
plant operator to be on par with a airline pilots...

I don't know exactly what training etc airline pilots need to have but in my country in both the power & research reactors, the actual operators, ie the people who drive the desk, are effectively little more than specialised techs. They do not have to be of the intellectual equivalent to have a technical degree & while perhaps some of them do go much farther than a vague understanding of the physics, I would expect most of them to just absorb enough from the training they receive in order to keep their operating licences. That is not to diss them - ultimately it's the same as any job, most people drift into a regime where they do enough to get by. This is why it is the job of the people with the numerous degrees etc to design the plant such that unusual events are minimised or when they do occur, human response is minimised as far as possible to reduce these "unthinking" responses.

Maybe this is a terminology thing - do you mean something to the effet of Physics Supervisor rather than actual bog standard operator?

 

[Morbius]

Maybe this is a terminology thing - do you mean something to the effet of Physics Supervisor rather than actual bog standard operator?

curie,

There should be an SRO - Senior Reactor Operator - on duty; and an SRO should understand the
physics and operation of the reactor, in my opinion.

Perhaps some ROs are just "technicians" - in the sense that they just implement procedures that are
written down for them - "In case of 'A' - do 'B'". However, if we are going to depend on the operators
to also be able to handle unique situations which crop up that haven't been anticipated in the
procedures - then you need someone that really understands the reactor.

Dr. Gregory Greenman
Physicist

 

[curie]

curie,

There should be an SRO - Senior Reactor Operator - on duty; and an SRO should understand the
physics and operation of the reactor, in my opinion.

Yes, in my opinion too. However I've seen in many facilities that operators progress to the senior role and that to do this, they just have to tick more boxes, not necessarily have the increased intellectual capacity and understanding that such a role should merit. Indeed, if they had that in the first place they probably wouldn't have started as operators. The people with the real understanding needed tend to be in different roles not concerned primarily with the ins & outs of day to day running, ie not requiring them to actually be in the control room. These people tend to be on call for emergencies & of course by the time they get to a useful position, many decisions & actions may have already been taken that leads the situation down a particular path. This is played out time & time again in the emergency exercises that facilities are required to demonstrate.

I find the notable exception to be in n-powered marine craft where the defence staffing hierachy is more favourable, and of course an on-call team cannot be relied on!

 

[Morbius]

I find the notable exception to be in n-powered marine craft where the defence staffing hierachy is more favourable, and of course an on-call team cannot be relied on!

curie,

What I find puzzling is that I understand that a goodly fraction of nuclear power plant operators are
former nuclear propulsion operators in the US Navy.

I do know that the officers on board nuclear powered ships in the US Navy are trained in the
US Navy's "Nuclear Power School".

Perhaps the difference is that on a ship; the knowledgeable personell are only minutes away from
the reactor controls. After all, how long does it take to get from the forward torpedo room to the
engineering spaces on a nuclear sub? Not very long. Even on a big Nimitz-class nuclear carrier;
it can't take very long for any of the engineering officers to arrive in the reactor control center.

So on a naval vessel, knowledgeable people can be on the scene quickly before the situation gets
out of hand.

Even so; in the case of Three Mile Island; the "point of no return" in the accident was when the
operators shut down the main coolant pumps. Up to that time, the accident could have been
reversed. The shutdown of the main coolant pumps happened 90 minutes into the incident.

Dr. Gregory Greenman
Physicist

 

[Homer Simpson]

I think I should chime in here and comment on a few points about the modern day training involved. Where we are the training is broken into 3 basic parts. The first deals with the general science involved with the plant, mechanical equipment, Rx physics, thermodynamics, etc. This phase is about half a year and we are tested internally and by the regulator. The second phase is the plant specific material. This is a fairly huge amount of material, as you might imagine, is extremely in depth and frankly not easy at all. Again testing is done inside and by the regulator. The third is mainly to do with putting it all together in the simulator where events are fired at the candidates and response is scrutinized by internal and the regulator. The whole process generally takes about 3 years.

Candidates selected for the program go through a selection process based on aptitude test results, past performance, interview, knowledge tests, etc. Although much care is put into the selection, there is only about a 50% success rate through the program, which speaks to its difficulty.

Many licensed engineers take the same program, and failure rates are equivalent. Many engineers comment that the training is more intense than their university ever was.

Once training is complete, the licensed operator has just begun his career full of testing, as continual training and testing occurs several times per year, and each time the operator’s license is on the line.

Make no mistake; the licensed operator is the person you want at the controls.

 

[Morbius]

Make no mistake; the licensed operator is the person you want at the controls.

Homer,

Unfortunately, the two biggest accidents - Three Mile Island and Chernobyl were situations
where the operators actually percipitated the accident.

As per a seminar I attended given by the lead investigator of the Three Mile Island accident,
Prof. Kemeny; the TMI operators utterly failed to consider the information they had about the
thermodynamic state of the coolant, and how far away from boiling they were. The TMI
operators erroneously thought they had "stabilized" the reactor because coolant temperatures
stopped changing. In reality, the coolant temperature stopped changing because the coolant
was boiling.

So here we had a dire situation in that the coolant was boiling away approaching melting
conditions; and the operators were clueless as to the dire circumstances. They then
precipitated the final plunge to meltdown by shutting down the coolant pumps.

The operators at Chernobyl appeared to be unaware of the problems of trying to operate a
reactor in the middle of a Xenon transient.

Both reactors required more knowledgeable people at the controls than those available;
because in both cases, training not withstanding; the operators were woefully inadequate,
and not up to dealing with incidents which should have been non-events save for the
poor quality of personell at the controls.

Dr. Gregory Greenman
Physicist

 

[Homer Simpson]

"Operators responded by reducing the flow of replacement water. Their training told them that the pressurizer water level was the only dependable indication of the amount of cooling water in the system. Because the pressuriser level was increasing, they thought the reactor system was too full of water. Their training told them to do all they could to keep the pressuriser from filling with water. If it filled, they could not control pressure in the cooling system and it might rupture."

http://www.uic.com.au/nip48.htm

There was a huge change in 'common knowledge' after this, in that it is now commonly known to PWR operators that high pressurizer level in these scenario's is caused by coolant voiding.

If I ever see someone in the control room with steam tables in their hand, I'm going to assume it's either you or the prof, and calling security!

 

[Morbius]

"Operators responded by reducing the flow of replacement water. Their training told them that the pressurizer water level was the only dependable indication of the amount of cooling water in the system.

Homer,

That's the PROBLEM - the operators at TMI were so damnable STUPID that the
pressurizer level seemed to be ALL they cared about. If the operators had paid some attention
to the reactor pressure and temperature and consulted a steam table - then they would have
known that the coolant was boiling! If the coolant is boiling, then the coolant is being replaced
with vapor that doesn't have the capacity to properly cool the core. That's equivalent to letting
the water level fall too low.

If all we cared about were something as simple as pressurizer level - then we could replace the
operators with some feedback relays. The reason we have operators is to deal with circumstances
that the automation is too stupid to deal with.

Unfortunately, the Three Mile Island operators were about as stupid as the automation they were
supposed to be back-stopping.

The Three Mile Island operators were supposed to THINK - to use their BRAINS.

The operators are NOT supposed to be trained monkeys that just follow a script. Operators have
to understand the system and how it works. I compare nuclear power plant operators to the
pilots of commercial airliners. The reason we have pilots aboard airliners and not just rely on an
autopilot - is that humans are better than machines at dealing with unexpected circumstances.

Consider the crash of United Airlines 232 in Sioux City, IA in 1989. The catastrophic disassembly
of the turbine in the #2 engine and the shrapnel thus produced ended up disabling all the hydraulic
control systems on the plane. Captain Alfred Haynes, and his crew; along with Captain Dennis Fitch,
a DC-10 training instructor that just happened to be aboard; were able to improvise methods to gain
a certain amount of control of the mortally stricken DC-10. They were able to bring the plane into
Sioux City and save the majority of those aboard, and minimize loss of life. THAT's the type of
performance and professionalism that we need at the controls of powerful machines.

Instead of that, at Three Mile Island; we had a crew of operators that monomaniacally focused on
a SINGLE operational parameter; didn't pay attention to what the other indicators in the control room
were telling them. Because they didn't have steam tables, they didn't understand the meaning of
the indications that were presented to them. Because they were so clueless as to the condition of
the plant - they shutdown the primary coolant pumps; an action that led to the meltdown. The operators
overrode the automatic systems.

If we give the operators the authority and ability to override the automatic systems; then they better
be SMARTER than the automatic systems. The Three Mile Island operators proved that assumption
to be false.

That's why many of the responses to the TMI accident was to TAKE AWAY the authority of the
operators to override the automatic systems. We no longer assume that the operators know better
than the automatics and let them trump the decisions of the automated systems.

No - the nuclear design engineers now take the view that we CAN NOT trust operators to do the right
thing in emergency situations. Therefore, the current operators no longer have the ability to override
certain safety systems.

Dr. Gregory Greenman
Physicist

 

[nrqed]

Homer,
...
No - the nuclear design engineers now take the view that we CAN NOT trust operators to do the right
thing in emergency situations. Therefore, the current operators no longer have the ability to override
certain safety systems.

Dr. Gregory Greenman
Physicist

very very interesting post. Thanks to dr Greenman for posting this.

I hope that the irony of explaining this to Homer Simpson is not lost on anyone :-)

 

[vanesch]

very very interesting post. Thanks to dr Greenman for posting this.

I hope that the irony of explaining this to Homer Simpson is not lost on anyone :-)

 

[Homer Simpson]

So Morbius, do you work around or know any NPP operators? Have you seen them in action outside of "the china syndrome"? or at least have any insight to operations since 1979?

 

[Morbius]

or at least have any insight to operations since 1979?

Homer,

I sincerely hope that operators today I better than the boneheads at Three Mile Island that
just about killed an entire industry with their stupidity.

Dr. Gregory Greenman
Physicist