Who Destroyed Three Mile Island? - Nickolas Means | The Lead Developer Austin 2018

so I'll start by pointing out that the giant 18t cell mask that's there is due to South by and like most things in Austin right now, the problem with the microphone today is South's fault, so thank you for that temporary area that was very kind, you are always too kind. I really appreciate it. I really love what Mary and Ruth and the entire White October team have built into this event. I think it's something that those of us who care deeply about

lead

ing well really needed and that's why. I'm grateful it exists in the world, so thank you for all the time, effort, and attention you put into it.

I'm especially excited and grateful, yes please, I'm especially excited and grateful that they brought it to my hometown. Austin and I are incredibly honored to be on this stage tonight, so when I was a kid, my parents gave me this set of volume books called How Things Work. My father is a mechanical engineer by training and I think the reason I was given this set. of the books is because he got tired of answering all my complicated questions about how things work maybe it was that maybe it was that he wanted to teach me how to get these answers on my own.

I don't have the opportunity to look at these books. very often today, but they still hold a treasured place on my bookshelf because they are a big part of what made me who I am. I think these books are a big part of why I'm interested in all these strange disasters and stories. That's what I like to call ya stinker, remember when it was all over the local news in 1990 that the Comanche Peak unit one outside of Dallas had come online, it was the first nuclear reactor I remember hearing about and I remember turning here for two pages 68 and 69 of volume one of how things work to try to understand how a nuclear reactor produces electricity and I think that's a good place for us to start today as well with one of the reactor diagrams at the bottom of this page.

The basic mechanics of a new nuclear power plant are the same as those of a combustion plant. A heat source heats water. In this case, it is a carefully controlled nuclear reaction fuel made of uranium, but in a combustion plant coal or natural gas would be burned and that heat heats the water. High-pressure water circulating through the reactor carries heat to a heat exchanger where it is used to boil water and convert it to steam. The steam is channeled into the turbine which is basically a giant fan in a tube and the turbine spins a generator and that is what ultimately produces the electricity, after that the steam is pumped to a condenser where it is cooled and It turns back into water and spins and spins.

So what exactly makes this a pressurized water reactor? Because that is important to us. Understand today the components that I have just explained to you across the Earth, in two separate coolant circulation circuits. Here is a primary circuit in orange consisting of water flowing through the reactor vessel to collect heat and then through the heat exchanger over and over again. the only place the water goes and then there is a secondary loop here in blue that flows through the heat exchanger where it boils into steam and that steam, the expansion of that steam is what drives the turbine to generate electricity and It then condenses back into water. and it goes through that secondary circuit over and over again these two circuits never mix they are completely isolated the water is completely separated and what makes it a pressurized water reactor is that the primary circuit is maintained at approximately 2000 psi there is a very A The simple economic reason for this is that a boiling water reactor, the other major type of nuclear reactor, has to have a very large reactor pressure.

Because the water actually boils the steam in the reactor itself, there has to be room for that expansion to occur in the reactor. The vessel and a pressurized reactor can be much smaller because when the pressure of the water is increased, the boiling point increases and therefore the water in the primary loop is at about 600 degrees Fahrenheit, but because it is kept at such high pressure it doesn't boil nor at least it shouldn't and that brings us to March 28, 1979. The Three Mile Island Nuclear Power Plant is a two unit nuclear power plant in Londonderry Township, Pennsylvania, it is built on a sandbar

three

mile

s long in the middle of the Susquehanna River and is about ten

mile

s south of Harrisburg Pennsylvania the capital of state unit one is an 820 megawatt Babcock & Wilcox pressurized water reactor and commercial operation on September 2 1974 on March 28 has been operating for approximately five years without incident and is currently offline for refueling.

This reactor is not operational. Unit two is also a Babcock & Wilcox pressurized water reactor. It's a little larger, 906 megawatts, and entered commercial operation on December 30, 1978. If you do the math, it's only

three

months old at this point. it was only operating for three months on the morning of March 28, 1979 and that morning it is operating at 97% of its maximum capacity, it is operating correctly and normally, as they say in the nuclear power industry, these four men are at the control of Three Mile Island. unit two for the night shift on March 28 bill Z we is the shift supervisor for units one and two he is the most senior person on site for the night shift Fred Shima is the shift foreman for unit two is busy is the second in command sir gentleman in In the end in Frederick and Craig Foust or the control room operators on duty, they are the ones who are actually sitting at the controls in the reactor control room.

Everything the plant was going perfectly normal that night the plant was running exactly as designed except for a small problem with the condensate polisher the previous night shift had left them to deal with the water condensate polishers they have a set at Three Mile Island, a set of eight filtration tanks that filter water leaving the secondary coolant circuit. of the condenser before it returns to the expensive and delicate steam generators. These are not the actual Three Mile Island condensate polishers as you can imagine, it is very difficult to find a picture of a specific component from a specific nuclear power plant, but this is what they look like and these polishers are filled with resin beads sticky and what these beads do is anything that might be in the water that isn't water, like little flecks of rust or dust or whatever will stick to these resin beads, the only problem with this system is that sometimes As the five thousand tons of water that passed through these tanks push these beads they tend to compress and the problem the crew was facing tonight is that the beads and polisher tank number seven had completely clogged the tank so the crew on the shift had started working on this problem, these things have a backwash system that works like a pool filter backwash, so they used it wasn't enough, so they turned on a compressed air feed and also fed air compressed to the tank.

At 359 in the morning, Fred Shima is in the basement of the turbine room to see how things are going and to see if this tank is unstuck, but he is looking out the observation port of tank number 7 when things get incredibly unbelievable. silent, as you can imagine. Those five thousand tons of moving water per hour make an enormous amount of noise, so the sudden silence is very disconcerting and it barely breaks free before a water hammer hits and actually dislodges the feed pipe that feeds the eight condensate polishing tanks. What happened was over the last ten hours or so, a leaking one-way check valve had allowed water to rise from the condensate polisher tank into the air feed line and over the course of 10 hours it made its way into the manifold that fed the eight pneumatic control valves that controlled the inlets of these condensate polishers, so all eight tanks were closed at the same time, obviously this is not good, but tell us we understand why here is a schematic of Three Mile Island.

Unit two looks a little more complicated than the diagram we saw a minute ago, but I have it in the same color as that diagram. The primary loops and the orange secondary loop are in blue. Let me orient you very quickly here in the centers of the reactor vessel where the nuclear chain reaction creates heat, next to it are the two steam generators, what the other diagram calls the heat exchanger or primary circuit heat, boils water in the secondary circuit to create steam, this is a critical component of the plant, so there are two of them for redundancy: the steam generated in the steam generators is channeled to the turbine building to spin the turbine generator and then here is the condenser where the steam is cooled and cooled enough to turn back into water.

An interesting fact that I will comment on. Point out that most people think this cooling tower is a nuclear reactor, it's actually not, it's the small building next to the cooling tower and here, just after the condensate polisher, just after the condenser, there is the condensate polishing and so on with the condensate polishing section completely. blocked, there is no more water to pump through the secondary cooling circuit, so the main feedwater pump is disconnected. It is 36 seconds after 4:00 a.m., the official start of the accident at Three Mile Island, two seconds after the main feedwater pumps were triggered.

The turbine feels that it will not receive more steam and that is why it disconnects along with the generator. When this happens, plants get a lot of steam that they no longer need, so the plant's main safety valves open and release a ton of steam. steam in the sky early in the morning it's harmless it's not radioactive but it makes a lot of noise you can hear it for miles in the control room edie frederick and craig faust are getting the first hints that something has gone wrong a horn alarm sounds announcing that the turbine is tripping and several alarm indicators begin to flash a few seconds after the turbine and generator alarms go off and the reactor vessel is beginning to rise rapidly.

This is not unexpected, you see it without water in the secondary circuit. The heat that builds up in the primary coolant circuit has nowhere to go and when water heats up it expands, so it is normal that with nowhere for the heat to go, the pressure will increase. The good news is that the plant is designed for exactly this scenario and as soon as the alarm went off it started to react by taking action to resolve the situation automatically the reactor pressure control system is the first to go into action now there are two components in this system and both are important for the accident the first one we are going to talk about is the pressurizer now the pressurizer is the main job is to maintain the pressure of the system in a nuclear reactor and pressurized and this works like a giant piston the red area in the top is steam and the blue at the bottom is liquid water.

Now water expands when it's heated, like I just said, when they need to increase the pressure in the system, there's a heating element at the bottom that they can turn on that will increase the pressure in it. The whole primary refrigerant circuit when they need to lower the pressure, there is a sprinkler on top that they can turn on and by lowering the pressure in the pressurizer, it will lower the pressure of the entire system. There are a couple more purposes that the pressurizer serves. Well, Babcock and Wilcox designed this particular nuclear reactor without any monitoring of the water level and the reactor vessel itself, the reason for this is because the pressurizer is the highest point in the system and therefore if you monitor the water in the pressurizer, you can infer that if there is water in the reactor and it was much cheaper to place instruments in the pressurizer than the reactor vessel itself because it is exposed to high radioactivity and the third job that the pressurizer does is absorb the shocks of pressure.

Steam is significantly more compressible than water and so the vapor bubble at the top of the pressurizer acts as a giant shock absorber when the system experiences a rapid and significant increase in pressure, much like what it is experiencing now, so the steam and pressurizer absorb the initial shock, but the pressurizer is designed for small fine adjustments of pressure at this time, the primary circuit is at 2250 psi, about a hundred psi above operating pressure and the pressurizer would take a few minutes make that adjustment, so what does the system do to deal with a big pressure change like this? in a well, that's where the pilot operated relief valve comes in and if he's ever heard the story ofThree Mile Island unit two, this is the component you probably remember because it's the one that gets all the press attention in the event of a major pressure really increased, the pilot operated relief valve will open and release refrigerant in a drainage tank on the floor of the containment building.

The PRV opens four seconds after the turbine and generator are disconnected from the line. A few seconds later, the computer detects that even with pressure. The open pressure of the PRV and the reactor vessel still continues to increase, so another defensive reaction is needed. Your reactor grams now, the chain reaction at the core of a nuclear reactor consists of a group of neutrons bouncing off, colliding with uranium atoms and causing them to fission. or splits when that happens, it emits an enormous amount of heat and many more neutrons which then shoot out and collide with other uranium atoms, continuing the chain reaction.

The way this chain reaction is controlled is through a set of cadmium rods that can be inserted into the core of the reactor, what they do is absorb these neutrons and prevent them from flying into the Iranian atoms when the reactor crashes. . What happens is that the control mechanism that is responsible for lowering and raising these pressure rods releases them and they fall freely to the bottom of the reactor core and this stops the nuclear chain reaction almost instantly, but even after the stop, The reactor core continues to produce decay heat immediately after the shutdown, it is producing six and a half percent of what it was producing before it was shut down, an hour later. producing one and a half percent, so it is incredibly critical that cooling is maintained for the core during this first hour because that is a lot of heat that if not removed if it builds up in the core can cause significant damage a few seconds later in In the control room, a light on the console changes from red to green to indicate that the pilot-operated relief valve has closed.

At this point, the reactor operators feel that everything is very much under control. Reactor and turbine trips are not something that happens every day because obviously you want the plant to stay online and generate electricity, but they are not an emergency either, there are well established procedures to respond to them, the alarm horns continue to sound , the alarm indicators continue to flash, but the system behaves exactly as designed, that feeling of control for the reactor operators would last precisely two minutes. I guess two minutes later, the core's emergency cooling system specifically turns on the high-pressure injection pumps that blast a thousand gallons per minute of cold water directly into the reactor core.

The plant had gone from a state they understood to one they didn't understand as soon as the high pressure injection was activated, the reason this confused them so much is because they were observing the water level in the pressurizer and the water level in the pressurizer was rising seeing the water level in the pressurizer rising told him there was a lot of water in the system, so they couldn't understand why the high pressure injection system thought the system needed more water, so what Fred Shaymin made the call to turn off the high pressure injection system after it had only been running for about two and a half minutes if he hadn't, if he had left it alone, let it do its job, this would have been an inconvenience minor and this plant would have been back online approximately two days after this incident.

Five minutes into the accident sequence, there's something about this point that stumps Bill Ziwei. He is the one who can be seen hunched over and the Paisley shirt right in the middle. The water level in the pressurizer continues to rise, so he knows the main circuit. It is full of water but the pressure in the primary circuit continues to drop and this is a problem because if it drops too much, the water in the primary circuit will start to boil and will not be able to cool the fuel rods. So you have a hunch about what's going on and you suspect that maybe the pilot operated relief valve might be stuck open and that's why the system is having trouble maintaining pressure, so you double check the pressure gauge.

Pilot operated relief valve on control panel. shows up close just like he did before just to make sure one of the reactor operators checks the outlet temperature at the pilot operated relief valve the reading comes back to 228 degrees Fahrenheit this looks perfectly normal the bills to Irie so keep going ahead there is a There is a problem with that decision, although the plant's operating manual indicates that any reading above 200 degrees Fahrenheit indicates that the pilot-operated relief valve is open and, if that is the case, then the relief valve Manual lock in front of it must be closed to prevent refrigerant from escaping. from the head of the system, Bill Z, we simply close the block valve, he would have stopped the accident right then and there, but he doesn't, he leaves it open.

We are already six minutes after the accident, five minutes after four, 11 a.m., another alarm sounds. off this indicates that the sump in the containment building is filling the sump is a well at the bottom of the containment building that collects water that could leak or vent from somewhere in the system, in this case what is happening is that So much water has come out of the primary coolant circuit pilot-operated relief valve that it fills the drain tank on the floor of the containment building and the drain tank has begun to overflow into the sump, there is now enough water to fill The sump at the bottom of the containment building should have told these guys they had a giant leak, but they don't realize it, they don't get the clue: the core is in serious trouble right now, but the operators haven't yet finished just after 5:00 a.m.

The control room floor starts to rumble, it's very subtle at first but it quickly becomes impossible to ignore what's happening is that the reactor's primary coolant pumps are starting to vibrate because there is steam in the core and the pumps are pushing the scheme inward. In addition to the water they are designed to pump, this causes a lot of turbulence and they know what their training says to do when this happens to prevent very large and expensive pumps from vibrating to pieces and creating a coolant leak. They're supposed to shut down, they hold on as long as they can because they're worried what this might mean if they turn off these pumps, but 15 minutes on bills II, we can't take it anymore and he turns off the first set of pumps, this helps for a while, but 30 minutes later the vibrations got worse again and he turned off the other set.

It is now 544 in the morning and this nuclear reactor was operating at 97% of its maximum capacity in less than two hours. Before, now no coolant circulates through its core. None. Anetha. The effects of the lack of circulation do not take long to become known. At 6 a.m. m., exactly two hours after the accident, a radiation alarm like this begins to sound in the containment building. Now that tells us a couple of things: the first thing for the radiation alarm to sound is that one or more of these fuel rods must have been damaged. The nuclear fuel is packaged in zirconium rods like this one and they are a bunch of uranium capsules that are about the size of your pinky.

The beauty of this arrangement is that it prevents the radioactivity in the fuel rods from leaking into the primary coolant. , so for them to detect radioactivity in the containment building, the rods of the eruption started, the other thing that tells us is if the fuel rods have been damaged then it is almost certain that the water level in the vessel reactor has fallen below the top of the core now at this point the plant

lead

ership has begun to arrive at the plant Gary Miller is the station manager the CEO of across Mile Island, this is his plant energy.

George Condor is the Technical Support Manager for unit two at Three Mile Island, so he handles all the technical specialists on staff, the nuclear engineers, health physicists and chemists, almost as soon as they walk in the door. , they are asked to join a conference call with Leland Rogers, a site representative for Babcock & Wilcox, the company that designed this reactor, and while these three guys talk about what they know about the status of the plan, Rodgers says they close the valve lock, the right lock valve. tilt the valve that bills you we decided not to get dressed before George Kunder in the control room yells at someone else and says yes the black valve is closed a few seconds later the answer comes back yes, it is closed and so on at 6:20 two in the Tomorrow two hours and 22 minutes after the start of the accident, the block valve finally closes and the leak in the system is finally sealed.

Now, if they had done it 20 minutes after the accident, it would have been the right thing to do, at this time it actually occurred. Things got worse and the reason for this is that this valve was the only way it could escape from the reactor vessel into the primary coolant circuit. The only way the core was kept cool at this point was to boil the coolant and vent it through the pilot operated relief valve, so with the valve closed the heat in the core intensified rapidly, it took about eight minutes for the upper part of the court to collapse.

Later calculations would show that at 7:00 a.m. The core was two-thirds bare and temperatures in the hottest part of the core were about four thousand degrees Fahrenheit hot enough not only to melt the zirconium fuel rod cladding but also the uranium fuel inside. At 7:20 in the morning the radiation alarm sounded and the top of the containment building rang. now indicates a reading of 800 REM per hour to give you context of what that

means

, if one of the plant operators had been standing in a field of 800 REM per hour, they would have gotten their maximum allowable annual radiation dose in 20 Seconds, the crew had largely denied the state of the plant and the damage to the core after the first radiation alarm went off, but when this one went off, this is the biggest one, immediately after this alarm, they finally decide that It's time to return the high pressure injection. on but they only leave it on for 18 minutes because it makes the water level rise and the pressurizer are so obsessed with the pressurizer that it was not until 8:26 in the morning four hours and 26 minutes after the start of the accident after The situation continued Dorson that they finally decided to re-enable the high pressure injection and leave it on and they do so largely out of desperation.

They are not sure what to try at this time to gain control of the plant, it would take until 10:30 in the morning for these thousand gallon per minute pumps to cover the core with water and end the primary accident sequence. Over the next few days there would be continued concern about a radiation release at the plant, so they would continue to monitor the situation on the ground. On the ground they would send teams around the perimeter of the plant with radiation detectors, fly them in helicopters, but redundant containment in the plant did its job, a significant release of radiation would never occur, there is much public concern about a possible hydrogen explosion. because when the fuel rod's zirconium coating melts it reacts with the coolant to produce hydrogen, but it turns out that public fear was largely fueled by incorrect calculations;

Not as much hydrogen was released as people feared on Sunday April 1st. Four days after the accident, President Jimmy Carter and his wife Rosalynn would visit the plant and tour the control room to reassure the American public about the safety of nuclear power and to assure them that the situation at Three Mile Island was under control. . Later I would convene a commission of inquiry that would result in this report on the accident from which I have extracted many of the facts for this talk today of unit two of Three Mile Island an investment of 500 million dollars would be written off as a total loss. canceled in three months After it began operating, about 20 tons of melted uranium ended up at the bottom of the core, another 10 tons accumulated there in the middle.

This is what they found when they began the initial cleanup in 1983. You're looking at severed molten fuel rods. that ended up at the bottom of the reactor, the final cost of the initial cleanup was just over a billion dollars and it took 14 years and they are still not finished. Three Mile Island unit two is still in the middle of the Susquehanna River. see unit 1 here on your right, it is still running, it is still producing electricity, the final cleaning of unit 2 will not take place until unit 1 isdismantled and is currently scheduled for the year 2034, that's what happened, how did these four men miss so many signs?

Along the way, their reactor was in the middle of an accident due to loss of coolant. Why didn't they leave the emergency core cooling system on when it activated? Why didn't they close the block valve earlier? Sidney Dekker and has reserved the field guide. to understand human error introduces the concept of first stories and second stories and the story I just told you about Three Mile Island is intentionally a first story, so the first stories focus on the humans in the story and what They should have done differently in the first one. The story inevitably blames the accident on the humans involved and the decisions they made.

This is problematic for a couple of reasons. There are a couple of prejudices that we all have. The first is the hindsight bias that results when you review an event afterwards. occurred and you know the outcome, you automatically exaggerate your own ability to have predicted and avoided that outcome. This is sometimes known as the I Saw It All The Time effect. An example that here is all that water in the sink had to come from somewhere. I don't know anything about nuclear reactors and I would have realized there was a leak. The second is outcome bias.

It turns out that once you know the outcome of a situation, you carry the full weight of that outcome as you evaluate every decision that led to it. it makes you more willing to judge those decisions and makes you more likely to judge them harshly. A good example here is that knowing that the result of this is a partial meltdown, turning off the core's emergency cooling system at the beginning of the accident seems like a really stupid action. decision, then instead we must look for the second story, there is always a second story buried beneath that first story, in a second story, human error is seen as an effect of deeper systemic vulnerabilities within the organization, not as a result of poor decision making or not following instructions so how do we get to a second story?

We have to delve into decisions from the perspective of the people who made those decisions We have to try to see the world through their eyes We have to work to consider the messy reality they faced when they made the decision, not the clean room conditions that are viewed in retrospect and we have to look through the lens of positive intent with the belief that everyone involved made the best decisions they could with the information they had, so let's see if we can find some second Three Mile Island stories . Let's start early in the sequence. Why?

In the world, Fred Shi Minh made the call to shut down the emergency core cooling system five minutes after the accent. We will find our answer in the pressurizer's statement from the presidential inquiry. Fred Siemens says he turned off the emergency core cooling system because it was causing the water level in the pressurizer to rise and he was afraid the pressurizer was going to solidify, in quotes, that's a phrase that appears throughout This statement. The whole team was worried about the pressurizer solidifying, so what does that mean? Well, remember. Since one of the jobs of the zki pressurizer is to absorb pressure shocks in the system, letting it solidify is letting it fill with water to the point that it can no longer absorb that pressure.

He saw his pressure shots, so it makes sense that he wouldn't do it. you want the pressurizer to solidify, but you have to know that the core is in danger, why does your concern for the pressurizer override your concern for the core? Well, that answer goes back to Admiral Hyman Rickover in the early days of the nuclear Navy. It turns out that Bill ze Fred Shima, Frederick and Craig Faust were all former naval nuclear reactors and the naval reactor training designed by Admiral Rickover had taught them that keeping the pressurizer from solidifying was the most important job of a nuclear reactor. operator that actually makes sense in a submarine, the reason is that a 1960s submarine produces 12 megawatts of thermal energy for its propulsion, Three Mile Island unit two to generate 906 megawatts of electricity due to efficiencies in the system It has to produce 2841 megawatts. of heat, that's a lot of heat, remember when you shut down a reactor the primary heat production stops immediately, but there is still decay heat and it takes a while for the heat to cool down in a submarine reactor, that decay heat is trivial, it's about 780 kilowatts, you can basically ignore it if the reactor was completely uncovered, this wouldn't be enough heat to cause any damage to a power reactor, that 6.5% of the decayed heat is one hundred and eighty five megawatts of heat if dont do it. continually carrying that heat will cause fuel damage in a submarine a water hammer without shock absorption is literally a worst case scenario where it could result in a loss of propulsion and a crippled ship carrying that mentality into the operation of a power reactor where Much worse things are possible is a huge system and a vulnerability that was unreal before the Three Mile Island accident, so Fred Shima, faced with a rising pressurizer, inferred that the system was full of water, already allowing The emergency core cooling system will continue.

High pressure injection would overfill the system, risking a full pressurizer, and therefore, in an effort to keep the reactor safe, he turned off emergency core cooling. Look another, why didn't Bill Z close the lock valve when he first checked the outlet valve temperature? the outlet pipe temperature, if you remember, the reported outlet temperature was 228 degrees Fahrenheit and plant procedures called for the block valve to be closed if it exceeds 200 degrees, it turns out that at the Three Mile Island unit to the pilot The operated relief valve had been leaking almost from the first day of operation.

A very small leak, just a little bit of steam, and it was such a minor problem that it wouldn't really be fixed until the first refueling was closed. The consequences of that leak were that the outlet valve temperature, the outlet temperature of the pilot-operated relief valve, regularly exceeded 200 degrees Fahrenheit on an almost daily basis, so we at Bill Z had been conditioned to see temperatures over 200 degrees, despite what the reactor operating manual said, was fine and when you evaluated that temperature, you thought about it in terms of the pilot operated relief valve was just venting very hot water, normally it's around of 200 degrees. 228 doesn't seem unreasonable to me, so that's part of it, the other part is when he looked. on the control panel to check the position of the pilot operated relief valve, he saw that it was green indicating the valve was closed, but that's not really what that light meant, the light on the control panel just indicated the sign that the valve was bent. according to the computer a green light simply meant that the computer had told the valve to close, it was not engaged, the physical position of the valve, the only way to know the actual position of the pilot operated relief valve was infer it from the outlet temperature. and so Bills Ewing assimilated all the information he had at his disposal and considering that the pressurizer was full he left the block valve open so that the pilot operated relief valve could still respond if there was a pressure spike, he left the valve open to keep the reactor safe. one more this is quick when i promise how the crew confused the meaning of the single arm so much water in the sump it's obvious how they didn't know they had a coolant link the answer is really simple I never got the alarm, the control room via my

island

I conveyed alarm conditions to the crew in two ways: number one is this row of lights on the wall and there is a corresponding row on the other side, about 600 alarm lights in total and on any given day when the plant is running exactly as designed 40 to 50 of these would be there very noisy no rhyme or reason where they are placed one of the most important alarm lights in the entire system the reactor pressure alarm is right next to a light indicating that the elevator and containment building are stuck.

The third problem with these is that they don't indicate any timeline that you can't tell by looking at them when an alarm went off and what's new since you last looked at the dashboard. answer for that they had an alarm printer every time an alarm went off this printer printed a line describing the alarm the only problem is that it is connected to the computer via a very very slow 300 baud serial connection and therefore , less than an hour later After the accident, after more than a hundred alarms have been triggered, it would take the printer two and a half hours to finish printing all the alarms, so there is no way for operators to keep up from the avalanche of information that is directed at them, so they just don't see the simple arm, they don't get the message that the sink is full, so how do we implement this first and second floor idea with our teams, dr.

Decker has some helpful advice for us first, when trying to figure out why something is wrong. We agreed on a basic rule that human error is never the cause. Human error is always a symptom of underlying systemic issues or a problem, so blaming a problem on humans. The error prevents us from discovering what really went wrong. A good way to help frame the conversation in these terms is to ask who is responsible for an outcome and not whose fault it is. The second principle is to understand why it made sense for people on your teams not to do it.

They don't come to work with the intention of doing a bad job, chances are that when they make a decision that you don't understand, they had a very good reason for doing so, they took the time to see the world through your eyes and understand why they made their decision. In the third sense, seek accountability forward and not backward. Our instinct when things go wrong is often to find out who is responsible and punish them as we try to shift the blame away from our organizations and look for second stories. One of the most common objections is, but what about retaining people? responsible turns out that removing punishment actually frees people up to candidly share their stories of what happened so you can learn from them rather than having those experiences swept under the rug if you've implemented blame-free autopsies in your organization, you've seen this but there is another part of this that is very important, that is not talked about very often.

The act of telling the story of what happened, of giving your account and taking your part, is usually all the responsibility that well-intentioned people need to improve their already beating. they prepare for the decision they made they are already upset because something bad has happened they don't need systemic blame and punishment they don't need shame it doesn't help anyone it just teaches them not to share what happened and try to hide it backward accountability seeks to blame someone for past events forward accountability seeks to help people tell the story of what happened and accept it and focus on the work necessary for change and improvement in the future the beauty of this technique is that it is so widely applicable that there is always a second story if you are willing to do the work to find it this will work when someone leaves the production database it will work when your team has an important deadline it will work when a key team member chooses to leave it will work even When the sales department does not meet its quarterly sales goal, it requires honesty and building trust, but it is worth it because finding the second story is a very powerful way for your team to grow and improve and allows you to treat your teammates with the humanity they deserve goes back to the psychological safety Julia talked about earlier.

This is a great way to build psychological safety in your team. It turns out that who

destroyed

Three Mile Island is not a fair question at all. What we should be asking is what

destroyed

Three Mile Island and fortunately that is the question the Presidential Commission asked. See the subtitle of your report. This report is full of second stories. Those second stories revealed weaknesses in reactor design and operator training across the nuclear industry. around the world by overcoming human error to the real causes of the accident at Three Mile Island, the Presidential Commission made the world a safer place by taking the time to find the second stories of everything that happens, not just its interruptions , will make your organization a placesafer for the people who work there and you will fix the things that affect the speed and quality of your delivery, best of luck