All posts by Sarah Wrenn

I deliver workshops for analyzing, documenting, communicating and solving problems effectively and provide consulting services for incident investigation.
Uncategorized

Indian Point Fire and Oil Leak

By Sarah Wrenn

At 5:50 PM on May 9, 2015, a fire ignited in one of two main transformers for the Unit 3 Reactor at Indian Point Energy Center. These transformers carry electricity from the main generator to the electrical grid. While the transformer is part of an electrical system external to the nuclear system, the reactor is designed to automatically shut down following a transformer failure. This system functioned as designed and the reactor remains shut down with the ongoing investigation. Concurrently, oil (dielectric fluid) spilled from the damaged transformer into the plant’s discharge canal and some amount was also released into the Hudson River. On May 19, Fred Dacimo, vice president for license renewal at Indian Point and Bill Mohl, president of Entergy Wholesale Commodities, stated the transformer holds more than 24,000 gallons of dielectric fluid. Inspections after the fire revealed 8,300 gallons have been collected or were combusted during the fire. As a result, investigators are working to identify the remaining 16,000 gallons of oil. Based on estimates from the Coast Guard supported by NOAA, up to approximately 3,000 gallons may have gone into the Hudson River.

The graphic located here provides details regarding the event, facility layout and response.

Step 1. Define the Problem

There are a few problems in this event. Certainly, the transformer failure and fire are major problems. The transformer is an integral component to transfer electricity from the power plant to the grid. Without the transformer, production has been halted. In addition, there is an inherent risk of injury with the fire response. The site’s fire brigade was dispatched to respond to the fire and while there were no injuries, there was a potential for injury. In addition, the release of dielectric fluid and fire-retardant foam into the Hudson River is a problem. A moat around the transformer is designed to contain these fluids if released, but evidence shows that some amounts reached the Hudson River.

As shown in the timeline and noted on our problem outline, the transformer failure and fire occurred at 5:50 PM and was officially declared out 2.25 hours later.

As far as anything out of the ordinary or unusual when this event occurred, Unit 3 had just returned to operations after a shutdown on May 7 to repair a leak of clean steam from a pipe on the non-nuclear side of the plant. Also, it was noted that this is the 3rd transformer failure in the past 8 years. This frequency of transformer failures is considered unusual. The Wall Street Journal reported that the transformer that failed earlier this month replaced another transformer that malfunctioned and caught fire in 2007. Another transformer failed in 2010, which had been in operation for four years.

Multiple organizational goals were negatively impacted by this event. As mentioned above, there was a risk of injury related to the fire response. There was also a negative impact to the environment due to the release of dielectric fluid and fire-retardant foam. The negative publicity from the event impacts the organization’s customer service goal. A notification to the NRC of an Unusual Event (the lowest of 4 NRC emergency classifications) is a regulatory impact. For production/schedule, Unit 3 was shutdown May 9 and remains shutdown during the investigation. There was a loss of the transformer which needs to be replaced. Finally, there is labor/time required to address and contain the release, repair the transformer, and investigate the incident.

Step 2. Identify the Causes (Analysis)

Now that we’ve defined the problem in relation to how the organization’s goals were negatively impacted, we want to understand why.

The Safety Goal was impacted due to the potential for injury. The risk of injury exists because of the transformer fire.

 

 

The Regulatory Goal was impacted due to the notification to the NRC. This was because of the Unit 3 shutdown, which also impacts the Production/Schedule Goal. Unit 3 shutdown as this is the designed response to the emergency. This is the designed response because of the loss of the electrical transformer, which also impacts the Property/Equipment Goal. Why was the electrical transformer lost? Because of the transformer fire.

For the other goals impacted, Customer Service was because of the negative publicity which was caused by the containment, repair, investigation time and effort. This time and effort impacts the organization’s Labor/Time Goal. This time and effort was required because of the dielectric fluid and fire-retardant foam release. Why was there a release? Because the fluid and foam were able to access the river.

Why did the fluid and foam access the river?

The fire-retardant foam was introduced because the sprinkler system was ineffective. The transformer is located outside in the transformer yard which is equipped with a sprinkler system. Reports indicate that the fire was originally extinguished by the sprinklers, but then relit. Fire responders introduced fire-retardant foam and water to more aggressively address the fire. Some questions we would ask here include why was the sprinkler system ineffective at completely controlling the fire? Alternatively, is the sprinkler system designed to begin controlling the fire as an immediate response such that the fire brigade has time to respond? If this is the case, then did the sprinkler perform as expected and designed?

The transformer moat is designed to catch fluids and was unable to contain the fluid and the foam. When a containment is unable to hold the amount of fluid that is introduced, this means that either there is a leak in the containment or the amount of fluid introduced is greater than the capacity of the containment. We want to investigate the integrity of the containment and if there are any leak paths that would have allowed fluids to escape the moat. We also want to understand the volume of fluid that was introduced. The moat is capable of holding up to 89,000 gallons of fluid. A transformer contains approximately 24,000 gallons of dielectric fluid. What we don’t know is how much fire-retardant foam was introduced. If this value plus the amount of transformer fluid is greater than the capacity of the moat, then the fluid will overflow and can access the river. If this is the case, we also would want to understand if the moat capacity is sufficient, should it be larger? Also, is the moat designed such that an overflow will result in accessing the discharge canal and is this desired?

Finally, dielectric fluid accessed the river because the fluid was released from the transformer. Questions we would ask here are: Why was the fluid released and why does a transformer contain dielectric fluid? Dielectric fluid is used to cool the transformers. Other cooling methods, such as fans are also in place. The causes of the fluid release and transformer failure is still being investigated, but in addition to determining these causes, we would also ask how are the transformers monitored and maintained? The Wall Street Journal provided a statement from Jerry Nappi, a spokesman for Entergy. Nappi said both of unit 3’s transformers passed extensive electrical inspections in March. Transformers at Indian Point get these intensive inspections every two years. Aspects of the devices also are inspected daily.

Finally, we want to understand why was there a transformer fire. The transformer fire occurred because there was some heat source (ignition source), fuel, and oxygen. We want to investigate what was the heat source – was there a spark, a short in the wiring, a static electricity build up? Also, where did the fuel come from and is it expected to be there? The dielectric fluid is flammable, but are there other fuel sources that exist?

Step 3. Select the Best Solutions (Reduce the Risk)

What can be done? With the investigation ongoing, a lot of facts still need to be gathered to complete the analysis. Once that information is gathered, we want to consider what is possible to reduce the risk of having this type of event occur in the future. We would want to evaluate what can be done to address the transformer, implementing solutions to better maintain, monitor, and/or operate it. Focusing on solutions that will minimize the risk of failure and fire. However, if a failure does occur, we want to consider solutions so that the failure and fire does not result in a release. Further, we can consider the immediate response; do these steps adequately contain the release? Identifying specific solutions to the causes identified will provide reductions to the risk of future similar events.

Resources:

This Cause Map was built using publicly available information from the following resources.

De Avila, Joseph “New York State Calls for Tougher Inspections at Indian Point” http://www.wsj.com/articles/nuclear-regulatory-commission-opens-probe-at-indian-point-1432054561 Published 5/20/2015. Accessed 5/20/2015

“Entergy’s Response to the Transformer Failure at Indian Point Energy Center” http://www.safesecurevital.com/transformer_update/ Accessed 5/19/2015

“Entergy Plans Maintenance Shutdown of Indian Point Unit 3” http://www.safesecurevital.com/entergy-plans-maintenance-shutdown-of-indian-point-unit-3/ Published 5/7/2015. Accessed 5/19/2015

“Indian Point Unit 3 Safely Shutdown Following Failure of Transformer” http://www.safesecurevital.com/indian-point-unit-3-safely-shutdown-following-failure-of-transformer/ Published 5/9/2015. Accessed 5/19/2015

“Entergy Leading Response to Monitor and Mitigate Potential Impacts to Hudson River Following Transformer Failure at Indian Point Energy Center” http://www.safesecurevital.com/entergy-leading-response-to-monitor-and-mitigate-potential-impacts-to-hudson-river-following-transformer-failure-at-indian-point-energy-center/ Published 5/13/2015. Accessed 5/19/2015

“Entergy Continues Investigation of Failed Transformer, Spilled Dielectric Fluid at Indian Point Energy Center” http://www.safesecurevital.com/entergy-continues-investigation-of-failed-transformer-spilled-dielectric-fluid-at-indian-point-energy-center/ Published 5/15/2015. Accessed 5/19/2015

McGeehan, Patrick “Fire Prompts Renewed Calls to Close the Indian Point Nuclear Plant” http://www.nytimes.com/2015/05/13/nyregion/fire-prompts-renewed-calls-to-close-the-indian-point-nuclear-plant.html?_r=0 Published 5/12/2015. Accessed 5/19/2015

Screnci, Diane. “Indian Point Transformer Fire” http://public-blog.nrc-gateway.gov/2015/05/12/indian-point-transformer-fire/comment-page-2/#comment-1568543 Accessed 5/19/2015

Root Cause Analysis - Incident Investigation

Distraction Related Accidents: Eyes on Road, Hands on Wheel, AND Mind on Task

By  Sarah Wrenn

Admit it – you’ve checked your phone while driving.  We’ve likely all been guilty of it at some point.  And despite knowing that we’re not supposed to do it – it’s against the law in most states and we understand that the distraction increases our risk of having an accident – we still do it.  Why?

On March 31, 2015, the National Transportation Safety Board (NTSB) held its first roundtable discussion on distractions within the transportation industry.  In 2015, the NTSB added “Disconnect from Deadly Distractions” to its “Most Wanted List of Transportation Safety Improvements for 2015.”  This list represents the NTSB’s priorities to increase awareness and support for key issues related to transportation safety.  Other critical topics include “Make Mass Transit Safer” and “Require Medical Fitness for Duty.”

Representatives from all modes of transportation, technology, law enforcement, insurance, researchers, advocates, and educators came together for discussion related to distractions facing vehicle operators.

“New technologies are connecting us as never before – to information, to entertainment, and to each other,” said NTSB Member Robert Sumwalt. “But when those technologies compete for our attention while we’re behind the wheel of a car or at the controls of other vehicles, the results can be deadly.”

Digging into the causes

So let’s take a look at some of the causes related to an accident where the operator is distracted.  In addition to the accident occurring because of the distraction, the level of driver expertise is also a factor.  A large effort has been made to raise awareness and provide education to teenage drivers.  This is in part because, as novice drivers, they have a more limited exposure to driving situations and may not have the ability to react as a more skilled driver.

Operators become distracted

We also want to understand the causes that led to the operator being distracted.  There is a distraction type (or mode) that was introduced, the duration of the distraction, and the individual’s inability to ignore the distraction that result in the operator distraction.  While the type of distraction plays a large role in taking the operator’s eyes off the road, hands off the wheel or mind off the task, the duration of the distraction also is a key factor.  For example, while one’s eyes remain on the road during a phone call, the duration of that call disengages the brain from the task for more time than the act of dialing the phone.  This is not to say that one of these actions is more or less impactful; it is important to note that they both play a role in distracting the individual.

It’s not just the text that is distracting

There are three primary forms of distractions – Visual (taking eyes off of the road), Manual (taking hands off of the wheel), and Cognitive (taking mind off of the task).  Visual and manual types of distractions are very easy to define and generally recognized as risky behaviors while operating a vehicle.  Cognitive distractions are less tangible and therefore more difficult to define.  Research and studies generally define cognitive distractions as when the individual’s attention is divided between two or more tasks.  While technology and activities such as texting or talking on the phone are typically identified as the primary forms of distraction, it is interesting to note that cognitive distractions such as allowing your mind to wander while operating a vehicle can be just as risky.  The AAA Foundation released a 2013 study “Measuring Cognitive Distraction in the Automobile.”  The study rates various tasks such as using a hands-free cell phone and listening to the radio according to the amount of cognitive workload imposed upon an operator.  The study concludes that “while some tasks, like listening to the radio, are not very distracting, others – such as maintaining phone conversations and interacting with speech-to-text systems – place a high cognitive demand on drivers and degrade performance and brain activity necessary for safe driving.”

The forum discussed the concept that ability to multi-task is actually a myth, with evidence and data to conclude that for certain types of activities multi-tasking is not only difficult, but impossible.  For example, tasks such as navigation and speech require the use of the same circuits within the brain.  As such, the brain cannot do both tasks at once.  Instead, the brain is switching between these tasks, resulting in a reduction of focus on the primary task (driving) while attempting to perform a secondary task (speaking).  Therefore, attempting to multi-task introduces a cognitive distraction that increases the risk of unsafe driving.

Just ignore it

Why don’t we just ignore the temptation to become distracted?

Our brains function by releasing serotonin and dopamine when an action occurs that makes us feel good.  Dr. Paul Atchley of the University of Kansas stated: “There is nothing more interesting to the human brain than other people.  I don’t care how you design your vehicle or your roadways, if you have technologies in the vehicle that allow you to be social, your brain will not be able to ignore them.  There are only two things we love, serotonin and dopamine.  The two reward chemicals that come along with all those other things that make us feel good.  There is really nothing more rewarding to us than the opportunity to talk to someone else.”

Surveys performed by various organizations have revealed a large percentage of people (sometimes 3 out of 4) that will admit to being distracted while driving.  Meanwhile, a staggering percent (upwards of 90%) will rationalize the behavior which is a sign of addiction.

Finally, the level of brain development controls our ability to respond to distractions.  For example, a teenager has a less developed fontal cortex than an adult which means, as Dr. David Strayer of the University of Utah explains: “Teens’ frontal cortex, the parts of the brain that do decision-making in terms of multitasking, are underdeveloped.”  Much of the focus on distracted driving is focused on teens and this is justified as their brain development is not yet complete.  It is, however, important to note that this is not just an issue for teens who can’t be separated from their phones or seniors who don’t understand them; this is an issue that crosses all demographics.  Level of brain development is just one factor.

So what can we do?

At the end of the day, we want to identify solutions that are going to effectively reduce the risk of having accidents related to distractions from occurring.  While there will always be some risk, it is key to take a comprehensive approach to education, technology, and policy.  Programs like EndDD.org and stopdistractions.org are focused on bringing awareness, education, and training to youth and adults about the risks of operating vehicles while distracted.  Technology can also be used in a variety of ways to reduce the risk of these types of accidents.  Sensors can be built into vehicles to identify distractions and provide alerts to drivers or apps can be used to disable functions of technology so the receipt of calls and texts are delayed.  Finally, establishing policies and laws that are realistic and enforceable is important so that individuals are held accountable for risky behaviors before an accident occurs.  No one single solution is going to reach everyone and no one single solution is going to eliminate the risk of deadly accidents.  Each one of these solutions has limitations, but they also have advantages.  With a balanced approach to raise awareness and education, provide resources and tools to drivers, and change the culture of what is acceptable while driving, we can reduce the amount of accidents and save lives.

References:

NTSB Roundtable: Disconnect from Deadly Distractions held March 31, 2015, from 9:00 a.m. – 4:00 p.m.

AAA Foundation: Measuring Cognitive Distraction in the Automobile, June 2013

Root Cause Analysis - Incident Investigation

Chicago O’Hare Commuter Train Derailment Injures 33

By Sarah Wrenn

At 2:49 AM on March 24, 2014, a Blue Line Commuter train entered the Chicago-O’Hare International Airport Station, collided with the track bumper post, and proceeded to derail landing on an escalator and stairway.  Thirty-two passengers and the train operator were injured and transported to nearby hospitals.  Images showing the lead rail car perched on the escalator look like the train was involved in filming an action movie.

So what caused a Chicago Transit Authority (CTA) train, part of the nation’s second largest public transportation system, to derail?  We can use the Cause Mapping process to analyze this specific incident with the following three steps: 1) Define the problem, 2) Conduct the analysis and 3) Identify the best solutions.

We start by defining the problem.  In the problem outline, you’ll notice we’ve asked four questions: What is the problem? When did it happen? Where did it happen? And how did it impact the goals?

Next we’ll analyze the incident.  We start with the impacted goals and begin asking “why” questions while documenting the answers to visually lay out all the causes that contributed to the incident.  The cause and effect relationships lay out from left to right.  As can be seen in the problem outline, this incident resulted in multiple goals being impacted.

In this incident, 33 people were injured when the train they were riding derailed in the O’Hare station thereby affecting our safety goal of zero injuries.  The injuries were caused by the train derailing, so let’s dig in to why the train derailed.  Let’s first ask why the train operator was unable to stop the train.  Operator statements are crucial to understanding exactly what happened.  Here, it is important to avoid blame by asking questions about the process followed by the operator.  Interestingly, 45 seconds before the crash, the operator manually reduced the train speed.  However, at some point, the train operator dozed off.  The train operator’s schedule (working nearly 60 hours the previous week), length of shift, and time off are all possible causes of the lack of rest.  Evidence that the operator was coming off of an 18 hour break allows us to eliminate insufficient time off between shifts as a cause.  In addition, the train operator was relatively new (qualified train operator in January 2014), but also she was an “extra-board” employee meaning she substituted for other train operators who were out sick or on vacation.

Next, let’s ask why the train was unable to stop.  An automatic breaking system is installed at this station and the system activated when the train crossed the fixed trip stop.  The train was unable to stop, because there was an insufficient stopping distance for the train’s speed.  At the location of the trip stop, the train speed limit was 25 mph and the train was traveling 26 mph.  While the emergency braking system functioned correctly, the limited distance and the speed of the train did not allow the train to stop.

The train derailing impacted multiple organizational goals, but also the personal goal of the train operator who was fired.  During the investigation, we learn that the train operator failed to appear at a disciplinary hearing and had a previous safety violation in which she dozed off and overshot a station.  These details reveal themselves on the cause map by asking why questions.

The final step of the investigation is to use the cause map to identify and select the best solutions that will reduce the risk of the incident recurring.  On April 4, 2014, the CTA announced proposed changes to the train operator scheduling policy.  In addition, the CTA changed the speed limit when entering a station and moved the trip stops to increase the stopping distance.   Each of these identified solutions reduce the risk of a future incident by addressing many of the causes identified during the investigation.