All the Cheese Fails – Causal Factors from Three-Mile Island

The Nuclear Safety Analysis Center, in its 1980 publication Analysis of Three Mile Island – Unit 2 Accident, described a chain of causal factors. From the Foreword:

“Systems are designed and operated to be accommodating or fail-safe to a considerable number of lapses and equipment malfunctions or failures. For example, about 20 factors contributed to the damaging results at Three Mile Island. If any one of these factors had been different–in a way which is common in other plants–there would have been no core damage, and no release of radioactivity.”

From the technical summary provided in that same report, we can identify seven Causal Factors. There are MANY more. Here is a simple version of the Three Mile Island Causal Factors and Safeguards SnapCharT®.

To have a reactor meltdown, every safeguard – against a reactor meltdown – failed or was absent. Blaming the last person to use it misses the history of precursors, removed barriers, known deficiencies, and failed safeguards.

Do you think it credible that even these seven causal factors failed for the first time that day?

• Leaking water past a check valve into service air
• Feed pump block valve was shut well before the incident and not returned to open.
• Causes of the Pressure relief valve (PRV) binding in the open position existed way before that day.
• Operators thinking PRV was shut was a pure human factors + system design issue.
• You get the picture.

All root causes for these Causal Factors, were uncorrected by previous Category 3 and 2 investigations, leading to the “impossible” Reactor Meltdown. The last of three Missed Opportunities HERE:

“A plant upset occurs due to corrective maintenance. A relief lifts but fails to shut when pressure decreases. Operators, initially preoccupied with other alarms, misdiagnose the problem and shut off critical safety equipment. The “impossible” accident – a core meltdown – happens at Three Mile Island. The investigation uncovers similar precursor incidents and a history of relief valve failures at TMI and other similar nuclear plants. But the incidents didn’t get a thorough root cause analysis and adequate corrective actions.”

Here is the Nuclear Incident Iceberg effect:

Individual Causal Factors are Category 4

Read more about misconceptions in the nuclear accident iceberg:

Causal Factors that affect the safeguard diagram for high-energy hazards merit their own full root cause analysis investigations, not a passing glance.

Causal Factors here are human mistakes, errors, and equipment failures that directly lead to the incident or make the outcome worse.

For the rest of us Safeguard Analysis is a fantastic tool to start and bound the scope of your SnapCharT®:

• What happened (or what do we want to prevent)
• What must fail that would allow it to happen?

This quick safeguard analysis gives us a framework to tackle latent problems, the Category 4 issues. Remember from above that “about 20 factors contributed to the damaging results at Three Mile Island. If any one of these factors had been different…there would have been no core damage…”

Let’s not calculate probabilities after the design phase, let’s make sure those assumptions stay valid. Precursor ATTITUDES to category 1 incidents include

• “Nobody would be so stupid as to…”
• “That’s not a credible scenario.”
• “We would never see all those at once.”
• “It’s never been an issue before.”

“I would say in ALL cases that machine failures occur due to a succession of oversights. Every single one. You have to pay attention to the details! You have to remove the vulnerability increase due to each detail, because you don’t know which one will come back to haunt you.”

Heinz P. Bloch

Luckily, it doesn’t take 30 years and hundreds of investigations to know what to look for, and how to quickly, systematically investigate. Two keystone courses to handle any level of incident:

3-Day VIRTUAL Equifactor® Equipment Troubleshooting and Root Cause Analysis course

5-Day TapRooT® Advanced Root Cause Analysis Team Leader course

We teach not just how to prove root causes, but what to do about them, and present in a way that gets them done. Your organization doesn’t suffer from a lack of intelligence, but you do need a standardized framework for problem-solving.