By Anthony J Spurgin Independent Consultant San Diego

1. Impact of Management Decisions onAccidents: Fukushima (Daiichi Accident), Challenger and Macondo Oil Well Explosion By Anthony J Spurgin Independent Consultant San Diego IEEE Section & Reliability Meeting

2. Introduction • The presentation will discuss an important aspect in the underlying causes of accidents, namely the role of management decision-making • Here I want to consider the role of management in the process of accident initiation and progression • Accidents are often perceived as random events involving natural events or caused by the actions of humans, so called human errors • Management decisions are considered to be the greatest contribution to both accident initiation and faulty recovery IEEE Section & Reliability Meeting

3. All Organization are:Shaped by Accidents-Continued • Industry has always reacted to accidents • Changes have occurred in organizations • Organizations have changed: • Their outlooks, Mgmt. organization and functions, training/maintenance • Regulators have changed • INPO and WANO have been formed in the Nuclear Business IEEE Section & Reliability Meeting

4. Areas of Influencedby Decisions Prior to the accident During the accident Post accident - recovery IEEE Section & Reliability Meeting

5. Prior to Accident: Influential Decisions Selection of Specific Plant Design Selection and training of staff Approach to accidents, including design of procedures; normal, abnormal, emergency and post accident procedures Specifics of man-machine interfaces Failure to deeply consider possible accidents on defense capabilities of plant (not identical to why one selects a plant because of economic reasons) Consideration of impact of accidents on the capabilities of internal and external personnel to recover a plant (terminate/mitigate) IEEE Section & Reliability Meeting

6. Decisions;During Accident Formation of Response teams Prior development and test of response procedures Training of teams IEEE Section & Reliability Meeting

7. Decisions;Post-Accident recovery Availability of well trained rescue teams Understanding of how accidents can affect accident working conditions Rapid availability of support materials and tools: generators, etc Flexible emergency procedures capable of being applied to a variety circumstances IEEE Section & Reliability Meeting

8. Illustration of Findings:Selection of accidents and situations Daiichi accident, Japan Challenger Accident, NASA BP Macondo accident Sandy, N-E Coast Weather Time is short so these will not be covered Three Mile Island Accident LA rail Accident IEEE Section & Reliability Meeting

9. Fukushima, Daiichi Accident and Impact • These are my comments on the accident and are not the position of IEEE or anyone else • Clearly this accident has already had an effect on the Nuclear Industry world wide • Japan and some other countries have taken actions to shutdown or phase-out NPPs. These actions, I think, are basically unscientific, emotional and/or political inspired • Lessons to be drawn from the accident IEEE Section & Reliability Meeting

10. Fukushima Accident and Impact : Review • Some damage from the earthquake, but real damage caused by the resulting tsunami • Tepco (plant owners) completely responsible for their inaction in protecting NPPs : this resulted in the future cost of the NPPs being written-off and resulting cleanup due to core partial melts (like TMI #2) • Electrical distribution within plants shorted due to ingress of water, even if loss of diesels had not occurred, the plant personnel could not have quickly connected pumps, valves, etc. • Plant personnel had not established and practiced procedures to deal with the issue (Tepco Mgmt deficiency, see earlier item) • Plant supervisor tried to ad hoc actions to rescue the NPPs, too little too late IEEE Section & Reliability Meeting

11. Fukushima Accident and Impact , continued • Water Levels: Tsunami related IEEE Section & Reliability Meeting

12. Cross Section of a Fukushima NPP showing plant and key water levels IEEE Section & Reliability Meeting

13. Fukushima Accident and Impact , continued Plant personnel tried to deal with the situation as best they could, but even as they got things moving, but often the effects of the accident negated their actions Hydrogen releases following core damage were not dealt with effectively Resulting hydrogen led to explosions, which caused injuries, blocked paths and destroyed cables, trucks, The crews had problems with valves, poor access and bad working conditions, radiation Eventually they were able to inject both clean and sea water to cover the remains of the cores IEEE Section & Reliability Meeting

14. Direct Lessons fromthe Fukushima Accident • Failure to prevent the consequences of the Tsunami: need to re-evaluate external events and management decisions –act promptly to rectify • Diesels were placed too low vs a vs the high water level: increase height margins or add protective methods • Electrical systems, switch gear, etc. located in basement of Reactor buildings, too vulnerable to floods: need for better protection, consider all pathways! • Poor emergency planning, training and positioning of support equipment : review, update and train IEEE Section & Reliability Meeting

15. Fukushima Accident and Impact: lessons for all Need to review design bases on a regular period to ensure assessment of external and internal events has not changed and then act promptly to correct situation Be aware that "Black-out" is not just the diesels and batteries, but includes power and instrumentation distribution systems Develop emergency procedures, somewhat like the symptom-based EOPs, that take into account unknown accident conditions, that can affect the plant and ability of personnel to prevent core damage Practice these procedures and use of emergency equipment on a regular basis, more than once a year Be aware of the cost-benefit of safety upgrades relative to the costs related to the effects of core damage, loss of plant, loss of generation and long clean-up follow a core-damage accident Need for political bodies to realize that effects of radiation releases maybe significantly less than the direct effects of earthquakes and tsunamis on the public IEEE Section & Reliability Meeting

16. Macondo Well Accident: British PetroleumDecisions • BP underestimated the issues with the local management relative to taking actions not in the real interest of BP as a whole. Decisions made to save small amounts of money, but risking much more. Lack of perspective on behalf local management • BP main management failed to have a risk study to identify the consequences of a failure of the BOP valve isolation system. Superficial understanding of common cause issues led to a locally reliable system that failed to perform • Local BP management did not have an effective quality control program • Local rig members seemed to be not as well trained in safety aspects as they should be • BP analysis of the possibility of stopping the leak along with others was too optimistic leading to a failure by BP management to state the correct time to fix • US Government fixated on BP’s responsibility in the case of the leak and failed to see what their proper role was. They acted much too late and even then did not fully commit both US and other resources. In fact they seemed to act against the interests of the citizens living the Gulf regions IEEE Section & Reliability Meeting

17. Challenger Accident: Managementand Engineering Decisions • NASA top management wanted to launch the Challenger on time and did not wish to hear any engineering ‘overly conservative engineering opinions’, because of implied political pressure. • Interesting the pressure seemed to be self imposed by NASA, since no trace of a request from Reagan has been located. • NASA should have investigated the “O” ring near failures earlier. This was a failure on the part of NASA and Morton Thiokol. There are suggestions this was a failure of personnel at lower levels to forward information on the problems with the design of the “O” ring joint • NASA had a launch review procedure, the launch directors should have followed a more conservative process based upon engineering advice IEEE Section & Reliability Meeting

18. Sandy and similar storms:Comments & Decisions • Storms and floods occur on regular basis • Specific lessons have been learned and forgotten • The Dutch invented the polder system, including wind driven pumps, many years ago • In more times the British have introduced the Thames barrage system to protect London from North sea storm surges and high water IEEE Section & Reliability Meeting

19. Storms in later part of 20th Century, source: Wikipedia Season Storm Category: Peak intensity, Intensity at landfall,Date 1938New England Hurricane of 1938 Category 5 Category 3 September 21, 1938 1944 Great Atlantic Hurricane Category 4 Category 1 September 15, 1944 1952Hurricane Able Category 2 Tropical Depression September 1, 1952 1954 Hurricane Carol Category 3 Category 3 August 31, 1954 1954 Hurricane Edna Category 3 Category 1 September 11, 1954 1955 Hurricane Diane Category 3 Tropical Storm August 18–19, 1955 1959 Hurricane Cindy Category 1 Tropical Storm July 11, 1959 1960 Hurricane Donna Category 5 Category 2 September 12, 1960 1961 Hurricane Esther Category 4 Tropical Storm September 26, 1961 1966 Hurricane Alma Category 3 Extr. Storm June 13, 1966 1971 Tropical Storm Doria Tropical Storm Tropical storm August 29, 1971 1972 Hurricane Agnes Category 1 Tropical Storm June 22, 1972 1972 Tropical Storm Carrie Tropical Storm Tropical Storm September 3, 1972 1973 Subtropical Storm Alfa Tropical Storm Subtropical Storm July 30, 1973 1976 Hurricane Belle Category 3 Tropical Storm August 10, 1976 1985 Tropical Storm Henri Tropical Storm Tropical Depression September 23, 1985 1985 Hurricane Gloria Category 4 Category 1 September 27, 1985 1988 Tropical Storm Chris Tropical Storm Tropical Depression August 29, 1988 1991 Hurricane Bob Category 3 Category 2 August 19, 1991 1996 Hurricane Bertha Category 3 Tropical Storm July 13, 1996 1999 Hurricane Floyd Category 4 Tropical Storm September 16–17, 1999 IEEE Section & Reliability Meeting

20. Storms in North-East Mostly in Fall 21 over 91 years (20% probability) Ranged from Tropical depression to category 5 storm Affected N-E areas from New Jersey to Maine Caused flooding to wind caused destruction Predicable Not due to Global weather change (not a new phenomena) IEEE Section & Reliability Meeting

21. Sandy: Observations and Comments related to Organizational Deficiencies Failure to learn from past storms and equivalent accidents Failure of to understand limitations of emergency electric power for hospitals, see Daiichi accident (need to protect power supplies from flooding) Inadequate establishment and training of teams Need to develop and test of response procedures Inadequate availability of supplies to support civilians and rescuers Failure to foresee limitations of water barriers and consequences for citizens, either build defenses or limit areas to building near coast IEEE Section & Reliability Meeting

22. Recommendations for decision-makers • Failure to prevent the consequences of the weather induced effects: need to re-evaluate external events and management decisions –act promptly to rectify • Emergency power systems were placed too low vs a vs the high water level: increase height margins or add protective methods • Electrical systems, switch gear, etc. located in basement of buildings, too vulnerable to floods: need for better protection, consider all pathways! • Poor emergency planning, training and positioning of support equipment : review, update and train • Consider possible design solutions from other places, time and people, consider barriers and other solutions: review options and make better decisions • Top managers often lack basic skills and training: Acquire better training and/or rely on your support team • Support team: Have more faith in your advice IEEE Section & Reliability Meeting