Cause of accident: temperature indicator
This was a partial meltdown of a nuclear reactor on 28 March 1979.
It involved a relatively minor malfunction in the secondary cooling circuit, which caused the temperature in the primary coolant to rise. This in turn caused the reactor to shut down automatically. A relief valve then failed to close, but instrumentation did not reveal the fact. The primary coolant was vented to an extent that the heat in the reactor core was not removed.
The operators were unable to diagnose or respond properly to the unplanned automatic shutdown of the reactor. Deficient control room instrumentation and inadequate emergency response training proved to be root causes of the accident.
There were several control panel interface problems that resulted in the correct action not being taken. The first was not strictly ergonomic; the light that was supposed to indicate the position of the faulty valve did not actually show the valve’s status: it indicated the power to the solenoid for the valve.
Operators were used to the light indicating the valve’s status and assumed that the valve was closed. No remedial action was taken until the new shift recognised the problem. Until then, coolant water had continued to vent.
The next problem was a temperature indicator that, if consulted, would have shown that the valve was still open. It was at the back of the desk, effectively out of sight, and was not consulted. The fact that the operators were not trained on its use was a factor.
Because there was no core water level indicator, the operators judged its water level solely on the pressuriser water level. But as the cooling water flow decreased, temperatures increased. As a result, steam pockets replaced the coolant in the pressuriser; the pressuriser water level indicators showed rising levels, but the measurement it was partially due to steam. As this level indicator was high, they assumed the core was safely covered.
Because the water indicators for the pressuriser showed its level to be increasing, the operators reduced the flow of cooling water to avoid overfilling. Hence the runaway situation and the resultant partial meltdown.
So, in summary, the instrumentation did not represent the true situation and operators had had no training on its use.
Disaster 3: Kegworth air crash, 1989
