2) Criticism of the official version
A) The list of technical problems or human
was therefore an accumulation of problems 20 technical or human.
1) The water system is connected to the air stream, which causes the water enters the air stream, closes the valves connecting the demineralisers the secondary circuit and thus leads to the pumps stop the secondary circuit.
2) The fact that blockade of the secondary circuit due to valves demineralisers had been expected, and a system to prevent their closure installed, but had never been connected.
3) the fact that the inlet valves of the emergency circuit secondary have remained closed due to a 42h before testing. While procedure indicates that they must be immediately reopened.
4) An indicator indicating the closure of these valves is covered with a label maintenance, preventing operators realize the closure.
5) The fact that operators are not able to see that the indicator opening / closing the valves is hidden by a label maintenance.
6) Operators who do not see the indicator on the second valve, which is not hidden by a label. And this, for 42h!
7) The presence of the two previous problems when one of the first things to check in the check-list of operators in the control room is the flow of emergency circuit through the indicators in question.
8) The design of the ill-conceived pass circuit in the secondary circuit, which makes the vacuum pump stops almost immediately, so that the water must come out directly into the atmosphere.
9) the discharge valve of the primary circuit which remains open when it should have been close.
10) Deactivation by the operators of automatic water injection in the primary circuit. So that water loss due to the discharge valve remained open was not could be compensated.
11) the indicator on the valve that indicates that the fact that the closure order was given, but not if the valve is open or closed (and therefore if the closure order was executed with success). This time it is known that the discharge valve has an average of only 40 successes before knowing failure of closure.
12) indicator of water level in the primary circuit which in some cases, still probably quite common, do not give the right pressure, so called because of a phenomenon that would make the water via complex movements with steam, deceive indicator, thus believing that the water level is correct (or even at maximum) while this is not the case. It is true that we thought was enough, because the valve was supposed to open only rarely (the same valve on Unit 1 at Three Mile Island had never been open, except during tests) . But we also knew that the defect in the design of the condenser unit 2 training she opened at each stop of the turbine generator.
13) The fact that when the reservoir from which water flowed from the primary circuit through the valve quickly regained full, the operators have ignored for 3 hours the alarm was triggered.
14) The fact that an operator reads the wrong indicator when asked to give the temperature at the outlet of the valve of the primary circuit. Whereas if he had read the right indicator, the high temperature display would have shown that the valve was not closed.
15) The fact that operators have also ignored the fact that for 3 hours than normal temperatures have also been detected in the pipe connected to the wastegate.
16) The fact that operators have ignored the indication for 3 h a higher temperature and pressure in the containment building. This clearly indicated that there was a problem.
17) The fact that operators have not seen for at least 2 hours that the auxiliary building tanks receiving radioactive water from the containment building were filled.
18) The fact that the alarms did not sound the radioactivity when the tank was punctured and containment of radioactive water that spilled into the containment building. And also the fact that, oddly, they have worked 3 hours later (which means it worked). Or, (Since the fact that the alarms had not sounded that is defended in a document), the fact that the alarms are triggered, but the operators do not realize it are, and this for more than 3h .
19) The fact that Frederick had consulted indicator of water level in the containment tank too late, ie after the safety disc of it had been broken and the tank is emptied. So that the indicator had returned to normal levels.
20) The fact that operators are realizing that pumps the coolant began to vibrate strongly, they cut pumps in question, but they do not understand that it means they are pumping more steam than water and that it therefore means that there is enough water in the primary circuit.
B) Analysis of technical issues and those related to operators
All these problems, it is a lot. It is very huge. It's been too much for the theory of the accident is credible. Especially since they are not small problems or logical problems, no, these are huge problems and unbelievable.
What is the probability that 20 such incredible things happen on the same day in a place as controlled a plant? 1 in 100 million? No, the only possible reason for such an accumulation of events, it is a sabotage.
- The initial problem of demineralisers
What happened at that time was already very suspicious.
, plugging a water circuit to the second pneumatic system already indicates a clear intent to sabotage, especially just before a maintenance operation on demineralisers. The explanation that someone might have wanted to pressurize the water system or connect together the two systems by a pneumatic connection error seems completely farfetched. And then nobody would take responsibility of such a thing without consulting a manager. It is strictly impossible for a single operator is fun to do this without orders from a superior. And if a manager had given such an order, the operator having executed would not embarrassed to speak at the inquiry. So in reality, there is no convincing explanation for this act out of a desire to sabotage.
The fact that operators do not see that there was a pipe connecting the water circuit system Pneumatic control valves is very fishy. We are told that it was dark there. As if working in the dark, as if there was not enough light for them to see this problem of unauthorized connection. And even if that were the case, one can imagine that they would have then brought flashlights.
It also wonders why all this has not happened earlier, when the pipe was connected. The person (assuming it was done without intent to sabotage) that connected the two systems had to do it for immediate use of the craft. In this case, it would trigger the the disaster at that time. Maybe he was more open another valve to the water swept into the air instrument system. So we can not actually be sure it would have necessarily occur earlier. But there is still a big doubt on this point.
Moreover, regarding the survey conducted after the "accident", it says that the NRC has issued this hypothesis on the cause of the blockage of valves demineralisers. Only when performing an experiment to test the hypothesis, they were unable to obtain the expected result. So, the connection water system to the pneumatic system can not close the valves controlled by it. So the official explanation on the valves that are blocked due to water pressure which would be introduced into the pneumatic system fails.
So it is quite possible that the connection between the two circuits have been realized after the fact and in reality what has caused the closure of the valves would be a voluntary order of the operators or, alternatively, on a sabotage element of the pneumatic circuit, again, by operators.
Moreover, the history of the closure of valves demineralisers tends to be simplified in what we read in most descriptions. In fact, only the first demineraliser that was blocked. The valves of the other 8 demineralisers should have stayed open and the flow of water would therefore continue to pass. But they are closed almost at the same time as the first demineraliser. The official explanation is a mysterious connection error that would have resulted in other demineralisers should close when the first did. It would have yet another connection error. It's starting to do a lot. And then, again, we imagine such a thing can not be done without the consent of the person responsible. And one might think that the performer was then given the name of the officer responsible for the error. So one can imagine that in fact the connection error, it was actually quite voluntary.
It also says it has found that a compressed air pipe of one of demineralisers was broken. Investigators said the air could not flow into the demineraliser because of an automatic valve would close automatically. Only one operator has subsequently testified to having heard the air leaking into the demineraliser at the time of the accident. One hypothesis put forward by an operator is that it's a hammer that broke the pipeline in question. But the NRC investigators have subsequently found that the hammer was not as important as the operator had said. Therefore, since according to investigators, it could not be a natural cause that had caused the breaking of the air duct, one can again think of sabotage.
http://www.tmia.com/old-website/tmisab.html
Then a little later, there is the problem of relief valves in the circuit closed and not reopened following an intervention before 42h. While the procedure specifically states that they should be reopened. An "error" more human.
In addition, other error, the operators do not notice the light indicating that the valves remain closed, for one, because a service label conceals the lamp and the second simply because they notice it. You can of course ask questions about why the presence of the label maintenance. But it is mainly the fact that the light was not hidden was not noticed for 42 hours which is extremely suspicious (that they were not tilted on the presence maintenance of the label is suspicious too, but to a lesser extent). For 42h, the operators of the control room have a light that lights up when it never is, they know what match this light, yet they do not notice it. And at that moment, we can not rely on the fact that they were overwhelmed by alarms. So it's very very suspicious.
But it was there all these problems if we wanted that the accident happened. If the water system was not connected to the compressed air system controlling the valves of the first demineraliser, no reason why it hangs. If the compressed air system of the second demineraliser did not have a connection error, no reason any more than it freezes, and suddenly, no blocking of the secondary circuit. And if the relief valves of the circuit had been opened, the secondary circuit was supplied with water after a few seconds of blocking, and then no problem of temperature rise in the secondary circuit, and therefore not in the circuit primary. Similarly, it was the alarms yet clearly indicating that the valves were closed are ignored by the operators for over 42 hours. Otherwise, if they had reacted immediately, even problem: the secondary circuit and the primary circuit would have had no problem of temperature rise. So no opening of the discharge valve in the primary circuit and not melt the heart.
the way, having solved the problem of locked gates of the secondary circuit is nothing extraordinary. Insofar as it must certainly be an indicator of heat in the secondary circuit, they quickly saw that the secondary circuit does not cooled. So it would necessarily mean that the valves remained closed. I say this because it gives us the impression that there had been full of events that were happening, everything had to be super complicated and therefore, operators have to react very intelligent. No, it was completely basic.
- The problem of measurement of water level during the first 10 or 15 minutes
Part of the "accident" on the primary circuit will still show the best of sabotage.
Already, the explanations for disabling the automatic injection of water are flimsy. The history of water level indicator that does it more correctly when the discharge valve is opened makes absolutely no sense.
Already if the movements of water and steam were complex as can be read in the reports of the accident, they were also unstable. So the operator in charge of analyzing the pressure ought to have seen continual variations in water level.
the same kind of idea, it seems we are told that the pressure increased gradually. If the level meter of water was disrupted by the movement of water out of the situation leading to continual variations in pressure, possibly, there could have been one (very unlikely, but hey, suppose) where the indicator was pushed its maximum at all times. But then the pressure would not have risen steadily, but it would have been more than once. But apart from these two situations (change, or put the indicator at all), it is unclear how the complex movements of water, so erratic, could lead to a gradual increase in water level.
And then, once that water injection has been disabled, it is unclear what happened to the water level indicator. Is that the problem was solved? In principle, yes, since it seems people say that the water pressure dropped. And later, when water injection was reactivated, it does not seem to speak again of this problem. So why would he just had a malfunction at the beginning? Mystery. If it's because there was more water in the pressurizer (ie, at the very beginning of the problem, well before there was mostly steam in the primary circuit), then that would mean that happen mostly in situations somewhat removed from normal. So it should come almost every time he is opening the valve for 5 or 6 minutes. If the valve opens, because the heat and so the pressure become too important in the primary circuit. So there are chances that Then there is training movement of steam or water complex in the pressurizer. And if it was common long ago that it would be seen operators.
If it was not known and solved, it is simply that such movements do not exist. It is a pure ad hoc invention to explain that operators have not responded. If it were known, the designers of the plant would put other types of detectors to prevent the problem is not detected.
And also, the designers of the flag of the pressurizer water level it would clearly be seen during tests on the indicator.
We are told that when the safety injection was cut after a few minutes, an indication of water level has fallen. It indicated that the pressure decreased. So that means that the water level indicator worked properly again. The gradual decrease in pressure makes it clear that there was a loss of fluid. So at that point, the traders would immediately understand that the valve was left open.
Moreover, it would be a good indicator of pressure. There he was an analyzer water level apparently. So if there was also pressure analyzer (not because of malfunction, him), there would have been a second indicator that contradicts the first.
- The valve can be closed only 40 times
Then, the story of valve that can be closed successfully, 40 times before they know a failure of closure is also highly suspect.
Imagine badly for something as critical in an environment where security issues are crucial, we could have a material that is so unreliable. It is said that this valve was supposed to work only very rarely. But even very rarely seen the absolutely crucial role of this valve, there should have been out of the question if it has a low reliability. Moreover, it is unclear what would be a problem for the closure of a single valve.
It is said that the problem was that it was never designed to be a problem at the opening, but in return, she frequently posed problems for the closure. But in this case, the double valve with another valve downstream, which she did not have these problems closing.
And if the second valve is suspected of having problems at the opening, then made a second discharge circuit. That way, no danger that the pressure can not be evacuated, and no danger either that the liquid can escape from the primary circuit due to a failure of the valve closing.
In any case, if the valve is left with no duplicates, then it is sure to have indicators that provide precisely the situation of the valve, with redundant sensors of course.
The fact that the valve indicator reports only that the stop order was given, but there is no indicator showing the exact position of the valve (open or closed) is So incredible. Why make an alarm that only serves to say that the order has been given, then we know that the valve is lousy and can not serve as forty times? Hello something fishy.
Especially it seems clear that the problem does not come from too rapid wear of the mechanism of the valve, but it's a random problem. So, a change valve, or maintenance thereof had no effect on the number of cycles before the first failure of closure. The issue should arrive early or late in a power plant. The presence of indicators to report its actual condition was all the more necessary.
The most plausible version is that the valve had a running time with success far beyond what we're told. This story would be an explanation ad hoc to make us accept the fact that the valve broke down just at that time. It is on with all other failures and "errors" of operators, if the problem of the valve was considered exceptional, the idea of sabotage could have come to the minds of people. It could be the straw that broke the camel's back. In fact, the valve was functioning perfectly, but it had to be sabotaged (or is the software controlling its closure has been tampered with).
- Operators does not include more than 3 hours during the valve remained open
The fact that for two hours, operators do not realize that the valve remained open is totally unbelievable. This is clearly the most incredible of all, that clearly indicates the willingness of sabotage.
There are too many elements that showed that the valve remained open so that operators were unable to understand that she was.
Already, the fact the most obvious is that the temperature continued to rise more in the primary circuit of water while the pressure decreased. If the pressure decreased and the temperature increased, it is inevitably that either the system (and therefore the valve) was not closed and there was loss of liquid or the temperature gauge was out of adjustment.
The first hypothesis was to remember that there was no error indicator. In this case, the fact that the pressure decreases as the temperature increase shows unambiguously that the system was not closed. In a closed system, variations of these two measures are the same meaning. If it goes in the opposite direction is that the system is not closed. And if it was not closed, it was obviously that the valve had not closed. And given the low reliability of the valve, we do not see what operators could find surprising. There could be a leak elsewhere of course, a breach in the primary circuit. But the thing to check first, it was clearly the relief valve.
If the valve was closed and the temperature gauge was deregulated, it means that there was no danger in delay and in fact everything was normal. Since the secondary circuit was again in water, it was clear that the primary circuit was cooled without problem. So it was on the potential problem of the lack of closure of the valve need to concentrate efforts analysis.
In fact, he could not even be simply error on the temperature gauge, since the pressure fell too, and quickly found very low. If there had been an error on the temperature (so it actually fell), and the valve was actually closed, then the pressure would decrease the course, but only slightly. She would not have fallen so sharply. So, if the valve was closed, it means that the two indicators were false, temperature, and pressure. Given that the probability that both indicators are failing was very low, it meant so clearly that it was good the second solution: the valve was open, and therefore the coolant was leaking, which lowered the increasing pressure and temperature.
So everything had to run the analysis primarily to the state of the discharge valve, and only then, possibly, the temperature gauge.
Once this is established, it is clear that in addition to check all indicators that can reveal that the valve remained open, he immediately had to test the reaction of the primary circuit by closing the valve located behind the discharge valve. If the temperature had risen more slowly, or had stabilized, had begun to show off, and if the pressure had begun to rise, he was immediately clear that the valve was indeed the problem. The fact that the operators have not performed this operation is also highly suspicious.
So having ignored the 4 or 5 indicators exponent obvious that the relief valve was open already shows a clear sabotage. These indicators were sufficient in themselves so that there is no doubt about the origin of the problem (the valve). But increasingly, as it was already perfectly clear logical point of view that there was loss of fluid in the primary circuit, having ignored these indicators shows unambiguously that there was sabotage on the part of operators. When we know that there are only two possible reasons for a phenomenon, and that systematically ignores the indicators pointing clearly one of these two reasons, and besides, it is almost impossible that this is the other reason (seen here, the secondary circuit was in water) is that there will sabotage . Especially when this blindness lasts two hours.
elements to realize that the relief valve was left open are: 1) The fact that when the reservoir from which water flowed through the primary circuit the valve was quickly regained full, the operators have ignored for three hours the alarm was triggered. 2) The fact that an operator read the wrong indicator when asked to give the temperature at the outlet of the valve of the primary circuit. 3) The fact that operators have also ignored the fact that for 3 h temperature above normal was also detected in the pipe connected to the valve discharge. 4) The fact that operators have ignored for 3 h indicating a higher temperature and pressure in the containment building. This clearly indicated that there was a problem. 5) The fact that Frederick had consulted indicator of water level in the containment tank too late, ie after the disc Security of it had been broken and the tank is empty. So that the indicator had returned to normal levels.
On problems 1, 3 and 4, well that's what. For 3 hours, the operators had these indicators under the eyes. As we have seen, they necessarily knew that the most likely cause of the problem encountered was that the valve was left open. These indicators on their side necessarily implied that the relief valve was open. And for 3 hours, they did nothing. Such a thing is absolutely impossible without intent to sabotage. We can not ignore systematically for 3 hours of indicators we have under our eyes without it being voluntary. Especially when it is many. Already, with a single person, it's completely unbelievable, then, with several people, it's impossible.
Moreover, one can think that there should be indicators not identified in the various articles on "accident" that should reveal the problem of the valve. For example, there should be other tools to know the pressure in the primary circuit. In an area as sensitive, there is obviously redundant measuring instruments, so that if one fails, two or three others can be consulted to see what happens. We are told once completed, the containment tank is then poured into the containment. Again, there should be a detector which would indicate the thing. And there must have detectors of radioactivity in the containment. Therefore, the presence of radioactive water would be immediately detected also from that angle.
The fact that the technician to give the temperature at the outlet of the valve of the primary circuit is wrong Zewe indicator (bp 2) and read the temperature output of another valve is a little drop of water the last straw. After a number of "errors" Human (system connection compressed air and water, poor connection on the second demineraliser not check the valve opening, maintenance label on one indicator, but ignored other visible indicator, indicators systematically ignored for 3 hours, etc ...) can no longer speak of clumsiness or error, we can only speak of betrayal. But it is on that if you had said that Zewe had not thought of that, it would have seemed too suspicious. So they said he had thought, but there was an error reading.
Regarding the fact that the supervisor has watched indicator of filling the tank containment too late (bp 5), we must see the timing of the thing. At the 8th minute, the problem was solved for the secondary circuit. Therefore, operators could concentrate on the primary circuit. They had already seen that there was a problem with it. So, finally having time, they would have to focus on this problem (which is still the largest component of the plant). So, given that between the 8th minute and 15th, there was an indicator showing that the containment reservoir was filled, they would have to notice it (think there was an alarm signal). They had 7 minutes to notice it. Then, when the tank was full, there is an alarm that sounds for 3h. For 3 h, the operators could not but realize that. When the disc from the containment tank broke and water flowed out of the reservoir, a measuring instrument for 3 h indicated that the heat and pressure were above normal. The operators could not move next to it.
Furthermore, one might think they should know exactly the amount of fluid lost by the primary circuit. It must necessarily be an indicator of filling the tank. So just a simple subtraction to find out how much water was lost by the primary circuit and how many had been injected by the injection safety. We know then how much water remains in the primary circuit (and depending on the temperature, what must be the pressure). So why, initially, to stop the transfer of water because of the pressure then you should know that in fact the primary circuit has already lost a lot of water and can not be pressure situation?
Another problem is that the vibration of pumps also indicated that the primary circuit had more water and therefore that the valve remained open. If Zewe saw that the pumps were shaking, it would necessarily do what the reasoning. But no, Zewe does not understand.
is strange that there was not an alarm set for the disc to break security (apparently so, since we do not talk about in any reports) . Because of this rupture disk must still be a major problem for a plant. And once the visual alarm begins to tilt, it should not stop. So we shall see sooner or later.
Another thing, in "the nuclear accident at TMI day 1 (part 4), it is said that in fact, radioactive water flowing from the primary building to building auxiliary pumps through drains was stored in a tank in the auxiliary building. So, the water was not reflected directly in the auxiliary building. And suddenly, it means that here too, there should be indicators of filling, pressure gauges, etc. ... So, the filling of reservoirs in the auxiliary building would be seen by the operators.
As already mentioned, regarding the timing or the first alarm to radioactivity began to ring, the sources are contradictory. According to versions, it was dispatched to the 15th minute of the accident ("Engineering.com") or so it has not rung to moment by failure of the alarm ("TMI step by step") or the operators have realized that water was radioactive in the 45th minute (Everything). Moreover, it is said that only T = 2:45, the alarm goes off to radioactivity (English version of wikipedia). Finally, according to the French version of Wikipedia, is that at T = 3:12 the alarm goes off to radioactivity. Engineering.com contradicts himself apparently himself, it is said that the alarm sounds when the radioactivity at the time Porter arrived in the control room (so to 6am, either at T = 2h). 5 sources that contradict all, more a contradiction in a source, that's a lot.
In any case, it was an incredible malfunction or human error by more incredible. If the alarm went off at T = 15 minutes, as it would make sense, it means that very early during the "accident", the operators had a very important addition to understanding what was going on and the valve that again they have not understood for about 1h45. Even with an alarm is triggered in the 45th minute, it is still 1:15 to flat encephalogram. And if the alarms had been triggered around 2:45 or 3:12, it means that there was dysfunction of the alarm before it (and even more alarms as quickly, the water was pumped into the drains that had apparently sensors radioactivity), which is equally amazing (and especially then, the alarm would work).
We are told that T = 2 hours (6am), the engineer in the morning, Ivan Porter, sees that the primary circuit pressure is low. So the pressure indicator showed the correct pressure well for a while if the engineer could see that the pressure was low. Therefore, operators of the control room should have been noticing long. He also notes that the temperature in the containment tank is very high. So, there was also a temperature sensor in the tank containment, in addition to a water level sensor. Therefore, also, the operators should have realized that the primary circuit water was being discharged into the containment tank.
Towards the end of the crisis between T = T = 3:12 2:22 ET, we do not understand why the operators have closed the valve downstream of the valve of the pressurizer (to stop the evacuation of water then), and have given a pump, all without getting water again. If they have closed the valve, that they had to realize that the valve was still open. And from there, they were bound to realize that she had remained open for over 2 hours. So they knew that the primary circuit was heavily drained. They would therefore introduce the cooling water and more. Obviously, we understand much better if it were traitors.
One wonders also how they calculated the amount of water back into the primary circuit. Because if the pressure indicator is crappy and joking when there are cavitation, Well it is completely unreliable. However, since we apparently relies solely on him to determine the amount of water in the heart, it is unclear how one could know how much there is still water in the heart, and therefore, how much water must be reset so that it is again fully submerged. But by chance, at this point, the indicator does more messing.
- Operators supposedly overwhelmed by alarms
To explain the fact that operators did not understand what was going on for over 3 hours, we are told that the operators were overwhelmed by the indicators. C'mon.
They say that the alarms were lit everywhere. But anyway, what matters are the indicators, not alarms. And until further notice, the indicators, they were not gone mad (besides the problem of the indicator valve, which was only 1 indicator wrong. And yet, the problem was inherent in the design of the instrument). So, it was enough that they analyze the indicators. And once solved the problem of the secondary circuit, there was not 36 things changed in the plant. There were only the primary circuit temperature increased and the pressure dropped. None of this should be surprising for an operator. In when radioactive water spilled in the containment tank and the containment building and finally, in the auxiliary building of the reservoir, well exactly, that would make clear the origin of the problem (the fact that the valve remained open).
Anyway, they are supposed to be trained for this kind of situation. We must train them not to let panic alarms and by not watching the indicators. And as we have seen, there were many indicators that allow to understand the situation. Especially because, come earlier, the events have not gone in 10 minutes, which would actually justify the operators have been flooded with alarms, but in 3:20, leaving plenty of time to understand the situation, especially with all the engineers present.
And like all control rods were lowered, and the secondary circuit was again in water, operators in the control room had almost no problem. They could take their time, since the heart is still retained (before cooling completely), a few megawatts of heat. And the fact that everything has happened so slowly shows. So even if there were actually indicators that were flashing everywhere, operators no longer reason to stress completely. They could analyze the relatively quietly.
And we are told that the operators were flooded with alarms, but obviously, as it happens, we are not told why. If that were the case, they would have said what alarms flashed and how it made them cautious in what it was they did not understand what was happening. They would have said what the alarms that have attracted their attention at a given moment, and why it attracted their attention. Moreover, in such circumstances, we develop hypotheses. But almost nowhere we are told assumptions developed by operators at any given time (except to the very end), what they did to verify the hypothesis in question was good, and when they realized it was bad. This is normal, in fact, they absolutely do not reflected in the assumptions, they knew very well what was happening. They waited quietly closing the valve of the primary circuit at the right time (or valve located downstream from it).
In fact, it is not sure what alarms did not see the problem that remained he could still occur. Everything was fixed in the secondary circuit. So it should no longer be any alarms that side. Most of the alarms should be focused on what the problem, namely the primary circuit. So the alarm in question were certainly useful alerts and focused on the problem of the moment. In any case, we can consider this a spate of false alarms distracting the operators of the main problem.
Most likely, it is certainly that all the alarms were not set to operate at the same time, those who sounded the alarms were significant, but they decided to ignore them because they were traitors simply.
On the evidence of the flooding of the alarms (and evidence of how the accident happened), it seems that everything is based on reports provided by the printer used to transcribe the alarms of the control room . However, according to traders, there were so many alarms that are triggered during the first moments of the warning that the printer could not keep up. More time passed, the more she fell behind. After 2 hours, operators control room had emptied the memory of the printer to print out alarms yet. Suddenly, the alarm information by chance have been lost forever. Thereby allowing operators to invent this story avalanche of alarms (and absent from triggering the alarm for certain events)-post as they wanted. Nobody could contradict them.
In any case, it means that for this story avalanche of alarms, there is no evidence. Only the good times that operators must rest.
That said, it's hard to believe that they rested on the printer to have a history of events and they could not go back in time with the computer (on the screen connected to one) to see what had happened. They have been able to verify the pressure development during the last hour and see what happened to that level.
A) The list of technical problems or human
was therefore an accumulation of problems 20 technical or human.
1) The water system is connected to the air stream, which causes the water enters the air stream, closes the valves connecting the demineralisers the secondary circuit and thus leads to the pumps stop the secondary circuit.
2) The fact that blockade of the secondary circuit due to valves demineralisers had been expected, and a system to prevent their closure installed, but had never been connected.
3) the fact that the inlet valves of the emergency circuit secondary have remained closed due to a 42h before testing. While procedure indicates that they must be immediately reopened.
4) An indicator indicating the closure of these valves is covered with a label maintenance, preventing operators realize the closure.
5) The fact that operators are not able to see that the indicator opening / closing the valves is hidden by a label maintenance.
6) Operators who do not see the indicator on the second valve, which is not hidden by a label. And this, for 42h!
7) The presence of the two previous problems when one of the first things to check in the check-list of operators in the control room is the flow of emergency circuit through the indicators in question.
8) The design of the ill-conceived pass circuit in the secondary circuit, which makes the vacuum pump stops almost immediately, so that the water must come out directly into the atmosphere.
9) the discharge valve of the primary circuit which remains open when it should have been close.
10) Deactivation by the operators of automatic water injection in the primary circuit. So that water loss due to the discharge valve remained open was not could be compensated.
11) the indicator on the valve that indicates that the fact that the closure order was given, but not if the valve is open or closed (and therefore if the closure order was executed with success). This time it is known that the discharge valve has an average of only 40 successes before knowing failure of closure.
12) indicator of water level in the primary circuit which in some cases, still probably quite common, do not give the right pressure, so called because of a phenomenon that would make the water via complex movements with steam, deceive indicator, thus believing that the water level is correct (or even at maximum) while this is not the case. It is true that we thought was enough, because the valve was supposed to open only rarely (the same valve on Unit 1 at Three Mile Island had never been open, except during tests) . But we also knew that the defect in the design of the condenser unit 2 training she opened at each stop of the turbine generator.
13) The fact that when the reservoir from which water flowed from the primary circuit through the valve quickly regained full, the operators have ignored for 3 hours the alarm was triggered.
14) The fact that an operator reads the wrong indicator when asked to give the temperature at the outlet of the valve of the primary circuit. Whereas if he had read the right indicator, the high temperature display would have shown that the valve was not closed.
15) The fact that operators have also ignored the fact that for 3 hours than normal temperatures have also been detected in the pipe connected to the wastegate.
16) The fact that operators have ignored the indication for 3 h a higher temperature and pressure in the containment building. This clearly indicated that there was a problem.
17) The fact that operators have not seen for at least 2 hours that the auxiliary building tanks receiving radioactive water from the containment building were filled.
18) The fact that the alarms did not sound the radioactivity when the tank was punctured and containment of radioactive water that spilled into the containment building. And also the fact that, oddly, they have worked 3 hours later (which means it worked). Or, (Since the fact that the alarms had not sounded that is defended in a document), the fact that the alarms are triggered, but the operators do not realize it are, and this for more than 3h .
19) The fact that Frederick had consulted indicator of water level in the containment tank too late, ie after the safety disc of it had been broken and the tank is emptied. So that the indicator had returned to normal levels.
20) The fact that operators are realizing that pumps the coolant began to vibrate strongly, they cut pumps in question, but they do not understand that it means they are pumping more steam than water and that it therefore means that there is enough water in the primary circuit.
B) Analysis of technical issues and those related to operators
All these problems, it is a lot. It is very huge. It's been too much for the theory of the accident is credible. Especially since they are not small problems or logical problems, no, these are huge problems and unbelievable.
What is the probability that 20 such incredible things happen on the same day in a place as controlled a plant? 1 in 100 million? No, the only possible reason for such an accumulation of events, it is a sabotage.
- The initial problem of demineralisers
What happened at that time was already very suspicious.
, plugging a water circuit to the second pneumatic system already indicates a clear intent to sabotage, especially just before a maintenance operation on demineralisers. The explanation that someone might have wanted to pressurize the water system or connect together the two systems by a pneumatic connection error seems completely farfetched. And then nobody would take responsibility of such a thing without consulting a manager. It is strictly impossible for a single operator is fun to do this without orders from a superior. And if a manager had given such an order, the operator having executed would not embarrassed to speak at the inquiry. So in reality, there is no convincing explanation for this act out of a desire to sabotage.
The fact that operators do not see that there was a pipe connecting the water circuit system Pneumatic control valves is very fishy. We are told that it was dark there. As if working in the dark, as if there was not enough light for them to see this problem of unauthorized connection. And even if that were the case, one can imagine that they would have then brought flashlights.
It also wonders why all this has not happened earlier, when the pipe was connected. The person (assuming it was done without intent to sabotage) that connected the two systems had to do it for immediate use of the craft. In this case, it would trigger the the disaster at that time. Maybe he was more open another valve to the water swept into the air instrument system. So we can not actually be sure it would have necessarily occur earlier. But there is still a big doubt on this point.
Moreover, regarding the survey conducted after the "accident", it says that the NRC has issued this hypothesis on the cause of the blockage of valves demineralisers. Only when performing an experiment to test the hypothesis, they were unable to obtain the expected result. So, the connection water system to the pneumatic system can not close the valves controlled by it. So the official explanation on the valves that are blocked due to water pressure which would be introduced into the pneumatic system fails.
So it is quite possible that the connection between the two circuits have been realized after the fact and in reality what has caused the closure of the valves would be a voluntary order of the operators or, alternatively, on a sabotage element of the pneumatic circuit, again, by operators.
Moreover, the history of the closure of valves demineralisers tends to be simplified in what we read in most descriptions. In fact, only the first demineraliser that was blocked. The valves of the other 8 demineralisers should have stayed open and the flow of water would therefore continue to pass. But they are closed almost at the same time as the first demineraliser. The official explanation is a mysterious connection error that would have resulted in other demineralisers should close when the first did. It would have yet another connection error. It's starting to do a lot. And then, again, we imagine such a thing can not be done without the consent of the person responsible. And one might think that the performer was then given the name of the officer responsible for the error. So one can imagine that in fact the connection error, it was actually quite voluntary.
It also says it has found that a compressed air pipe of one of demineralisers was broken. Investigators said the air could not flow into the demineraliser because of an automatic valve would close automatically. Only one operator has subsequently testified to having heard the air leaking into the demineraliser at the time of the accident. One hypothesis put forward by an operator is that it's a hammer that broke the pipeline in question. But the NRC investigators have subsequently found that the hammer was not as important as the operator had said. Therefore, since according to investigators, it could not be a natural cause that had caused the breaking of the air duct, one can again think of sabotage.
http://www.tmia.com/old-website/tmisab.html
Then a little later, there is the problem of relief valves in the circuit closed and not reopened following an intervention before 42h. While the procedure specifically states that they should be reopened. An "error" more human.
In addition, other error, the operators do not notice the light indicating that the valves remain closed, for one, because a service label conceals the lamp and the second simply because they notice it. You can of course ask questions about why the presence of the label maintenance. But it is mainly the fact that the light was not hidden was not noticed for 42 hours which is extremely suspicious (that they were not tilted on the presence maintenance of the label is suspicious too, but to a lesser extent). For 42h, the operators of the control room have a light that lights up when it never is, they know what match this light, yet they do not notice it. And at that moment, we can not rely on the fact that they were overwhelmed by alarms. So it's very very suspicious.
But it was there all these problems if we wanted that the accident happened. If the water system was not connected to the compressed air system controlling the valves of the first demineraliser, no reason why it hangs. If the compressed air system of the second demineraliser did not have a connection error, no reason any more than it freezes, and suddenly, no blocking of the secondary circuit. And if the relief valves of the circuit had been opened, the secondary circuit was supplied with water after a few seconds of blocking, and then no problem of temperature rise in the secondary circuit, and therefore not in the circuit primary. Similarly, it was the alarms yet clearly indicating that the valves were closed are ignored by the operators for over 42 hours. Otherwise, if they had reacted immediately, even problem: the secondary circuit and the primary circuit would have had no problem of temperature rise. So no opening of the discharge valve in the primary circuit and not melt the heart.
the way, having solved the problem of locked gates of the secondary circuit is nothing extraordinary. Insofar as it must certainly be an indicator of heat in the secondary circuit, they quickly saw that the secondary circuit does not cooled. So it would necessarily mean that the valves remained closed. I say this because it gives us the impression that there had been full of events that were happening, everything had to be super complicated and therefore, operators have to react very intelligent. No, it was completely basic.
- The problem of measurement of water level during the first 10 or 15 minutes
Part of the "accident" on the primary circuit will still show the best of sabotage.
Already, the explanations for disabling the automatic injection of water are flimsy. The history of water level indicator that does it more correctly when the discharge valve is opened makes absolutely no sense.
Already if the movements of water and steam were complex as can be read in the reports of the accident, they were also unstable. So the operator in charge of analyzing the pressure ought to have seen continual variations in water level.
the same kind of idea, it seems we are told that the pressure increased gradually. If the level meter of water was disrupted by the movement of water out of the situation leading to continual variations in pressure, possibly, there could have been one (very unlikely, but hey, suppose) where the indicator was pushed its maximum at all times. But then the pressure would not have risen steadily, but it would have been more than once. But apart from these two situations (change, or put the indicator at all), it is unclear how the complex movements of water, so erratic, could lead to a gradual increase in water level.
And then, once that water injection has been disabled, it is unclear what happened to the water level indicator. Is that the problem was solved? In principle, yes, since it seems people say that the water pressure dropped. And later, when water injection was reactivated, it does not seem to speak again of this problem. So why would he just had a malfunction at the beginning? Mystery. If it's because there was more water in the pressurizer (ie, at the very beginning of the problem, well before there was mostly steam in the primary circuit), then that would mean that happen mostly in situations somewhat removed from normal. So it should come almost every time he is opening the valve for 5 or 6 minutes. If the valve opens, because the heat and so the pressure become too important in the primary circuit. So there are chances that Then there is training movement of steam or water complex in the pressurizer. And if it was common long ago that it would be seen operators.
If it was not known and solved, it is simply that such movements do not exist. It is a pure ad hoc invention to explain that operators have not responded. If it were known, the designers of the plant would put other types of detectors to prevent the problem is not detected.
And also, the designers of the flag of the pressurizer water level it would clearly be seen during tests on the indicator.
We are told that when the safety injection was cut after a few minutes, an indication of water level has fallen. It indicated that the pressure decreased. So that means that the water level indicator worked properly again. The gradual decrease in pressure makes it clear that there was a loss of fluid. So at that point, the traders would immediately understand that the valve was left open.
Moreover, it would be a good indicator of pressure. There he was an analyzer water level apparently. So if there was also pressure analyzer (not because of malfunction, him), there would have been a second indicator that contradicts the first.
- The valve can be closed only 40 times
Then, the story of valve that can be closed successfully, 40 times before they know a failure of closure is also highly suspect.
Imagine badly for something as critical in an environment where security issues are crucial, we could have a material that is so unreliable. It is said that this valve was supposed to work only very rarely. But even very rarely seen the absolutely crucial role of this valve, there should have been out of the question if it has a low reliability. Moreover, it is unclear what would be a problem for the closure of a single valve.
It is said that the problem was that it was never designed to be a problem at the opening, but in return, she frequently posed problems for the closure. But in this case, the double valve with another valve downstream, which she did not have these problems closing.
And if the second valve is suspected of having problems at the opening, then made a second discharge circuit. That way, no danger that the pressure can not be evacuated, and no danger either that the liquid can escape from the primary circuit due to a failure of the valve closing.
In any case, if the valve is left with no duplicates, then it is sure to have indicators that provide precisely the situation of the valve, with redundant sensors of course.
The fact that the valve indicator reports only that the stop order was given, but there is no indicator showing the exact position of the valve (open or closed) is So incredible. Why make an alarm that only serves to say that the order has been given, then we know that the valve is lousy and can not serve as forty times? Hello something fishy.
Especially it seems clear that the problem does not come from too rapid wear of the mechanism of the valve, but it's a random problem. So, a change valve, or maintenance thereof had no effect on the number of cycles before the first failure of closure. The issue should arrive early or late in a power plant. The presence of indicators to report its actual condition was all the more necessary.
The most plausible version is that the valve had a running time with success far beyond what we're told. This story would be an explanation ad hoc to make us accept the fact that the valve broke down just at that time. It is on with all other failures and "errors" of operators, if the problem of the valve was considered exceptional, the idea of sabotage could have come to the minds of people. It could be the straw that broke the camel's back. In fact, the valve was functioning perfectly, but it had to be sabotaged (or is the software controlling its closure has been tampered with).
- Operators does not include more than 3 hours during the valve remained open
The fact that for two hours, operators do not realize that the valve remained open is totally unbelievable. This is clearly the most incredible of all, that clearly indicates the willingness of sabotage.
There are too many elements that showed that the valve remained open so that operators were unable to understand that she was.
- The temperature rises and the pressure drop indicated clearly where the problem came
Already, the fact the most obvious is that the temperature continued to rise more in the primary circuit of water while the pressure decreased. If the pressure decreased and the temperature increased, it is inevitably that either the system (and therefore the valve) was not closed and there was loss of liquid or the temperature gauge was out of adjustment.
The first hypothesis was to remember that there was no error indicator. In this case, the fact that the pressure decreases as the temperature increase shows unambiguously that the system was not closed. In a closed system, variations of these two measures are the same meaning. If it goes in the opposite direction is that the system is not closed. And if it was not closed, it was obviously that the valve had not closed. And given the low reliability of the valve, we do not see what operators could find surprising. There could be a leak elsewhere of course, a breach in the primary circuit. But the thing to check first, it was clearly the relief valve.
If the valve was closed and the temperature gauge was deregulated, it means that there was no danger in delay and in fact everything was normal. Since the secondary circuit was again in water, it was clear that the primary circuit was cooled without problem. So it was on the potential problem of the lack of closure of the valve need to concentrate efforts analysis.
In fact, he could not even be simply error on the temperature gauge, since the pressure fell too, and quickly found very low. If there had been an error on the temperature (so it actually fell), and the valve was actually closed, then the pressure would decrease the course, but only slightly. She would not have fallen so sharply. So, if the valve was closed, it means that the two indicators were false, temperature, and pressure. Given that the probability that both indicators are failing was very low, it meant so clearly that it was good the second solution: the valve was open, and therefore the coolant was leaking, which lowered the increasing pressure and temperature.
So everything had to run the analysis primarily to the state of the discharge valve, and only then, possibly, the temperature gauge.
Once this is established, it is clear that in addition to check all indicators that can reveal that the valve remained open, he immediately had to test the reaction of the primary circuit by closing the valve located behind the discharge valve. If the temperature had risen more slowly, or had stabilized, had begun to show off, and if the pressure had begun to rise, he was immediately clear that the valve was indeed the problem. The fact that the operators have not performed this operation is also highly suspicious.
So having ignored the 4 or 5 indicators exponent obvious that the relief valve was open already shows a clear sabotage. These indicators were sufficient in themselves so that there is no doubt about the origin of the problem (the valve). But increasingly, as it was already perfectly clear logical point of view that there was loss of fluid in the primary circuit, having ignored these indicators shows unambiguously that there was sabotage on the part of operators. When we know that there are only two possible reasons for a phenomenon, and that systematically ignores the indicators pointing clearly one of these two reasons, and besides, it is almost impossible that this is the other reason (seen here, the secondary circuit was in water) is that there will sabotage . Especially when this blindness lasts two hours.
- indicators ignored for 3 hours
elements to realize that the relief valve was left open are: 1) The fact that when the reservoir from which water flowed through the primary circuit the valve was quickly regained full, the operators have ignored for three hours the alarm was triggered. 2) The fact that an operator read the wrong indicator when asked to give the temperature at the outlet of the valve of the primary circuit. 3) The fact that operators have also ignored the fact that for 3 h temperature above normal was also detected in the pipe connected to the valve discharge. 4) The fact that operators have ignored for 3 h indicating a higher temperature and pressure in the containment building. This clearly indicated that there was a problem. 5) The fact that Frederick had consulted indicator of water level in the containment tank too late, ie after the disc Security of it had been broken and the tank is empty. So that the indicator had returned to normal levels.
On problems 1, 3 and 4, well that's what. For 3 hours, the operators had these indicators under the eyes. As we have seen, they necessarily knew that the most likely cause of the problem encountered was that the valve was left open. These indicators on their side necessarily implied that the relief valve was open. And for 3 hours, they did nothing. Such a thing is absolutely impossible without intent to sabotage. We can not ignore systematically for 3 hours of indicators we have under our eyes without it being voluntary. Especially when it is many. Already, with a single person, it's completely unbelievable, then, with several people, it's impossible.
Moreover, one can think that there should be indicators not identified in the various articles on "accident" that should reveal the problem of the valve. For example, there should be other tools to know the pressure in the primary circuit. In an area as sensitive, there is obviously redundant measuring instruments, so that if one fails, two or three others can be consulted to see what happens. We are told once completed, the containment tank is then poured into the containment. Again, there should be a detector which would indicate the thing. And there must have detectors of radioactivity in the containment. Therefore, the presence of radioactive water would be immediately detected also from that angle.
The fact that the technician to give the temperature at the outlet of the valve of the primary circuit is wrong Zewe indicator (bp 2) and read the temperature output of another valve is a little drop of water the last straw. After a number of "errors" Human (system connection compressed air and water, poor connection on the second demineraliser not check the valve opening, maintenance label on one indicator, but ignored other visible indicator, indicators systematically ignored for 3 hours, etc ...) can no longer speak of clumsiness or error, we can only speak of betrayal. But it is on that if you had said that Zewe had not thought of that, it would have seemed too suspicious. So they said he had thought, but there was an error reading.
Regarding the fact that the supervisor has watched indicator of filling the tank containment too late (bp 5), we must see the timing of the thing. At the 8th minute, the problem was solved for the secondary circuit. Therefore, operators could concentrate on the primary circuit. They had already seen that there was a problem with it. So, finally having time, they would have to focus on this problem (which is still the largest component of the plant). So, given that between the 8th minute and 15th, there was an indicator showing that the containment reservoir was filled, they would have to notice it (think there was an alarm signal). They had 7 minutes to notice it. Then, when the tank was full, there is an alarm that sounds for 3h. For 3 h, the operators could not but realize that. When the disc from the containment tank broke and water flowed out of the reservoir, a measuring instrument for 3 h indicated that the heat and pressure were above normal. The operators could not move next to it.
- More Details
Furthermore, one might think they should know exactly the amount of fluid lost by the primary circuit. It must necessarily be an indicator of filling the tank. So just a simple subtraction to find out how much water was lost by the primary circuit and how many had been injected by the injection safety. We know then how much water remains in the primary circuit (and depending on the temperature, what must be the pressure). So why, initially, to stop the transfer of water because of the pressure then you should know that in fact the primary circuit has already lost a lot of water and can not be pressure situation?
Another problem is that the vibration of pumps also indicated that the primary circuit had more water and therefore that the valve remained open. If Zewe saw that the pumps were shaking, it would necessarily do what the reasoning. But no, Zewe does not understand.
is strange that there was not an alarm set for the disc to break security (apparently so, since we do not talk about in any reports) . Because of this rupture disk must still be a major problem for a plant. And once the visual alarm begins to tilt, it should not stop. So we shall see sooner or later.
Another thing, in "the nuclear accident at TMI day 1 (part 4), it is said that in fact, radioactive water flowing from the primary building to building auxiliary pumps through drains was stored in a tank in the auxiliary building. So, the water was not reflected directly in the auxiliary building. And suddenly, it means that here too, there should be indicators of filling, pressure gauges, etc. ... So, the filling of reservoirs in the auxiliary building would be seen by the operators.
As already mentioned, regarding the timing or the first alarm to radioactivity began to ring, the sources are contradictory. According to versions, it was dispatched to the 15th minute of the accident ("Engineering.com") or so it has not rung to moment by failure of the alarm ("TMI step by step") or the operators have realized that water was radioactive in the 45th minute (Everything). Moreover, it is said that only T = 2:45, the alarm goes off to radioactivity (English version of wikipedia). Finally, according to the French version of Wikipedia, is that at T = 3:12 the alarm goes off to radioactivity. Engineering.com contradicts himself apparently himself, it is said that the alarm sounds when the radioactivity at the time Porter arrived in the control room (so to 6am, either at T = 2h). 5 sources that contradict all, more a contradiction in a source, that's a lot.
In any case, it was an incredible malfunction or human error by more incredible. If the alarm went off at T = 15 minutes, as it would make sense, it means that very early during the "accident", the operators had a very important addition to understanding what was going on and the valve that again they have not understood for about 1h45. Even with an alarm is triggered in the 45th minute, it is still 1:15 to flat encephalogram. And if the alarms had been triggered around 2:45 or 3:12, it means that there was dysfunction of the alarm before it (and even more alarms as quickly, the water was pumped into the drains that had apparently sensors radioactivity), which is equally amazing (and especially then, the alarm would work).
We are told that T = 2 hours (6am), the engineer in the morning, Ivan Porter, sees that the primary circuit pressure is low. So the pressure indicator showed the correct pressure well for a while if the engineer could see that the pressure was low. Therefore, operators of the control room should have been noticing long. He also notes that the temperature in the containment tank is very high. So, there was also a temperature sensor in the tank containment, in addition to a water level sensor. Therefore, also, the operators should have realized that the primary circuit water was being discharged into the containment tank.
Towards the end of the crisis between T = T = 3:12 2:22 ET, we do not understand why the operators have closed the valve downstream of the valve of the pressurizer (to stop the evacuation of water then), and have given a pump, all without getting water again. If they have closed the valve, that they had to realize that the valve was still open. And from there, they were bound to realize that she had remained open for over 2 hours. So they knew that the primary circuit was heavily drained. They would therefore introduce the cooling water and more. Obviously, we understand much better if it were traitors.
One wonders also how they calculated the amount of water back into the primary circuit. Because if the pressure indicator is crappy and joking when there are cavitation, Well it is completely unreliable. However, since we apparently relies solely on him to determine the amount of water in the heart, it is unclear how one could know how much there is still water in the heart, and therefore, how much water must be reset so that it is again fully submerged. But by chance, at this point, the indicator does more messing.
- Operators supposedly overwhelmed by alarms
To explain the fact that operators did not understand what was going on for over 3 hours, we are told that the operators were overwhelmed by the indicators. C'mon.
They say that the alarms were lit everywhere. But anyway, what matters are the indicators, not alarms. And until further notice, the indicators, they were not gone mad (besides the problem of the indicator valve, which was only 1 indicator wrong. And yet, the problem was inherent in the design of the instrument). So, it was enough that they analyze the indicators. And once solved the problem of the secondary circuit, there was not 36 things changed in the plant. There were only the primary circuit temperature increased and the pressure dropped. None of this should be surprising for an operator. In when radioactive water spilled in the containment tank and the containment building and finally, in the auxiliary building of the reservoir, well exactly, that would make clear the origin of the problem (the fact that the valve remained open).
Anyway, they are supposed to be trained for this kind of situation. We must train them not to let panic alarms and by not watching the indicators. And as we have seen, there were many indicators that allow to understand the situation. Especially because, come earlier, the events have not gone in 10 minutes, which would actually justify the operators have been flooded with alarms, but in 3:20, leaving plenty of time to understand the situation, especially with all the engineers present.
And like all control rods were lowered, and the secondary circuit was again in water, operators in the control room had almost no problem. They could take their time, since the heart is still retained (before cooling completely), a few megawatts of heat. And the fact that everything has happened so slowly shows. So even if there were actually indicators that were flashing everywhere, operators no longer reason to stress completely. They could analyze the relatively quietly.
And we are told that the operators were flooded with alarms, but obviously, as it happens, we are not told why. If that were the case, they would have said what alarms flashed and how it made them cautious in what it was they did not understand what was happening. They would have said what the alarms that have attracted their attention at a given moment, and why it attracted their attention. Moreover, in such circumstances, we develop hypotheses. But almost nowhere we are told assumptions developed by operators at any given time (except to the very end), what they did to verify the hypothesis in question was good, and when they realized it was bad. This is normal, in fact, they absolutely do not reflected in the assumptions, they knew very well what was happening. They waited quietly closing the valve of the primary circuit at the right time (or valve located downstream from it).
In fact, it is not sure what alarms did not see the problem that remained he could still occur. Everything was fixed in the secondary circuit. So it should no longer be any alarms that side. Most of the alarms should be focused on what the problem, namely the primary circuit. So the alarm in question were certainly useful alerts and focused on the problem of the moment. In any case, we can consider this a spate of false alarms distracting the operators of the main problem.
Most likely, it is certainly that all the alarms were not set to operate at the same time, those who sounded the alarms were significant, but they decided to ignore them because they were traitors simply.
On the evidence of the flooding of the alarms (and evidence of how the accident happened), it seems that everything is based on reports provided by the printer used to transcribe the alarms of the control room . However, according to traders, there were so many alarms that are triggered during the first moments of the warning that the printer could not keep up. More time passed, the more she fell behind. After 2 hours, operators control room had emptied the memory of the printer to print out alarms yet. Suddenly, the alarm information by chance have been lost forever. Thereby allowing operators to invent this story avalanche of alarms (and absent from triggering the alarm for certain events)-post as they wanted. Nobody could contradict them.
In any case, it means that for this story avalanche of alarms, there is no evidence. Only the good times that operators must rest.
That said, it's hard to believe that they rested on the printer to have a history of events and they could not go back in time with the computer (on the screen connected to one) to see what had happened. They have been able to verify the pressure development during the last hour and see what happened to that level.
0 comments:
Post a Comment