Examples of the secondary risks:

Examples of faults of the resilience features

• Redundancy and backup features might fail
• Components of the alarm system might fail (see alarm reliability )
• Sensors added to ensure fault detection might fail

Examples of operator's failure to operate the resilience features

• Disabling a critical backup system, such as for maintenance
• Degradation in the operator's vigilance, such as in responding to nuisance alarms
• Disabling the alarm system to prevent nuisance.

Case study - TMI accident

In an incidence during the operation of the Davis-Besse 1 nuclear plant in Sept. 24, 1977, the operators were not aware of the fact that a critical valve, the PORV, was stuck open ( details ). To prevent similar incidences, the designers of the Three Miles Island (TMI) nuclear plant added a sensor for testing the state of this valve. This sensor was not reliable, yet, the operators relied on its false indication, resulting in the famous TMI accident ( Perrow ).

Two latent hazards of safety add-ons were involved in the TMI accident:

• The backup cooling system was disconnected, due to maintenance activity
• The PORV was stuck open after releasing the excessive pressure.

Related topic

Updated on 05 Nov 2016.