|
The only fatal reactor accident in the United States occurred on January 3, 1961, when an Army prototype known as SL-1 (for stationary, low power reactor, unit 1) exploded, killing the 3 operators who were present. We'll use the SL-1 tragedy as an example of how the Cause Mapping process can be applied to a specific incident and determine the root cause analysis.
The three steps are:
1) Define the problem,
2) Conduct the analysis
3) Identify the best solutions.
Each step will be discussed below.
Step 1. Define the Problem
The first step of the Cause Mapping approach is to define the problem by asking the four questions: What is the problem? When did it happen? Where did it happen? And how did it impact the goals? One person may say that the problem was the reactor criticality. Another person might say that the problem was that the reactor exploded, and a third person could say that the problem was the release of fission products. We can write down these three “problems” on the first line. In the Cause Mapping methodology the facilitator anticipates that the group may disagree so all three responses are written down. There is no need to spend time debating the problem. The magnitude of this incident is defined by the impact to the goals.
The second question is the "When?" which is the date and time of the incident. When captures the timing of the issue and also has a line for what was different or unusual in this occurrence. The question of what was different is fundamental in any basic investigation. On the SL-1 issue we capture the date as January 3, 1961 and the time of 9:01 p.m. when the alarm alerted the site of a problem in the SL-1 building.
In an investigation there can be several pieces of information that need to be captured when specifying the location. At a minimum the physical/geographic location and the process should be captured. The physical location is where geographically the incident happened. SL-1 was located at the National Reactor Testing Station near Idaho Falls, Idaho. There were several differences that may or may not play into the goal. First, a control rod was manually withdrawn. This particular control rod had a face type seal (which was different from the other control rods), and the reactor had been shutdown for 11 days, which did not frequently occur.
The next section is the impact to the overall goals. An overall goal is always to have zero injuries. The SL-1 tragedy killed the three operators present. One of the other goals in nuclear power production is to have no contamination to people or the environment. The explosion caused radioactive contamination of people, and the building housing the reactor. Another goal is that there be no damage to the vessel. In the case of SL-1, the vessel sustained extensive damage. There were other goals that were affected but the magnitude of the loss of life makes the loss of the vessel and any other goals less significant. The three goals that are impacted in theSL-1 example are the safety goal, the environmental and the material goal.
Step 2. Identify the Causes (The Analysis)
The analysis step is where the incident is broken down into causes which are captured on the Cause Map. The Cause Map starts by writing down the goals that were affected as defined in problem outline. For SL-1, the safety goal was impacted because of the three lives that were lost, the environmental goal was impacted because of the contamination, and the material goal was impacted because the vessel was severely damaged. These are the first three cause-and-effect relationships in the root cause analysis.
The analysis can continue by asking Why questions and moving to the right of either of the cause-and-effect relationships above. In this example we’ll start with the loss of three lives which was caused by the reactor exploding. The damage to the reactor was also caused by the explosion. The next question is "Why did the reactor explode?"
The reactor exploded because it went prompt critical (an uncontrollable, exponentially increasing fission reaction). The reactor went prompt critical because withdrawal of the central rod can cause prompt criticality due to a lack of shutdown margin in the core, and inadequate safety criteria, and because the rod was rapidly, manually lifted 26.4" out of the core.
Because most of the evidence was so effectively destroyed, nobody really knows why the control rod was lifted out of the core. There are two theories (disregarding the bizarre and improbable murder/suicide theory): 1) the control rod got stuck while being lifted to be attached to the drive mechanism, and, as the operator was exerting greater force on it, suddenly came free, resulting in a lift far greater than intended, or that an rod drop testing/exercising was performed improperly.
We'll examine the rod sticking theory first. The control rod was stuck, and came free while being attached because it was required to be lifted 4" out of the core and because control rods had been sticking.
The control rods had been sticking for one or more of the following reasons:
1) reduced clearances due to radiation damage (which can cause structural material to swell)
2) the passage was blocked due to loss of poison strips in the channel, caused by poor design and inadequate testing
3) lifting equipment not working properly due to inadequate lifting capacity of the lifting equipment.
Now we will look at the second theory, that exercising/testing was improperly performed. This could have occurred because the operators chose to exercise/test the rods, attempting to ensure that they would perform properly, and because they didn't realize what would happen. This is because of inadequate training and inadequate work instructions. The testing was also potentially done improperly due to inadequate work instructions.
Even more detail can be added to this Cause Map as the analysis continues. As with any investigation the level of detail in the analysis is based on the impact of the incident on the organization’s overall goals. The specific action items from SL-1 can be matched to specific causes on the detailed Cause Map. The detailed Cause Map can be found on the worksheet labeled "CM - Detail".
Step 3. Select the Best Solutions (Reduce the Risk)
Once the Cause Map is build to a sufficient level of detail with supporting evidence the solutions step can be started. The Cause Map is used to identify all the possible solutions for given issue so that the best solutions can be selected. It is easier to identify many possible solutions from the detailed Cause Map than the oversimplified high level analysis of "the operators were killed because the reactor exploded."
There are causes to every issue. The SL-1 tragedy at a high level has only three causes. At a more detailed level it has 9 causes, 26 causes and 76 causes. All of the levels of the Cause Map are accurate - some simply have more detail that others. An issue should be worked to a sufficient level of detail to prevent the incident, meaning to reduce the risk of the incident occurring to an acceptable level. This is why solutions and work processes at a coffee shop are not as thorough or detailed as an airline or nuclear power facility. The risk or impact to the goals dictates how effective the solutions should be. Lower risk incidents will have relatively lower detail investigations while significantly high risk to an organization’s goals requires a much more through analysis.
Cause Mapping Improves Problem Solving Skills
The Cause Mapping method focuses on the basics of the cause-and-effect principle so that it can be applied consistently to day-to-day issues as well as catastrophic, high risk issues. The steps of Cause Mapping are the same, but the level of detail is different. Focusing on the basics of the cause-and-effect principle make the Cause Mapping approach to root cause analysis a simple and effective method for investigating safety, environmental, compliance, customer, production, equipment or service issues.
|