Faulty culture of safety a root cause of the Priest Rapids Dam explosion

DESERT AIRE - There were mechanical reasons for the explosion last Oct. 8 at Priest Rapids Dam in which six men were injured - some burned severely.

There were also human reasons - plenty of them - according to a long and detailed report from the investigation, which appears to have been about as thorough as possible.

"We wanted to know not only the immediate cause of the explosion but also the root causes," Grant County PUD Information Officer Chuck Allen said. "What was it that could have allowed this to happen?"

The report concluded there was a faulty sense of safety throughout the PUD. Complacency, in other words.

People had stopped being as aware of safety as they should have been. Nearly no one escaped this criticism, from to top to bottom, including the six men who were injured in the explosion.

Now, Allen said, the PUD can take corrective measures. There will be upgrades in training, in the seriousness of that training and assessments of the training's effectiveness.

The investigation was carried out by three entities - Grant PUD, The International Brotherhood of Electrical Workers 77 (IBEW) and Energy Northwest, a consortium of Energy companies.

The PUD asked Energy Northwest (ENW) to use the procedure in place at the Columbia Generating Station Nuclear Plant. The PUD also contracted with ENW to assist in performing the RCA.

This RCA was not intended to be a culpability/disciplinary process. Culpability and any potential discipline as a result of the incident is being established outside of the RCA.

The report is simply too long to print in this newspaper. This version is quite condensed. To see a full report, you'd have to contact the PUD.

The Event Narrative probably tells the story best. ENW said this is the best analysis after the gathering of evidence.

The narrative was assembled from written statements, numerous interviews, relay protection system event files, annunciation and control system data and a third-party forensic inspection, upon disassembly, of the circuit breaker that malfunctioned.

The chain of events that led to the explosion started on Sept. 3, according to the narrative. Generator unit 8 (P08) was taken out of service to repair a turbine oil leak. It was supposed to be brought back on line at 4 p.m. on Oct. 8.

At 4 p.m. on Oct. 8 the six injured men were doing what they thought were the final tasks to bring P08 back on line, Allen said. That was when all went wrong. Mechanically, the cause was the circuit breaker that was the on-and-off switch for B08.

The short of it is that the PUD arrived at the appointed hour unable to put P08 back on line. The level of knowledge and ability failed, and irreversible mistakes were made.

The following is copied exactly from the narrative.

"At 1601 (4:01 p.m), the Operator closed 831/833 generator disconnects and restored power to the generator circuit breaker's (GCB) hydraulic pump. The Operator noted a problem with the pump not compressing the spring and turned it off. The Operator then proceeded to the Control Room to report the problem.

"The Chief Operator (Chief) and the Operator returned to the P08 GCB while the Senior Operator (Senior) called the Electrical Foreman (Foreman) at 1602. The Senior inaccurately described the problem to the Foreman as the P08 breaker will not close. The Chief stays at the GCB.

"The Operator returns to the Control Room and obtains instructions from the Foreman by phone to run the pump as it will time out and automatically turn off after approximately five minutes. The Operator goes back to the GCB and informs the Chief.

"The Chief and the Operator enter the Control Room at 1607. At this point the Operator considers the problem turned over to the Chief and resumes working on the original switching order. The Chief once again returns to the GCB and starts the pump; an excess pump run alarm is received at 1613 and reset four seconds later. The Chief then restarts the pump, sets a stop watch and returns to the Control Room.

"Meanwhile, the Foreman dispatched two electricians, Electrician 1 and Electrician 2. Electrician 2 proceeds to obtain Flame Resistant (FR) clothing. Electrician 1 goes to GCB. Electrician 2 comes across Electrician 3 & Electrician 4 and tells them of the breaker problem and that the breaker will not close.

"When Electrician 1 arrives at the P08 GCB first, the Chief is not onsite. Electrician 3 arrives shortly after Electrician 1. They both note that the pump is very noisy and turn it off. The Chief returns at approximately 1617 and finds the pump turned off, invalidating the stop watch timing which had been running for about two and a half minutes.

"Electricians 1 and 3 begin to review the GCB control drawing and start troubleshooting. The Chief opens the GCB lower cabinet doors. Electrician 4, the Foreman & Electrician 2 arrive one at a time sequentially. The generator disconnects 831/833 remain closed. The GCB timer is verified to be operating correctly. The Chief starts the pump and the pump gear condition is visually verified through the window as satisfactory.

"The electricians begin to remove the plexiglass cover. This plexiglass cover is clear to allow visual inspection of the GCB hydraulic drive mechanism while preventing inadvertent physical manipulation. Electrician 4 (considered by the electricians to be knowledgeable on the GCBs) tries to step in/move up front but is stopped by the Foreman because Electrician 4 is not wearing FR clothing.

"The Chief grants Electrician 1 permission to operate the hydraulic pump. Electrician 1 turns off the pump, finishes removing the plexiglass cover, and turns the pump back on.

"At 1620, Electrician 1 & Electrician 3 noticed that it is time to catch their vanpool. The Foreman says that the team should put the breaker back together and save the remainder of the work for the next day. Electrician 4 asks if they tried the solenoid plungers to which they replied they did not. Electrician 4 moves into an upfront position and Electrician 3 moves back to watch.

"NOTE: At this point, the generator circuit breaker is in the open position.

"Electrician 4 proceeds to manually operate the hydraulic solenoids which bypasses all protection and lockout circuits of the breaker. This action re-seats the valves allowing the drive spring to begin compressing. This action also closes the breaker and the following sequence of events takes place over the next 20 seconds:

"The generator circuit breaker very slowly closes due to low spring pressure; the breaker takes 30 to 40 times longer to close than designed as measured by the relay system data. This results in significant damage to the internal components of the circuit breaker. The turbine and generator were at a standstill resulting in high in-rush current.

"One of the unit protection relays (5C - Unit Shutdown) immediately trips on generator under excitation. This action sends a Trip signal to the GCB.

"The GCB does not open until adequate spring pressure/stored energy is developed in the hydraulic drive mechanism for proper operation. This does not happen until about 15 seconds after the GCB first closes.

"The A-phase interrupter, while damaged, is able to contain and extinguish the arc, and stop the flow of current as per normal operation. However, the damaged B-phase and C-phase interrupter poles of the circuit breaker fail to contain & extinguish the

arc.

"Because the B- and C-phase arcs are not contained and extinguished, the arcs spread to the main contacts which are not designed for or made of materials to handle such arcing.

The vaporizing contact material and heated gas creates sudden and severe overpressure conditions inside of the Band C-phase interrupter poles.

"Built-in safety failure points called rupture disks rupture as designed to vent this pressure and prevent an explosion. This vents the hot SF6 insulating gas and metal vapors in the interrupter poles out the front side of the circuit breaker and onto the six personnel gathered around the GCB.

"The escaping hot gas and metal vapor is the direct source of their injuries and likely source of whistling or jet engine sound reported by some employees that were not in the immediate vicinity."

The report went on to say:

"The first root cause is that Management is not adequately setting and enforcing safety expectations which has resulted in a poor safety culture. Many shortcuts were taken during this event: No job brief, minimal communications among the team members, assumptions on energy isolation and standby clearance, and a lack of onsite control of work activities all stem from an inadequate enforcement of expectations.

"The second root cause is that the on-site leaders (Chief and Foreman) did not control the work activities. Additionally, they did not ensure the energy sources were isolated prior to allowing the Electricians to troubleshoot the breaker.

"The troubleshooting activities lead to the breaker slow close resulting in an explosion and injuries. Overall, the Chief is responsible for the GCB according to District policy, procedure and job description.

In a check-list of existing conditions at the time of the incident, the report is clear that perhaps nothing was being done in a safe manner. Some of the questions were:

Was there time pressure (in a hurry) to complete the task?

Did the task contain a high workload, i.e., mental demands to maintain high concentration levels, e.g., interpreting, deciding, while having to recall excessive amounts of information either from training or earlier in the task?

Did the task contain interpretation requirements, i.e., in-field diagnosis that could have led to misunderstanding or application of the wrong rule or procedure?

Were there unclear goals, roles, and responsibilities associated with the task, i.e., unclear work objectives, expectations; uncertainty about duties?

Were there irreversible actions, i.e., an action for which there is no obvious means of reversal once it is taken?

The answer to all of these was "yes."