1. Electrical Explosion

2. Luck is NOT a Robust Barrier
Fault
Occu
rred H
ere

3. Simplified Schematic of Plant Electric System
t
Faul
ere
red H
r
Occu

4. FT 1.0
Production
Decrease
0955-1920
Plant Trip
0955
See
FT 2.0
Full Production
1920
No
Personnel
Injury
See
FT 4.0
No
4160-volt
Blackout
See
FT 3.0
No
Rupture
Disc Blow
Proper
Operator
Action
Spares
Including
“Breaker”
in Stock
Operator
Initiative
END
END
END

5. FT 2.0
Plant Trip
0955
Defect in
Cubicle
Causes
are
unknown
END
Contactors
Closed
Defect in
Cubicle
Not
Known
See
FT 2.1
4160 Volts
on Cubicle
CRO
Starts
Atomizer
END
END

6. FT 2.1
Defect in
Cubicle Not Known
Inspections not
capable
END
No test
available
Instrumentation
not capable
END
END

7. FT 3.0
No 4160volt
Blackout
Fast Transfer
to Start-up
Transformer
Start-up
Transformer
Available
Fault on 4160 V
Bus Cleared
Feeder Bkr Tripped
See
FT 3.1
END
END

8. FT 3.1
Fast Transfer to Startup Transformer
(Likely Scenario)
Aux Xfmr
Main Breaker
Opens on
Undervoltage
4160 Fault
Drags Voltage down
Aux Xfmr
Does Not
Open on
Overcurrent
4160-volt Feeder
Breaker Clears Fault
Breaker Opens on
Timed Overcurrent
Before SUT Main Bkr Shuts
Unknown
Unknown

9. FT 4.0
No
Personnel
Injury
Stand-off
Distance
of 22’
END
Partial
Shielding
by Cubicle
Stack
Fault on 4160 V
Bus Cleared to
Limit Energy
END
END

10. The next slide is a Factorsconsequence Matrix
It shows how various factors
would have affected the
consequences of the event.

11. Actual
Case
Case 1 IP
enabled
Case 2
Anomaly
detected
Case 3
Atomizer
not
started.
Case 4
Combustible
s present.
Case 5
Operator
near cubicle.
Case 6
No fast transfer
Case 7
No circ water
pump start
Instantaneous
protection
disabled
Yes
No (not
disabled)
Yes
Yes
Yes
Yes
Yes
Yes
Undetected bkr
abnormality
Yes
Yes
No
Yes
Yes
Yes
Yes
Yes
Atomizer started
Yes
Yes
Yes
No
Yes
Yes
Yes
Yes
No combustibles
nearby
Yes
Yes
Yes
Yes
No
Yes
Yes
Yes
Operator
protected by
location
Yes
Yes
Yes
Yes
Yes
No
Yes
Yes
Fast transfer
Yes
Yes
Yes
Yes
Yes
Yes
No
Yes
Circ water pump
restarted
Yes
Yes
Yes
Yes
Yes
Yes
Yes
No
None
Less
severe
explosion
.
None.
Anomaly
fixed.
None right
away.
Latent
problem.
Worse fire.
Potential
burns.
Severe
injury or
death.
No change.
No change.
Explosion
,Trip,
Lost
Revenue,
Equipmen
t damage
No plant
trip. Only
feeder
bkr trip.
None
None right
away.
Latent
problem.
Worse fire,
etc..
Explosion,
Trip, Lost
Revenue,
Long outage
for
investigatio
n
Explosion,Trip,
Lost Revenue,
Equipment
damage. 4160v
blackout.
Longer
outage due to
rupture
disc(s)
blown.
Factors
Consequences
Personnel
Plant/Financial

12. Eight Questions For Insight
Quality & Safety Impact
What were the event consequences?
What was the event significance?
Vulnerability
Consummation
Exacerbation
Mitigation
Corrective Action
(closeout)
What set us up for the event?
What triggered the event?
What made the event as bad as it was?
What kept it from being a lot worse?
Learning: What should be learned from the event?
Doing: What should be done about it?
© 2000, William R. Corcoran, NSRC Corp., 860-285-8779, firebird.one@alum.mit.edu

13. 1. Consequences
No personnel injuries. Explosion, fire, trip, lost
revenue, etc.
2. Significance
Saved by luck, lots of surprises, Arc Flash hazard
underestimated, complex event
3. Set-up
Bechtel wiring anomaly, latent defect in “breaker”
4. Trigger
Starting an atomizer from Control Room
5. Exacerbation
Feeder breaker didn’t trip on instantaneous. This
caused plant trip.
(what made it worse)
kept it from being even
worse)
Operator location! Fast transfer malfunctioned in our
favor! Good personnel actions. Spares on hand.
7. Lessons to be
Learned
Energizing a circuit is a hazard. Distance and
shielding work. Control combustibles.
8. Corrective
Actions
Stand-off from energizations. Ring out protective
circuits. Re-do Arc Flash Study. Re-do breaker coordination.
6. Mitigation (what

14. Now is the time for
•
•
•
•
Questions?
Comments?
Recommendations?
Discussion?