Who Destroyed Three Mile Island? - Nickolas Means | The Lead Developer Austin 2018

[Music] [Music] so I will start by pointing out that the giant 18 t cell mask that's over there is because of South by and so like most things in Austin right now the problem with the microphone today is South by his fault so thanks for that interim area that was very kind you're always way too kind I really appreciate it I really love what Mary and Ruth and the whole team at White October have built in this event I think it's something that those of us that care deeply about leading well really needed and so I'm thankful it exists in the world so thank you for all the time and effort and attention that you put into it I'm especially excited and thankful yeah please I'm especially excited and thankful that they brought it to my home town of Austin and I am incredibly honored to be on this stage tonight so when I was a kid my parents gave me this for volume set of books called how things work my dad is a mechanical engineer by training and I think the reason they gave me this set of books is because he got tired of answering all of my complicated questions about how things work maybe it was that maybe it was that he wanted to teach me to get these answers on my own I don't have a chance to look at these books very often these days but they still occupy a treasured spot on my bookshelf because they're a big part of what made me who I am I think these books are a big part of why I'm interested in all these weird disasters and the stories that I like to tell aya stinky remember when it was all over the local news in 1990 that Comanche peak unit one outside of Dallas had gone online it was the first reactor nuclear reactor that I remember hearing about and I remember turning here two pages 68 and 69 of volume one of how things work to try to make sense of how a nuclear reactor made electricity and I think that's a good place for us to start today as well with one of the reactor diagrams at the bottom of this page as it turns out the basic mechanics of a new nuclear power plant are the same as a combustion power plant a heat source heats up water in this case it's a carefully controlled nuclear reaction fuel by uranium but in a in a in a combustion plant it would be burning coal or natural gas and that heat heats up water high-pressure water circulating through the reactor carries the heat to a heat exchanger where it's used to boil water turning it into steam steam gets piped to the turbine which is basically a giant fan in a tube and the turbine turns a generator and that's what finally produces the electricity after that the steam gets pumped into a condenser where it gets cooled and turned back into water and around and around it goes so what exactly makes this a pressurized water reactor because that's important for us to understand today the components I just walked you through earth through on two separate coolant circulation loops there's a primary loop in orange here that consists of the water that flows through the reactor vessel to gather the heat and then through the heat exchanger over and over again that's the only place that water goes and then there's a secondary loop here in blue that flows through the heat exchanger where it boils into steam and that steam the expansion of that steam is what drives the turbine to generate the electricity and then it's condensed back into water and it goes through that secondary loop over and over again these two loops never mix they're completely isolated the water is completely separate and the thing that makes it a pressurized water reactor is that the primary loop is held at about 2,000 psi there's a very simple economic reason for this so a boiling water reactor the other major type of nuclear reactor has to have a very large reactor Pressure Vessel because the water actually boils the steam in the reactor itself there has to be room for that expansion to take place the reactor vessel and a pressurised reactor can be much smaller because when you raise the the pressure of water it raises the boiling point and so the water in the primary loop is about 600 degrees Fahrenheit but because it's held at such high pressure it doesn't boil or at least it shouldn't and that brings us to March 28th 1979 Three Mile Island nuclear generating station is a two unit nuclear power plant in Londonderry Township Pennsylvania it's built on a three-mile long sandbar in the middle of the Susquehanna River and it's about ten miles south of Harrisburg Pennsylvania the capital of the state unit one is an 820 megawatt Babcock & Wilcox pressurized water reactor the and commercial operation on September the 2nd 1974 on March 28th it's been operating for about five years no incidents and it's currently offline for refueling outages of this reactor is not operating unit two is also a Babcock & Wilcox pressurized water reactor it's slightly larger 906 megawatts and it went into commercial operation on December 30th 1978 which if you do the math it's only three months old at this point this reactor has only been running for three months on the morning of March 28th 1979 and on that morning it's running at 97% of max capacity it's running hot straight and normal as they say in the nuclear power industry these four men are at the controls of Three Mile Island unit two for the overnight shift on March 28 bill Z we is the shift supervisor for units one and two he's the most senior person on site for the overnight shift Fred Shima is the shift Foreman for unit two he's busy he's second in command mister gentleman on the end at Frederick and Craig Foust or the control room operators on duty they're the ones that are actually sitting at the controls in the the reactor control room everything that the plant was going perfectly normal that night the plant was running exactly as designed except for a small problem in the condensate polisher that the swing shift the night before had left them to deal with the water condensate polishers they are a set in Three Mile Island a set of eight filtration tanks that filter the water in the secondary coolant loop coming out of the condenser before it goes back into the expensive and delicate steam generators now these are not the actual condensate polishers from Three Mile Island as you can imagine it's very difficult to find a picture of a specific component of a specific nuclear power plant but this is what they look like and these polishers are filled with sticky resin beads and what these beads do is anything that might be in the water that's not water like little flecks of rust or dust or whatever they stick to these resin beads the only problem with this system is that as the five thousand tons of water that passed through these tanks push on these beads they tend to compress and the problem that the crew was facing this night is that the beads and the number seven polisher tank had completely clogged the tank so the crew on the swing shift had started working on this problem these things have a backwash system that works about like a pool filter backwash so they'd used that wasn't sufficient so they turned on a compressed air feed as well feeding compressed air into the tank at 359 in the morning Fred Shima is down in the basement of the turbine hall to see how things are coming to see if this tank is unstuck yet he's looking in the viewing port of the number-7 tank when things get incredibly quiet you can imagine that five thousand tons of water per hour moving makes a tremendous amount of noise so the sudden quiet is very disconcerting and he barely jumps free before a water hammer comes through and actually dislodges the feed pipe feeding all eight of these condensate polisher tanks now what had happened is over the last ten hours or so a leaky one-way check valve had allowed water to press up from in the condensate polisher tank into the air feed line and over the course of 10 hours it worked its way all the way up to the manifold that fed all eight of the pneumatic control valves that controlled the inlets inlets for these condensate polishers and so all eight of these tanks closed off at the same time obviously this is not good but tell us understand why here is a schematic of Three Mile Island unit two looks a little more complicated than the diagram we looked at a minute ago but I've got it colored the same as that schematic the primary loops an orange secondary loop is in blue let me get you oriented real quick here in the centers of the reactor vessel where the nuclear chain reaction creates heat next to it are the two steam generators what the other diagram called the heat exchanger or heat from the primary loop boils water in the secondary loop to create steam this is a critical component of the plant so there's two of them for redundancy that steam generated in the steam generators is piped to the turbine building to turn the turbine generator and then here's the condenser where the steam cools down and gets cooled enough to change back into water one interesting tidbit that I'll point out most people think that this cooling tower is a nuclear reactor it's actually not it's the little tiny building that's next to the cooling tower and here right after the condensate polisher right after the condenser is the condensate polishing and so with the condensate polisher section completely blocked there is no more water to be pumped through the secondary cooling loop and so the main feedwater pump trips offline it's 36 seconds past 4:00 in the morning the official start of the accident at Three Mile Island two seconds after the main feedwater pumps trip the turbine senses it's not going to be getting any more steam and so it trips offline along with the generator when this happens the plants got a bunch of steam that it no longer needs so the main safety valves of the plant open and release a ton of steam into the early morning sky it's harmless it's not radioactive but it makes a ton of noise it can be heard from miles away in the control room edie frederick and craig Faust are getting their first indications that something has gone awry an alarm horn is sounding announcing that the turbine is tripped offline and several alarm indicators start to flash a few seconds after the turbine and generator alarms go off the pressure and the reactor vessel is starting to climb rapidly now this is not unexpected you see with with no water in the secondary loop the heat that's built up in the primary coolant loop has nowhere to go and when water heats up it expands and so it's normal that with nowhere for the heat to go the pressure is going to go up the good news is that the plant is designed for exactly this scenario and as soon as that alarm went off it began taking reacted taking action to resolve the situation automatically the reactors pressure control system is the first to jump into action now there are two components to this system and both of them are important to the accident the first one we're going to talk about is the pressurizer now the pressurizer is main job is to maintain system pressure in a nuclear and of pressurized nuclear reactor and this works like a giant piston the red area at the top is steam and the blue at the bottom is liquid water now water expands when it gets hot like I just said so when they need to raise the pressure of the system there's a heating element at the bottom that they can turn on and that'll raise the pressure in the entire primary coolant loop when they need to lower the pressure there's a sprayer at the top they can turn on and by lowering the pressure in the pressurizer it'll lower the pressure of the entire system there's a couple of other purposes that the pressurizer serves as well Babcock and Wilcox designed this particular nuclear reactor without any water level monitoring and the reactor vessel itself the reason for this is because the pressurizer is the highest point in the system and so if you monitor the water in the pressurizer you can infer that if there's water there there's water in the reactor and it was much cheaper to put instrumentation in the pressurizer than the reactor vessel itself lor it's exposed to high radioactivity and the third job that the pressurizer does is it absorbs pressure shocks steam is significantly more compressible than water and so the steam bubble at the top of the pressurizer acts as a giant shock absorber when the system experience is a significant quick pressure increase much like its it's experiencing right now so the steam and the pressurizer absorbs the initial shock but the pressurizer is designed for small fine pressure adjustments right now the primary loop is at 2250 psi about a hundred psi over operating pressure and it would take the pressurizer a few minutes to make that much of an adjustment so what does the system do to deal with a big pressure change like this one well that's where the pilot operated relief valve comes in and if you've ever heard the story of Three Mile Island unit two this is the component that you probably remember because it's the one that gets all of the press in the event of a big pressure really pressure spiked the pilot-operated relief valve will open and it will release coolant into a drain tank on the containment building floor the PRV opens four seconds after the turbine and generator trip off line a few seconds later the computer senses that even with the PRV open pressure and the reactor vessel is still continuing to rise so it takes another defensive reaction its grams the reactor now the chain reaction in the core of a nuclear reactor consists of a bunch of neutrons bouncing around running into uranium atoms and causing them to fission or split when that happens it gives off a tremendous amount of heat and a bunch more neutrons that then go off and crash into other uranium atoms continuing the chain reaction the way that you control this chain reaction is via a set of cadmium rods that can be inserted into the reactor core what they do is they absorb these neutrons and keep them from flying in the Iranian atoms when the reactor scrammed what happens is the control mechanism that is responsible for lowering and raising these pressure rods releases them and they freefall to the bottom of the reactor core and this stops the nuclear chain reaction almost instantly but even after the scram the reactor core is still producing decay heat immediately after scram it's producing a six and a half percent of whatever it was producing before it was scrammed an hour later it's producing one and a half percent so it's incredibly critical that cooling is maintained for the core throughout this first hour because that's plenty of heat that if it's not carried away if it accumulates in the core it can cause significant damage a few seconds later back in the control room a light on the console turns from red to green to indicate that the pilot-operated relief valve has closed this point everything feels very much under control to the reactor operators reactor and turbine trips they're not an everyday occurrence because obviously you want the plant to stay online and generate electricity but they're also not an emergency there are well-established procedures for responding to them the alarm horns are still blaring the alarm indicators are still flashing but the system is behaving exactly as it's designed that feeling of control for the reactor operators would last for precisely two minutes I guess two minutes later the emergency core cooling system turns on specifically the high pressure injection pumps dumping a thousand gallons per minute of cold water straight into the reactor core the plant had gone from a state they understood to one they didn't as soon as the high-pressure injection turned on the reason this confused them so much is because they were watching the water level in the pressurizer and the water level in the pressurizer was rising seeing the water level in the pressurizer rise told him that there was plenty of water in the system so they couldn't understand why the high pressure injection system thought the system needed more water and so Fred Shaymin made the call to turn off the high pressure injection system after had only been running for about two and a half minutes had he not done that have you just left it alone let it do its job this would have been a minor inconvenience and this plant would have been back online about two days after this incident we're now five minutes into the accident sequence there's something at this point that's perplexing bill ziwei he's the one that you can kind of see hunched over and the Paisley shirt right in the middle the water level in the pressurizer is continuing to rise so he knows the primary loop is full of water but the pressure of the primary loop is continuing to drop and this is a problem because if it drops too far the water in the primary loop is going to start to boil and it won't be able to cool the fuel rods so he has a hunch of what's going on he suspects that maybe the pilot-operated relief valve might be stuck open and that's why the system's having trouble maintaining pressure so he double-checks the pilot-operated relief valve indicator on the control panel it still shows close just as it did before just to make sure he has one of the reactor operators check the outlet temperature in the pilot-operated relief valve the reading comes back at 228 degrees Fahrenheit this seems perfectly normal the bills Irie so he moves on there's a problem with that decision though the plant operation manual indicates that any reading over 200 degrees Fahrenheit indicates that the pilot-operated relief valve is open and if that's the case then the manual block valve in front of it should be closed to prevent coolant from leaking out of the system head Bill Z we just closed the block valve he would have stopped the accident right then and there but he doesn't he leaves it open we're now six minutes into the accident five minutes later of four 11 a.m. another alarm goes off this one indicates that the sump in the containment building is filling up the sump is a pit at the bottom of the containment building that collects any water that might leak or be vented from somewhere in the system in this case what's happening is that so much water has come out of the pilot-operated relief valve from the primary coolant loop that is filled up the drain tank on the floor of the containment building and the drain tank has started overflowing into the sump now enough water to fill up the sump at the bottom of the containment building should have told these guys that they had a giant leak but they miss it they don't catch that clue the core is in serious trouble at this point but the operators still aren't done just after 5:00 a.m. the floor of the control room starts to rumble it's really subtle at first but it quickly becomes impossible to ignore what's happening is that the primary coolant pumps of the reactor are starting to vibrate because there's steam in the core and the pumps are pushing around scheme in addition to the water that they're designed to pump and this causing a lot of turbulence and they know what their training says to do when this happens in order to keep the very large very expensive pumps from vibrating themselves to pieces and creating a coolant leak they're supposed to be shut down they hold out as long as they can because they're worried about what this might mean if they turn these pumps off but 15 minutes in bills II we can't stand it any longer and he turns off the first set of pumps this helps for a little while but 30 minutes later the vibrations gotten bad again and he turns off the other set it's now 544 in the morning and this nuclear reactor that was running at 97% of max capacity less than two hours earlier now has no coolant being circulated through its core none anetha doesn't take very long for the effects of no circulation to make themselves known at 6 a.m. precisely two hours into the accident a radiation alarm like this one starts going off in the containment building now that tells us a couple things the first for radiation alarm to be going off one or more of these fuel rods has to have been damaged nuclear nuclear fuel is packaged in zirconium rods like this and it's it's a bunch of uranium capsules that are about the size of your pinky the beauty of this arrangement is that it keeps the radioactivity in the fuel rods from leaking into the primary coolant so for them to be detecting radioactivity in the containment building the rods of started eruption the other thing that tells us is if the fuel rods have been damaged then it's almost certain that the water level in the reactor vessel has dropped below the top of the core now at this point plant leadership has started to make its way to the plant Gary Miller is the station manager the chief executive of through Mile Island this is his power plant George Condor is the Technical Support Manager for Three Mile Island unit two so he manages all the technical specialists on staff the nuclear engineers the health physicists the chemists almost as soon as they walk in the door they're asked to join a conference call with Leland Rogers a site rep for Babcock & Wilcox the company that designed this reactor and as these three guys are talking through what they know about the state of the plan Rodgers says they close the block valve right block valve the bow the valve that bills you we decided not clothes earlier George Kunder in the control room yells at somebody else and says is the black valve shut a few seconds later the answer comes back yeah it's shut and so at 6:20 two in the morning two hours and 22 minutes after the start of the accident the block valve is finally closed and the leak in the system is finally sealed now had they done that 20 minutes into the accident it would have been the right thing to do at this point it actually made things worse and the reason for that is that this valve was the only way that he could escape from the reactor vessel in the primary coolant loop the only way the the core was keeping itself cool at this point was boiling off coolant and venting it out through the pilot-operated relief valve so with the valve closed the heat in the core intensified rapidly it took about eight minutes for the top of the court of collapse subsequent calculations would show that by 7:00 a.m. the core was two-thirds uncovered and temperatures in the hottest part of the core were about four thousand degrees Fahrenheit hot enough not only to melt the zirconium fuel rod cladding but the uranium fuel inside as well at 7:20 in the morning the radiation alarm and that the top of the containment building goes off indicating a reading of 800 REM per hour now to give you some context for what that means if one of the operators from the plant had been standing at an 800 rim per hour field they would have gotten their maximum yearly allowable dose of radiation in 20 seconds the crew had largely been in denial about the state of the plant and core damage after the first radiation alarm went off but when this one off this is the big one immediately after this alarm they finally decide it's time to turn high-pressure injection back on but they only leave it running for 18 minutes because it causes the water level and the pressurizer to rise they are so fixated on the pressurizer it wasn't until 8 26 in the morning four hours and 26 minutes after the start of the accident after the situation continued Dorson that they finally decided to re-enable high pressure injection and leave it on and they do this largely out of desperation they're not sure what to try at this point to get control of the plant it would take until 10:30 in the morning for these thousand gallon per minutes pumps to cover the core with water ending the primary accident sequence over the next few days there would be continued worry about a radiation release at the plant and so they'd keep monitoring the situation on the ground they'd send teams around the perimeter of the plant with radiation detectors they flew them overhead in helicopters but the redundant redundant containment in the plant did its job no significant radiation release would ever occur there's a lot of public worry about a potential hydrogen explosion because when the zirconium cladding of the fuel rod melts it reacts with the coolant to produce hydrogen but it turns out that public fear was fueled largely by incorrect calculations there wasn't nearly as much hydrogen released as people were afraid there was on Sunday April first four days after the accident President Jimmy Carter and his wife Rosalynn would visit the plant tour the control room to reassure the American public about the safety of nuclear power and to reassure them that the situation at Three Mile Island was well under control he would later convene an investigatory Commission that would result in this report on the accident that I've drawn a lot of the facts for this talk today from Three Mile Island unit two would be written off as a total loss a 500 million dollar investment completely written off three months after it began operation about 20 tons of melted uranium ended up at the bottom of the core another 10 tons has blob together there in the middle this is what they found when they began the initial cleanup in 1983 you're looking at severed melted fuel rods that ended up at the bottom of the reactor the final cost of the initial cleanup just over 1 billion dollars and it took 14 years and they're still not done Three Mile Island unit two is still standing in the middle of the Susquehanna River you can see unit 1 here on your right it's still operating it's still producing electricity final cleanup of unit 2 won't take place until unit 1 is decommissioned and that's currently scheduled to take place in 2034 that's what happened how did these four men miss so many signs along the way that their reactor was in the middle of a loss of coolant accident why don't they just leave the emergency core cooling system on when it activated why didn't they close the block valve sooner Sidney Dekker and has booked the field guide to understanding human error introduces the concept of first stories and second stories and the story I've just told you of Three Mile Island is a first story intentionally so first stories focus on the humans in the story and what they should have done differently a first story inevitably lays blame for the accident at the feet of the humans involved and the decisions they made this is problematic for a couple of reasons there's a couple of biases that we all have the first is hindsight bias turns out that when you review an event after its occurred and you know the outcome you automatically exaggerate your own ability to have predicted and prevented that outcome this is known sometimes as the I saw it all along effect an example of that here is all that water in the sump had to be coming from somewhere I know nothing about nuclear reactors and I would have figured out that there was a leak the second is outcome bias it turns out that once you know the outcome of a situation you carry the full weight of that outcome into evaluating every decision that led to it it makes you more willing to judge those decisions and it makes you more likely to judge them harshly a good example here is that knowing the outcome of this is a partial meltdown turning off the emergency core cooling system early in the accident looks like a really moronic decision so which we do instead we should look for the second story there's always a second story buried under that first story in a second story human error is seen as an effect of systemic vulnerabilities deeper inside the organization not a result of bad decision-making or failure to follow instructions so how do we get to a second story we we have to dig into decisions from the perspective of the people who made those decisions we have to try to see the world through their eyes we have to work to consider the messy reality that they were faced when they made the decision not the cleanroom conditions that your hindsight gives you and we have to look through the lens of positive intent with the belief that everyone involved made the best decisions they could with the information they had so let's see if we can find some second stories from Three Mile Island let's start early in the sequence why in the world did Fred Shi Minh make the call to turn off the emergency core cooling system five minutes into the accent well find our answer in the pressurizer in his deposition of the presidential inquiry Fred Siemens says that he turned off the emergency core cooling system because it was causing the water level in the pressurizer to rise and he was afraid that the pressurizer was going to quote go solid unquote that's a phrase that appears throughout this deposition this whole crew was worried about the pressurizer going solid so what does that mean well remember that one of the pressurizer zki jobs is to absorb pressure shocks to the system letting it go solid is to let it fill up with water to the point that it can no longer absorb those pressure saw his pressure shocks so that makes sense he doesn't want the pressurizer to go solid but he has to know that the core is in danger why does his concern for the pressurizer override his concern for the core well that answer goes all the way back to Admiral Hyman rickover in the early days of the nuclear Navy turns out that bill ze Fred Shima ed Frederick and Craig Faust were all former naval nuclear reactors and the naval reactor training designed by Admiral rickover had drilled into these man that keeping keeping the pressurizer from going solid was the single most important job of a nuclear reactor operator that actually makes sense on a submarine the reason is that a 1960s era submarine produces 12 megawatts of thermal energy for its propulsion Three Mile Island unit two in order to make 906 megawatts of electricity because of in efficiencies in the system has to produce 2841 megawatts of heat that's a lot of heat remember that when you scram a reactor the primary heat production stops immediately but there's still decay heat going on and it takes a while for that to get heat to cool down in a submarine reactor that decay heat is trivial it's about 780 kilowatts you can essentially just ignore it if the reactor was completely uncovered this would not be enough heat to do any damage in a power reactor that 6.5% of decayed heat is a hundred and eighty-five megawatts of heat if you don't continually carry that heat away it will cause damage to the fuel in a submarine a water hammer with no shock absorption is literally the worst case scenario where it could result in a loss of propulsion and a disabled ship carrying that mentality into the operation of a power reactor were far worse things are possible is a huge system and vulnerability one that was unreal eyes before the Three Mile Island accident and so Fred Shima faced with a rising pressurizer inferred that the system was full of water already allowing the emergency core cooling system to continue high pressure injection would overfill the system risking a full pressurizer and so in an effort to keep the reactor safe he turned off emergency core cooling look at another one why did bill Z we not close the block valve when he first checked the the outlet valve temp the outlet tote pipe temperature if you'll remember the reported outlet temperature was 228 degrees Fahrenheit and the procedures of the plant called for the block valve to be shut if it's anything over 200 degrees it turns out that at Three Mile Island unit to the pilot-operated relief valve had been leaking almost since the first day of operation very small leak just a little bit of steam and it was such an insignificant issue that it actually wouldn't be fixed until the first refueling shut down the consequences of that leak were that the outlet valve temp the outlet temperature of the pilot-operated relief valve was regularly over 200 degrees Fahrenheit on an almost daily basis and so bill Z we had been conditioned that seeing temperatures above 200 degrees despite what the reactor operation manual said were okay and when he evaluated that temperature he thought about it in terms of well the pilot-operated relief valve was just venting really hot water it's normally about 200 degrees 228 doesn't seem unreasonable to me so that's part of it the other part is when he looked at the control panel to check the position of the pilot-operated relief valve he saw that it was green indicating the valve was closed but that's not actually what that light meant the light on the control panel only indicated the signal that Bent's it to the valve by the computer a green light simply meant that the computer had told the valve to close it was not coupled the physical position of the valve the only way to know the actual position of the pilot-operated relief valve was to infer it from the outlet temperature and so bills ewing assimilating all the information that he had at his disposal and considering the full pressurizer left the block valve open so the pilot-operated relief valve could still respond if there was a pressure spike he left the valve open to keep the reactor safe one more this is quick when I promise how did the crew mist significance of the simple arm that much water in the sump is obvious how did they not know they had a coolant link the answer is really simple I never got the alarm the control room it through my island relayed alarm conditions to the the crew in two ways number one is this row of lights on the wall and there's a corresponding row on the other side about 600 alarm lights in total and on a given day when the plant is running exactly as it's designed 40 to 50 of these would be on there very noisy there's also no rhyme or reason to where they're placed one of the most important alarm lights in the entire system the reactor pressure alarm is right next to a light that indicates that the elevator and the containment building is stuck the third problem of these is they don't indicate any chronology you can't tell by looking at them when an alarm turned on and what's new since the last time you looked at the panel they did have an answer for that one they had an alarm printer every time an alarm would go off this printer would print a line describing the alarm the only problem is it's connected to the computer by a 300 baud serial connection very very slow and so less than an hour into the accident after more than a hundred alarms have gone off it would take the printer two and a half hours to finish printing all the alarms so there's no way the operators can keep up with the flood of information that's being directed at them and so they just don't see the simple arm they don't get the message that the sump is full so how do we implement this idea of first and second stories with our teams dr. Decker has some helpful advice for us first when we're trying to figure out why something wrong we agree on a baseline rule that human error is never the cause human error is always a symptom of underlying systemic problems or problem so blaming an issue on human error keeps us from figuring out what really went wrong a good way of helping frame the conversation in these terms is to ask what is responsible for an outcome not whose fault it is second principle is to understand why it made sense the people on your teams don't come to work intending to do a bad job chances are when they make a decision that you don't understand they had a very good reason why they did it take the time to see the world through their eyes and understand why their decision made sense third seek forward accountability not backwards our instinct when things go wrong is often to figure out who's responsible and punish them when we try to move our organizations away from blame and towards finding second stories one of the most common objections is but what about holding people accountable turns out that removing punishment actually frees people up to candidly share their stories of what happened so you can learn from them instead of those experiences getting swept under the rug if you've implemented blameless post-mortems in your organization you've seen this but there's another part of this that's very important it's not talked about very often the act of telling the story of what happened of giving their account and owning their part in it is generally all the accountability that well-intentioned people need to improve their already beating themselves up for the decision that they made they're already upset that something bad has happened they don't need systemic blame and punishment they don't need shame it doesn't help anybody it just teaches them not to share what happened and try to hide it backwards accountability looks to blame somebody for past events forward accountability seeks to help people tell the story of what happened and come to terms with it and focus on the work necessary for change and improvement going forward the beauty of this technique is that it's so broadly applicable there's always a second story if you're willing to do the work to find it this will work when somebody drops the production database it'll work when your team is an important deadline it'll work when a key team member chooses to leave it'll even work when sales misses their quarterly sales goal it requires honesty and building trust but it's worth it because finding the second story is such a powerful way for your team to grow and improve and it allows you to treat your teammates with the humanity that they so that they deserve it goes back to the psychological safety that Julia was talking about earlier this is a great way to build psychological safety in your team it turns out that who destroyed Three Mile Island it's not a fair question at all question we should be asking is what destroyed Three Mile Island and thankfully that's the question that the President's Commission asked check out the subtitle of their report this report is full of second stories in those second stories revealed weaknesses in reactor design and operator training throughout the nuclear industry worldwide by getting past human error to the real causes of the accident at Three Mile Island the President's Commission made the world a safer place if you take the time to find the second stories for everything that happens not just your outages you'll make your organization a safer place for the people who work there and you'll fix the things that impact your delivery speed and quality best of luck [Music] [Music]

Channel: The Lead Developer

Views: 305,779

Rating: 4.8815169 out of 5

Keywords: The Lead Developer Austin 2018, lead dev Austin, lead dev, white October events, Nickolas Means, Who Destroyed Three Mile Island?, lead developer conference, lead dev conference, lead developer, who destroyed three mile island, three mile island, nickolas means 2018, tech lead

Id: 1xQeXOz0Ncs

Length: 37min 6sec (2226 seconds)

Published: Wed Mar 21 2018