This is TVA's Sequoyah Nuclear Plant Simulator. I worked in Operations and Training in that plant and simulator for almost 20 years. I was there in the 90's and 2000's. The only person I know is the instructor in the dark blue shirt sitting on the left out of the picture most of the time but walking around and consulting. I'll use generic terms for the crew members so most will understand. The fella in the maroon shirt is a (Post TMI) Shift Technical Advisor. He is a reactor engineer that verifies the event and reaction to the event. He gives no direction to the licensed crew but does verify crew decisions and give input to the crew should it be necessary. The lady standing at the front is the Control Room Supervisor (CRS). It looks like she is doing very little but she is the focal point for the procedures selected and usage of them. She verifies and directs the reactor operators through the procedures. The light blue and white shirt guys are Reactor Operators (ROs). ROs perform the (memorized) immediate actions for a reactor trip to ensure all plant functions occur as designed for a reactor trip (control rods fully inserted, turbine tripped, and etc.), and then perform other procedure functions as directed by the CRS. They check alarms and silence them once the alarms are verified. The fella sitting with the hoodie is the Shift Supervisor (SS). He is the most senior operations person on shift. Once arriving in the control room he monitors and verifies the crew actions and assists the CRS in decision making. This crew has seen this before. These crews get hundreds of hours of classroom and simulator instruction before they get to this point. The post reactor trip immediate actions are pretty much over 1 min into the event. By that time the crew would already know from the alarms, indictors and Safety Assessment Computer that the event is a Large Break Loss of Coolant Accident (LOCA) and Safety Injection (SI). The CRS ensures that the RO's perform the immediate actions and then directs the crew into a large break local emergency procedure, and that procedure would give the hundreds of follow-up actions for the event. This is a noisy event because of the pressures and level changes and emergency equipment (diesel generators, pumps and valves) actuations that occur throughout the event. Also many of the alarms are redundant or for reoccurring actions. The dings are when a parameter giving an alarm clears after it has been acknowledged. A Large Break LOCA could empty the reactor within just a few minutes; however, the SI Actuation isolates the containment building, starts backup cooling water pumps to send flow to the reactor, and hundreds of other actions to maintain reactor integrity. Most of this video is the crew performing the follow-up functional recovery procedures that verify SI occurred as designed. The colors of the video are way off. It's not that depressing. All in all, it's pretty cool.
Do they ever throw actual events from other plants at these trainees? I'm thinking of the incident in sweden where the national grid was accidentally shorted outside the plant, and all the triple-redundant backup power generators failed in indentical ways? (eventually some engineer running around the place noticed that despite national grid being dead, a weak utility line from the local utulity was still live, and he/she tied plant critical bus to that line and saved the day),
It’s a simulator. It’s used for new engineers, certifications, and CEU. That’s why they’re filming. It’s likely a control room crew going for recertification or accreditation of some sort.
after TMI a lot changed and everyone has to go through this multiple times a year sometimes their will be no failures. this training makes sure that people don't get complacent and bravado that nothing will go wrong.
@@carter608this is a to-scale simulator of the reactor control room. It is required by law so all operators are familiar with the specific plants. (Source: working on my Reactor Op License)
Worked on several simulators just like this over my career. Started in '86 and finally retired in '19, so 33 years. Computers and the simulation model software grew and became more and more realistic over the decades. One of the greatest compliments I ever heard was from the crew that was on shift during the 2003 blackout in the northeast. Afterward a crew member told me, "It was hairy, just like in the simulator. Total loss of off-site power and reactor scram."
During my career I satisfyingly heard many times, after turbine trips, reactor trips, LOOPs, (Loss Of Offsite Power) etc., from the operators on shift at the time of the event "It was just another simulator exercise". The events I personally observed in person in the control room were identical to that in the simulator. Although I am sure a higher levels of stress hormones would be present, I would expect the same response even in the event of an accident such as in the video above a LB-LOCA (Large Break - Loss Of Coolant Accident), MSLB (Main Steam Line Break), or a STGR (Steam Generator Tube Rupture), or any variation of these three accident categories. I am responding to many of these posts because I strongly perceive the public does not at all perceive how precise and scripted everything is in the control room and this includes everything from normal operations, off normal conditions such as an instrument failure, to any variation of all three accident categories. I am sure the video above does not make this appear to be the case but it certainly is. BTW, for multiple reasons I perceive the video above is about 20 years old but the current culture of control room professionalism, verbatim without exception procedural guidance for everything, human error prevention techniques, etc. have all been present since the mid to late 80s.
I was a simulator software engineer. I remember watching one brand new trainee that had just started training watch the Reactor Vessel Head during a depressurization event say “I’ve got a void in my head!”
That blackout was in 2003, not 2013. I was in the TMI-1 control room at the time, and grid frequency was all over the map. We almost tripped, but pulled through. Most of the big units North and East of us went down, coal and nukes.
@@garysmith8593 - After the Texas winter grid crisis a few years back, it was common to blame it on the fact that ERCOT was isolated. However, even an inter-connected grid like the northeast can import grid disturbances.
probably to still keep a sense of urgency, while not being completely overwhelmingly annoying and cause a sensory overload. but hey, im no nuclear engineer XD
@@ObamaTookMyCat I think you are 100% correct. An experienced operator can also probably tell which alarms are still active based on which overtones they’re hearing. It really is smart design.
That’s the kind of thing that most people don’t ever think about. I wouldn’t doubt that the operators probably don’t know that, they just react to the alarms. Great observation! These control rooms were designed and installed in the late 60’s, 70’s, and 80’s. Mechanical gauges everywhere, thousands of annunciator lights, hundreds, if not thousands of mechanical switches and buttons, and then the alarms are thrown in the mix. When all of those alarms start going off at once I don’t know how they can hear what’s going on. Engineers have to make sure that certain alarms are heard over others but they also have to limit as much alarm noise as possible so that the operators can still communicate with each other. It’s not like a fire alarm where the intent is to convey danger and to have you get out of the building immediately. These alarms are more important considering what they are hooked up to. But you want the operators to be able to talk to one another. Just one of many details that have to be taken into consideration. I’m sure it’s somewhat similar to commercial airliners, where several of them are working through checklists that exist for each potential problem that they can pull out once they know what the problem actually is. Then they can work through it and disable alarms by turning certain things on or off or whatever. It’s very fascinating! To think that a group of engineers had to sit down prior to the construction of a plant like this and make sure that every pump, valve, sensor, fan, electrical contact, etc…has an indicator light and/or gauge and a control mechanism of some sort, whether that be a toggle switch or large turn knob, is amazing. I will be anxious to see what the control room for future new nuclear plants will look like. Probably similar to what’s happened with airplanes. Lots of computer screens, hardly and mechanical gauges, and even more automation. But, also like airplanes I’m sure they will still have certain instruments that will be mechanical/analog for backup in case of a failure with the primary computer system. Who knows. That’s just speculation on my part.
some of them I recognise from telephone exchanges - the single chime bar for example, and the slightly faster single bell tone You can actually discern the priority of the alarm, and probably the urgency of the condition it represents from the tempo of each alarm sound. If you listen back to it, you hear them clear down the fastest alarm tones first, leaving the slowest until almost last. Same with the blinkenlights - a slow blinking annunciator is likely lower priority than a fast blinking one etc.
"We have absolutely zero radiation leaks" "Sir, the room and everything in it are literally glowing green" "He's delusional. Take him to the infirmary."
Very Real Life. I was I&C tech at Robinson Nuclear in the 80s and Simulator Tech until 1995. This brings back memories of dedicated highly skilled individuals that work everyday as a team.
Coming from the aviation industry I'm impressed by the amount of sound alarms and multiple displays for various systems faults. I'm aware that the people that operate those systems are highly trained, but I can see they becoming overwhelmed by multiple faults being depicted multiple times on several panels in a real scenario. I would assume the newer powerplants probably have some sort of centralization and priority handling by computer over the information that gets shown to the crew right?
Yeah, theres like 4 different sounds at once, and close to dozen individual alarms throughout the video. Surely some of them are redundant and guy doing X doesn't need to be constantly reminded that something entirely different at Y broke? Or is it so integrated that it's a must? I am not in aviation but watched some crash videos and know that newer planes have actual effort put into the sound design, and not overwhelming and tirening the pilots with alarms. I would hope newer reactors do this as well. On the upside, reactors always were more passively safe&failsafe then planes, and there rarely is a direct threat to guys in the control room, so one could argue that stress levels are lower then on planes? As well as having 5 crew instead of just 2 pilots?
Some of it isn't obvious, but most alarm panels have some 'key' alarms that are identified in some way. Some plants even have some of the alarm windows color-coded in some way. When following emergency procedures, they 'home in' on specific instruments and alternate indications of key parameters and know right where to look. You might liken it to a pilot, when he gets a 'stick shake' for a stall warning, he knows instinctively to look at artificial horizon and air speed indications despite the wide array of other instruments. (no, I'm not a pilot, but that's an example of the point I'm trying to make).
Well the stick shaker is more an intuitive thing like you said, it is rooted on the pilot's training since their first couple hours. I was comparing it more with the systems alarm and fault manager like the EICAS stuff. We have a bunch of systems that corelate to each other and when one or some of them fails the computer will centralize the alarms and give you a list of what failed based on its priority to the safety of the flight. So you have one master caution or master warning alarm and a list that can be expanded to display what failed. In the past we kinda had that thing where a bunch of panels would flash a large amount of lights and multiple different alarms would sound individually.
Yeah, you're seeing 1960's technology. Also note people are going all over, doing actions from memory, without a checklist or second set of eyes. It's all obsolete from human factors perspective. To compensate and bring the risk levels down, there's a huge amount of drilling, it's around 25% of operator's time is in training. But it's still a poor design, an operator missed two lights and we had the Three Mile Island meltdown.
I don't work in nuclear power plant but I do work on a ship as the boiler engineer and the amount of dials and gauges can be overwhelming to a newbie. But this takes what I see on a daily basis to a whole new level.
TMI had "global silence" on their annunciators. Active alarms still blinked but the noise of all those alarms inhibits clear voice communication. Admiral Rickover suggested it when he visited our plant after the "accident"". I was I&C there for 28 years.
A relatively large number of comments below reference what appears to be chaos, people running around, and other thoughts that certainly are not accurate and do not reflect what happens in the real world. The word "terrifying" was used in one comment. There are also many comments about things the operators are required to do that are misinterpreted in a negative way. I feel a need to clarify what really happens as, although retired for a number of years now, I feel compelled to provide an accurate picture of what really occurs and it is certainly not what is portrayed above. This appears to me to be a very informal amateur video during maybe even an impromptu demonstration event. There are far too many people in the control room and people are distractingly wandering around in places they do not need to be or belong. The real event (control room and simulator) will typically have only two board operators (manipulating the controls), one unit supervisor managing the event and reading the procedure, and the senior manager/supervisor in a mostly silent out of the way, but absolutely vital role, keeping the big picture. In a simulator scenario/evaluation there will always additionally be mostly a single floor instructor/evaluator but that person(s) stay(s) back in an unobtrusive position. Control room staff all wear "uniforms" that might only be a defined color slacks (like dockers) and either a button down color defined shirt or polo shirt (usually with a logo printed on them). As part of the culture to maintain an unremitting highly professional atmosphere, jeans, T shirts, etc. became banned in the mid 80s at most plants. There is also a lot less distracting chaotic noise level than portrayed by this video. The annunciator alarm sounds are still there but not once in my years of experience were they so loud to be distracting. In fact, it was never my experience that the noise level ever reached a level to require anything more than a slightly raised voice. The alarm is loud enough to be sure it is heard but never so loud to require shouting over it to be heard. The type of sound is not harsh, at least in the plants I am familiar with. I also never experienced the annoying unrelenting cacophony of so many multiple different audible alarms at the same time. The beginning of an event almost always eventually results with a number of annunciators coming in (sometimes many). This, of course, immediately gets the operators attention. The need for a reactor and/or turbine trip very quickly becomes obvious (if needed - might be a manageable instrument malfunction) and, if so, instantly drives the two board operators into their four immediate actions (as in the event above and applicable for the Westinghouse plant above). Its hard to hear but the operators calling out their immediate actions can be heard. The pointing at instruments and controls is a required and trained response that 1) is an excellent human error reduction thing and 2) lets an evaluator know one is looking at the right things. If there is a need for a reactor and/or turbine trip, no matter what, requires going to the entry point procedure in the EOP (Emergency Operating Procedure) network or package. The unit supervisor (the woman above) then starts reading the procedure. She starts reading after she hears the call outs from the board operators to the four immediate actions. She starts at step 1 reading/repeating the already completed immediate actions and continues directing step by step from the procedure. The EOP package is comprehensively designed to diagnose, verify, direct everything, and take effective action if a "Response Not Obtained (RNO)". No one takes any action that is not directed by the supervisor with verbatim compliance to the procedure she is reading. Also, every verbal instruction/communication requires a three-way verification and independent verification is required for every control manipulation - none of that is seen above. In parallel with this, there is an appropriately trained and degreed engineer present (a post TMI requirement), called a Shift Technical Advisor (STA), that also is required to stay out of the way, keep the big picture, and monitor a different set of critical but very high priority parameters. In the real control room, all unnecessary personnel will be immediately ushered out of the controlled area (probably the entire control room) and the only people remaining will be those directly responding to the event. The overall order, deliberate responses, lack of any but necessary conversation, professionalism, etc. conveys a very calm controlled environment, not at all the chaos that is felt in the video above. If you could see a real event taking place, not an informal demo, there would be much less people and movement, the annunciators would be silenced more frequently (albeit not locked in), much structure to everyone's actions and motions, and an overall slow deliberate order/response type thing taking place. I did check out a few other videos but a brief search found nothing that truly provides the satisfying, albeit complex, deliberate, precise, well trained dance, that actually defines these events. The operations world in commercial power is an arcane culture with many components not at all obvious to those not exposed to it. Please keep this in mind when forming opinions of these videos. It is now heavily influenced by the nuclear navy approach (I was not in the military). There are exceptions to everything but that is extremely limited in this world as human error prevention, structure, verbatim procedural compliance, professionalism absolutely apply to everything, even the response to a worst case accident. There is zero reason, ever, for an operator to take sudden heroic action and any operator that comes into this world with a hero mindset does not succeed (I have see people kicked out of the program for that). Again, I have to emphasize, the chaotic depiction in the video above does not represent the real world, at least in any plant I was in over a 40+ year career, 20 years of which were directly associated with operations (I held an SRO). The real world is actually much more mundane and would make piss poor material for a movie if accuracy was important.
Well-said. The Nuclear Navy has brought a positive safety and communications culture to nuclear power. But, as you also know, commercial nuclear plant operators have always had a similar mindset, since many of these people have the same, or similar, backgrounds. These plants do differ greatly from nuclear powered vessels in their size, complexity, and operation. And, as you can attest, the emergency response of a nuclear power plant's safety systems happens in a blink of the eye, so the key role of the operator, and the entire crew, is to monitor and manage these actions - adding an additional level of oversight and intelligence to the systems and their responses. And these actions are all governed by rigorous adherence to the procedures - reinforced by extensive training.
I remember reading about a coal fired power station in the ‘60s, it was going to be a quiet Sunday afternoon. Then some old favourite TV show aired, it might have been “The Ghost and Mrs Muir”, everyone turned on their vacuum tube TVs and power demand crept up and apparently caused a minor panic. In the aftermath there was some reviewing of TV programs and other public events that might cause a spike in demand. In those days, Melbourne was notorious for being shut down on Sunday afternoon.
As I understand it with modern western reactors next to each actual control room there is a simulator room. Teams work in periodic shifts so for example whilst a team is on the actual control room for say 6 weeks another team is on the simulator for the same period.
The simulator is typically in a dedicated training building; at least in every plant I was in. Controls rooms became sacred territory in the 80s with limited access, not so much for security (which is still very important) but to keep unwanted distractions (people not needing to be there) out. Anyone, including senior corporate managers, must get permission from a licensed supervisor to enter the control room. A very long time ago I witnessed an operator tell the on site plant VP "Its your plant and you certainly don't need my permission". That licensed operator got three days off without pay. Since the simulator environment is also very closely tied to classroom and evaluation activities, a need for debriefing rooms after every scenario, frequent visitors who can inadvertently do harm in the real control room, outside evaluators including the NRC, etc., it is not likely anyone wants the simulator in the "Protected Area" especially near the control room. I never was in a plant that had a visitors gallery like in the China Syndrome movie overlooking the real control room. There might be some but I highly doubt it as the simulator provides everything to a visitor the real control room does. The exact duplication of the real thing by the simulators are uncannily accurate in appearance and response. The only difference I could ever point out were the TV cameras in the ceiling and somewhat better cleanliness. With respect to training, at least what was required in a previous un-retired life, every six weeks all licensed operators had to attend one week of "Licensed Operator Continuing Training". It probably has different names at different plants but most just say "requal". The week consisted of four days with 4 classroom hours and 4 simulator hours each day. Friday was exam day with a written exam (4 hours) and graded simulator evaluations (4 hours). Once each year was NRC required annual requal that also included written and simulator exams. Anyone failing had a second chance for a makeup exam but lost 50% of their sizeable retention bonus. Second failure cost the entire bonus and an extensive get well program, maybe. Part of the evaluation also included an in-plant walk through with an evaluator for prescribed certain tasks. These kinds of things make the job of a licensed reactor operator a very high stress job. Over the years I saw the shift schedule change a number of times. Years ago there were three eight hour shifts each day and each week the crew rotated eight hours to the next shift (I forget which direction they rotated). It caused everyone to be in almost continuous jet lag and that, of course, is a real human error precursor. It eventually changed to a complex schedule of 12 hour shifts for three or four days, three or four days off, and every six weeks or so an entire week off. That appeared to be a lot friendlier to human beings. I do not know what the norm is now but I suspect some variation of this varying from plant to plant.
Yes, I have ejected management from my control room. Even the NRC asks permission to enter. I have also allowed visitors to approach the control board but told them to not break the plane of the rail below the panel. Once I had some folks come in with non-English speaking folks and one pointed to the turbine trip button. I grabbed his hand and stopped the tour. They could observe from 20 feet away after then incident. Their Interpreter explained and they apologized. It is with respect and caution that you operate and observe the control room.@@bmwem9291
@@bmwem9291San Onofre 2&3 had a visitors gallery overlooking the control room, which became their Technical Support Center. Susquehanna may also have one.
It does a very good job getting ones focus in all cases but that is not necessarily anxiety. I felt more anxiety when I was evaluated on the simulator than I ever did in the control room. For a number of years I was a simulator instructor/evaluator and felt the most anxiety when evaluating others as something I would miss or be wrong about could effect someones income and job.
Maybe it's being recorded some type of tinted one-way glass or Something. So maybe that why it Looks green. But yeah it's look like the Green in the Cartoons... 😁😁😁
@@RobloxCoreGamer I have no idea what I'm looking at though for that one. Can't see any text. And I used my own personal experience of Columbia. I'm not familiar with the controls here.
The ability to survive with a simultaneous failure of offsite power, and an RCS break in the worst possible location -- is what they were testing at Chernobyl. The test was succesful - unfortunately subsequent to the completion of the test the reactor exploded
The local two nukes love it when that happens. NRC put them on the watch list because they went down 4 times in one year. Because offsite power went down, they also went down. In a hurry. But like the old B-52s, they will be running even after I am dead. Currently permitted for 60 years of operation and may get an extension to 80 years. Dad was there when they first went online and took a voluntary retirement after 18 years. He started as a Helper and retired as a Plant Supervisor 3.
That's an unforseen consequence of not being able to foresee all possible consequences. Basically games designers are one step ahead and the sound designer makes sure all alert sounds are distinctly identified by frequency. Because this is what happens if they are generated based on a computer clock.
I work in a chemical industry where control rooms are way bigger and it is all on computer screens with redundant power supply.. I would not like that amount of sirens all at the same time, real scary
@@jimskywaker4345 Yep they should have unionised to protect that job! Robots taking the jobs of humans... It is unconscionable!! en.wikipedia.org/wiki/Scram#:~:text=Scram%20is%20sometimes%20cited%20as,the%20world's%20first%20nuclear%20reactor.
i like how they have a manual to read through to try and figure it out, thats about as helpful as the manual in the cockpit of a plane ! safety first !
Planes have very extensive manuals, larger the plane thicker the book, some emergencies procedures are by memory but most of the time the pilots do have to read the manual during an emergency
A nuclear power plant has tens of thousands of variables during operation, only someone who has spent 30 years in the business can eventually know the majority of them, so the operators have operation manuals they can reference to diagnose and solve a problem. The first and main thing they learn though is that if there is a power excursion they can press the SCRAM button to shut the reactor down, and with the exception of Chernobyl (based on a very bad reactor design) the SCRAM button always works.
The aircraft industry has "checklists" and we have volumes of multi page, detailed, sometimes lengthy, procedures. The checklists in airplanes are usually relatively short (even each ECAM screen on modern jets) whereas nuclear plants have volumes of procedures that are each very specific for every possible event. In an airplane one pilot flies while the other pilot, mostly independently, handles the appropriate checklist. In the control room of a PWR plant as in the video above, during an event, there are two licensed board operators doing control manipulations only as directed by a licensed supervisor that reads the appropriate procedure step to the board operators. The supervisor reading, reads a step to the appropriate operator, the operator repeats back the instruction, the supervisor verifies the repeat back, and then the operator takes the action. There is no rushing no matter what and everything is very deliberate. No one memorizes the procedures (except for very limited immediate actions) but the procedures are taught at length in the classroom, written tested on (open book), and practiced so many times in the simulator that everyone knows whats coming next and why, albeit not verbatim memorized. The reader is also required to use place keeping techniques so if distracted does not lose his/her place in the procedure. In some cases, due to the control room layout, an operator must take an action not visible by the reader. In the video above there is a lot of switch manipulations going on independently and I cannot explain what that is about. In the video above the reader is the woman. She is required to be a supervisor with an SRO (Senior Reactor Operator) license. A limited number of procedures have so called immediate actions that must be memorized. The number of immediate actions in a procedure are also very limited. In the video above they had an accident (a Large Break LOCA) that, as designed, caused a reactor/turbine trip. Any reactor trip, manual or automatic, except during a normal planned shutdown as directed by procedure, requires entry into a specific procedure (E0) that starts with four immediate actions. You can hear the board operators calling out their immediate actions although it is hard to hear that in the video above. The supervisor initially orders "E0 Immediate Actions" and then pauses while the board operators verify them. Then she starts reading the steps. In this case each procedure step has two columns. The left column is the desired action or parameter condition and the right column is what to do if that desired condition is not met (Response Not Obtained or RNO).
Not entirely so. Starting around 2000 the many ubiquitous mechanical strip chart recorders were replaced with electronic color LCD screens and, at least in one plant I recently visited, all the old L&N mechanical strip charts were gone. This change was very welcome in many respects. No more paper rolls to change, no ink carts, no paper jams, no ink smears, no tearing/annotating/filing the previous 24 hours of paper, etc. The electronic recorders are much easier to read and much friendlier for an operator in many respects. With respect to gauges, some have been changed with the much less friendly electronic LED bar graphs etc. I have not seen one electronic gauge in any of the control rooms I have been in as human friendly as an analog gauge. In the plant I was trained on the mechanical analog gauges had needles that move vertically against a vertical scale. Everyone of the many consequential instrument channels usually have three or four redundant channels with the gauges adjacent and abutting each other. It was very very human friendly to just glance at a board filled with gauges and instantly see the one needle that was not where it belonged. I could never do that so quickly and accurately with the new and better whiz-bang led instruments. Last month I was in a control room that still had almost all these analog gauges still in place. IMO these analog gauge design and their placement was an excellent example of outstanding human engineering dating back to the mid 1960s.
Reactor Trip (verified 4 indicators checked), Turbine Trip (check breakers, steam admission valves and lack of load), Power to 1E busses (check voltage and pot lights), had SI actuated? (check 4 inputs, any auto alignment of SI components or SI signals present). If not SI then pull E0 procedure, IF SI indicated or actuated then continue with other 12 steps of automatic operator actions and then pull E1 procedure. If you are up for the "game" then you can expect after each scenario about an hour going over questions and the video explaining how and why you performed every movement/action/communication during the "game". Of course, leave your feelings outside and don't take comments or critique as personal but instead as a way to improve reliability and performance, thus improving safety. Yes, you are graded and if you fail then you are given more training and once chance to reperform but it will not be the exact same simulation. If you fail twice then leave your badge and keys with your supervisor or HR.
can someone explain what a reactor trip is? my assumption is that its where the reactor scrams when operators are trying to do something but I believe this assumption might be wrong
A reactor trip is a sudden shutdown of the reactor by rapid insertion of the control rods either by an automatic signal generated by the Reactor Protection System or by an operator. Normally, reactors are shutdown by gradual, controlled insertion of control rods.
The video event simulates a so called "Design Basis Accident", in this case a "Large Break Loss of Coolant Accident" or LB-LOCA. There is, depending on the plant and my 20+ years of memory (since I once had it all memorized), somewhere around 25,000 gallons of water circulating through the reactor and the steam generators, all inside the massive concrete and steel lined containment building. Three or four, depending on the plant, 6,000 horsepower pumps keeps all this water circulating between the reactor and steam generators. This water is not boiling but it is at a pressure circa 2250 psig and at an average temperature of 574 degrees F or even higher. The pipes, if I remember correctly, are over three feet in diameter. The accident above assumes a worst case complete circumferential break of one of these pipes, almost instantly exposing all that hot high pressure water to the atmospheric pressure inside the containment building. That means all those tens of thousands of gallons of water instantly flashes to steam, leaving the reactor core void of anything but steam. A lot of multiple and massively redundant sensors instantly sense this event and initiate a lot of stuff including a reactor trip (although that happens naturally when the water is suddenly replaced by steam), a turbine trip, and a so called "Safety Injection". The reactor trip signal allows gravity to pull all the control rods into the core, the Turbine trip signal causes all the huge turbine steam valves to almost instantly close stopping about ten million pounds per hour of steam flow, and multiple start signals are sent to all redundant trains of pumps etc. to make sure there is a huge amount of water from a 300,000 gallon tank quickly pumped or injected into the core to prevent core damage - this is called an "SI" or Safety Injection signal. In the video above you see and hear (with difficulty) the operators responding to the sudden onset of this event. The first things they do (from memory and called "Immediate Actions") is verifying the stuff I just described plus electrical power (1-Rx Trip, 2-Turbine Trip, 3-Power on electrical busses, and 4-is there an SI?). The reader (the woman in this case) then starts reading the procedure and, strictly from the procedure only, directing the operators to take action to make anything happen that didn't automatically happen as it was supposed to. This accident was historically considered worst case and is practiced so many times in the simulator that it is, at least it was to me, routine although I expect if for real Adrenalin levels probably would rise a bit. The plant is designed in depth to take care of itself in these events for a moderate period of time without operator action. If the operators at TMI had let the plant take care of itself we probably would not have ever had heard of it.
The W/CE/B&W PWR plants call automatic or instant manual reactor shutdowns "Trips". GE BWR plants call the same thing a "Scram". If the reactor is intentionally shutdown for a planned shutdown that is usually not a trip or scram. However, even in a planned shutdown, the shutdown procedure sometimes allows the operator at a very low power level (meaning minimal or no sudden thermal change) to just "trip the reactor" in lieu of manually step by step driving rods all the way into the core.
Large RCS break is easy, just sit back an let the automatic systems do their thing. Loss of Off site requires at least one EDG start and load sequencer. It is the small breaks that can turn bad real quick.
Lots of training in the simulator. After doing a Loss of Coolant Casualty so many times, you can memorize what alarms come in and when they do. That also doesn't count the numerous times these operators have read the procedure for qualification/testing. Like others have said, the reactor is protecting itself with built-in Reactor Protection Systems that have multiple redundancies to insure the core remains covered with water.
The hundreds of little square lights above the control panels are called "annunciators". Each one is used to alert the operator of an off normal parameter or condition. Today all plants use a so called "Black Board" approach which means no annunciator is lit if everything is normal (this was not the practice in the distant past where there were always some squares lit "normally"). This is a humans error prevention factor so the operators do not get used to seeing a lit panel as normal and any lit annunciator means something is amiss and must be addressed. Although each frosted plastic cover is engraved with a description, during normal and off normal ops, an annunciator response procedure is immediately opened to the page associated with the specific lit panel. This page provides necessary actions, the various inputs and associated set-points that can trigger the alarm, references to other procedures etc. When something causes a reactor and/or turbine trip, too many windows light up to practically address each one but these events require immediate entry into the emergency procedure package. Eventually, after things settle down, all of the probably many lit annunciators will be individually addressed. Some off-normal events, such as an instrument failure, will probably cause multiple windows to light. Via the simulator, the operators learn how to prioritize what is addressed first and may even, in a few cases, require one or two memorized immediate actions. Via repeated simulator training, operators learn to recognize patterns of lit windows so during many instrument failures, as an example, the pattern of lit squares instantly tells the trained operator what instruments he should be looking at. 25 years later, as an example, I still remember those geometric light patterns for steam generator level channel failures. Any time something signals a window to light, the window starts to blink and an audible alarm sounds. Buttons are installed in multiple locations to just silence the audible alarm anytime. A second button is available to lock in the alarm and stop the blinking. The lock in button needs to be pushed at an appropriate time so operators can identify any new signals causing additional alarms. These type of annunciators date to well before computers. Since the 70s a plant data monitoring computer provides a real time print out with a time stamp to the hundredth of a second for every single alarm. This print out provides the forensic evidence for the post trip review to learn what initiated the event. However, before computers there still needed to be a way of figuring out what caused the event. To accomplish this each annunciator panel has whats called "First Out" panels that blink a different color so it is possible to retain a sort of crude but very useful memory of the initiating event(s). Even with all the computers now the First Out features are still there (at least so I understand).
@@zlanNickel The annunciators, all the rectangular windows at the very top of all the vertical control panels, are all dark (no light behind them) when whatever parameter it is monitoring is in the expected condition. If that parameter is not in accordance with a previously defined range of values, position, etc., it then starts flashing without any intentional color (there is a specific exception I'll explain later). The color might appear yellowish but that is not intentional. When it starts flashing it is also accompanied with an audible alarm. The operators then have a choice of two buttons to push, one only silences the audible alarm, the other both silences the alarm and stops the flashing ("locks it in"). There is strict protocol for when it is acceptable to push these buttons. The one exception, to no intentional color, is a holdover from conventional plants and the ancient days (maybe 1960s and earlier) before data logging printers and computers. For a simple event like an instrument failure, only a small handful of windows may light, and it is very straight forward for the operator to know what happened. However, a major event, like something that trips the plant, can bring in hundreds of windows. This still does not present any problem for the operators with respect to knowing how to respond but it does present a major problem later when it is necessary to understand what happened and, very importantly, what initiated the event. Therefore, for certain major events, there are so called "First Out" windows that light up red. These red lit "First Outs" provide(d) a diagnostic aid in determining what initiated the event. My time in control rooms started in the early 80s. Even at that time (I think starting in the 70s) there were computers that monitored only (no control function) hundreds or thousands of parameters. I remember a big ass, very loud, high speed dot matrix printer in the center of the control room. If everything was steady state quiet, and the printer actuated, the sound instantly got everyone's attention. This really negated the need for first outs but, at least twenty-five years ago, when I still was active in the Ops world, the first outs were maintained and always looked at. In the obsession today for computer screens I do not know if this is still important. I recently read an accident analysis for a large new cruise ship that not too long ago lost all propulsion in very heavy seas due to low oil levels in all their diesel lube sumps and almost drifted into rocks. It seemed unforgivable to me that the control center alarm panel consisted of computer screens (maybe just one) that simply texted a line item for each alarm. The alarms were not categorized and the same screen with low lube oil alarms also included alarms for broken toilets, etc. The low lube oil alarms were common, so the operators became inured to them and did not respond to them appropriately. There are (were) other much smaller annunciator panels that did use colors. For reliability, safety, etc., there are multiple redundant instrument channels. For example, you do not want a single failed instrument to prevent a safety actuation from taking place nor do you want a single failed instrument from causing a spurious actuation. Therefore, depending on the plant, function, etc., there might be three or four parallel redundant channels. Two out of three logic or similar, as an example, might be used. In at least the W plant I was trained on, there was a panel, about the size of a large computer monitor, with four rows of postage stamp size windows. Each row represented a specific instrument channel and had a specific color. I seem to remember red, blue, green, orange but too many years and too many dead brain cells at this time. The wonderful human friendly analog instruments on the panels also had a color code adjacent to them so the specific instrument channel and power supply it was associated with was instantly obvious. Most switches that start and stop equipment, open/close valves, etc. have a red and a green light associated with them. Red means energy is flowing (the circuit breaker is closed, the valve is open, etc.) and green means no energy is flowing. For valves in mid travel, both the red and green lights are lit. I only saw one exception to this convention in the early 1970s. I designed the switchgear (very large electrical distribution equipment) for a large national industrial manufacturing company that used a continuous process. Thier convention specified everything should be green if in the expected position so anything that might stop or slow down production was instantly visible. I thought and still do think this convention was insanely unsafe but was unable to even offer my opinion then. With respect to convention, I mentioned in the first paragraph above that all the hundreds of annunciators were dark when whatever parameter it is monitoring is in the expected condition. This was not originally the case. Up until, I think, the late 90s, there was always a large handful of windows normally lit. As a human factors thing, always lit annunciators inured operators to seeing an abnormal condition, even though the ones that remained lit were "normal" for the existing status of the plant. Now, no window is allowed to be lit if everything is in the expected condition. I understand the aircraft industry has adopted this dark panel practice in commercial cockpits for all status indicators. If any widow lights, without exception, the "Annunciator Response Procedure" must be immediately referenced for that specific window.
@@zlanNickel @zlanNickel The annunciators, all the rectangular windows at the very top of all the vertical control panels, are all dark (no light behind them) when whatever parameter it is monitoring is in the expected condition. If that parameter is not in accordance with a previously defined range of values, position, etc., it then starts flashing without any intentional color (there is a specific exception I'll explain later). The color might appear yellowish but that is not intentional. When it starts flashing it is also accompanied with an audible alarm. The operators then have a choice of two buttons to push, one only silences the audible alarm, the other both silences the alarm and stops the flashing ("locks it in"). There is strict protocol for when it is acceptable to push these buttons. The one exception, to no intentional color, is a holdover from conventional plants and the ancient days (maybe 1960s and earlier) before data logging printers and computers. For a simple event like an instrument failure, only a small handful of windows may light, and it is very straight forward for the operator to know what happened. However, a major event, like something that trips the plant, can bring in hundreds of windows. This still does not present any problem for the operators with respect to knowing how to respond but it does present a major problem later when it is necessary to understand what happened and, very importantly, what initiated the event. Therefore, for certain major events, there are so called "First Out" windows that light up red. These red lit "First Outs" provide(d) a diagnostic aid in determining what initiated the event. My time in control rooms started in the early 80s. Even at that time (I think starting in the 70s) there were computers that monitored only (no control function) hundreds or thousands of parameters. I remember a big ass, very loud, high speed dot matrix printer in the center of the control room. If everything was steady state quiet, and the printer actuated, the sound instantly got everyone's attention. This really negated the need for first outs but, at least twenty-five years ago, when I still was active in the Ops world, the first outs were maintained and always looked at. In the obsession today for computer screens I do not know if this is still important. I recently read an accident analysis for a large new cruise ship that not too long ago lost all propulsion in very heavy seas due to low oil levels in all their diesel lube sumps and almost drifted into rocks. It seemed unforgivable to me that the control center alarm panel consisted of computer screens (maybe just one) that simply texted a line item for each alarm. The alarms were not categorized and the same screen with low lube oil alarms also included alarms for broken toilets, etc. The low lube oil alarms were common, so the operators became inured to them and did not respond to them appropriately. There are (were) other much smaller annunciator panels that did use colors. For reliability, safety, etc., there are multiple redundant instrument channels. For example, you do not want a single failed instrument to prevent a safety actuation from taking place nor do you want a single failed instrument from causing a spurious actuation. Therefore, depending on the plant, function, etc., there might be three or four parallel redundant channels. Two out of three logic or similar, as an example, might be used. In at least the W plant I was trained on, there was a panel, about the size of a large computer monitor, with four rows of postage stamp size windows. Each row represented a specific instrument channel and had a specific color. I seem to remember red, blue, green, orange but too many years and too many dead brain cells at this time. The wonderful human friendly analog instruments on the panels also had a color code adjacent to them so the specific instrument channel and power supply it was associated with was instantly obvious. Most switches that start and stop equipment, open/close valves, etc. have a red and a green light associated with them. Red means energy is flowing (the circuit breaker is closed, the valve is open, etc.) and green means no energy is flowing. For valves in mid travel, both the red and green lights are lit. I only saw one exception to this convention in the early 1970s. I designed the switchgear (very large electrical distribution equipment) for a large national industrial manufacturing company that used a continuous process. Thier convention specified everything should be green if in the expected position so anything that might stop or slow down production was instantly visible. I thought and still do think this convention was insanely unsafe but was unable to even offer my opinion then. With respect to convention, I mentioned in the first paragraph above that all the hundreds of annunciators were dark when whatever parameter it is monitoring is in the expected condition. This was not originally the case. Up until, I think, the late 90s, there was always a large handful of windows normally lit. As a human factors thing, always lit annunciators inured operators to seeing an abnormal condition, even though the ones that remained lit were "normal" for the existing status of the plant. Now, no window is allowed to be lit if everything is in the expected condition. I understand the aircraft industry has adopted this dark panel practice in commercial cockpits for all status indicators. If any widow lights, without exception, the "Annunciator Response Procedure" must be immediately referenced for that specific window.
Water pressure in to reactor, water pressure out of the reactor. Neutron propagation , stand by control rod insertion, standby diesel backup for cooling water , slow reaction in core reduce 10%. Notification of potential reactor shutdown to all on list. Verify cooling system flow with no cavitation of steam in out flow cooling water.
I will never again think that my control room looks old. This thing looks ancient! Also, this is the slowest E-0 I have ever seen. I am a license continuing training instructor at my plant.
Waiting for somebody to re-create this in Roblox and make it also to 100% functional....man, that would be CRAZY. There already are games on Roblox related to MCRs etc. like this but not as detailed as that. But for the love of god, add working automatic controls too. Dunscom August 30th Tech Demo is a great example of how to scare away people who rely on automatic controls because this game's MCR is a full manual system with no existing auto.
I don't think it would be at all "terrifying" although I am sure Adrenalin levels would go up - a big difference. Operators regularly (like for one week out of every six) practice a multitude of accident scenarios repeatedly in the simulator. For multiple reasons, I am certain what you see in the video above is probably an informal demonstration for some group of visitors and does not at all convey, in multiple aspects, the order, structure, and precision that is part of both the real control room and real training/evaluation simulator scenarios. Anything formal in the simulator, including ALL training/practice scenarios, must be conducted as exactly as it would be in the real control room. For example, it is not at all acceptable to ever refer to the simulator, when in the simulator, as "the simulator", for example. There are three, and only three, basic accident categories (Loss Of Coolant, Tube Rupture, Main Steam Line Break) and, of course, many variations of each. Although long overdue IMO, in the mid 1980s the owner's group of each brand of "Nuclear Steam Supply System" (Westinghouse, CE, B&W, and GE) all developed a very well thought out and comprehensive EOP (Emergency Operating Procedure) Package for each of their designs. I am only intimately familiar (at least was) with the W package as that is what I was trained on but I am sure the others are just as excellent. The W package is large and very structured. There are very well defined entry points to start using the package and the package covers every credible accident including a number of incredible accidents that are not part of the design basis because they are not considered credible events. Everything is prioritized, so there is zero confusion if multiple events take place. Absolute verbatim compliance is required and certainly enforced. There is no, and I mean absolutely NO, cases, like in the movies and commercials (Holiday Inn Express) where an operator must suddenly take unscripted heroic action to save the planet. The terminology is rigidly standardized and adhered to. I once saw an operator in training fail a simulator evaluation for saying "make it happen" ala Captain Picard (he eventually was dropped from the program for similar transgressions). As soon as some event occurs that requires use of the EOPs, a supervisor with an SRO (Senior Reactor Operators) license takes a physical position intentional back from the panels/controls and starts reading the procedure steps. He/she directs every single action taken from the written procedures and NEVER steps out of that role. Three way communication requiring repeat backs is required for each instruction given. Additionally, that supervisors boss, has no defined place to be, but has clear accountability of keeping "the big picture" and is not permitted, ever, to drop out of that role. The result of all this continuously practiced, ad nauseam, and unrelentingly enforced structure is an almost automatic detailed expectation of what the procedures are going to do. It is also clearly understood that following the procedures as trained, doing exactly what the procedure packages specify, may not prevent a financial disaster for the stock holder (that may have already happened when whatever broke, broke), but will absolutely prevent compromising "the health and safety of the public". I do not remember the plant but a number of years ago some plant had a "Steam generator tube rupture". This is a major event, and, if not appropriately handled, can lead to a small but unacceptable release of radioactive gasses to the environment (although a small release it would be considered unacceptable because it would be greater than that which the plant was designed and licensed for). The operators handled this event exactly as scripted and practiced and later commented that it was just like a simulator scenario. It has been about 20 years since I was directly in the operations arena but I clearly remember thinking that my stress level in a real accident naturally would certainly elevate but probably not more so than the stress I felt of failing an evaluated simulator scenario, especially when my retention bonus would be threatened by a failure. Notice I said "evaluated". I clearly remember the stress level of an evaluated exam, especially the yearly ones with maybe a senior manager and an NRC inspector observing from the "booth", were much more stressful (but certainly not at the terrifying level) than I anything I expected to feel in a real event. If one learns and practices a complex event to the point of ad nauseam, as is the case here, then one reaches a level of familiarity and competence that makes the emotions lean much more to an orderly expected familiar structure and confidence than terror. In fact, immediately after a simulator scenario started, typically, there would be a period a period of normal ops, then maybe one or two instrument or equipment failures that would not necessarily trip the plant. These failures, although clearly driven by procedure like everything else, were stressful because many of them deviously were designed to test ones understanding of integrated plant operation. The not so much joke during these parts of the scenario was "I cannot wait for the accident to happen because then I will be in the clear detailed control of the EOP network".
@mattaddison1910 agreed. If you get to a given panel 2 seconds faster and end up hitting the wrong switch, then there's no point to saving those 2 seconds.
_PA: (Alarms blaring) Warning! Problem in sector 7-G._ "ZZZZZZZ......ZZZZZZZZ.....Huh?.....Noise!.....Bad Noise!....." _PA: 5 minutes before critical mass._ "Critical wha? OK, OK, don't panic. Whosever this problem is, I'm sure they know how to handle it." _(Popping noise...looking at core temperature indicator that is maxed out)_ "IT'S MY PROBLEM...WE'RE DOOMED!"
I assume you are referring to the color of the panels. In this case, the green appears very exaggerated probably due to the color temperature of the fluorescent lighting not matching that expected by the recording device. I have seen the panels painted in various colors but never so bright and so saturated as above. Typically muted green, grey, or tan shades are used. The colors, as in airplanes, are intended to be non-distracting.
This is TVA's Sequoyah Nuclear Plant Simulator. I worked in Operations and Training in that plant and simulator for almost 20 years. I was there in the 90's and 2000's. The only person I know is the instructor in the dark blue shirt sitting on the left out of the picture most of the time but walking around and consulting. I'll use generic terms for the crew members so most will understand. The fella in the maroon shirt is a (Post TMI) Shift Technical Advisor. He is a reactor engineer that verifies the event and reaction to the event. He gives no direction to the licensed crew but does verify crew decisions and give input to the crew should it be necessary. The lady standing at the front is the Control Room Supervisor (CRS). It looks like she is doing very little but she is the focal point for the procedures selected and usage of them. She verifies and directs the reactor operators through the procedures. The light blue and white shirt guys are Reactor Operators (ROs). ROs perform the (memorized) immediate actions for a reactor trip to ensure all plant functions occur as designed for a reactor trip (control rods fully inserted, turbine tripped, and etc.), and then perform other procedure functions as directed by the CRS. They check alarms and silence them once the alarms are verified. The fella sitting with the hoodie is the Shift Supervisor (SS). He is the most senior operations person on shift. Once arriving in the control room he monitors and verifies the crew actions and assists the CRS in decision making.
This crew has seen this before. These crews get hundreds of hours of classroom and simulator instruction before they get to this point. The post reactor trip immediate actions are pretty much over 1 min into the event. By that time the crew would already know from the alarms, indictors and Safety Assessment Computer that the event is a Large Break Loss of Coolant Accident (LOCA) and Safety Injection (SI). The CRS ensures that the RO's perform the immediate actions and then directs the crew into a large break local emergency procedure, and that procedure would give the hundreds of follow-up actions for the event. This is a noisy event because of the pressures and level changes and emergency equipment (diesel generators, pumps and valves) actuations that occur throughout the event. Also many of the alarms are redundant or for reoccurring actions. The dings are when a parameter giving an alarm clears after it has been acknowledged. A Large Break LOCA could empty the reactor within just a few minutes; however, the SI Actuation isolates the containment building, starts backup cooling water pumps to send flow to the reactor, and hundreds of other actions to maintain reactor integrity. Most of this video is the crew performing the follow-up functional recovery procedures that verify SI occurred as designed.
The colors of the video are way off. It's not that depressing. All in all, it's pretty cool.
I wish I knew what they were saying fully, Some of the things they are saying are kind of hard to understand because it is inaudible
what is the background and/or education required to even get a job in a nuclear reactor?
Do they ever throw actual events from other plants at these trainees? I'm thinking of the incident in sweden where the national grid was accidentally shorted outside the plant, and all the triple-redundant backup power generators failed in indentical ways? (eventually some engineer running around the place noticed that despite national grid being dead, a weak utility line from the local utulity was still live, and he/she tied plant critical bus to that line and saved the day),
Lovely in depth comment! Thumbs up for taking the time for writing
Ah - was going to ask if this was simulator training.
It’s a simulator. It’s used for new engineers, certifications, and CEU. That’s why they’re filming. It’s likely a control room crew going for recertification or accreditation of some sort.
after TMI a lot changed and everyone has to go through this multiple times a year sometimes their will be no failures. this training makes sure that people don't get complacent and bravado that nothing will go wrong.
Normally done every 6 weeks
i dont believe this control room is a simulator
This real condition, not simulator
@@carter608this is a to-scale simulator of the reactor control room. It is required by law so all operators are familiar with the specific plants. (Source: working on my Reactor Op License)
Worked on several simulators just like this over my career. Started in '86 and finally retired in '19, so 33 years. Computers and the simulation model software grew and became more and more realistic over the decades.
One of the greatest compliments I ever heard was from the crew that was on shift during the 2003 blackout in the northeast. Afterward a crew member told me, "It was hairy, just like in the simulator. Total loss of off-site power and reactor scram."
During my career I satisfyingly heard many times, after turbine trips, reactor trips, LOOPs, (Loss Of Offsite Power) etc., from the operators on shift at the time of the event "It was just another simulator exercise". The events I personally observed in person in the control room were identical to that in the simulator. Although I am sure a higher levels of stress hormones would be present, I would expect the same response even in the event of an accident such as in the video above a LB-LOCA (Large Break - Loss Of Coolant Accident), MSLB (Main Steam Line Break), or a STGR (Steam Generator Tube Rupture), or any variation of these three accident categories. I am responding to many of these posts because I strongly perceive the public does not at all perceive how precise and scripted everything is in the control room and this includes everything from normal operations, off normal conditions such as an instrument failure, to any variation of all three accident categories. I am sure the video above does not make this appear to be the case but it certainly is. BTW, for multiple reasons I perceive the video above is about 20 years old but the current culture of control room professionalism, verbatim without exception procedural guidance for everything, human error prevention techniques, etc. have all been present since the mid to late 80s.
I was a simulator software engineer. I remember watching one brand new trainee that had just started training watch the Reactor Vessel Head during a depressurization event say “I’ve got a void in my head!”
That blackout was in 2003, not 2013. I was in the TMI-1 control room at the time, and grid frequency was all over the map. We almost tripped, but pulled through. Most of the big units North and East of us went down, coal and nukes.
@@garysmith8593 - After the Texas winter grid crisis a few years back, it was common to blame it on the fact that ERCOT was isolated. However, even an inter-connected grid like the northeast can import grid disturbances.
@@garysmith85932003 vs 2013. Well of course you're right. My brain just did a whoops there. Thanks, I've corrected it.
Keeping all the alarms in the same key (and making it minor key) is actually genius.
probably to still keep a sense of urgency, while not being completely overwhelmingly annoying and cause a sensory overload. but hey, im no nuclear engineer XD
@@ObamaTookMyCat I think you are 100% correct. An experienced operator can also probably tell which alarms are still active based on which overtones they’re hearing. It really is smart design.
That’s the kind of thing that most people don’t ever think about. I wouldn’t doubt that the operators probably don’t know that, they just react to the alarms. Great observation!
These control rooms were designed and installed in the late 60’s, 70’s, and 80’s. Mechanical gauges everywhere, thousands of annunciator lights, hundreds, if not thousands of mechanical switches and buttons, and then the alarms are thrown in the mix. When all of those alarms start going off at once I don’t know how they can hear what’s going on.
Engineers have to make sure that certain alarms are heard over others but they also have to limit as much alarm noise as possible so that the operators can still communicate with each other. It’s not like a fire alarm where the intent is to convey danger and to have you get out of the building immediately. These alarms are more important considering what they are hooked up to. But you want the operators to be able to talk to one another. Just one of many details that have to be taken into consideration.
I’m sure it’s somewhat similar to commercial airliners, where several of them are working through checklists that exist for each potential problem that they can pull out once they know what the problem actually is. Then they can work through it and disable alarms by turning certain things on or off or whatever. It’s very fascinating! To think that a group of engineers had to sit down prior to the construction of a plant like this and make sure that every pump, valve, sensor, fan, electrical contact, etc…has an indicator light and/or gauge and a control mechanism of some sort, whether that be a toggle switch or large turn knob, is amazing. I will be anxious to see what the control room for future new nuclear plants will look like. Probably similar to what’s happened with airplanes. Lots of computer screens, hardly and mechanical gauges, and even more automation. But, also like airplanes I’m sure they will still have certain instruments that will be mechanical/analog for backup in case of a failure with the primary computer system. Who knows. That’s just speculation on my part.
some of them I recognise from telephone exchanges - the single chime bar for example, and the slightly faster single bell tone
You can actually discern the priority of the alarm, and probably the urgency of the condition it represents from the tempo of each alarm sound. If you listen back to it, you hear them clear down the fastest alarm tones first, leaving the slowest until almost last.
Same with the blinkenlights - a slow blinking annunciator is likely lower priority than a fast blinking one etc.
"We have absolutely zero radiation leaks"
"Sir, the room and everything in it are literally glowing green"
"He's delusional. Take him to the infirmary."
When I say no radiation i mean there is a certain amount
Not great not terrible
Dyatlov really was a horrible person
Very Real Life. I was I&C tech at Robinson Nuclear in the 80s and Simulator Tech until 1995. This brings back memories of dedicated highly skilled individuals that work everyday as a team.
Coming from the aviation industry I'm impressed by the amount of sound alarms and multiple displays for various systems faults. I'm aware that the people that operate those systems are highly trained, but I can see they becoming overwhelmed by multiple faults being depicted multiple times on several panels in a real scenario. I would assume the newer powerplants probably have some sort of centralization and priority handling by computer over the information that gets shown to the crew right?
Yeah, theres like 4 different sounds at once, and close to dozen individual alarms throughout the video. Surely some of them are redundant and guy doing X doesn't need to be constantly reminded that something entirely different at Y broke? Or is it so integrated that it's a must?
I am not in aviation but watched some crash videos and know that newer planes have actual effort put into the sound design, and not overwhelming and tirening the pilots with alarms. I would hope newer reactors do this as well. On the upside, reactors always were more passively safe&failsafe then planes, and there rarely is a direct threat to guys in the control room, so one could argue that stress levels are lower then on planes? As well as having 5 crew instead of just 2 pilots?
Some of it isn't obvious, but most alarm panels have some 'key' alarms that are identified in some way. Some plants even have some of the alarm windows color-coded in some way. When following emergency procedures, they 'home in' on specific instruments and alternate indications of key parameters and know right where to look.
You might liken it to a pilot, when he gets a 'stick shake' for a stall warning, he knows instinctively to look at artificial horizon and air speed indications despite the wide array of other instruments. (no, I'm not a pilot, but that's an example of the point I'm trying to make).
Well the stick shaker is more an intuitive thing like you said, it is rooted on the pilot's training since their first couple hours.
I was comparing it more with the systems alarm and fault manager like the EICAS stuff. We have a bunch of systems that corelate to each other and when one or some of them fails the computer will centralize the alarms and give you a list of what failed based on its priority to the safety of the flight. So you have one master caution or master warning alarm and a list that can be expanded to display what failed.
In the past we kinda had that thing where a bunch of panels would flash a large amount of lights and multiple different alarms would sound individually.
Yeah, you're seeing 1960's technology. Also note people are going all over, doing actions from memory, without a checklist or second set of eyes. It's all obsolete from human factors perspective. To compensate and bring the risk levels down, there's a huge amount of drilling, it's around 25% of operator's time is in training. But it's still a poor design, an operator missed two lights and we had the Three Mile Island meltdown.
I don't work in nuclear power plant but I do work on a ship as the boiler engineer and the amount of dials and gauges can be overwhelming to a newbie. But this takes what I see on a daily basis to a whole new level.
I wish I could get those alarm sounds as an audio file man, Those alarms sound so sick
you can get some of them, the bell sfx is an edwards signal product and they have the file
@@w4drone720 I have found that one, But I dont think the others are publically available
TMI had "global silence" on their annunciators. Active alarms still blinked but the noise of all those alarms inhibits clear voice communication. Admiral Rickover suggested it when he visited our plant after the "accident"". I was I&C there for 28 years.
A relatively large number of comments below reference what appears to be chaos, people running around, and other thoughts that certainly are not accurate and do not reflect what happens in the real world. The word "terrifying" was used in one comment. There are also many comments about things the operators are required to do that are misinterpreted in a negative way. I feel a need to clarify what really happens as, although retired for a number of years now, I feel compelled to provide an accurate picture of what really occurs and it is certainly not what is portrayed above.
This appears to me to be a very informal amateur video during maybe even an impromptu demonstration event. There are far too many people in the control room and people are distractingly wandering around in places they do not need to be or belong. The real event (control room and simulator) will typically have only two board operators (manipulating the controls), one unit supervisor managing the event and reading the procedure, and the senior manager/supervisor in a mostly silent out of the way, but absolutely vital role, keeping the big picture. In a simulator scenario/evaluation there will always additionally be mostly a single floor instructor/evaluator but that person(s) stay(s) back in an unobtrusive position. Control room staff all wear "uniforms" that might only be a defined color slacks (like dockers) and either a button down color defined shirt or polo shirt (usually with a logo printed on them). As part of the culture to maintain an unremitting highly professional atmosphere, jeans, T shirts, etc. became banned in the mid 80s at most plants. There is also a lot less distracting chaotic noise level than portrayed by this video. The annunciator alarm sounds are still there but not once in my years of experience were they so loud to be distracting. In fact, it was never my experience that the noise level ever reached a level to require anything more than a slightly raised voice. The alarm is loud enough to be sure it is heard but never so loud to require shouting over it to be heard. The type of sound is not harsh, at least in the plants I am familiar with. I also never experienced the annoying unrelenting cacophony of so many multiple different audible alarms at the same time.
The beginning of an event almost always eventually results with a number of annunciators coming in (sometimes many). This, of course, immediately gets the operators attention. The need for a reactor and/or turbine trip very quickly becomes obvious (if needed - might be a manageable instrument malfunction) and, if so, instantly drives the two board operators into their four immediate actions (as in the event above and applicable for the Westinghouse plant above). Its hard to hear but the operators calling out their immediate actions can be heard. The pointing at instruments and controls is a required and trained response that 1) is an excellent human error reduction thing and 2) lets an evaluator know one is looking at the right things. If there is a need for a reactor and/or turbine trip, no matter what, requires going to the entry point procedure in the EOP (Emergency Operating Procedure) network or package. The unit supervisor (the woman above) then starts reading the procedure. She starts reading after she hears the call outs from the board operators to the four immediate actions. She starts at step 1 reading/repeating the already completed immediate actions and continues directing step by step from the procedure. The EOP package is comprehensively designed to diagnose, verify, direct everything, and take effective action if a "Response Not Obtained (RNO)". No one takes any action that is not directed by the supervisor with verbatim compliance to the procedure she is reading. Also, every verbal instruction/communication requires a three-way verification and independent verification is required for every control manipulation - none of that is seen above. In parallel with this, there is an appropriately trained and degreed engineer present (a post TMI requirement), called a Shift Technical Advisor (STA), that also is required to stay out of the way, keep the big picture, and monitor a different set of critical but very high priority parameters. In the real control room, all unnecessary personnel will be immediately ushered out of the controlled area (probably the entire control room) and the only people remaining will be those directly responding to the event. The overall order, deliberate responses, lack of any but necessary conversation, professionalism, etc. conveys a very calm controlled environment, not at all the chaos that is felt in the video above.
If you could see a real event taking place, not an informal demo, there would be much less people and movement, the annunciators would be silenced more frequently (albeit not locked in), much structure to everyone's actions and motions, and an overall slow deliberate order/response type thing taking place. I did check out a few other videos but a brief search found nothing that truly provides the satisfying, albeit complex, deliberate, precise, well trained dance, that actually defines these events.
The operations world in commercial power is an arcane culture with many components not at all obvious to those not exposed to it. Please keep this in mind when forming opinions of these videos. It is now heavily influenced by the nuclear navy approach (I was not in the military). There are exceptions to everything but that is extremely limited in this world as human error prevention, structure, verbatim procedural compliance, professionalism absolutely apply to everything, even the response to a worst case accident. There is zero reason, ever, for an operator to take sudden heroic action and any operator that comes into this world with a hero mindset does not succeed (I have see people kicked out of the program for that). Again, I have to emphasize, the chaotic depiction in the video above does not represent the real world, at least in any plant I was in over a 40+ year career, 20 years of which were directly associated with operations (I held an SRO). The real world is actually much more mundane and would make piss poor material for a movie if accuracy was important.
Four-loop SRO here… I am aligned with this comment in entirety.
Well-said. The Nuclear Navy has brought a positive safety and communications culture to nuclear power. But, as you also know, commercial nuclear plant operators have always had a similar mindset, since many of these people have the same, or similar, backgrounds. These plants do differ greatly from nuclear powered vessels in their size, complexity, and operation. And, as you can attest, the emergency response of a nuclear power plant's safety systems happens in a blink of the eye, so the key role of the operator, and the entire crew, is to monitor and manage these actions - adding an additional level of oversight and intelligence to the systems and their responses. And these actions are all governed by rigorous adherence to the procedures - reinforced by extensive training.
this video was gone for a while, but now it's back up, thanks for getting it back up
I remember reading about a coal fired power station in the ‘60s, it was going to be a quiet Sunday afternoon. Then some old favourite TV show aired, it might have been “The Ghost and Mrs Muir”, everyone turned on their vacuum tube TVs and power demand crept up and apparently caused a minor panic.
In the aftermath there was some reviewing of TV programs and other public events that might cause a spike in demand.
In those days, Melbourne was notorious for being shut down on Sunday afternoon.
- How many alarms do you want?
- Yes
Running procedures. Cool watching them continue to work the program.
This a vast improvement over past alarms, where all you got was the blaring sound of the reactor exploding.
Commencing saucer separation
First, this looks like its from a movie lol. This looks pretty cool! I do realize that mistakes will have a heavy impact on the Nuclear Plant.
Kevin needs a beer.
Great video, thanks for posting. From my observations, this would have been a different ending had Kevin not have been on hand. 🤚
Sounds like normal shift at McDonald‘s in the 90s.
"Ice cream machine's tripped!"
As I understand it with modern western reactors next to each actual control room there is a simulator room. Teams work in periodic shifts so for example whilst a team is on the actual control room for say 6 weeks another team is on the simulator for the same period.
The simulator is typically in a dedicated training building; at least in every plant I was in. Controls rooms became sacred territory in the 80s with limited access, not so much for security (which is still very important) but to keep unwanted distractions (people not needing to be there) out. Anyone, including senior corporate managers, must get permission from a licensed supervisor to enter the control room. A very long time ago I witnessed an operator tell the on site plant VP "Its your plant and you certainly don't need my permission". That licensed operator got three days off without pay. Since the simulator environment is also very closely tied to classroom and evaluation activities, a need for debriefing rooms after every scenario, frequent visitors who can inadvertently do harm in the real control room, outside evaluators including the NRC, etc., it is not likely anyone wants the simulator in the "Protected Area" especially near the control room. I never was in a plant that had a visitors gallery like in the China Syndrome movie overlooking the real control room. There might be some but I highly doubt it as the simulator provides everything to a visitor the real control room does. The exact duplication of the real thing by the simulators are uncannily accurate in appearance and response. The only difference I could ever point out were the TV cameras in the ceiling and somewhat better cleanliness.
With respect to training, at least what was required in a previous un-retired life, every six weeks all licensed operators had to attend one week of "Licensed Operator Continuing Training". It probably has different names at different plants but most just say "requal". The week consisted of four days with 4 classroom hours and 4 simulator hours each day. Friday was exam day with a written exam (4 hours) and graded simulator evaluations (4 hours). Once each year was NRC required annual requal that also included written and simulator exams. Anyone failing had a second chance for a makeup exam but lost 50% of their sizeable retention bonus. Second failure cost the entire bonus and an extensive get well program, maybe. Part of the evaluation also included an in-plant walk through with an evaluator for prescribed certain tasks. These kinds of things make the job of a licensed reactor operator a very high stress job.
Over the years I saw the shift schedule change a number of times. Years ago there were three eight hour shifts each day and each week the crew rotated eight hours to the next shift (I forget which direction they rotated). It caused everyone to be in almost continuous jet lag and that, of course, is a real human error precursor. It eventually changed to a complex schedule of 12 hour shifts for three or four days, three or four days off, and every six weeks or so an entire week off. That appeared to be a lot friendlier to human beings. I do not know what the norm is now but I suspect some variation of this varying from plant to plant.
Yes, I have ejected management from my control room. Even the NRC asks permission to enter. I have also allowed visitors to approach the control board but told them to not break the plane of the rail below the panel. Once I had some folks come in with non-English speaking folks and one pointed to the turbine trip button. I grabbed his hand and stopped the tour. They could observe from 20 feet away after then incident. Their Interpreter explained and they apologized. It is with respect and caution that you operate and observe the control room.@@bmwem9291
@@bmwem9291San Onofre 2&3 had a visitors gallery overlooking the control room, which became their Technical Support Center. Susquehanna may also have one.
It is just a simulator, but it is still pretty damn anxiety inducing.
It does a very good job getting ones focus in all cases but that is not necessarily anxiety. I felt more anxiety when I was evaluated on the simulator than I ever did in the control room. For a number of years I was a simulator instructor/evaluator and felt the most anxiety when evaluating others as something I would miss or be wrong about could effect someones income and job.
I thought nuclear power only glows green in cartoons 😂
Maybe it's being recorded some type of tinted one-way glass or Something. So maybe that why it Looks green. But yeah it's look like the Green in the Cartoons... 😁😁😁
Thank you so much for this. I don't know how you got this video out without getting fired but thank you. My gosh, subscribed for this.
fr same
@WilliamsPlays maybe you should make a video about this one like you did about the safety video of collumbia
@@RobloxCoreGamer I have no idea what I'm looking at though for that one. Can't see any text. And I used my own personal experience of Columbia. I'm not familiar with the controls here.
It was likely a simulator mock-up of the control room
It's a simulation
Hainbach should make an album here
Ah the “warmth” the nuke circuit adds to the drone of overloaded transmission lines.
The Atom, it sings to me.
The Price is Right bell is a center piece to nuclear control rooms
Throw in a loss of offsite power and it’d really be fun.
if the diesel´s start it´ll be ok, if not, see Fukushima
The ability to survive with a simultaneous failure of offsite power, and an RCS break in the worst possible location -- is what they were testing at Chernobyl. The test was succesful - unfortunately subsequent to the completion of the test the reactor exploded
@@DartzIRL test not successful. Lmao 🤣 they had 600 megawatt. Not even enough to drive the turbine.
@@DartzIRL test failed successfully.
The local two nukes love it when that happens. NRC put them on the watch list because they went down 4 times in one year. Because offsite power went down, they also went down. In a hurry. But like the old B-52s, they will be running even after I am dead. Currently permitted for 60 years of operation and may get an extension to 80 years. Dad was there when they first went online and took a voluntary retirement after 18 years. He started as a Helper and retired as a Plant Supervisor 3.
Is it just me or are all those alarms in key?
That's an unforseen consequence of not being able to foresee all possible consequences. Basically games designers are one step ahead and the sound designer makes sure all alert sounds are distinctly identified by frequency. Because this is what happens if they are generated based on a computer clock.
El encendido de un reactor, con lo complejo y delicado que es hace que el chequeo pre- vuelo de 747 sea un juego de niños....😬
That's a cool Christmas tree they got, mine doesn't make noise though, but it's got the blinking lights!
i saw a ripple in that cup of coffee !
I see what you did there. Hehehe. Great movie. I watch it a couple times a year. There was a vibration!!
Are you within limits, Ted?
Jack Lemon’s coffee.
Where's Jack Lemmon when you need him? Get him some damn feed water already!
I work in a chemical industry where control rooms are way bigger and it is all on computer screens with redundant power supply.. I would not like that amount of sirens all at the same time, real scary
Danger Will Robinson, Danger!!
PS: Where is the "Safety Control Rod Axe Man" when you need him???!!
Under the stands at Stagg Field at the University of Chicago.
Single, not safety, and he's been replaced by an automated system, just another example of automation stealing jobs.
@@jimskywaker4345 Yep they should have unionised to protect that job! Robots taking the jobs of humans... It is unconscionable!!
en.wikipedia.org/wiki/Scram#:~:text=Scram%20is%20sometimes%20cited%20as,the%20world's%20first%20nuclear%20reactor.
Woah, a Lost In Space reference in the wild? Never would’ve guessed I’d find one!
Thanks for sharing this simulation and demonstration!
The Backrooms aesthetic really adds to the drama
Why did this video get deleted in the first place and reuploaded?
The first minute of this video is the inside of my brain when work is stressful
those alarms remind me of the sound effects produced by the old school Atari 2600 game system.
i like how they have a manual to read through to try and figure it out, thats about as helpful as the manual in the cockpit of a plane ! safety first !
What else are they supposed to do? Memorize all the checklists?
Can't tell if you're being sarcastic? Pilots literally go through checklists during emergencies.
Planes have very extensive manuals, larger the plane thicker the book, some emergencies procedures are by memory but most of the time the pilots do have to read the manual during an emergency
A nuclear power plant has tens of thousands of variables during operation, only someone who has spent 30 years in the business can eventually know the majority of them, so the operators have operation manuals they can reference to diagnose and solve a problem.
The first and main thing they learn though is that if there is a power excursion they can press the SCRAM button to shut the reactor down, and with the exception of Chernobyl (based on a very bad reactor design) the SCRAM button always works.
The aircraft industry has "checklists" and we have volumes of multi page, detailed, sometimes lengthy, procedures. The checklists in airplanes are usually relatively short (even each ECAM screen on modern jets) whereas nuclear plants have volumes of procedures that are each very specific for every possible event. In an airplane one pilot flies while the other pilot, mostly independently, handles the appropriate checklist. In the control room of a PWR plant as in the video above, during an event, there are two licensed board operators doing control manipulations only as directed by a licensed supervisor that reads the appropriate procedure step to the board operators. The supervisor reading, reads a step to the appropriate operator, the operator repeats back the instruction, the supervisor verifies the repeat back, and then the operator takes the action. There is no rushing no matter what and everything is very deliberate. No one memorizes the procedures (except for very limited immediate actions) but the procedures are taught at length in the classroom, written tested on (open book), and practiced so many times in the simulator that everyone knows whats coming next and why, albeit not verbatim memorized. The reader is also required to use place keeping techniques so if distracted does not lose his/her place in the procedure. In some cases, due to the control room layout, an operator must take an action not visible by the reader. In the video above there is a lot of switch manipulations going on independently and I cannot explain what that is about. In the video above the reader is the woman. She is required to be a supervisor with an SRO (Senior Reactor Operator) license. A limited number of procedures have so called immediate actions that must be memorized. The number of immediate actions in a procedure are also very limited. In the video above they had an accident (a Large Break LOCA) that, as designed, caused a reactor/turbine trip. Any reactor trip, manual or automatic, except during a normal planned shutdown as directed by procedure, requires entry into a specific procedure (E0) that starts with four immediate actions. You can hear the board operators calling out their immediate actions although it is hard to hear that in the video above. The supervisor initially orders "E0 Immediate Actions" and then pauses while the board operators verify them. Then she starts reading the steps. In this case each procedure step has two columns. The left column is the desired action or parameter condition and the right column is what to do if that desired condition is not met (Response Not Obtained or RNO).
High water level in the reactor. What level? Level 8 sir. Can someone turn of the damn alarm I can't think with all that going off.
The alarms was almost electronic compositional music.
it is, I've already sampled it.
Everything's so green!
Someone forgot to set the fluorescent filter on their phone camera.
this looks like a starship engineering section
Wow!! Its true!!!
All those cartoons and video game reactor alarm sound effects...
They really do make those weird sounds
0:07 I keep expecting the Mission Impossible theme song to start.
Guy in the blue shirt is like me trying to adjust my smart thermostat.
You can't convince me they didn't raid the stock alarm sounds of the Doctor Who sound mixers for these alarms. Brilliant. 😂
All sorts of bells and chimes and klaxons and buzzers and... probably small air horns?
Did they try tapping the gauge to check the accuracy of the water level...
Most of the mechanical gauges and strip chart recorders have been replaced by electronic indicators.
You wanna go down there and turn those valves by hand?!
@@sbalneav I can feel the vibrations
Not entirely so. Starting around 2000 the many ubiquitous mechanical strip chart recorders were replaced with electronic color LCD screens and, at least in one plant I recently visited, all the old L&N mechanical strip charts were gone. This change was very welcome in many respects. No more paper rolls to change, no ink carts, no paper jams, no ink smears, no tearing/annotating/filing the previous 24 hours of paper, etc. The electronic recorders are much easier to read and much friendlier for an operator in many respects. With respect to gauges, some have been changed with the much less friendly electronic LED bar graphs etc. I have not seen one electronic gauge in any of the control rooms I have been in as human friendly as an analog gauge. In the plant I was trained on the mechanical analog gauges had needles that move vertically against a vertical scale. Everyone of the many consequential instrument channels usually have three or four redundant channels with the gauges adjacent and abutting each other. It was very very human friendly to just glance at a board filled with gauges and instantly see the one needle that was not where it belonged. I could never do that so quickly and accurately with the new and better whiz-bang led instruments. Last month I was in a control room that still had almost all these analog gauges still in place. IMO these analog gauge design and their placement was an excellent example of outstanding human engineering dating back to the mid 1960s.
@bmwem9291 Obviously you did see the movie.
Reactor Trip (verified 4 indicators checked), Turbine Trip (check breakers, steam admission valves and lack of load), Power to 1E busses (check voltage and pot lights), had SI actuated? (check 4 inputs, any auto alignment of SI components or SI signals present). If not SI then pull E0 procedure, IF SI indicated or actuated then continue with other 12 steps of automatic operator actions and then pull E1 procedure.
If you are up for the "game" then you can expect after each scenario about an hour going over questions and the video explaining how and why you performed every movement/action/communication during the "game". Of course, leave your feelings outside and don't take comments or critique as personal but instead as a way to improve reliability and performance, thus improving safety.
Yes, you are graded and if you fail then you are given more training and once chance to reperform but it will not be the exact same simulation. If you fail twice then leave your badge and keys with your supervisor or HR.
Kevin is the best!
Got the green paint on sale eh?
Someone else said that it's a major color grading issue.
Instructor: "What alarm is this?", Trainee: "This is a B minor 7, sir!", Instructor: "Get the hell out of my simulator!"
I’d love to see the room where the simulation is controlled from. Program a Kobayashi Maru.
can someone explain what a reactor trip is? my assumption is that its where the reactor scrams when operators are trying to do something but I believe this assumption might be wrong
A reactor trip is a sudden shutdown of the reactor by rapid insertion of the control rods either by an automatic signal generated by the Reactor Protection System or by an operator. Normally, reactors are shutdown by gradual, controlled insertion of control rods.
@@KevinBalch-dt8ot so I wasn't completely wrong about it being a sudden reactor scram?
The video event simulates a so called "Design Basis Accident", in this case a "Large Break Loss of Coolant Accident" or LB-LOCA. There is, depending on the plant and my 20+ years of memory (since I once had it all memorized), somewhere around 25,000 gallons of water circulating through the reactor and the steam generators, all inside the massive concrete and steel lined containment building. Three or four, depending on the plant, 6,000 horsepower pumps keeps all this water circulating between the reactor and steam generators. This water is not boiling but it is at a pressure circa 2250 psig and at an average temperature of 574 degrees F or even higher. The pipes, if I remember correctly, are over three feet in diameter. The accident above assumes a worst case complete circumferential break of one of these pipes, almost instantly exposing all that hot high pressure water to the atmospheric pressure inside the containment building. That means all those tens of thousands of gallons of water instantly flashes to steam, leaving the reactor core void of anything but steam. A lot of multiple and massively redundant sensors instantly sense this event and initiate a lot of stuff including a reactor trip (although that happens naturally when the water is suddenly replaced by steam), a turbine trip, and a so called "Safety Injection". The reactor trip signal allows gravity to pull all the control rods into the core, the Turbine trip signal causes all the huge turbine steam valves to almost instantly close stopping about ten million pounds per hour of steam flow, and multiple start signals are sent to all redundant trains of pumps etc. to make sure there is a huge amount of water from a 300,000 gallon tank quickly pumped or injected into the core to prevent core damage - this is called an "SI" or Safety Injection signal. In the video above you see and hear (with difficulty) the operators responding to the sudden onset of this event. The first things they do (from memory and called "Immediate Actions") is verifying the stuff I just described plus electrical power (1-Rx Trip, 2-Turbine Trip, 3-Power on electrical busses, and 4-is there an SI?). The reader (the woman in this case) then starts reading the procedure and, strictly from the procedure only, directing the operators to take action to make anything happen that didn't automatically happen as it was supposed to. This accident was historically considered worst case and is practiced so many times in the simulator that it is, at least it was to me, routine although I expect if for real Adrenalin levels probably would rise a bit. The plant is designed in depth to take care of itself in these events for a moderate period of time without operator action. If the operators at TMI had let the plant take care of itself we probably would not have ever had heard of it.
The W/CE/B&W PWR plants call automatic or instant manual reactor shutdowns "Trips". GE BWR plants call the same thing a "Scram". If the reactor is intentionally shutdown for a planned shutdown that is usually not a trip or scram. However, even in a planned shutdown, the shutdown procedure sometimes allows the operator at a very low power level (meaning minimal or no sudden thermal change) to just "trip the reactor" in lieu of manually step by step driving rods all the way into the core.
scram = trip just different words
trip is used in pwrs and i think gen elec bwrs might use scram, but they still mean the same exact thing
Have you tried turning It off and on again?
I am sure they have tech support for that...
xenon gonna have some fun with that.
Large RCS break is easy, just sit back an let the automatic systems do their thing. Loss of Off site requires at least one EDG start and load sequencer. It is the small breaks that can turn bad real quick.
Where’s the control room that screws with the training room
The annunciation horns are very loud compared with our station.
Damn, this video would be a 1000 times better if we could hear the damn drill!
How does anyone function properly when alarm sirens are screaming...
Lots of training in the simulator. After doing a Loss of Coolant Casualty so many times, you can memorize what alarms come in and when they do. That also doesn't count the numerous times these operators have read the procedure for qualification/testing. Like others have said, the reactor is protecting itself with built-in Reactor Protection Systems that have multiple redundancies to insure the core remains covered with water.
What do each of the alarms mean?
I would also like to know
The hundreds of little square lights above the control panels are called "annunciators". Each one is used to alert the operator of an off normal parameter or condition. Today all plants use a so called "Black Board" approach which means no annunciator is lit if everything is normal (this was not the practice in the distant past where there were always some squares lit "normally"). This is a humans error prevention factor so the operators do not get used to seeing a lit panel as normal and any lit annunciator means something is amiss and must be addressed. Although each frosted plastic cover is engraved with a description, during normal and off normal ops, an annunciator response procedure is immediately opened to the page associated with the specific lit panel. This page provides necessary actions, the various inputs and associated set-points that can trigger the alarm, references to other procedures etc. When something causes a reactor and/or turbine trip, too many windows light up to practically address each one but these events require immediate entry into the emergency procedure package. Eventually, after things settle down, all of the probably many lit annunciators will be individually addressed. Some off-normal events, such as an instrument failure, will probably cause multiple windows to light. Via the simulator, the operators learn how to prioritize what is addressed first and may even, in a few cases, require one or two memorized immediate actions. Via repeated simulator training, operators learn to recognize patterns of lit windows so during many instrument failures, as an example, the pattern of lit squares instantly tells the trained operator what instruments he should be looking at. 25 years later, as an example, I still remember those geometric light patterns for steam generator level channel failures. Any time something signals a window to light, the window starts to blink and an audible alarm sounds. Buttons are installed in multiple locations to just silence the audible alarm anytime. A second button is available to lock in the alarm and stop the blinking. The lock in button needs to be pushed at an appropriate time so operators can identify any new signals causing additional alarms. These type of annunciators date to well before computers. Since the 70s a plant data monitoring computer provides a real time print out with a time stamp to the hundredth of a second for every single alarm. This print out provides the forensic evidence for the post trip review to learn what initiated the event. However, before computers there still needed to be a way of figuring out what caused the event. To accomplish this each annunciator panel has whats called "First Out" panels that blink a different color so it is possible to retain a sort of crude but very useful memory of the initiating event(s). Even with all the computers now the First Out features are still there (at least so I understand).
@@bmwem9291 differnent colors of the alarms? i understand red and amber... but what is blue / green
@@zlanNickel The annunciators, all the rectangular windows at the very top of all the vertical control panels, are all dark (no light behind them) when whatever parameter it is monitoring is in the expected condition. If that parameter is not in accordance with a previously defined range of values, position, etc., it then starts flashing without any intentional color (there is a specific exception I'll explain later). The color might appear yellowish but that is not intentional. When it starts flashing it is also accompanied with an audible alarm. The operators then have a choice of two buttons to push, one only silences the audible alarm, the other both silences the alarm and stops the flashing ("locks it in"). There is strict protocol for when it is acceptable to push these buttons. The one exception, to no intentional color, is a holdover from conventional plants and the ancient days (maybe 1960s and earlier) before data logging printers and computers. For a simple event like an instrument failure, only a small handful of windows may light, and it is very straight forward for the operator to know what happened. However, a major event, like something that trips the plant, can bring in hundreds of windows. This still does not present any problem for the operators with respect to knowing how to respond but it does present a major problem later when it is necessary to understand what happened and, very importantly, what initiated the event. Therefore, for certain major events, there are so called "First Out" windows that light up red. These red lit "First Outs" provide(d) a diagnostic aid in determining what initiated the event. My time in control rooms started in the early 80s. Even at that time (I think starting in the 70s) there were computers that monitored only (no control function) hundreds or thousands of parameters. I remember a big ass, very loud, high speed dot matrix printer in the center of the control room. If everything was steady state quiet, and the printer actuated, the sound instantly got everyone's attention. This really negated the need for first outs but, at least twenty-five years ago, when I still was active in the Ops world, the first outs were maintained and always looked at. In the obsession today for computer screens I do not know if this is still important. I recently read an accident analysis for a large new cruise ship that not too long ago lost all propulsion in very heavy seas due to low oil levels in all their diesel lube sumps and almost drifted into rocks. It seemed unforgivable to me that the control center alarm panel consisted of computer screens (maybe just one) that simply texted a line item for each alarm. The alarms were not categorized and the same screen with low lube oil alarms also included alarms for broken toilets, etc. The low lube oil alarms were common, so the operators became inured to them and did not respond to them appropriately.
There are (were) other much smaller annunciator panels that did use colors. For reliability, safety, etc., there are multiple redundant instrument channels. For example, you do not want a single failed instrument to prevent a safety actuation from taking place nor do you want a single failed instrument from causing a spurious actuation. Therefore, depending on the plant, function, etc., there might be three or four parallel redundant channels. Two out of three logic or similar, as an example, might be used. In at least the W plant I was trained on, there was a panel, about the size of a large computer monitor, with four rows of postage stamp size windows. Each row represented a specific instrument channel and had a specific color. I seem to remember red, blue, green, orange but too many years and too many dead brain cells at this time. The wonderful human friendly analog instruments on the panels also had a color code adjacent to them so the specific instrument channel and power supply it was associated with was instantly obvious.
Most switches that start and stop equipment, open/close valves, etc. have a red and a green light associated with them. Red means energy is flowing (the circuit breaker is closed, the valve is open, etc.) and green means no energy is flowing. For valves in mid travel, both the red and green lights are lit. I only saw one exception to this convention in the early 1970s. I designed the switchgear (very large electrical distribution equipment) for a large national industrial manufacturing company that used a continuous process. Thier convention specified everything should be green if in the expected position so anything that might stop or slow down production was instantly visible. I thought and still do think this convention was insanely unsafe but was unable to even offer my opinion then.
With respect to convention, I mentioned in the first paragraph above that all the hundreds of annunciators were dark when whatever parameter it is monitoring is in the expected condition. This was not originally the case. Up until, I think, the late 90s, there was always a large handful of windows normally lit. As a human factors thing, always lit annunciators inured operators to seeing an abnormal condition, even though the ones that remained lit were "normal" for the existing status of the plant. Now, no window is allowed to be lit if everything is in the expected condition. I understand the aircraft industry has adopted this dark panel practice in commercial cockpits for all status indicators. If any widow lights, without exception, the "Annunciator Response Procedure" must be immediately referenced for that specific window.
@@zlanNickel @zlanNickel The annunciators, all the rectangular windows at the very top of all the vertical control panels, are all dark (no light behind them) when whatever parameter it is monitoring is in the expected condition. If that parameter is not in accordance with a previously defined range of values, position, etc., it then starts flashing without any intentional color (there is a specific exception I'll explain later). The color might appear yellowish but that is not intentional. When it starts flashing it is also accompanied with an audible alarm. The operators then have a choice of two buttons to push, one only silences the audible alarm, the other both silences the alarm and stops the flashing ("locks it in"). There is strict protocol for when it is acceptable to push these buttons. The one exception, to no intentional color, is a holdover from conventional plants and the ancient days (maybe 1960s and earlier) before data logging printers and computers. For a simple event like an instrument failure, only a small handful of windows may light, and it is very straight forward for the operator to know what happened. However, a major event, like something that trips the plant, can bring in hundreds of windows. This still does not present any problem for the operators with respect to knowing how to respond but it does present a major problem later when it is necessary to understand what happened and, very importantly, what initiated the event. Therefore, for certain major events, there are so called "First Out" windows that light up red. These red lit "First Outs" provide(d) a diagnostic aid in determining what initiated the event. My time in control rooms started in the early 80s. Even at that time (I think starting in the 70s) there were computers that monitored only (no control function) hundreds or thousands of parameters. I remember a big ass, very loud, high speed dot matrix printer in the center of the control room. If everything was steady state quiet, and the printer actuated, the sound instantly got everyone's attention. This really negated the need for first outs but, at least twenty-five years ago, when I still was active in the Ops world, the first outs were maintained and always looked at. In the obsession today for computer screens I do not know if this is still important. I recently read an accident analysis for a large new cruise ship that not too long ago lost all propulsion in very heavy seas due to low oil levels in all their diesel lube sumps and almost drifted into rocks. It seemed unforgivable to me that the control center alarm panel consisted of computer screens (maybe just one) that simply texted a line item for each alarm. The alarms were not categorized and the same screen with low lube oil alarms also included alarms for broken toilets, etc. The low lube oil alarms were common, so the operators became inured to them and did not respond to them appropriately.
There are (were) other much smaller annunciator panels that did use colors. For reliability, safety, etc., there are multiple redundant instrument channels. For example, you do not want a single failed instrument to prevent a safety actuation from taking place nor do you want a single failed instrument from causing a spurious actuation. Therefore, depending on the plant, function, etc., there might be three or four parallel redundant channels. Two out of three logic or similar, as an example, might be used. In at least the W plant I was trained on, there was a panel, about the size of a large computer monitor, with four rows of postage stamp size windows. Each row represented a specific instrument channel and had a specific color. I seem to remember red, blue, green, orange but too many years and too many dead brain cells at this time. The wonderful human friendly analog instruments on the panels also had a color code adjacent to them so the specific instrument channel and power supply it was associated with was instantly obvious.
Most switches that start and stop equipment, open/close valves, etc. have a red and a green light associated with them. Red means energy is flowing (the circuit breaker is closed, the valve is open, etc.) and green means no energy is flowing. For valves in mid travel, both the red and green lights are lit. I only saw one exception to this convention in the early 1970s. I designed the switchgear (very large electrical distribution equipment) for a large national industrial manufacturing company that used a continuous process. Thier convention specified everything should be green if in the expected position so anything that might stop or slow down production was instantly visible. I thought and still do think this convention was insanely unsafe but was unable to even offer my opinion then.
With respect to convention, I mentioned in the first paragraph above that all the hundreds of annunciators were dark when whatever parameter it is monitoring is in the expected condition. This was not originally the case. Up until, I think, the late 90s, there was always a large handful of windows normally lit. As a human factors thing, always lit annunciators inured operators to seeing an abnormal condition, even though the ones that remained lit were "normal" for the existing status of the plant. Now, no window is allowed to be lit if everything is in the expected condition. I understand the aircraft industry has adopted this dark panel practice in commercial cockpits for all status indicators. If any widow lights, without exception, the "Annunciator Response Procedure" must be immediately referenced for that specific window.
Water pressure in to reactor, water pressure out of the reactor. Neutron propagation , stand by control rod insertion, standby diesel backup for cooling water , slow reaction in core reduce 10%. Notification of potential reactor shutdown to all on list. Verify cooling system flow with no cavitation of steam in out flow cooling water.
Man, I guess people are motivated to fix this so that machine just shuts the hell up.
I will never again think that my control room looks old. This thing looks ancient! Also, this is the slowest E-0 I have ever seen. I am a license continuing training instructor at my plant.
Newer isn't necessarily better, you know many modern trains actually run their computer systems on windows 95
The colors are way off, it’s doesn’t actually look like that
the alarms from @4:15 to @5:00 are kind of spooky sounding.
RCS as in reactor cooling system?
Yes.
Navy nuke here.
You don't say, "twenty-five." You say, "two five." Communications are KEY in the operation of a nuclear power plant!
is ths the seqoya nuclear plant
Looks like the bridge of the Battlestar Galactica. 😛
imagine a janitor has to turn the Reactor management AI back on, "saveing" the plant and avoiding damages
How do you NOT have sample of the line from Dark City as a master alarm?
This reminds me of the 1979 movie The China Syndrome.
Looks like a scene from a '60s scifi.
Kevin, the man on the moon. Tell me what the sensors say?
Waiting for somebody to re-create this in Roblox and make it also to 100% functional....man, that would be CRAZY.
There already are games on Roblox related to MCRs etc. like this but not as detailed as that.
But for the love of god, add working automatic controls too.
Dunscom August 30th Tech Demo is a great example of how to scare away people who rely on automatic controls because this game's MCR is a full manual system with no existing auto.
hi norbert
Who is the lazy guy sitting with his arms crossed?
im not seeing him but you are probably looking at a supervisor... they give orders and direct rather than actually work at the controls
Kevin sounds important. I hope nothing happens to Kevin
I am OK at the moment...
is this at Sequoyah's simulator?
Yes!
I'd like to work there.
Love the "RCS pressure is 1700#...aw shit.. RCS pressure is 9#"
Keep talking and nobody explodes! ❤
why did youtube autoplay decide to play this at 3am? 😅
if this would happen in your shift in real life it would be absolutly terrifying
I don't think it would be at all "terrifying" although I am sure Adrenalin levels would go up - a big difference. Operators regularly (like for one week out of every six) practice a multitude of accident scenarios repeatedly in the simulator. For multiple reasons, I am certain what you see in the video above is probably an informal demonstration for some group of visitors and does not at all convey, in multiple aspects, the order, structure, and precision that is part of both the real control room and real training/evaluation simulator scenarios. Anything formal in the simulator, including ALL training/practice scenarios, must be conducted as exactly as it would be in the real control room. For example, it is not at all acceptable to ever refer to the simulator, when in the simulator, as "the simulator", for example.
There are three, and only three, basic accident categories (Loss Of Coolant, Tube Rupture, Main Steam Line Break) and, of course, many variations of each. Although long overdue IMO, in the mid 1980s the owner's group of each brand of "Nuclear Steam Supply System" (Westinghouse, CE, B&W, and GE) all developed a very well thought out and comprehensive EOP (Emergency Operating Procedure) Package for each of their designs. I am only intimately familiar (at least was) with the W package as that is what I was trained on but I am sure the others are just as excellent. The W package is large and very structured. There are very well defined entry points to start using the package and the package covers every credible accident including a number of incredible accidents that are not part of the design basis because they are not considered credible events. Everything is prioritized, so there is zero confusion if multiple events take place. Absolute verbatim compliance is required and certainly enforced. There is no, and I mean absolutely NO, cases, like in the movies and commercials (Holiday Inn Express) where an operator must suddenly take unscripted heroic action to save the planet. The terminology is rigidly standardized and adhered to. I once saw an operator in training fail a simulator evaluation for saying "make it happen" ala Captain Picard (he eventually was dropped from the program for similar transgressions). As soon as some event occurs that requires use of the EOPs, a supervisor with an SRO (Senior Reactor Operators) license takes a physical position intentional back from the panels/controls and starts reading the procedure steps. He/she directs every single action taken from the written procedures and NEVER steps out of that role. Three way communication requiring repeat backs is required for each instruction given. Additionally, that supervisors boss, has no defined place to be, but has clear accountability of keeping "the big picture" and is not permitted, ever, to drop out of that role.
The result of all this continuously practiced, ad nauseam, and unrelentingly enforced structure is an almost automatic detailed expectation of what the procedures are going to do. It is also clearly understood that following the procedures as trained, doing exactly what the procedure packages specify, may not prevent a financial disaster for the stock holder (that may have already happened when whatever broke, broke), but will absolutely prevent compromising "the health and safety of the public". I do not remember the plant but a number of years ago some plant had a "Steam generator tube rupture". This is a major event, and, if not appropriately handled, can lead to a small but unacceptable release of radioactive gasses to the environment (although a small release it would be considered unacceptable because it would be greater than that which the plant was designed and licensed for). The operators handled this event exactly as scripted and practiced and later commented that it was just like a simulator scenario.
It has been about 20 years since I was directly in the operations arena but I clearly remember thinking that my stress level in a real accident naturally would certainly elevate but probably not more so than the stress I felt of failing an evaluated simulator scenario, especially when my retention bonus would be threatened by a failure. Notice I said "evaluated". I clearly remember the stress level of an evaluated exam, especially the yearly ones with maybe a senior manager and an NRC inspector observing from the "booth", were much more stressful (but certainly not at the terrifying level) than I anything I expected to feel in a real event. If one learns and practices a complex event to the point of ad nauseam, as is the case here, then one reaches a level of familiarity and competence that makes the emotions lean much more to an orderly expected familiar structure and confidence than terror. In fact, immediately after a simulator scenario started, typically, there would be a period a period of normal ops, then maybe one or two instrument or equipment failures that would not necessarily trip the plant. These failures, although clearly driven by procedure like everything else, were stressful because many of them deviously were designed to test ones understanding of integrated plant operation. The not so much joke during these parts of the scenario was "I cannot wait for the accident to happen because then I will be in the clear detailed control of the EOP network".
My only question is this...Would the people in this simulation be moving as slowly as they are now if this was happening in real life?
@mattaddison1910 agreed. If you get to a given panel 2 seconds faster and end up hitting the wrong switch, then there's no point to saving those 2 seconds.
they're all working to checklists. if you rush you miss something.
Slow is smooth and smooth is fast.
@@compmanio36 And fast is hard. And hard is good.
I think they were fairly fast. I was actually awed by how fast their minds must be working, that too with all that distracting noise.
Where is Jack Lemmon when you need him!
Captain Klingon vessel decloaking
What does SI stand for?
Safety Injection
@@genericchannelname5085 Thank you.
@@genericchannelname5085 Safety injection? Is that what OSHA does, inject safety into things? :)
Is it me or is Kevin only doing the work? I feel everything just ends up with one person saving the situation
Where is Homer Simpson to help?
ตรวจสภาพพร้อมรบฐานยิงจรวดใต้ดิน ที่ขั้วโลกใต้อ่ะครับ ตรวจสภาพพร้อมรบให้ข้าพเจ้าด้วย
_PA: (Alarms blaring) Warning! Problem in sector 7-G._
"ZZZZZZZ......ZZZZZZZZ.....Huh?.....Noise!.....Bad Noise!....."
_PA: 5 minutes before critical mass._
"Critical wha? OK, OK, don't panic. Whosever this problem is, I'm sure they know how to handle it."
_(Popping noise...looking at core temperature indicator that is maxed out)_
"IT'S MY PROBLEM...WE'RE DOOMED!"
This sounds like the soundtrack to a Philip Glass movie
Phillip Glass is a composer... he doesn't make movies.
@@edgeeffect he composes music... FOR MOVIES. You know this, right. Koyanisquasti? Powequatsi?
tf kind if simulation am i looking at, a description would be helpful or would you prefer we guess
Is there some type of scientific reason why it's green?
I assume you are referring to the color of the panels. In this case, the green appears very exaggerated probably due to the color temperature of the fluorescent lighting not matching that expected by the recording device. I have seen the panels painted in various colors but never so bright and so saturated as above. Typically muted green, grey, or tan shades are used. The colors, as in airplanes, are intended to be non-distracting.
Wrong camera settings.
Propaganda?@@ksavage681
3.6. Not great, not terrible.
Holy shit, nuclear reactors are indeed somewhat complicated machines
"Everything's going to hell. I'm outta here!" 😀
They need an array of 15” subwoofers behind the console should a Chornobyl event occur.
It's very green