MIS 5241 Three Mile Island What Happened, What Worked, What Didn’t

MIS 5242 AGENDA  The Situation, Events  Analysis of Events  Lessons for IT Security

MIS 5243 The Situation Pennsylvania Philadelphia Pittsburgh Harrisburg Three Mile Island Nuclear Power Plant 120 Miles

MIS 5244 The Reactor Reactor Steam Generators Main Feedwater Cycle Relief Valve Secondary feedwater cycle

MIS 5245 The Events Reactor Steam Generators Main Feedwater Cycle Relief Valve 1. Secondary feedwater cycle was partially closed off for maint’c. 2. Main feedwater pump failed 3. Pressure built up from reactor heat 4. Relief valve stuck OPEN, draining lines 5. However, indicator of high pressure was used to measure water volume 6. Operators assumed too high volume, shut off rest of main feedwater supply 7. Result was exposed reactor core, no cooling Nasty stuff, fortunately not a lot of it.

MIS 5246 Analysis  Poor maintenance procedures  Operators not trained in emergency procedures  Operators use one item of info as indicator of a loosely related state  “Common-Fault” failure made annunciator board useless  No PR procedures in place  Civil institutions were not ready  Quick analysis hindered by common fault failure

MIS 5247 Common Fault Failure Many things go wrong; it is not apparent that there is a common fault; some of the symptoms may have other, more reasonable causes, crippling diagnosis Common Fault Effects Failures

MIS 5248 Implications for IS Security  Maintenance procedures need to be well documented  Operators should be trained in emergency procedures  Operators need to know full set of indicators  “Common-Fault” failure is likely  PR procedures must be in place  Civil institutions must be made ready  Analysis must be helped by simulation of fault failures