Fukushima

For the Fukushima session, Lise brings in Dr. Teodora Vasquez, who spent two years on Ontario Power Generation's response to the CNSC Fukushima Task Force. "Three Mile Island taught us about operators and instruments," Teodora says. "Chernobyl taught us about design and safety culture. Fukushima taught us that a site can lose everything at once, all units, all power, all instruments, for days, because nature exceeded what the designers assumed. Every portable pump and connection point you see at Darlington is a lesson from Fukushima."

The site and the event

The Fukushima Daiichi Nuclear Power Station, operated by the Tokyo Electric Power Company, TEPCO, had six boiling water reactors on the Pacific coast of Japan. Units 1 to 5 had Mark I containments, and unit 6 a Mark II. On 11 March 2011, units 1, 2 and 3 were operating, and units 4, 5 and 6 were shut down for outages; the core of unit 4 had been fully unloaded into its spent fuel pool.

At 14:46 local time, the Great East Japan Earthquake, of magnitude 9.0, struck off the coast. The operating reactors shut down automatically. The earthquake damaged the offsite power lines, and the emergency diesel generators started to supply the safety systems, as designed. About 40 to 50 minutes later, a series of tsunami waves arrived. The largest reached a height of about 14 to 15 metres at the site, far above the design basis for the station, which had originally been about 3 metres and had been re-evaluated to about 6 metres. The water flooded the turbine buildings and reactor buildings, disabling most of the diesel generators, the electrical switchgear and, in units 1 and 2, the direct current batteries. Seawater pumps used to reject heat to the ocean were also destroyed.

Units 1, 2 and 3 suffered a station blackout, and units 1 and 2 also lost DC power, so the operators lost most of their instruments and the ability to control valves from the control room. The decay heat in the cores, a few percent of full power just after shutdown and falling slowly, now had to be removed with whatever systems could work without AC power.

Units 1, 2 and 3

Unit 1 relied on isolation condensers, which remove heat by natural circulation to a large water tank and need no pumps. With the loss of DC power, their valves were left in a mostly closed state, and the operators could not confirm whether they were working. In fact, they were providing little cooling. The core of unit 1 began to uncover within a few hours of the tsunami, and severe core damage followed during the night. Fresh water and later seawater injection by fire engines began on 12 March, but too late to prevent core melting.

# Time for decay heat to boil off water above the core after all cooling stops
# (illustrative values for a BWR of about 2 400 MW thermal).
P0, Top = 2.38e9, 3.0e7
def decay(t): return 0.0622 * P0 * (t ** -0.2 - (t + Top) ** -0.2)
water_above = 150000.0      # kg of water above the top of active fuel
h_fg = 1.5e6                # J/kg latent heat at about 7 MPa
for start_h in (1, 8, 24):
    t = start_h * 3600.0; boiled = 0.0
    while boiled < water_above:
        boiled += decay(t) * 60 / h_fg; t += 60
    print(f"cooling lost {start_h:2d} h after shutdown: fuel starts to uncover after about {(t - start_h*3600)/3600:4.1f} h")

cooling lost  1 h after shutdown: fuel starts to uncover after about  3.2 h
cooling lost  8 h after shutdown: fuel starts to uncover after about  4.7 h
cooling lost 24 h after shutdown: fuel starts to uncover after about  6.2 h

The program shows why the timing mattered so much. Decay heat falls with time, so the later cooling is lost, the longer the water above the fuel lasts. In units 2 and 3, the steam-driven reactor core isolation cooling system, and in unit 3 also the high-pressure coolant injection system, kept injecting water for about a day or more. When these systems stopped and the reactors had to be depressurised before low-pressure injection by fire engines could start, the water boiled off and the cores were damaged, unit 3 on 13 March and unit 2 on 14 to 15 March.

In all three units, zirconium-steam oxidation produced large amounts of hydrogen. The Mark I containments were inerted with nitrogen, so the hydrogen could not burn inside them, but as containment pressure rose far above design values, hydrogen leaked out through seals and penetrations, and in some cases through venting paths, into the reactor buildings. There it mixed with air. The upper part of the unit 1 reactor building exploded on 12 March and that of unit 3 on 14 March. On 15 March, the unit 4 reactor building also exploded. Its fuel was in the spent fuel pool and had not been damaged; the hydrogen came from unit 3 through a shared venting line. The containment of unit 2 was damaged without an explosion in the building, and this unit is thought to have contributed a large part of the release.

Spent fuel pools and the other stations

The spent fuel pools at the top of the reactor buildings, and especially the pool of unit 4 with its full core load of recently discharged fuel, caused great concern in the first days, as the pools had lost their cooling and the explosions had damaged the buildings. Later inspection showed that the pools had retained enough water and the fuel had not been significantly damaged. Nevertheless, the episode led regulators worldwide to require reliable instruments to measure spent fuel pool level and means to add water to the pools from outside the buildings.

Other nuclear stations hit by the same earthquake and tsunami fared better. At Fukushima Daini, about 12 kilometres to the south, one offsite power line survived and the operators laid kilometres of temporary cable to restore cooling, bringing all four reactors to cold shutdown within a few days. At Onagawa, closer to the epicentre, the plant had been built on higher ground, and the tsunami did not flood it. These contrasts show how much the outcome depended on site elevation, the survival of power supplies and the improvisation of the staff.

Consequences

Large amounts of iodine-131 and caesium-137 were released, mainly between 12 and 15 March, and contaminated land to the northwest of the station. The Japanese government evacuated people from a zone of 20 kilometres and later from areas beyond it where doses were expected to be high. In all, more than 100 000 people were evacuated, and some areas remained restricted for many years. The accident was rated level 7 on the International Nuclear and Radiological Event Scale.

No deaths among workers or the public have been attributed to acute radiation exposure. The IAEA and the UN Scientific Committee on the Effects of Atomic Radiation concluded that no discernible increase in health effects among the public is expected that could be attributed to radiation from the accident. The evacuation itself, however, caused serious harm, particularly among elderly and hospitalised people moved under difficult conditions, and more than a thousand disaster-related deaths in Fukushima Prefecture have been associated with evacuation and long-term displacement. The disruption of communities, the loss of livelihoods and the stress of uncertainty were the largest effects on people's lives. Decommissioning of the site, including the removal of melted fuel debris and the management of treated water, is expected to take decades.

Findings of the investigations

The Japanese parliament's independent investigation commission, the government's investigation committee and the IAEA all found that the accident was not simply the result of an unforeseeable natural disaster. The IAEA Director General's report, published in 2015 with technical volumes prepared by international experts, concluded that a major factor was the assumption in Japan that nuclear power plants were so safe that an accident of this magnitude was simply unthinkable. It found that the tsunami hazard had been underestimated even though evidence of large historical tsunamis had been available; that the plant was vulnerable to flooding and lacked protection for essential equipment; that the regulatory framework had not kept pace with international practice; that severe accident management provisions and training were inadequate for a multi-unit event with loss of all power; and that emergency preparedness for a severe accident affecting the public was insufficient.

What changed

The CNSC established the Fukushima Task Force in March 2011, which reported in October 2011 that Canadian nuclear facilities were safe but recommended improvements, and the CNSC issued an Action Plan with Fukushima action items for every licensee. Canadian stations installed emergency mitigating equipment, including portable pumps, generators and water supplies stored in protected locations with connection points to inject water into the heat transport system, steam generators, moderator, calandria vault and spent fuel bays. Passive autocatalytic recombiners were installed in containments, and filtered containment venting was added or planned at multi-unit stations. Hazard assessments for flooding, seismic events and extreme weather were updated, and the CNSC's regulatory documents on accident management and emergency preparedness were strengthened, together with provincial plans for offsite emergencies.

Internationally, the IAEA Action Plan on Nuclear Safety was adopted in 2011, the European Union carried out stress tests of all its plants, and the Vienna Declaration on Nuclear Safety in 2015 set the principle that new plants should be designed so that accidents with early or large releases are practically eliminated. Japan replaced its regulator with the independent Nuclear Regulation Authority in 2012 and introduced new regulatory requirements before allowing plants to restart.

Working in the dark

The staff at Fukushima Daiichi worked for days in conditions that no procedure had foreseen. With the control rooms dark, they read instruments with car batteries, walked through flooded and debris-filled buildings to open valves by hand, and connected fire engines to inject water into the reactors, all while aftershocks and tsunami warnings continued and radiation levels rose. Their actions limited the accident, and the investigations recognised their dedication, but they also showed that improvisation cannot replace equipment, procedures and training prepared in advance for a prolonged loss of power affecting several units.

The accident also showed the importance of preparing for events that affect several units at once. Staff, equipment and emergency facilities that would be adequate for one damaged unit were stretched across four. Hydrogen from one unit damaged another, and explosions in one building hampered work at its neighbours. Multi-unit risk is now an explicit part of probabilistic assessment and emergency planning in many countries, including the sites with four or more units in Canada and the multi-unit sites in the United States.