Source: October 22

After the release of James Acton and Mark Hibbs's Carnegie Paper Why Fukushima Was Preventable in March, the Tokyo Electric Power Company responded to some of the claims made in the report, which resulted in the following dialogue between TEPCO and the authors of the paper.

TEPCO: There are some comments on your report regarding the Carnegie paper “Why Fukushima was Preventable” that we would like you to revise. The reader will likely misunderstand the report as it is written; therefore, we would like you to make the following correction. If you have any counter-comments, please let us know. We appreciate your kind consideration.

Acton and Hibbs reply: We are grateful to TEPCO for taking the time to comment on our report. Whether the accident at Fukushima Daiichi was reasonably foreseeable is a profoundly important question, especially for the public acceptance of nuclear power generation in future. We remain convinced that, had international best standards and best practices “been heeded and applied, the risks to the Fukushima Daiichi Nuclear Power Plant would likely have been recognized and effective steps to prevent a major accident could have been taken.” Some details in the presentation of our argument would change in light of information that has only become available since our report was published, including information communicated to us privately by TEPCO, but our overall conclusions would not be significantly altered. Indeed in some cases our conclusions have been strengthened by this new information.

 

Acton and Hibbs wrote: Had international standards and best practices been followed, the scale of the natural disaster on March 11, 2011, might have been predicted, giving TEPCO the opportunity to enhance plant defenses. We say “might” rather than “would” because while it is often possible after the fact to point to indicators of an impending disaster, we also recognize that, in practice, hazard prediction is challenging. In any case, the accident sequence dramatically demonstrated that the plant was not equipped to cope with the events of March 11. (p.15)

Had the plant’s owner, TEPCO, and the Japanese regulator, NISA, heeded timely warnings and good practices elsewhere about the dangers discussed above, they might have realized that the tsunami threat to Fukushima Daiichi had been underestimated and that they could have defended the plant against the natural forces that fatally crippled three reactors at the site without such advance preparations. (p.30)

TEPCO: When in fact, we are collecting international operating experiences through the WANO network and evaluating them. If necessary, we modified and improved the equipments in TEPCO Nuclear Power Plants (NPPs). In the WANO Peer Review and the IAEA OSART, our evaluation and measures were reviewed and conducted necessary correction.

Acton and Hibbs reply: WANO peer reviews and IAEA OSART missions are, as a general rule, concerned almost exclusively with operational safety practices, not with the role of plant design in protecting against severe accidents. We have seen no evidence that WANO or OSART reviewers prior to the Fukushima Daiichi accident significantly engaged with plant owners over plant design issues related to hazard protection, which is the main subject of our report.

Elsewhere—and in Europe in particular—safety systems that were of great significance during the accident sequence at Fukushima Daiichi are significantly more robust and redundant than at Fukushima Daiichi. Most notably, emergency power generators appear to be better protected. During the past three decades, European nuclear power plant owners, hand in hand with national regulators, have upgraded plant design and the configuration of safety equipment to improve protection against flooding and loss of power significantly. Ultimately, any measures taken by TEPCO before the accident related to the design of the plant and safety system configurations did not protect the plant from a severe accident with considerable off-site consequences.

 

Acton and Hibbs wrote: Following a flooding incident at Blayais Nuclear Power Plant in France in 1999, European countries significantly enhanced their plants’ defenses against extreme external events. Japanese operators were aware of this experience, and TEPCO could and should have upgraded Fukushima Daiichi (p.1)

By contrast, Japan has been much slower to appreciate the potential danger of some other external events, especially tsunamis (p. 26)

TEPCO: When in fact, we received this information from the WANO and reviewed in a timely manner. In the design of flood protection barrier at the Blayais site, they took account of the maximum tidal level, but not the additional effect of wave height. We confirmed that TEPCO NPPs were designed in accordance with the regulatory requirements which NPP design had to reflect the appropriate consideration of the most severe of the natural phenomena including wave height that have been historically reported for the site and surrounding area. Therefore, we made decision not to improve any facility. Thereafter, we reevaluated the tsunami height according to 2002 JSCE tsunami Assessment method, 2002. Therefore, we revised tsunami height and implemented the countermeasures such as raising the electric pump motors and flooding prevention measures of the building penetrations.

Acton and Hibbs reply: One of the central lessons of Blayais is the need to be conservative in plant design. This is especially true where flooding is concerned because of “cliff-edge” effects where a small increase in flood height can have large adverse safety impacts. After Blayais, several European regulators insisted that safety margins at nuclear power plants be widened, and ordered that the plants withstand conditions exceeding then-current design requirements. Merely ensuring that plants are capable of withstanding a design-basis flooding event—as TEPCO did—misses this key lesson of Blayais.

 

Acton and Hibbs wrote: Second, there appear to have been deficiencies in tsunami modeling procedures, resulting in an insufficient margin of safety at Fukushima Daiichi. A nuclear power plant built on a slope by the sea must be designed so that it is not damaged as a tsunami runs up the slope. In 2002, the Japan Society of Civil Engineers developed a detailed methodology for determining the maximum run-up of a tsunami. This methodology prompted TEPCO, voluntarily, to revise the design-basis tsunami at Fukushima Daiichi from 3.1 meters to 5.7 meters. However, in at least one important respect, TEPCO does not appear to have implemented the relevant procedures in full. (p.12)

TEPCO: When in fact, we evaluate run-up with the latest JSCE tsunami Assessment method. In the past assessment result, we didn’t have to consider countermeasures because it was estimated that tsunami didn’t run up to the ground level of Unit 1 to 4 main building.

Please refer to JSCE “Tsunami Assessment Method for Nuclear Power Plants in Japan” http://committees.jsce.or.jp/ceofnp/system/files/JSCE_Tsunami_060519.pdf  

And please refer to page 6 to 12 of “Supplementary Volume of TEPCO interim report” for your understanding the detail story of TEPCO tsunami assessment. TEPCO Accident Interim Report, Supplementary Volume, http://www.tepco.co.jp/en/press/corp-com/release/betu11_e/images/111202e16.pdf  

Acton and Hibbs reply: In our report, we cite from the JSCE methodology and we note that it requires “computer modeling based on site specific data.” We go on to note, however, that according to the IAEA “[i]t seems also that [TEPCO's] calculation of the run-up have not considered the specific and detailed arrangements of plant layout.” TEPCO have subsequently informed us that, contrary to what the IAEA mission was told, they did conduct such modeling. We believe that further engagement between TEPCO and the IAEA would be useful to clarify this point further.

 

Acton and Hibbs wrote: The methods used by TEPCO and NISA to assess the risk from tsunamis lagged behind international standards in at least three important respects: (p.1)

•  Insufficient attention was paid to evidence of large tsunamis inundating the region surrounding the plant about once every thousand years.
  
• Computer modeling of the tsunami threat was inadequate. Most importantly, preliminary simulations conducted in 2008 that suggested the tsunami risk to the plant had been seriously underestimated were not followed up and were only reported to NISA on March 7, 2011.
  
• NISA failed to review simulations conducted by TEPCO and to foster the development of appropriate computer modeling tools. (p.23) In 2003, the IAEA published a safety guide on flood hazards for nuclear power plants, which contains guidance concerning all factors that must be considered in assessing the risk from tsunamis. The Japanese methodology did not meet this guidance since it focused only on evaluating tsunami run-up and ignored other salient factors such as the effect of debris. (p.31) However, the clearest warning signs of potential risk before the accident were procedural: Japan’s methodology for assessing tsunami risks lagged markedly behind international standards, TEPCO did not even implement that methodology in full, and NISA showed little concern about the risks from tsunamis.

TEPCO: When in fact, JSCE tsunami assessment method was quoted by Annex II in the latest IAEA standard “Meteorological and Hydrological Hazards in Site Evaluation for Nuclear Installations”. This means TEPCO evaluated expected tsunami with the state-of-the-art tsunami assessment method, which IAEA accepted. You can find IAEA standard “Metrological and Hydrological Hazards in Site Evaluation for Nuclear Installations” on the following website. http://www-pub.iaea.org/books/iaeabooks/8635/Meteorological-and-Hydrological-Hazards-in-Site-Evaluation-for-Nuclear-Installations  

As a result from this, we reported the simulation results to NISA in August, 2009. Please refer to page 10 of “Supplementary Volume of TEPCO Interim Report” for your understanding the detail story of TEPCO tsunami assessment. TEPCO Accident Interim Report, Supplementary Volume, http://www.tepco.co.jp/en/press/corp-com/release/betu11_e/images/111202e16.pdf  

Acton and Hibbs reply: The fact that the JSCE methodology appears in an Annex to an IAEA report (which, incidentally, we cite in our study) does not imply it is endorsed by the IAEA. More importantly, as we note, the JSCE methodology does not consider a number of the factors, such as hydrodynamic forces and the effect of debris, which are highlighted both by the IAEA safety guide that was operative at the time of the accident (NS-G-3.5) and by its replacement (SSG-18). Page 10 of TEPCO's interim report (which discusses only tsunami height and run-up) merely confirms this. The importance of considering hydrodynamic forces is illustrated by the Fukushima accident. For instance, because the doors to the intake buildings opened inward rather than outward they were swept open by the oncoming tsunami. As we state explicitly in our report, however, we do not blame TEPCO for the absence of appropriate tools for tsunami assessment; NISA must take responsibility for failing to foster the development of a methodology compliant with IAEA standards.

 

Acton and Hibbs wrote: First, there appears to have been insufficient attention given by TEPCO and NISA to historical evidence of large earthquakes and tsunamis. (p.11)

These simulations assumed a repeat of the 869 AD earthquake. Because this event was larger than the earthquake on which previous simulations were based, the resulting tsunami was predicted to be higher. Given the new simulations were based on an actual historical earthquake, they should have been followed up on immediately. Had the results been verified, TEPCO may have been able to take corrective action in time to avert the disaster of March 11, 2011. (p.13)

TEPCO: As you see in section 3 of our investigation report “Fukushima Nuclear Accident Analysis Report (TEPCO Interim Report) and its “Supplementary Volume” (P5 -13), it was impossible for us to know this return period before March 11, 2011 and had not identified any other short period of the significant earthquake in the past. A risk-informed analysis had also been prepared; however, it was impossible to conduct the analysis due to such uncertain conditions. After reviewing this accident, TEPCO should, at a minimum prepare some measures for the far beyond design basis. TEPCO Accident Interim Report, http://www.tepco.co.jp/en/press/corp-com/release/betu11_e/images/111202e14.pdf TEPCO Accident Interim Report, Supplementary Volume, http://www.tepco.co.jp/en/press/corp-com/release/betu11_e/images/111202e16.pdf  

Acton and Hibbs reply: As we acknowledge in our report, hazard assessment is difficult. We do not claim that TEPCO knew for certain that the tsunami risks to Fukushima Daiichi had been underestimated. However, because of the need to take a conservative approach to nuclear safety, the relevant questions in assessing whether TEPCO had taken adequate steps to prepare for tsunamis are:

• Given the cliff-edge effects that tsunamis can induce, did TEPCO allow an appropriately wide margin of safety at Fukushima Daiichi?
   
• Did TEPCO in a timely manner pursue evidence that tsunami risks had been underestimated?
  
  We believe that—based on TEPCO's own chronology—the answers to both questions are “no”.
        
• In 2001, a study by Minoura et al. identified the recurrence period of the earthquake that caused the 869 Jogan tsunami—a tsunami that caused extensive flooding in North Eastern Japan—as 1,000 years. By itself, this finding was not particularly significant for the safety of Fukushima Daiichi since Minoura et al. suggested that the earthquake source lay some distance to the north of the plant and they consequently predicted that its impact on Fukushima would be relatively small. However, information was to emerge over the course of the following decade that would make this paper much more significant from a safety perspective.
   
• In 2002, TEPCO re-evaluated the design basis for Fukushima Daiichi using the JSCE methodology. At about the same time, a government organization, the Headquarters for Earthquake Research Promotion (HERP), released a new seismic model that hypothesized the possibility of a magnitude 8.2 earthquake anywhere along the Japan trench. This marked a significant change to the assumptions used by TEPCO in implementing the JSCE methodology. Because of limitations with the HERP model, extensive work would have been needed to understand its implications for tsunami safety at Fukushima Daiichi. Such work should have begun immediately. In fact, it did not begin until 2008—six years after the model was first proposed.
   
• In the mid-2000s, evidence emerged that the Jogan earthquake took place closer to Fukushima than had previously been believed. This represented another significant change to the assumptions on which the design basis for Fukushima Daiichi had been re-evaluated in 2002. Moreover, over 1,100 years had passed since the Jogan tsunami. Given Minoura et al.’s finding that the Jogan earthquake had a recurrence period of 1,000 years, there was now evidence of a short-term tsunami risk to the plant. TEPCO argues that, because it did not have a “source model” (a mathematical description of the earthquake) available for either the Jogan earthquake or an earthquake in the Japan trench, it could not have reasonably followed up on either of these leads. But, it could have taken the steps to develop its own source models rather than waiting passively for academia to provide them—indeed, this is precisely what it did eventually do beginning in 2008.
   
• In 2008, TEPCO finally began to follow up on the evidence that the tsunami risk to Fukushima Daiichi had been underestimated by performing two sets of “trial calculations.” In accordance with the HERP model, the first set assumed an earthquake in the Japan trench off the coast of Fukushima. The second assumed a repeat of the Jogan earthquake using models provided in a newly available paper by Satake et al. Both studies predicted larger tsunamis than the plant had been designed to withstand. Once again, these simulations did not prove that the tsunami threat had been underestimated since the source models TEPCO was using were not entirely reliable. However, these calculations did add to a growing picture that previous calculations were insufficiently conservative, that the margin of safety at Fukushima Daiichi was too small and that urgent action was needed.
   
• Almost a year passed until winter 2009-10, when TEPCO performed a sediment survey to help develop a source model for the Jogan earthquake. Sediment from the Jogan tsunami was found about 15km to the north of Fukushima Daiichi. Once again, this result was not entirely conclusive since sediment was not found 15km to the south of the plant (local geological conditions did not permit a survey at the plant itself). However, there was now clear evidence that an earthquake with a recurrence period of 1,000 years had flooded an area immediately adjacent to the plant 1,100 years ago. Viewed through the conservative lens that is appropriate for nuclear safety, it was a clear warning of a potentially catastrophic short-term tsunami risk to the plant. The earthquake and tsunami that caused so much devastation throughout North Eastern Japan on March 11, 2011 belied expectations.

The earthquake was much larger than almost any seismologist had thought possible and it was spread over a much larger area than any model had previously predicted. It was not simply a repeat of the Jogan earthquake but a qualitatively and quantitatively different event. Nonetheless, had the warnings that had arisen over the course of a decade been heeded, actions to defend the plant could have been taken in advance of March 11. Ultimately, TEPCO took an insufficiently conservative approach to safety, effectively demanding proof of the danger before making changes. Their efforts to obtain this proof were far too slow, including a six-year hiatus between 2002 and 2008.

To be fair, as we make very clear in our report, TEPCO is not solely responsible. NISA must share a large part of the blame for insufficient oversight. And, we would not be surprised if serious shortcomings in other utilities’ approaches to hazard prediction were exposed, were they to be subjected to the scrutiny that TEPCO now is. None of this, however, alters our argument that the tsunami risk to Fukushima Daiichi could have been anticipated.

Ultimately, our question—was the accident at Fukushima Daiichi avoidable?—goes to the heart of the matter of whether the public will accept the risks associated with nuclear power generation. We argue that, had NISA and TEPCO taken prudent prophylactic actions to cope with the kind of threats which dramatically surfaced at Fukushima Daiichi last year, a severe accident with off-site consequences could have been prevented. If, industry and regulators now rest their defense on assertions that all regulatory requirements had been met before the accident, and that the accident sequence which transpired on March 11 2011 “had not been anticipated,” the public will surely and logically demand to know whether there are other, unknown or undisclosed vulnerabilities with nuclear power plants. Beyond that, the public will also ask whether those individuals and organizations responsible for assuring the safety of nuclear power can be trusted. Accordingly, we believe that it actually is in the long-term interests of nuclear industry to acknowledge where it has made mistakes.

 

Acton and Hibbs wrote: Another illustration of this excessive confidence is that, unlike nearly all other power reactor owners worldwide, Japanese utilities face unlimited liability in the event of an accident. This provision was apparently implemented at the request of plant owners, who wanted to demonstrate their confidence in the safety of their power plants to local populations. (p.28)

TEPCO: When in fact, Japanese utilities have to accept unlimited liability in order to protect the victims, and Japanese government can provide necessary support if government admits their demand in Japanese law.

Acton and Hibbs reply: TEPCO's answer is true but does not, in any way, contradict our argument that the utilities’ request to face unlimited liability in the event of an accident was an example of their over-confidence in nuclear safety.