II. ACCIDENT ANALYSIS
II.A. The Event
The earthquake occurred at 2:46 p.m. on Friday, March 11, 2011. A tsunami, caused by the earthquake, arrived at the coastline in several waves ~30 to 45 minutes later. As indicated in Fig. 7, five NPSs, located on the northeast coast of Honshu, Japan’s largest island, are in the vicinity of the earthquake/tsunami. They are, going north to south, the Higashidori NPS, the Onagawa NPS, the Fukushima Daiichi NPS, the Fukushima Daini NPS, and the Tokai Daini NPS.3 These NPSs are the ones that were primarily affected by the earthquake/tsunami. Table 1 gives details of each NPS.
All Japanese NPPs have seismic instrumentation systems that shut down the reactors when a significant earthquake occurs, and when the earthquake occurred, these systems functioned normally for all units. Following the earthquake, all the safety systems, including on-site emergency electrical power, operated as designed. It was the subsequent tsunami that caused the major damage. Let us consider the impact at each NPS.
II.A.1. Impact at Higashidori NPS
Since Unit 1 was under periodic inspection at the time of the earthquake, all the fuel in the reactor core had already been taken out and placed into the SFP. All three lines of the off-site power supply lost power because of the earthquake. One of the two EDGs was under inspection, but the other EDG started and fed power to the emergency electrical busses to provide the AC power needed for the safety systems.
II.A.2. Impact at Onagawa NPS
Units 1 and 3 were at rated thermal power operation at the time of the earthquake, and Unit 2 was under reactor start-up operation. Four out of the five lines of the off-site power supply were lost as a result of the earthquake, but the off-site power supply was maintained through the continued operation of one power line.
Unit 1 tripped at 2:46 p.m. because of high seismic acceleration, and both EDGs started automatically. At 2:55 p.m. the start-up transformer failed because of a fault and short-circuit in the high-voltage electrical switchgear caused by the earthquake, and this led to a loss of power supply in the NPP. Both EDGs fed power to the emergency AC electrical busses that power the safety systems. Using normal systems, the reactor reached a state of cold shutdown with a reactor coolant temperature of <100°C (212°F) at ~1:00 a.m. on March 12.
Since Unit 2 was in start-up operation, it shifted promptly to cold shutdown because the reactor had shut down automatically at 2:46 p.m. as a result of high seismic acceleration. The three EDGs automatically started because of an automatic signal from the EDG at 2:47 p.m. but remained in a standby state since the off-site power source was available. Subsequently, as a result of the tsunami, one division of component cooling pumps was flooded and lost function, and two of the EDGs tripped. Since the component cooling water system pump in the remaining division was intact, there was no degradation of the reactor’s cooling function.
Unit 3 tripped at 2:46 p.m. because of high seismic acceleration. The off-site power source was maintained, until the tsunami arrived, which caused the turbine component cooling seawater pump to fail. Nevertheless, cooling and depressurization operations of the reactor were able to be successfully carried out, leading the reactor to a state of cold shutdown with a reactor coolant temperature of <100°C (212°F) at ~1:00 a.m. on March 12.
II.A.3. Impact at Fukushima Daiichi NPS
At the time of the earthquake, Units 1, 2, and 3 were operating at rated power level. Unit 4 was in a periodic inspection outage, and large-scale repairs were under way. Unit 4 fuel had all been relocated to the SFP in the reactor building. Units 5 and 6 were also in a periodic inspection outage, but the fuel remained in the reactor core area of the RPV, and the reactors were in a cold shutdown condition.
The earthquake brought Units 1, 2, and 3 to an automatic shutdown because of the high seismic acceleration. The off-site power supply was also lost because of damage to the transmission towers from the earthquake. For this reason, the EDGs for each unit were automatically started up to maintain the function of cooling the reactors and the SFPs. Normal reactor cooldown and decay heat removal functions were under way.
About 45 minutes after the earthquake, the tsunami arrived with an estimated maximum wave height of ~15 m, which was much larger than the seawall at 5 m. All the EDGs (except for one air-cooled EDG at Unit 6) stopped when the tsunami arrived. Specifically, the tsunami submerged the seawater systems that cooled the EDGs and the electrical switchgear. The result was that all AC power supply was lost at Units 1 through 5.
Units 1 through 4 were significantly damaged by the tsunami and subsequent actions and are the subject of more detailed description below.
Units 5 and 6 are slightly separated from Units 1 through 4 and are at a higher elevation. The earthquake disabled the off-site power, and the tsunami caused the loss of both EDGs of Unit 5 and two of the three EDGs of Unit 6. However, one EDG of Unit 6 was air cooled (not dependent on cooling water) and was located at a higher elevation, so it was able to supply emergency AC power to both Units 5 and 6. The availability of AC power gave these units the ability to depressurize the reactors. So, it was possible to add water to the RPVs via the low-pressure condensate transfer pumps. The residual heat removal (RHR) pumps were also not lost, so when a temporary seawater pump was installed to allow transfer of heat to the ocean, it was possible to reach cold shutdown again in both Units 5 and 6. This was achieved by March 20.
II.A.4. Impact at Fukushima Daini NPS
Units 1 through 4 were all in operation and automatically shut down because of the earthquake. After the occurrence of the earthquake, the power supply needed for the NPS was maintained through one of the three external power transmission lines, and normal decay heat removal was occurring. Subsequently, the tsunami triggered by the earthquake hit, flooding the seawater cooling pumps, making them inoperable and causing a loss of normal decay heat removal function.
Units 1, 2, and 4 maintained core cooling by the use of the RCIC systems and the CST water supply. However, since there was no decay heat removal function, the suppression pool temperature continued to rise and reached 100°C (212°F) ~14 hours after the tsunami struck. During this time, because of the extraordinary efforts of the operating staff, Units 1, 2, and 4 recovered their decay heat removal functions; e.g., electrical cables were installed, and damaged pump motors were replaced. The success of this effort was aided by the fact that limited off-site power connections were maintained and key pieces of equipment were not damaged. As a result, the Unit 1 suppression pool temperature was reduced to <100°C (212°F) at 10:15 a.m. on March 14, and the reactor was brought to a cold shutdown condition at 5:00 p.m. on March 14. The Unit 2 suppression pool temperature was reduced to <100°C (212°F) at 3:52 p.m., and the reactor was brought to a cold shutdown condition at 6:00 p.m. on March 14. The Unit 4 suppression pool temperature was reduced to <100°C (212°F), and the reactor was brought to a cold shutdown condition at 7:15 a.m. on March 15. It was not necessary to vent the containments at these units because the containment pressure did not reach the containment design pressure.
At Unit 3, one RHR loop was not damaged at all, so the reactor was brought to a cold shutdown condition at 12:15 p.m. on March 12 without losing reactor cooling functions or suffering other damage.
II.A.5. Impact at Tokai Daini NPS
The Tokai Daini NPS was at rated thermal power operation at the time of the earthquake on March 11; at 2:48 p.m. that day, the reactor tripped because of a turbine trip caused by the turbine shaft bearing registering a large vibration signal as a result of the earthquake. Immediately after the earthquake, all three off-site power source systems were lost. However, the power supply to the equipment for emergency use was provided by the activation of three EDGs. Because the EDGs provided power, the ECCSs kept the water level of the reactor at a normal level, and cooling of the core and removal of decay heat were maintained.
Subsequently, one seawater pump for one EDG stopped as a consequence of the tsunami, and the EDG became inoperable. But, the remaining two EDGs provided power supply to the emergency equipment, and cooling of the suppression pool was maintained by one RHR system.
One off-site power supply system was restored at 7:37 p.m. on March 13, and the nuclear reactor reached a state of cold shutdown with a coolant temperature of <100°C (212°F) at 12:40 a.m. on March 15.
II.B. Accident Details for Fukushima Daiichi NPS: Units 1 Through 4
II.B.1. Fukushima Daiichi Unit 1
After scram4 and loss of AC power due to the earthquake, both trains of the isolation condenser system were started because of closure of the main steam isolation valves (MSIVs) and subsequent pressurization of the RPV. Operators determined that with both trains operating, the reactor cooldown rate exceeded the technical specification rate of 55°C/hour (100°F/hour), so the isolation condensers were shut down by the operators. Subsequently, one train of the isolation condenser system was restarted and stopped several times to control the reactor pressure and cool the reactor. The HPCI system was not started during this time period as the water level in the RPV was adequate. After the tsunami struck, there was major flooding. In addition to the loss of heat removal function, the EDGs and direct-current (DC) batteries for both power and instrumentation, which were located in the basement of the turbine building, were also flooded and lost. All the instrumentation that was needed to monitor and control the emergency became unavailable; in addition, the HPCI system was not able to operate because of the loss of DC power and not yet needed because the isolation condenser system had just been shut down.
Several attempts were made to open the steam supply and condensate return valves of the previously operating train of the isolation condenser system. There is some evidence that this isolation condenser was at least partially working, because of observed steam evolution from the shell side of the heat exchanger. However, by 10:00 p.m., March 11, rising radiation levels were observed in the reactor and turbine buildings, which was an indication that core damage was occurring.
In addition, at 12:49 a.m. on March 12, local measurements confirmed that the containment pressure had exceeded the design pressure, which was further evidence of core damage and hydrogen production from the zirconium fuel cladding metal-water reaction. Therefore, processes were started to evacuate local residents and to prepare the containment for venting, in accordance with the NPP emergency procedures. Operators began preparations for primary containment vessel (PCV) venting, but the work ran into trouble because the radiation level in the reactor building was already high. At ~2:30 p.m. on March 12, a small decrease in the PCV pressure level was actually confirmed, which could have been due to leakage paths in the PCV that opened because of the PCV being at high containment pressure and temperature or because of the vent rupture disk opening. Subsequently, at 3:36 p.m., a hydrogen explosion5 occurred in the upper part of the Unit 1 reactor building. The source of the hydrogen in the reactor building is thought to be containment leakage due to the high containment pressure and temperature that occurred, which were well in excess of the design.
The records do not show any deliberate attempt to depressurize the RPV, which would be necessary to allow emergency pumps, such as fire pumps, to add water. However, by 2:45 a.m. on March 12, the RPV pressure was found to be low, and by 5:46 a.m. on March 12, the operators began adding freshwater using fire engines. It is not clear whether the RPV depressurization occurred because of damage to the RPV by the molten core, a break in an attached low-elevation pipe, or SRVs that had stuck open. By this time, the fuel was already significantly damaged.
Longer term, the water level in the RPV did not recover to more than core midplane regardless of the makeup water quantity being added, indicating a low-elevation leak in the RPV pressure boundary.
II.B.2. Fukushima Daiichi Unit 2
As with Unit 1, a scram occurred, and the MSIVs were closed after the earthquake. The RCIC system was manually started a couple of times and automatically tripped because of a high water level in the RPV. After the tsunami, some DC power was also lost, just as in Unit 1; therefore, the HPCI system was lost. However, the RCIC system operated for ~70 hours. In general, one should not expect the RCIC system to run much beyond 8 hours in a station blackout (SBO).
At 1:25 p.m. on March 14, it was determined that the RCIC system of Unit 2 had stopped because the reactor water level was decreasing, and operators began to reduce the RPV pressure in order to be able to inject seawater into the reactor using fire-extinguishing-system lines. There were problems depressurizing due to lack of electricity for the solenoid valves and lack of pressurized nitrogen supply to force the SRVs open. These issues caused significant time delays in achieving a low-enough reactor pressure to allow the low-pressure emergency pumps to add water to the RPV. Therefore, the fuel was uncovered while the RPV was without any water injection for ~6.5 hours. The fuel heated up, with significant damage and hydrogen production. Longer term, the water level in the RPV has not recovered to higher than core midplane, indicating a low-elevation leak in the RPV pressure boundary.
The containment pressure rise at first was much slower than should be expected if all the decay heat is delivered to the suppression pool, which is an indication of a leak in the containment boundary. The wetwell venting line configuration had been completed by 11:00 a.m. on March 13, but the containment pressure had not reached the rupture disk setpoint, so no venting occurred. After core damage, the containment pressure increased more rapidly, probably because of hydrogen production. At 6:00 a.m. on March 15, an impulsive sound that was initially attributed to a hydrogen explosion was confirmed near the suppression chamber of the containment. Later reviews suggested that sound was not due to hydrogen burn. In any case the containment pressure did sharply decrease. It is not clear whether the designed vent path was ever in service; however, longer term, the containment pressure has remained low, around the level of atmospheric pressure.
II.B.3. Fukushima Daiichi Unit 3
The situation at Unit 3 followed closely that of Unit 2, except that the RCIC system ran for only 20+ hours. However, the DC power supply for the HPCI system was not damaged, so the HPCI system started up and was run for an additional 15 hours. The operation of the HPCI system apparently also had the side benefit of reducing the RPV pressure because of the steam consumption by the HPCI turbine (seven times larger than that of the RCIC system).
After the HPCI system stopped, the RPV repressurized. Depressurization of the RPV to allow low-pressure pumps to add water was not started for 7 hours, and the RPV did not receive any water for that time. As with Unit 2, there were problems with power for the solenoid valves and the pressurized nitrogen needed for SRV operation. The water level decreased to below the fuel level, and significant core damage and hydrogen production occurred. Fire engines began alternative water injection (freshwater containing boron) into the reactor at ~9:25 a.m. on March 13. Later, the injection was changed to seawater; however, the water level in the RPV never recovered as expected, indicating a leak in the RPV or attached piping.
As with Unit 2, the containment pressure rise from decay heating was slower than expected, indicating the presence of a leak. In parallel with RPV depressurization, containment venting to decrease the PCV pressure was begun. Because of trouble with the solenoid valves and pressurized nitrogen supply, vent operations had to be done several times. Subsequently, at 11:01 a.m. on March 14, a hydrogen explosion5 occurred in the upper part of the reactor building. The source of the hydrogen is thought to be from leaks in the containment boundary. Longer term, the containment pressure has remained low.
II.B.4. Fukushima Daiichi Unit 4
The total AC power supply for Unit 4 also was lost because of the earthquake/tsunami; therefore, the functions of cooling and supplying water to the SFP were lost. The SFP temperature increased to 84°C (183°F) by 4:00 a.m. on March 14. At ~6:00 a.m. on March 15, an explosion that was thought to be a hydrogen explosion occurred in the reactor building, severely damaging part of the building. At first, this was thought to be from fuel uncovery, heatup, and hydrogen production. Therefore, over the next several days, several different schemes were used to add water—via helicopter, fire truck, and concrete pump truck. Both freshwater and seawater were used. Later, photographs indicated that there was no overheat damage to fuel in the SFP, and the source of hydrogen was traced to backflow through the standby gas treatment system ducting that shared a common piping at the NPP stack with Unit 3, whose containment was being vented.
II.C. Spent-Fuel Situation at Fukushima
Damage to stored used fuel resulting in the release of radioactive material can result from several mechanisms:
• a sustained loss or degradation of effective active cooling of the SFP water
• loss of SFP water inventory
• physical impact of a dropped heavy object
• a combination of the above mechanisms.
Loss of cooling could lead to boiling of the SFP water. The time before the SFP water level drops sufficiently to result in fuel overheating depends on the amount of water in the SFP as well as the heat load of the spent fuel. In the absence of a leak in the SFP, this time could range from several days to a couple of weeks depending on the details of the SFP design and the decay heat.
Conditions at the NPS during the accident suggested that these mechanisms may have existed. However, the evidence is that no damage occurred to the fuel in the Unit 5 SFP, the Unit 6 SFP, or the common SFP. The September 2011 supplemental report by the Japanese government to the International Atomic Energy Agency (IAEA) concluded that it is most likely that water levels in the Unit 1 through Unit 4 SFPs were recovered before any spent fuel was exposed and damaged. No subsequent evidence has emerged to counter these conclusions.
When the off-site power and all but one of the EDGs were lost at the NPS because of the earthquake/tsunami, normal cooling of the SFPs was lost. The available EDG allowed cooling to be restored to the Unit 5 and Unit 6 SFPs before the temperature of these SFPs increased significantly. Power was also restored to the common SFP cooling system before its temperature increased significantly.
On March 12, a hydrogen explosion damaged the upper portion of the structure surrounding the refueling bay on Unit 1. While this explosion may have resulted in material falling into the SFP, there is no evidence that damage to the fuel occurred. Beginning on March 31, a concrete pumping truck was used to provide makeup inventory to the Unit 1 SFP. An alternative cooling water system has since been put in service for Unit 1. As of September, the SFP water in Unit 1 has been maintained at <35°C (95°F).
Water addition using existing Unit 2 SFP piping began on March 20 and was intermittent. A sample of the water in the Unit 2 skimmer surge tank was taken on April 16. Analysis of this sample suggests that the spent fuel was not damaged. By May 31, a dedicated system incorporating a heat exchanger was in service. An alternative cooling system is in operation, and as of September, the SFP water in Unit 2 has been maintained at <35°C (95°F).
On March 14, a hydrogen explosion damaged the structure housing the Unit 3 refueling pool. Water spray by water cannon and water drops by helicopter started March 17. By March 27, water addition to the pool was accomplished by use of a concrete pump. Use of existing SFP piping to restore SFP inventory began in late April. A video recording made in the Unit 3 SFP was released on June 16 that showed debris from the containment structure that had fallen into the SFP. It was not possible to confirm the structural integrity of the fuel racks using the video recording. It is likely that no damage has occurred to the spent fuel. As of September, the SFP water in Unit 3 has been maintained at <35°C (95°F).
Because of the relatively high decay heat associated with the fuel in the Unit 4 SFP (all fuel had been removed from the Unit 4 RPV in December 2010), special concern was focused on this SFP. When the refueling floor containment structure was severely damaged because of an apparent hydrogen explosion early in the morning of March 15, this concern was intensified. Initially, since the Unit 4 RPV was defueled, the source of the hydrogen was thought to be the stored used fuel, implying that SFP inventory had been lost early in the accident. Later, the source of the hydrogen was determined to likely be from Unit 3, via a pathway to the Unit 4 refueling floor, leaking through a shared pipe to the stack.
Unit 4 SFP temperatures were reported to be 84°C (183°F) on March 14 and 15. Water was intermittently sprayed from trucks beginning March 20. Nevertheless, the reported SFP temperature on March 24 was 100°C (212°F). Water was introduced to the SFP using concrete pumps starting March 25, which offered a more reliable method of delivering water to the SFP.
Additional evidence of the condition of the used fuel in the Unit 4 SFP was inferred from a series of assessments of specific radionuclides from samples taken of the SFP water. Evaluation of the radiochemical assessments supported the proposition that the source of the hydrogen that led to the destruction of the Unit 4 reactor bay superstructure was Unit 3. A video recording of the Unit 4 SFP was released on May 9. This video recording did not show evidence of extensive damage. In fact, the fuel racks appeared to be intact with little debris visible in the SFP.
In April, a concern developed centered around the strength of the structure supporting the Unit 4 SFP. Between May 31 and June 20, steel support pillars were installed to provide protection against damage that might result from additional seismic events.
In late September, the temperature in the Unit 4 SFP was <40°C (104°F), and a new system to provide active cooling was in operation. This is a typical SFP temperature.
II.D. What Happens When Disaster Strikes
When off-site and on-site AC power are lost, an SBO occurs. As noted above, this leaves only the following installed systems to cope with the loss of water supply to the RPV:
• the isolation condenser systems in BWR/3s, such as Fukushima Daiichi Unit 1
• the RCIC systems in BWR/4s, such as Fukushima Daiichi Units 2 through 5; in BWR/5s, such as Fukushima Daiichi Unit 6; and in BWR/6s
• the HPCI systems in BWR/3s and in BWR/4s, such as Fukushima Daiichi Units 1 through 5.
In addition to the systems themselves, DC power and compressed nitrogen (or air) are needed to open and close valves and operate the control systems, as well as provide power for instrumentation that the operator needs in order to take appropriate actions.
An isolation condenser system is capable of maintaining core cooling and removing decay heat, but if there are leaks in the pressure boundary, additional makeup water is needed for the reactor system. The RCIC and HPCI systems are capable of adding more water than is needed to make up for the steam generated by decay heat, and they can handle additional small leaks. During RCIC/HPCI system operation, reactor pressure is controlled by SRV action, but the steam is exhausted to the suppression pool inside the containment, so eventually decay heat removal from the containment must be restored or the containment must be vented.
In addition to the installed equipment discussed above, NPPs have direct diesel-driven pumps as part of the fire protection system, or the flexibility to connect fire trucks to the installed piping leading to the RPV for water makeup. In addition to the extra time it takes to utilize these additional emergency resources, the RPV must be depressurized to a low-enough pressure for these typically lower-pressure pumps to be able to inject. This also means it is necessary to be able to manually open SRVs to lower the reactor pressure. The manual opening of the SRVs still requires DC power and compressed nitrogen.
When there is no water coming into the RPV, there is a period of 1 to 2 hours (depending on how long the reactor has been shut down before the makeup stops) before the fuel becomes uncovered, and ~30 minutes after that, the fuel will start releasing hydrogen and heat from metal-water reaction and then melting. On the other hand, the large size of the suppression pool means that containment would not reach its design pressure for ~15 hours. Thus, higher priority should be given to assuring water makeup to the RPV, including assuring the capability to depressurize if it is necessary to use additional emergency pumps.
II.E. Analysis of Fukushima Daiichi Accident
In Unit 1, loss of DC power for both motive force and instrumentation due to flooding substantially increased the difficulty of controlling the accident. It is unfortunate that in addition to the design-basis tsunami6 being too low, additional flood protection for the batteries was not provided. Only the isolation condenser system was available as a makeup system, and because of lack of instrumentation, it was not clear how well it was working. Priority was given to venting the containment when it should have been given to assuring core cooling, such as by restoring the isolation condenser system at reactor pressure or by lining up alternative water sources into the RPV and depressurizing the reactor system so that low-pressure pumps could be used. At the time of this writing, there is no record of any attempt to depressurize the RPV throughout the event.
The containment vent design, with valves that need DC power and compressed air or nitrogen to operate, plus an in-line rupture disk (with a setpoint greater than the containment design pressure) that cannot be bypassed, led to containment pressures well in excess of the design pressure because of delays. Most likely, the source of the hydrogen in the reactor building was leaks in the containment due to the high pressure, and perhaps also high containment temperatures that could have led to deterioration of the major seals (drywell head cover, and equipment and personnel airlocks). Another possible source could also have been leakage past containment isolation valves.
In Units 2 and 3, the operators should be commended for keeping the RCIC and the HPCI systems operating as long as they did. We note that many probabilistic risk assessments performed on BWRs have shown the dominant core melt scenario to be SBO with eventual failure of the RCIC/HPCI systems, thought to be in ~8 hours because of a number of potential failure mechanisms. However, in that time period, no attempt was made to prepare for depressurization of the RPV until these systems failed, and because of DC power failures and issues with providing alternative compressed nitrogen, depressurization to allow alternative water sources was delayed. Such accident management strategies need to be thought out in advance given the evolution of an accident.