











First, their report offers the hyperbole:




But the error runs far deeper.

























IV. Conclusions



Comments     Threshold


By Solandri on 3/16/2011 7:23:38 PM , Rating: 2
The backup generators were flooded by the tsunami and had no protective measures for flooding. (not encased or anything).

IIRC, they were built to withstand a 6 meter tsunami because that's the biggest one that had been recorded in Japanese history. Unfortunately, this one was about 8 m. The same thing happened in all the towns which were washed away. They had 4.5-6 m tsunami walls. The tsunami just washed right over them. The videos you've seen of what looks like boats going down a mini-waterfall onto a street? That's the water spilling over the tsunami walls.

This is the one thing I thought was terribly mishandled. Not only should someone have had the foresight to at least try and protect the backup generators from water, there was no backup for the backup.

I'm sorry but the cooling system is clearly the biggest source of concern in a nuclear power station, there should have been several levels of redundancy.

There were several levels of redundancy. Normally they get power off the grid. The backups are the generators (which were quadruply redundant*). The level of backup were batteries, which they used but only lasted about 8 hours. The next backup was a waste-heat generator, probably something like a stirling engine. For some reason that didn't work. The last backup is getting external power from a generator mounted on a vehicle, but word is they could get the cables to connect properly. So they had to resort to venting steam to cool the cores.

So really you had a huge confluence of unfortunate circumstances. Whether that was just bad luck, or due to negligence in design, or poor maintenance remains to be seen.

*The quadruply redundant diesel generators is a common error when building risk-tolerant systems. Too often the thinking goes "Well, if there's a 10% chance of a generator failing, we'll just put 4 generators there. That way the chance of all four generators failing is 0.1^4 = 0.01%. So it's 99.99% likely to work." Unfortunately, that calculation assumes the failures are independent events. As we saw, the same factor which takes out one generator can take out all the others.

The same thing happened on the space shuttle Challenger. They knew when assembling the SRB segments, there was about a 1 in 100 chance of not mounting it properly and causing a hot spot. So they put in o-rings to seal against that. The o-rings were difficult to mount properly in their seatings, and were known to fail about 1 in something like 100 times. That resulted in a chance of failure of 1 in 10,000 which was too high. So they figured they could just put in 2 o-rings. Even if one failed the chances of both failing would be 1 in 10,000. That put the chance of complete failure at 1 in 1 million, which they deemed to be safe.

They completely missed that a factor (cold weather) could guarantee both o-rings would fail. (Well, apparently the engineers knew it, the managers just refused to believe them.)

By Donkeyshins on 3/16/2011 8:32:42 PM , Rating: 2
You are also failing to mention that the first reactors to have problems were 40-year-old reactors based upon the GE Mark 1 design and were scheduled to be retired in February of this year (until TEPCO lobbied to extend the life of the reactors by a decade). If these had been a Gen III or Gen III+ design, we most likely wouldn't be having this conversation as there wouldn't have been a loss of coolant.

