disaster, what we have to do is rather renovating the basic strategy of nuclear safety,
defense-in-depth principle, from a viewpoint of systems resilience.
2 What Did not Change After Fukushima
After Fukushima, many people including the press condemned that the myth of
nuclear safety was over and the thoughts of experts were totally wrong. The
accident, however, has shown clearly that the most basic strategy of
defense-in-depth principle is still valid, because the accident was caused exactly
from the lack of defense-in-depth. The single safety barrier that had protected the
Fukushima Daiichi plants against tsunamis was the seawalls. Since the largest scale
of tsunamis that may possibly occur in the area is uncertain, multiple barriers should
have been implemented for protecting the plants against tsunamis. In this situation,
the tsunami caused by Tohoku Earthquake that exceeded the design basis was fatal.
In addition to the seawalls of an insufficient height, the areas of safety-relevant
equipment in the plants were not watertight. The emergency power supply such as
metal clad switchboards as well as diesel generators were located under the ground
level. All these equipment were therefore submerged and lost functions just after
the tsunami hit the plants. The backup systems against station blackout were
insufficient, either, both in the emergency power supply and the means of water
injection.
Safety barriers were not well prepared for mitigation of the consequence of an
accident. Before the JCO criticality accident (JCO) [2], which occurred in 1999,
emergency response that requires evacuation of nearby residents had been a taboo
in Japanese nuclear development. As an aftermath of JCO, Act on Special Measures
Concerning Nuclear Emergency Preparedness was enacted, and emergency
response drills were enforced in each prefecture of major facility sites. It was
revealed, however, in Fukushima that these efforts were totally ineffective, because
the scale of accident was far beyond the prescribed scenarios of emergency
response plans.
As described above, the disaster of Fukushima occurred, not because the very
basis of nuclear safety was wrong, but because it was not implemented and
maintained properly. Defense-in-depth is the most basic strategy of nuclear safety
that had been established at an early stage of nuclear development, before
sophisticated methods of risk-informed safety management were introduced. After
Fukushima, some people claim that we should rely more on risk-informed methods
for safety management and we should evaluate more precisely the risks of external
hazards. It is necessary to do so, but only introducing more sophisticated
risk-informed methods is not the final answer.
Figure 1 shows an overview of the safety management based on a probabilistic
concept of risk, which is a combination of the scale and probability of damage.
A certain risk limit can be chosen as the curve shown on the scale-probability plane
in the figure. The region above this curve is called an unacceptable region, and that
36
K. Furuta and T. Kanno
defense-in-depth principle, from a viewpoint of systems resilience.
2 What Did not Change After Fukushima
After Fukushima, many people including the press condemned that the myth of
nuclear safety was over and the thoughts of experts were totally wrong. The
accident, however, has shown clearly that the most basic strategy of
defense-in-depth principle is still valid, because the accident was caused exactly
from the lack of defense-in-depth. The single safety barrier that had protected the
Fukushima Daiichi plants against tsunamis was the seawalls. Since the largest scale
of tsunamis that may possibly occur in the area is uncertain, multiple barriers should
have been implemented for protecting the plants against tsunamis. In this situation,
the tsunami caused by Tohoku Earthquake that exceeded the design basis was fatal.
In addition to the seawalls of an insufficient height, the areas of safety-relevant
equipment in the plants were not watertight. The emergency power supply such as
metal clad switchboards as well as diesel generators were located under the ground
level. All these equipment were therefore submerged and lost functions just after
the tsunami hit the plants. The backup systems against station blackout were
insufficient, either, both in the emergency power supply and the means of water
injection.
Safety barriers were not well prepared for mitigation of the consequence of an
accident. Before the JCO criticality accident (JCO) [2], which occurred in 1999,
emergency response that requires evacuation of nearby residents had been a taboo
in Japanese nuclear development. As an aftermath of JCO, Act on Special Measures
Concerning Nuclear Emergency Preparedness was enacted, and emergency
response drills were enforced in each prefecture of major facility sites. It was
revealed, however, in Fukushima that these efforts were totally ineffective, because
the scale of accident was far beyond the prescribed scenarios of emergency
response plans.
As described above, the disaster of Fukushima occurred, not because the very
basis of nuclear safety was wrong, but because it was not implemented and
maintained properly. Defense-in-depth is the most basic strategy of nuclear safety
that had been established at an early stage of nuclear development, before
sophisticated methods of risk-informed safety management were introduced. After
Fukushima, some people claim that we should rely more on risk-informed methods
for safety management and we should evaluate more precisely the risks of external
hazards. It is necessary to do so, but only introducing more sophisticated
risk-informed methods is not the final answer.
Figure 1 shows an overview of the safety management based on a probabilistic
concept of risk, which is a combination of the scale and probability of damage.
A certain risk limit can be chosen as the curve shown on the scale-probability plane
in the figure. The region above this curve is called an unacceptable region, and that
36
K. Furuta and T. Kanno