Japan Earthquake: Political Aspects

[zapperzero]

Operators at Fukushima were not wringing their hands over the decision to vent. There were three causes of the delay.

they had delays to get corporate and government permission to vent. Finally, they waited until initial evacuations were complete.

IOW, hand-wringing on several levels. It is worth noting that their SAMG did not say "delay venting until evacuation is complete" (it would have been absurd if they did). That was a decision taken by plant management.

I agree that the target should be no release, and that means preventing core damage from external events or extended SBOs.

Yes.

But we must also have some level of design for severe (beyond design basis) accidents.

AHH. THANK YOU. It took me a while, but now I can lay the problem out: severe accidents should not be kept out of the design basis.

There should be provisions to design for them in a reasonable manner (as per your earlier asteroid example) but they should NOT be kept out of consideration. At the very least, one should design taking into account the severe accidents that have already happened!

You may be spot on about early depressurization. You may also be right about filtration options for the vent path. But you also may be totally underestimating the interaction of the potential solutions. I was trying to help you see that by the discussion of interplay with early depressurization and venting. NRC and industry (and "watchdog" groups) have begun a series of meetings to discuss these complex issues. When trascripts or webcasts are available I will post links to the discussions. I hope you will see I am urging detailed evaluations for the options to make certain the results actually improve safety.

I do see that interaction between various safety systems and procedures needs to be taken into account. A small filter may be worse than no filter, hence the decision to have un-filtered vents of last resort. A big filter of new design is more expensive, may not be needed or may not work as advertised.

 

[zapperzero]

I like the asteroid example.

If it's an average everyday asteroid, it will be about the size of a fist and will have enough energy to go through several feet of concrete. So at the very worst, we are looking at a missile incident resulting in containment breach and a small-break LOCA.

Turns out this case is already taken into account in plant design and accident management procedures, because turbine blades tend to go AWOL from time to time.

Bigger asteroids tend to break up in the atmosphere and make big booms, in the megatons TNT equivalent... it is hard to know, because they are so rare, where to stop hardening the structure against overpressure. But such cases are taken somewhat into account, given that containment is designed to handle airplanes falling on top of it and smallish bombs going off in the vicinity.

As to other effects, Tunguska is thought to have produced a magnitude 5 quake at ground zero - well within design parameters.

Even bigger ones, that don't break up? Multi-megaton equivalent ground bursts, we have MUCH bigger problems than just a destroyed NPP. Of course, the tsunami/quake combo wrought such devastation and killed so many people that it can be compared to a largish asteroid. But then, they are much rarer than tsunamis.

 

[zapperzero]

In simulator training for aircraft, it is common for the instructors to simply throw problems you, like this: "the APU is gone, your electronic instruments are all dead. Oh btw, engine #1 is on fire" without regard for how probable the event is, just taking care that the situation IS recoverable from, in most cases.

Is this not the case with NPP simulators? Do simulated accident scenarios all have attached probabilities? Does anyone go "oh we won't train for a LOCA this year because they are so rare"?

 

[NUCENG]

AHH. THANK YOU. It took me a while, but now I can lay the problem out: severe accidents should not be kept out of the design basis.

There should be provisions to design for them in a reasonable manner (as per your earlier asteroid example) but they should NOT be kept out of consideration. At the very least, one should design taking into account the severe accidents that have already happened!

The probability of a large meteor or asteroid striking the Earth is about once per million years. The probability of striking a nuclear plant or close by is even lower. Therefore it is NOT considered part of design basis.

I like the asteroid example.

If it's an average everyday asteroid, it will be about the size of a fist and will have enough energy to go through several feet of concrete. So at the very worst, we are looking at a missile incident resulting in containment breach and a small-break LOCA.

Turns out this case is already taken into account in plant design and accident management procedures, because turbine blades tend to go AWOL from time to time.

Bigger asteroids tend to break up in the atmosphere and make big booms, in the megatons TNT equivalent... it is hard to know, because they are so rare, where to stop hardening the structure against overpressure. But such cases are taken somewhat into account, given that containment is designed to handle airplanes falling on top of it and smallish bombs going off in the vicinity.

As to other effects, Tunguska is thought to have produced a magnitude 5 quake at ground zero - well within design parameters.

Even bigger ones, that don't break up? Multi-megaton equivalent ground bursts, we have MUCH bigger problems than just a destroyed NPP. Of course, the tsunami/quake combo wrought such devastation and killed so many people that it can be compared to a largish asteroid. But then, they are much rarer than tsunamis.

In simulator training for aircraft, it is common for the instructors to simply throw problems you, like this: "the APU is gone, your electronic instruments are all dead. Oh btw, engine #1 is on fire" without regard for how probable the event is, just taking care that the situation IS recoverable from, in most cases.

Is this not the case with NPP simulators? Do simulated accident scenarios all have attached probabilities? Does anyone go "oh we won't train for a LOCA this year because they are so rare"?

Simulator training for operators includes some beyond design basis conditions to exercize SAMGs. SBOs are typical. The only way to exercise evacuations or offsite releases is to assume a beyond design basis core damage scenario and containment failure or leakage. In fact there are scenarios that have to assume release of fission products equivalent to multiple core source terms to fully exercise parts of emergency plans. So-called B.5.b equipment requirements assume large plant area damage from aircraft or terrorist attacks, while the design basis against terror attacks or airplane impacts is to prevent the success of the attack.

Again, Fukushima clearly indicates that extended SBO and external events need to be reconsidered. But if thos issues are resolved the whole issue of filtering hardened vents may be moot because its is at risk periods equivalent to the asteroid strike,

Your example of the LOCA is problematic.
The design basis LOCA is a double ended break of the largest pipe, plus the effects of pipe whip and jet impact, plus all equipment failures as a direct result of the LOCA, and finally assuming the single failure of safety systems or power supplies that results in the worst consequences. The design must assure that the core is not damaged in this scenario. But in addition, design bases for containment and SBGT are evaluated for assumed system leakage and fission product release from an arrested core melt scenarion without causing overexposure to workers or the public.

 

[zapperzero]

The probability of a large meteor or asteroid striking the Earth is about once per million years. The probability of striking a nuclear plant or close by is even lower. Therefore it is NOT considered part of design basis.

I was unclear, I mean that some events should rightfully be excluded.

 

[rmattila]

Even though the design bases in pretty much all Western nations were initially based on the NRC:s criteria from the 1960's, the definitions have since diverged.

Here in Finland, for example, severe accidents were included in the design bases in the 1980's, with specific criteria for failure assumptions (pretty much all "normal" safety systems and instrumentation assumed lost), containmet loads, equipment qualification for the core meltdown conditions, allowable releases (100 TBq Cs-137) etc., and backfittings (filtered ventings, passive containment flooding systems etc.) were made at the old plants. For new plants, a more robust core catcher has been required since the early 1990's.

A more recent development has been a systematic approach to so called "design extension conditions" (DEC), which were outside the original design bases. These conditions include e.g. situations with a common cause failure in any of the safety systems, other complex accident sequences or very rare natural events, and the category has its own design rules and acceptance criteria (to be demonstrated when applying a construction or operating permit and ever 10 years during operation).

So all in all, the design basis of plants consists of three event categories based on the conservatively estimated frequency of the initiating event:

1. the "old-fashioned" design basis conditions
DBC1, normal operation
DBC2, anticipated operational occurrences, f > 1e-2/a
DBC3, Class 1 postulated accidents, 1e-2/a < f < 1e-3/a
DBC4, Class 2 postulated accidents, f < 1e-3/a

2. Design extension conditions, events with an estimated frequency between 1e-4/a and 1e-7/a
DEC A, DBC2-3 with a CCF in a safety system
DEC B, complex accident sequence (=multiple failures)
DEC C, very rare events (such as a collision of a large passenger aircraft)

3. Severe accidents, events exceeding the acceptance criteria for DECs
total sum of all severe accident even trees shall be lower than 1e-5/a

Summing up, the cutoff frequency for events to be considered in the design is of the order of 1e-7, and there's the additional reuirement that the sum for all such events shall be lower than 1e-5. And the severe accident systems shall be able to fulfill their design basis so that the probability for exceeding the acceptance criteria for severe accidents is lower than 5e-7/a.

Since all these event categories contain explicit design rules and acceptance criteria, it is natural to include them all in the concept "design basis" of the plant. I have the impression that many other countries are also taking steps in this direction, so it may become internationally more common to redefine the "design basis" to go beyond the traditional DBC2-4 events with a single (or double in some countries) failure.

 

[nikkkom]

Again, Fukushima clearly indicates that extended SBO and external events need to be reconsidered. But if thos issues are resolved the whole issue of filtering hardened vents may be moot because its is at risk periods equivalent to the asteroid strike.

I see that you definitely won't be convinced that your attitude is wrong until a F1/Chernobyl scale release of Cs-137 in the US. Just don't say no one was telling you so.

 

[NUCENG]

I see that you definitely won't be convinced that your attitude is wrong until a F1/Chernobyl scale release of Cs-137 in the US. Just don't say no one was telling you so.

If my attitude is wrong, it is at least based on detailed knowledge and study. If you can show me where I am wrong with something of the same credibility, please post. Otherwise it comes down toL "You are wrong, and I am right, because I am right."

 

[NUCENG]

I was unclear, I mean that some events should rightfully be excluded.

Agreed

 

[nikkkom]

If my attitude is wrong, it is at least based on detailed knowledge and study. If you can show me where I am wrong with something of the same credibility, please post.

I told you several times already: in my opinion, the F1 disaster itself is a sufficient proof that existing NPPs are not secure enough. Snails' pace reaction from NRC and "it's all stupid Japanese's fault" attitude from US nuclear industry reinforces my POV. Feel free to disagree.

 

[NUCENG]

I told you several times already: in my opinion, the F1 disaster itself is a sufficient proof that existing NPPs are not secure enough. Snails' pace reaction from NRC and "it's all stupid Japanese's fault" attitude from US nuclear industry reinforces my POV. Feel free to disagree.

Your continuous reference to "stupid Japanese fault" is racist, and a total mistatement of my position. Your simplistic view of design basis is totally indefensible. Is the fact of an automobile accident or airplane crash "sufficient proof" that cars and airplanes aren't safe enough? Yes, accidents do point out things that can be better. But,The design of a car or airplane can never fully protect from human error, deliberate attack, or even faulty materials or design. There is risk in transportation, but there are benefits, too, so we continue to fly and drive. It is absurd to believe nuclear plants need to be scrapped ot install systems that have no impact on safety, just to satisfy people who want to ignore the basic truth of risk-awareness.

I have agreed with you "several times" that there are lessons in the Fukushima accident for all nuclear plants. As to a "snails pace," We still are getting revelations on things like corium/concrete interaction, which are based on theory and guesswork, because no one has seen inside the containments yet. NRC is planning to begin issuing orders in the next few months, even though some of it based on supposition and "best guess" information. Do you want efforts to be fast and wrong or deliberate and useful? (Yeah, I know, you want it fast and right! Too bad, it doesn't work that way.) The North Anna earthquake may indicate that there is no need for knee jerk reactions. NRC, IAEA, and every other nuclear power operator seems to agree. Even Germany continues to operate nuclear plants while they plan to move to other sources.

So "feel free to disagree" with me. I enjoy informed argument. But please, if you want to debate, bring something to the discussion other than implying that I am direspectful of the Japanese, trying to twist my position and the tired old anti-nuclear rhetoric.

 

[clancy688]

Even Germany continues to operate nuclear plants while they plan to move to other sources.

Not quite. We shut down the oldest eight of our 17 reactors a couple of days after Fukushima. And didn't turn them on again. And don't intend to turn them on again. Ever.
All of those eight reactors were built during the early seventies, that's probably the generation which makes the bulk of the american plants. In fact, not a single active U.S. plant was built after 1974. Which means that your most recent and most advanced plant design in use is exactly the design we shut down immeadiately because we deemed it to unsafe to operate any further.

If you'd apply recent German decisions on operating nuclear plants in the U.S., you'd have exactly zero plants running next week.

 

[nikkkom]

Your continuous reference to "stupid Japanese fault" is racist, and a total mistatement of my position.

To think that *Japanese* regulators and NPP owners can (knowingly or unknowingly) (1) underestimate tsunami risk and (2) fail to train personnel for a prolonged SBO scenario, but *American, French, etc* regulators and NPP owners are somehow immune to this is, indeed, wrong. (Whether its racism, arrogance or unwillingness to spend $$$ on safety upgrades is, frankly, not something I'm interested in figuring out. I want to see meaningful safety upgrades).

Your simplistic view of design basis is totally indefensible. Is the fact of an automobile accident or airplane crash "sufficient proof" that cars and airplanes aren't safe enough? Yes, accidents do point out things that can be better.

F1 points out that (1) plant personnel needs to know how to vent reactor and containment in a prolonged SBO and (2) this venting needs to be filtered. Before F1, we could have assumed that it's a very unlikely situation and thus plants and people need not be prepared for it. After F1, I find it hard to believe that a "very unlikely situation" happened in only 6*10^1 years of humanity's history of running NPPs. It _IS_ not that rare. We just got the empirical proof explode in our faces.

It is absurd to believe nuclear plants need to be scrapped ot install systems that have no impact on safety, just to satisfy people who want to ignore the basic truth of risk-awareness.

A scrubber on the vent does have a significant impact: it reduces contamination after venting. As such, it may make personnel less hesitant to vent when they need to - because they know they aren't dusting their children with large amounts of Cs-137...

As to a "snails pace," We still are getting revelations on things like corium/concrete interaction, which are based on theory and guesswork, because no one has seen inside the containments yet. NRC is planning to begin issuing orders in the next few months, even though some of it based on supposition and "best guess" information. Do you want efforts to be fast and wrong or deliberate and useful?

Japanese still did not release their accident report (which is outrageous too), but basic sequence of events which led to hydrogen explosions and meltdown is well-known for good six months already:

faulty EDG locations,
faulty distribution of emergency battery power,
faulty emergency systems (no light, no instrumentation, no nothing),
personnel untrained for extended SBO (doesn't know what to do),
failure to engage passive emergency cooling systems even where they existed,
failure to vent containments and reactors before Zr/steam reaction and meltdown,
failure to vent reactor buildings to prevent hydrogen accumulation.

How many years do we need to wait until NRC starts to act on these lessons learned?

 

[zapperzero]

The only way to exercise evacuations or offsite releases is to assume a beyond design basis core damage scenario and containment failure or leakage.

Perhaps I am misunderstanding. Are you saying that design basis events cannot possibly result in core damage and containment failure?

 

[clancy688]

As far as I understand a containment failure is per definitionem a beyond design basis accident.

At least here in Germany, the "design basis accident" (GAU - Größter Anzunehmender Unfall, largest assumable accident) is exactly the kind of accident, the plant still can cope with without releasing radioactivity to the environment.
So a "design basis accident" can include core damages (I'd classify TMI as a design basis accident), but doesn't necessarily have to. For modern plants with core catchers, even a fullscale meltdown and -through probably still counts "only" as a design basis accident, because the plant is designed to handle even that.
But older plants, like Fukushima, are not.

What I'm trying to say is that there's no standard definition of a "design basis accident" and a "beyond design basis accident". It depends on the type of plant you're looking at. And for some (older plants), design basis accidents don't include meltdowns, because that's clearly beyond the design basis. But containment failure is IMHO always a beyond design basis accident.

 

[zapperzero]

And for some (older plants), design basis accidents don't include meltdowns, because that's clearly beyond the design basis. But containment failure is IMHO always a beyond design basis accident.

You are saying that almost no NPP existing today is designed to "fail safe" or even just "fail gracefully", yes?

 

[clancy688]

You are saying that almost no NPP existing today is designed to "fail safe" or even just "fail gracefully", yes?

I don't know, ask NUCENG, he's the nuclear engineer. ;)


But I'd say that statistics indicate that plants of the sixties and seventies, which make the bulk of the plants in operation, are not what you could define as "hardened against meltdown accidents", wouldn't you agree so?

And the development of the core catcher technology is indeed a hint that meltdowns are not "treatable" at older plants. If they could cope with a meltdown, why developing core catchers?

 

[nikkkom]

You are saying that almost no NPP existing today is designed to "fail safe" or even just "fail gracefully", yes?

Yes. Almost all existing NPPs require *active* cooling for weeks after shutdown, and within a few days after that fails for whatever reason, they *will* spew lots of radioactive dirt, one way or another.

 

[clancy688]

and within a few days after that fails

Days? It's hours. F1 melted down within a few hours after the tsunami triggered the SBO. F2 and F3 also melted down within a few hours after the last line of defense (RCIC) failed. Up to that moment, they were cooled. Not quite sufficiently, but enough to prevent any catastrophic accident.
TMI melted down within hours as well. But since it was a PWR with the control rods entering from the top, there was no RPV breech since the RPV had no failure points (control rod entrances) at the bottom.
Again, I'm no nuclear engineer, but I'd say a comparison between TMI and F2 and F3 clearly shows that the BWR design is suffering of a deadly design flaw.

 

[nikkkom]

Days? It's hours.

I said "...they will spew lots of radioactive dirt".

Meltdown is not a sufficient condition to do that. TMI melted down, but did not release significant amounts of contamination.

As an aside, TMI's release could easily be contained within PWR containment, but they had automatic sump pumps which dutifully pumped spilled primary coolant to the outside. Got this? That NPP had *automatic* radionuclide dispenser *in its design*! LOL...

Again, I'm no nuclear engineer, but I'd say a comparison between TMI and F2 and F3 clearly shows that the BWR design is suffering of a deadly design flaw.

I don't see much difference. TMI's condition was easier - they _did_ have AC and cooling water. In fact, they had them entire time... Thus the results ended up to be much less "spectacular"...

 

[clancy688]

I don't see much difference. TMI's condition was easier - they _did_ have AC and cooling water. In fact, they had them entire time... Thus the results ended up to be much less "spectacular"...

If we trust the TEPCO analysis, F2 and F3 had similar core damage (~50%) to TMI. But at TMI, no fuel escaped. At Fukushima, it did, at least according to TEPCO.

So there are three partial meltdowns, each time cooling was disrupted for several hours, each time half of the core went AWOL, two were BWRs and one was a PWR. In both BWR's case, the fuel escaped the RPV, in the PWR's case it didn't. That's what I meant with design flaw. The PWR proved that it could contain even a limited meltdown. And the BWRs did not, thanks to the openings for the control rods.

If I remember correctly, TMI finished clean-up during the early nineties. With escaped fuel, they'd probably just have started defueling this decade.

 

[NUCENG]

Not quite. We shut down the oldest eight of our 17 reactors a couple of days after Fukushima. And didn't turn them on again. And don't intend to turn them on again. Ever.
All of those eight reactors were built during the early seventies, that's probably the generation which makes the bulk of the american plants. In fact, not a single active U.S. plant was built after 1974. Which means that your most recent and most advanced plant design in use is exactly the design we shut down immeadiately because we deemed it to unsafe to operate any further.

If you'd apply recent German decisions on operating nuclear plants in the U.S., you'd have exactly zero plants running next week.

Germany has stated that they will phase out nuclear power by 2022. What is the issue with my having said that Germany continues to operate nuclear plants? You have made your decision. If you want to make that decision for the US, immigrate, take citizenship, and vote here. I respect the decision you made, but that is apparently too much to ask in return. If that decision to shutdown nuclear power is reached in the US, I hope it won't just be because Germans think they might be unable to operate at a reasonable risk/benefit. Perhaps you should think of this as an opportunity to take a leap forward and create the intelligent grid to support all those renewable but unreliables while Americans make our nuclear plants safER (nothing is risk free).

As to the intent to turnoff nuclear in Germany, we will see. Never say never, especially since we already saw this cycle once before in Germany, and despite your objection, nuclear power is still being generated in Germany.

 

[NUCENG]

Perhaps I am misunderstanding. Are you saying that design basis events cannot possibly result in core damage and containment failure?

Yes. Even SBO is defined to be an extension of design requirements, but not a design basis event. That is because the current rules require at least two offsite power sources, then back that up with EDGs, batteries, and pneumatic supplies. The Fukushima Accident will result in significant upgrades to address extended SBOs, but the first focus has to be to ensure that those on-site sources can withstand the potential external events.

SBO history is a study in problem identification/corrective action efforts. There was the original Station Blackout Rule. Then there was the response to enhance security from terrorists or large aircraft impacts, now there will be likely increases in the duration and equipment available to combat the extended-SBO scenario. Of course. one additional thought might be to quit delaying construction of new plants that are designed for passive safety.

 

[NUCENG]

Days? It's hours. F1 melted down within a few hours after the tsunami triggered the SBO. F2 and F3 also melted down within a few hours after the last line of defense (RCIC) failed. Up to that moment, they were cooled. Not quite sufficiently, but enough to prevent any catastrophic accident.
TMI melted down within hours as well. But since it was a PWR with the control rods entering from the top, there was no RPV breech since the RPV had no failure points (control rod entrances) at the bottom.
Again, I'm no nuclear engineer, but I'd say a comparison between TMI and F2 and F3 clearly shows that the BWR design is suffering of a deadly design flaw.

Pardon the correction, but TMI2 was a PWR with a large dry containmentn not a pressure suppression containment, and the event was a LOCA, not an SBO, but BWRs also learned from that accident. And deadly design flaws? Show me the bodies and compare that design flaw with the civil risk from the tsunami. Had TEPCO or the Regulators in Japan done their jobs to address the seismic/tsunami risk, you wouldn't have learned so much, nor apparently understood so little about that information.

Nuclear operators have a moral duty to take action when unrecognized risks are found. That didn't happen in Japan, but prevention of a similar accident is now the focus of the world. In spite of that, there are persistent claims that the "industry" is a bunch of greedy corporate stooges out to steal the world and destroy children in their cribs. That deliberately ignores the fact that we live in our communities, and have families and friends, and there are probably even a few treehuggers that would object if nuclear was anywhere near as destructive as fossil fuels.
.

 

[rmattila]

So there are three partial meltdowns, each time cooling was disrupted for several hours, each time half of the core went AWOL, two were BWRs and one was a PWR. In both BWR's case, the fuel escaped the RPV, in the PWR's case it didn't. That's what I meant with design flaw. The PWR proved that it could contain even a limited meltdown. And the BWRs did not, thanks to the openings for the control rods.

If we think of a modern plant design - i.e. one with the fourth line of defence-in-depth (prevention of releases in a severe core damage situation) in place, there are two possible strategies to cope with the molten core: either try and cool it within the RPV or let it melt through and arrange a core catcher plus enable water filling of the containment up to the top of the initial fuel range.

In a BWR with a lot of bottom penetrations, it is probably not possible to reliably prevent a melt-through, and an ex-vessel core catcher will be required. In some PWR:s (those with a small thermal power, no bottom penetrations and a narrow reactor vessel cavity), it may be possible to passively cool the core debris through the RPV and prevent a melt-through - this is a strategy e.g. in the Loviisa VVER 440 reactors: http://sacre.web.psi.ch/ISAMM2009/oecd-sami2001/Papers/p10-lundstroem/oecd_paper_2.pdf - but in most modern PWR:s, the decay power is too high for such a strategy, and an ex-vessel core catcher will be needed.

From the environmental safety point of view, whether the molten core is within the RPV or below it plays no role, as long as the containment maintains its integrity. For the post-accident cleanup within the plant, it may be somewhat easier to remove the debris from within the vessel, but as long as the containment water filling is successful, it should be possible to cope with the corium in the core catcher as well, once the RPV has first been cleaned up and removed.

So I would't see incapability to contain the molten core within the RPV necessarily as a design flaw, as long as the containment integrity is not jeopardised as a consequence of a melt-through. However, for most of the existing plants, the containment has not been designed to cope with such a situation, and therefore prevention of melt-through will probably be the strategy to go with.

 

[clancy688]

What is the issue with my having said that Germany continues to operate nuclear plants?

You compared the situation to the U.S. It's my understanding of your comment that you tried to use the still running NPPs in Germany as proof that even anti-nuclear states don't see dangers in running old plants for a couple of more years.
Which's not entirely correct, at least if you compare the U.S. and Germany. Because, as I already stated, Germany SEES danger in running plants which are as old as the ones in the U.S. And therefore shuts those reactors down immediately.

As to the intent to turnoff nuclear in Germany, we will see. Never say never, especially since we already saw this cycle once before in Germany, and despite your objection, nuclear power is still being generated in Germany.

Well, yes. Our government already set us up once. And then those dipgarbages decided to prolong the lifetime of every NPP back in autumn last year. At least we'd had fun watching the decision blowing up in their faces in March. The FDP (liberal party), the most prominent supporter of nuclear power, went from 15% during the last election 2009 to 2.5% in current polls...

Pardon the correction, but TMI2 was a PWR with a large dry containmentn not a pressure suppression containment, and the event was a LOCA, not an SBO,
[...]
Had TEPCO or the Regulators in Japan done their jobs to address the seismic/tsunami risk, you wouldn't have learned so much, nor apparently understood so little about that information.

Of course it was a LOCA and Fukushima was an extended SBO. But in the end, the cause doesn't matter, because the result, loss of cooling for several hours, thus leading to a partial meltdown, is the same.
You can compare it to three car accidents. There are three cars, every car drives at ~30 miles, and each car crashes in the same corner at the same speed head first into a tree. One driver survived, two others didn't. Why? Is it because the surviving driver was drunken, while the other two lost control on an icy road?
Nope - why they crashed has absolutely no impact on the final outcome. One driver survived because his car had airbags and the other two didn't, and it doesn't matter the slightest if the surviving driver was the drunk one or one of the sober ones.

And deadly design flaws? Show me the bodies and compare that design flaw with the civil risk from the tsunami.

Uh, sorry. I didn't mean that literally. I used the "deadly" part in order to emphasize the danger coming from this design flaw.
Personally, I fear the economic consequences of nuclear accidents, not the health ones.

So I would't see incapability to contain the molten core within the RPV necessarily as a design flaw, as long as the containment integrity is not jeopardised as a consequence of a melt-through. However, for most of the existing plants, the containment has not been designed to cope with such a situation, and therefore prevention of melt-through will probably be the strategy to go with.

Sorry, but I had to laugh, really. That's what I made of your response:
"Possible meltthroughs are not a design flaw as long as the containment holds, but since most containments won't hold, they are indeed design flaws."

 

[rmattila]

Sorry, but I had to laugh, really. That's what I made of your response:
"Possible meltthroughs are not a design flaw as long as the containment holds, but since most containments won't hold, they are indeed design flaws."

Well, that's more or less how it is with the old plants: you have to get along with what you have. The main design deficiency regarding severe accidents is in the containment design, and therefore you have to do whatever you can to keep the molten core within the reactor vessel - and that too is an add-on to the original design bases: more achievable in some designs than others.

With the new plant designs the situation is different, and a more balanced design can be achieved, either by keeping the melt within the RPV or letting it out in a controlled manner. The latter is a more common design choice.

 

[NUCENG]

You compared the situation to the U.S. It's my understanding of your comment that you tried to use the still running NPPs in Germany as proof that even anti-nuclear states don't see dangers in running old plants for a couple of more years.
Which's not entirely correct, at least if you compare the U.S. and Germany. Because, as I already stated, Germany SEES danger in running plants which are as old as the ones in the U.S. And therefore shuts those reactors down immediately.

Once again, your understanding of my comment is flawed. My only intent was to say the Germany has not cut off all nuclear generation which means your country believes that the risk is low enough to operate some reactors while finding replacement sources.

Your defense that only the older plants are risky is also difficult to understand. So turning off the older plants makes the others immune to an accident? I know that isn't what you meant, but try this for one of those "Thought experiments" being touted all over this forum:

You turn German nuclear power into a dying occupation with an execution date 11 years from now, followed by decommissioning. How are you going to keep a highly technical, competent work force in light of that doomsday roughly one third of a career away? You still have fuel to store or reprocess. Perhaps you can export that problem, if you find any takers.

Well, yes. Our government already set us up once. And then those dipgarbages decided to prolong the lifetime of every NPP back in autumn last year. At least we'd had fun watching the decision blowing up in their faces in March. The FDP (liberal party), the most prominent supporter of nuclear power, went from 15% during the last election 2009 to 2.5% in current polls...

Exactly, it happened once and could happen again. Isn't that what you claim about Fukushima?

Of course it was a LOCA and Fukushima was an extended SBO. But in the end, the cause doesn't matter, because the result, loss of cooling for several hours, thus leading to a partial meltdown, is the same.
You can compare it to three car accidents. There are three cars, every car drives at ~30 miles, and each car crashes in the same corner at the same speed head first into a tree. One driver survived, two others didn't. Why? Is it because the surviving driver was drunken, while the other two lost control on an icy road?
Nope - why they crashed has absolutely no impact on the final outcome. One driver survived because his car had airbags and the other two didn't, and it doesn't matter the slightest if the surviving driver was the drunk one or one of the sober ones.

OK, let's use your three cars. The drunk driver was in a Toyota, His police officer let him drive anyway and he was killed. The driver in the Ford was killed, but people saw the carnage and decided to install airbags as well, and perhaps required a sobriety test ignition interlock. The BMW driver survived the crash thanks to his car that was a little newer and had airbags. But then he decided that cars were too risky so he ordered all cars without airbags off the road immediately and ordered automakers to stop production or importation of cars to his country by 2022 because we'd all have flying belts by then. I suppose bicycles are a good backup if that doesn't work out.

sorry. I didn't mean that literally. I used the "deadly" part in order to emphasize the danger coming from this design flaw.
Personally, I fear the economic consequences of nuclear accidents, not the health ones.

Me too, and luckily I don't have to worry about whether to calculate those consequences in Euros of Duetch Marks! (Just Kidding!)

 

[NUCENG]

Well, that's more or less how it is with the old plants: you have to get along with what you have. The main design deficiency regarding severe accidents is in the containment design, and therefore you have to do whatever you can to keep the molten core within the reactor vessel - and that too is an add-on to the original design bases: more achievable in some designs than others.

With the new plant designs the situation is different, and a more balanced design can be achieved, either by keeping the melt within the RPV or letting it out in a controlled manner. The latter is a more common design choice.

Wouldn't it be better to keep the core from melting to begin with? We keep jumping over that potential and assuming there is no other way to skin this cat.

 

[rmattila]

Wouldn't it be better to keep the core from melting to begin with? We keep jumping over that potential and assuming there is no other way to skin this cat.

That goes without saying. The question is: how many lines are needed in the defence in depth concept? The current trend seems to be towards a five-line defence. In the Finnish design guides the defence-in-depth is defined in the spirit of current IAEA guidelines as follows:

Safety functions in accordance with the defence-in-depth concept shall be assured through five successive levels of protection; the lowest two are designed to prevent accidents, whereas the remaining levels are designed to protect the plant, its operators and the environment from the adverse effects of an accident. The levels of defence are the following:

1) The first level is to prevent deviations from the normal operation of the plant. To achieve this, the design, manufacture, installation and maintenance of systems, structures and components and the operation of the plant shall comply with high standards of quality and reliability with adequate safety margins.

2) At the second level, provisions shall be made, despite the careful design and operation of the plant, for anticipated operational occurrences, and the plant shall be equipped with systems designed to detect and contain any anticipated operational occurrences and automatically place the plant in a controlled state.

3) At the third level, provisions shall be made for accidents by means of systems that are automatically actuated in the event of an accident, protect the barriers for confinement of radioactive materials, and prevent the accident from escalating into a severe accident. The third level shall be divided into two parts: level 3a and level 3b.

a. At level 3a, the objective is to control the postulated accidents (Class 1 and Class 2) arising from single initiating events and their consequential effects in order to limit the releases of radioactive materials.

b. At level 3b, the objective is to control design extension conditions, meaning:

• anticipated operational occurrences and Class 1 postulated accidents that involve a common-cause failure in the system designed for coping with the event concerned;
• combinations of failures selected on the basis of a probabilistic risk assessment; and
• rare events that are unlikely to occur but nevertheless considered possible, such as extreme weather phenomena or the impact of a large passenger airliner.

4) At level 4, the objective is to mitigate the consequences of a severe accident, in particular by ensuring the integrity and leaktightness of the containment.

5) At level 5, the objective is to mitigate the consequences of any major release of radioactive materials by means of emergency preparedness arrangements.

The levels 3b and 4 are those, where the old plant designs are not very strong. The whole idea of the "deterministic design philosophy" is to not be satisfied with the preventive actions, but to create a new independent defence line by postulating the loss of the previous ones. If each level is independent of the others and attains a ~99% reliability, the probability of a large release can be proven to be acceptably small. Without the 4th level, very much depends on the perfection of the 3rd one, and the defence is inevitably less deep. Existence of the 4th level does not, however, mean that one could be careless with the third one, and all practicable precautions shall be made to make a core melt as improbable as possible.

 

[clancy688]

My only intent was to say the Germany has not cut off all nuclear generation which means your country believes that the risk is low enough to operate some reactors while finding replacement sources.

Your defense that only the older plants are risky is also difficult to understand. So turning off the older plants makes the others immune to an accident?

It lowers the risk. And we believe that there's an acceptable risk in operating a couple of newer plants for the next ten years. But at the same time, we believe that operating older plants increases those risks to a point to high for us to accept.

How are you going to keep a highly technical, competent work force in light of that doomsday roughly one third of a career away? You still have fuel to store or reprocess.

The loss of the competent work force is indeed a problem. I don't have any informations on how the plants cope with that specific problem, but it is definitely NOT new. The former socialist-green government decided a phase out of nuclear power in 2000. So the problem you're mentioning has already existed for 10 years.
I agree, it's a risk factor, but it's the only way to abolish power. As for the reprocessing - well, we're already sending everything we have to La Hague for reprocessing. Storage is more difficult... we still don't have a final storage depot. And are still looking for one.

Exactly, it happened once and could happen again. Isn't that what you claim about Fukushima?

The current political reality in Germany makes it very unlikely. Because of Fukushima, the Greens became actually strongest party in the state of Baden-Württemberg. That's a sensation and comparable to a green governor in Texas. ;)

OK, let's use your three cars. The drunk driver was in a Toyota, His police officer let him drive anyway and he was killed. The driver in the Ford was killed, but people saw the carnage and decided to install airbags as well, and perhaps required a sobriety test ignition interlock. The BMW driver survived the crash thanks to his car that was a little newer and had airbags. But then he decided that cars were too risky so he ordered all cars without airbags off the road immediately and ordered automakers to stop production or importation of cars to his country by 2022 because we'd all have flying belts by then. I suppose bicycles are a good backup if that doesn't work out.

That's quite a cynical sight... moreover, you turned my purely technical meltdown example into a political one.
So maybe we Germans are irrational. I can live with that. I won't criticize our phase-out decision just because other pro-nuclear instances keep calling us "pussies". ;)

 

[NUCENG]

That goes without saying. The question is: how many lines are needed in the defence in depth concept? The current trend seems to be towards a five-line defence. In the Finnish design guides the defence-in-depth is defined in the spirit of current IAEA guidelines as follows:



The levels 3b and 4 are those, where the old plant designs are not very strong. The whole idea of the "deterministic design philosophy" is to not be satisfied with the preventive actions, but to create a new independent defence line by postulating the loss of the previous ones. If each level is independent of the others and attains a ~99% reliability, the probability of a large release can be proven to be acceptably small. Without the 4th level, very much depends on the perfection of the 3rd one, and the defence is inevitably less deep. Existence of the 4th level does not, however, mean that one could be careless with the third one, and all practicable precautions shall be made to make a core melt as improbable as possible.

This is worth spending some time on. I like that description and breakdown. Can you provide a link to this guidelines information? It is similar to discussions I heard in NRC meetings in the last week.

 

[NUCENG]

It lowers the risk. And we believe that there's an acceptable risk in operating a couple of newer plants for the next ten years. But at the same time, we believe that operating older plants increases those risks to a point to high for us to accept.



The loss of the competent work force is indeed a problem. I don't have any informations on how the plants cope with that specific problem, but it is definitely NOT new. The former socialist-green government decided a phase out of nuclear power in 2000. So the problem you're mentioning has already existed for 10 years.
I agree, it's a risk factor, but it's the only way to abolish power. As for the reprocessing - well, we're already sending everything we have to La Hague for reprocessing. Storage is more difficult... we still don't have a final storage depot. And are still looking for one.



The current political reality in Germany makes it very unlikely. Because of Fukushima, the Greens became actually strongest party in the state of Baden-Württemberg. That's a sensation and comparable to a green governor in Texas. ;)



That's quite a cynical sight... moreover, you turned my purely technical meltdown example into a political one.
So maybe we Germans are irrational. I can live with that. I won't criticize our phase-out decision just because other pro-nuclear instances keep calling us "pussies". ;)

No, sir, I am not trying to be cynical or belittle the German decision. That would be just as wrong as accepting a belief that the Japanese are stupid as others here have tried to imply. I really hope you succeed in making renwables work for you. The smaller German physical land area is better suited than the US to make intelligent grid a reality. The US, on the other hand, requires a large grid which becomes much more vulknerable if you increase the portion of variable renewals. Further most of our transmission grid angenerators are aging and need to be updated. That convinces me that we need to maintain large baseload generation, and the health impacts of coal is a stronger argument than global warming. We also have a much larger total electrical demand, and now they are adding electrical vehicles to the mix.

There is some risk in the German approach that renewables and your grid may take longer than 2022. That was the point of my parable. That is not saying the plan is irrational. It is actually visionary. If it doesn't work out and you end up keeping those plants running a little longer, you are still following the will of your people and that doesn't make you pussies.

And if you succeed and we can copy from your example, that too can be good.

 

[Dmytry]

Germans can perhaps go through with reduction of consumption as well. Passivhaus and all. With availability of cheap east european workforce it is easier to build work-intensive solutions of this kind.

The nuclear power is attractive to authoritarian type, a person who builds their worldview upon belief in the competence and incorruptibility of authorities (government), a person who is rendered extremely uncomfortable by any less optimistic assumptions.
This is something that Germans are understandably very vary about even 67 years after having witnessed the extremes of such approach; the German nuclear power plants may be very safe but at same time it is not possible for populace to know if they are very safe or it is a grand self deception, as with the small number of plants the safety can not be inferred from operation record.

Concorde is a good example of the safety self deception problem; before it crashed, was the 'safest' aircraft in history, with 0 crashes, and was often referred to as such. After Concorde crashed it became clear that it is in fact exceedingly unlikely it was anything but by far the least safe aircraft they had in operation; most airplanes would've been exceedingly unlikely to crash after so few flights; and suddenly it became clear that very significant safety issues have been consistently ignored as minor, leading to the crash; it was bound to fail because it never failed before.

 

[Caniche]

If each level is independent of the others and attains a ~99% reliability, the probability of a large release can be proven to be acceptably small.

All fine and dandy ,but when a statistically predictable larger than average nuclear disaster occurs ,how do you tell the 1,000,000 victims this is acceptable?