Site Engineering at Sea Side Nuclear Power Plants.

[Joe Neubarth]

Tell the world about the horrible site engineering the Fukushima crisis has exposed.

The Low Tsunami protection in a major earthquake zone with a wall that was notdesigned to protect the plant in a worst case scenario. They have a recorded history of high tsunamis in the past yet they ignored that history and built a low wall.

The building of almost all electrical and electronic distribution nodes in places where they could be douched by a tsunami.

Underground electrical conduits.

The location of the diesel generators in places where they could be douched.

The lack of an emergency common buss tie between the diesel generators so that a diesel generator in plant 6 could power the cooling pumps in plant 3 if necessary. That is called redundancy. You would think that any engineer would understand the concept.

The smoke (steam venting) stacks that were built for a loss of electrical power accident but have to have an electrically operated valve to open to be used. (How in the hell do you engineer a steam release system that needs to be used in a loss of electricity generated nuclear emergency that has to rely on electrically operated valves?

The list goes on and on and on...

Let us hope and pray that San Onofre in San Diego County is not engineered the same way. I have been out on San Clemente Island, and it is obvious to me that there is a fault line running down the middle of that island. I can see it in the north, but can not find it in the south, but where I can see it, it looks like it can split the island. That is not to say that half the island could fall east into the ocean, but part of it could. There is an earthquake fault and massive depth to the east of San Clemente so if there was a landslide into the ocean, there could be a forty foot tsunami generated that would flow east to the coast. Do you know what is just east of San Clemente? Yep, San Onofre nuclear power station. How high are their sea walls? They say 30 feet. I look at them, and they do not look that tall. They are probably only 25 feet above high tide. That is an estimate, but I am concerned. If that is all the higher their diesel generators are and their electrical connection boxes we could see the same problem at San Onofre the world has witnessed at Fukishima.

YOU can put the rest of the picture together yourself.

 

[msgellerman]

I have been out on San Clemente Island, and it is obvious to me that there is a fault line running down the middle of that island. I can see it in the north, but can not find it in the south, but where I can see it, it looks like it can split the island. That is not to say that half the island could fall east into the ocean, but part of it could. There is an earthquake fault and massive depth to the east of San Clemente so if there was a landslide into the ocean, there could be a forty foot tsunami generated that would flow east to the coast. Do you know what is just east of San Clemente? Yep, San Onofre nuclear power station. How high are their sea walls? They say 30 feet. I look at them, and they do not look that tall. They are probably only 25 feet above high tide. That is an estimate, but I am concerned. If that is all the higher their diesel generators are and their electrical connection boxes we could see the same problem at San Onofre the world has witnessed at Fukishima.

YOU can put the rest of the picture together yourself.

I wouldn't worry about San Clemente Island splitting in half anytime soon. There is a long fault just east of the island - the western edge of the deep graben with Santa Catalina being the obvious exposed horst on the other side. What looks like faulting on the north of the island are Pleistocene marine terraces cut by the various synchronicity of changing sea levels and uplift along the fault. If San Onofre gets hit by a huge tsunami on the scale of the one caused by the Tohoku quake - it will almost certainly come from a large offshore quake north of the Transverse Ranges or a huge rupture in the San Jacinto fault zone or even the southern part of the San Andreas fault zone.

Couldn't agree more about the basic engineering issues though - although even a shared buss on the generators wouldn't help since they couldn't get any of them to work ... not sure what they were thinking.

 

[joema]

I admit I don't understand the diesel generator site decision for Fukushima I. Disaster planning is key -- tornado, earthquake, tsunami, plane crash, hurricane, etc. That's one reason for an armored reactor containment. It's for external threats, not just internal melt downs.

But reactor integrity is equally dependent on diesel backup generators. It's not like diesel generators at a factory, where if they don't work you lose production. Diesel generators at a nuclear plant are life critical.

The space shuttle has quadruple redundant flight control computers, because they are absolutely life critical. Yet if all four fail, only the lives of the astronauts are lost.

A nuclear power plant potentially involves the lives of thousands.

How could the diesel backup generators not be sited and housed in a manner which reflects this reality?

Fukushima I ran on batteries for 8 hours, which drove the reactor core isolation cooling system. Did they not have a sat phone or other pre-planned contingency procedures to transport by helicopter emergency DC power within 8 hours?

 

[Joe Neubarth]

I admit I don't understand the diesel generator site decision for Fukushima I. Disaster planning is key -- tornado, earthquake, tsunami, plane crash, hurricane, etc. That's one reason for an armored reactor containment. It's for external threats, not just internal melt downs.

But reactor integrity is equally dependent on diesel backup generators. It's not like diesel generators at a factory, where if they don't work you lose production. Diesel generators at a nuclear plant are life critical.

The space shuttle has quadruple redundant flight control computers, because they are absolutely life critical. Yet if all four fail, only the lives of the astronauts are lost.

A nuclear power plant potentially involves the lives of thousands.

How could the diesel backup generators not be sited and housed in a manner which reflects this reality?

Fukushima I ran on batteries for 8 hours, which drove the reactor core isolation cooling system. Did they not have a sat phone or other pre-planned contingency procedures to transport by helicopter emergency DC power within 8 hours?

I understand they had one Sat Phone for the entire site.

They did have emergency portable diesel generators. Unfortunately nobody in their chaim of command bothered to see if they were compatible to the wiring leading to the plant. When they arrived, they were not used, because their "connection plug did not fit."

That is right. They did not use them because the plug did not fit. An electrical company did not have an electrician on site to quickly wire anything that the needed to stop the meltdown of the reactors. I think that is called a serious mistake in judgment.

 

[Joe Neubarth]

I wouldn't worry about San Clemente Island splitting in half anytime soon. There is a long fault just east of the island - the western edge of the deep graben with Santa Catalina being the obvious exposed horst on the other side. What looks like faulting on the north of the island are Pleistocene marine terraces cut by the various synchronicity of changing sea levels and uplift along the fault. If San Onofre gets hit by a huge tsunami on the scale of the one caused by the Tohoku quake - it will almost certainly come from a large offshore quake north of the Transverse Ranges or a huge rupture in the San Jacinto fault zone or even the southern part of the San Andreas fault zone.

Couldn't agree more about the basic engineering issues though - although even a shared buss on the generators wouldn't help since they couldn't get any of them to work ... not sure what they were thinking.

They should have built one or two diesel generator buildings with the capacity to run any of the reactor pumps from any of the diesel generators. Those generator building should have been built on top of the nearby hill, a hundred feet above the water.

 

[IowaNewbie]

They should have built one or two diesel generator buildings with the capacity to run any of the reactor pumps from any of the diesel generators. Those generator building should have been built on top of the nearby hill, a hundred feet above the water.

And to add insult to injury, that 100' hill you suggest - only 220 meters west of the reactors the elevation is 100'.

 

[Joe Neubarth]

And to add insult to injury, that 100' hill you suggest - only 220 meters west of the reactors the elevation is 100'.

Yep they had to cut down the hill to build the reactor site. By cutting down to close to sea level, they ensured a future catastrophe. We are now witnessing it.

 

[gmax137]

The lack of an emergency common buss tie between the diesel generators so that a diesel generator in plant 6 could power the cooling pumps in plant 3 if necessary. That is called redundancy. You would think that any engineer would understand the concept.

Joe, sharing safety systems between units is more complicated than you seem to realize. What if the diesels in unit 3 are failed by shorts? When you try to re-energize the buses from unit 6 all you're going to do is fail number 6's diesels too. It's called isolation. Most nuclear design engineers understand the concept.

I'm not saying that all of your ideas are bad. But the designs were given a lot more thought than you seem to think.

 

[joema]

As time passes, technical knowledge and operational experience increases. It's expected that newer generation reactors will be safer in ways that designers could not have envisioned when Fukushima I's reactors were designed 45 years ago.

That said, the siting decision for the diesel backup generators didn't require advanced technology or decades of reactor experience. I think engineers from ancient Rome could have understood the risk.

In a country that literally invented the word "tsunami", placing a life critical system in a non-hardened structure on the seaward side of the reactor doesn't make sense.

 

[Joe Neubarth]

Joe, sharing safety systems between units is more complicated than you seem to realize. What if the diesels in unit 3 are failed by shorts? When you try to re-energize the buses from unit 6 all you're going to do is fail number 6's diesels too. It's called isolation. Most nuclear design engineers understand the concept.

I'm not saying that all of your ideas are bad. But the designs were given a lot more thought than you seem to think.

Being an electrician, I totally disagree with you. You can easily run the cables out to the reactors from a Diesel Generator building. You could also have several cables between plants that can be used. You can manually switch to them in an emergency in a matter of a few seconds. Nobody said anything about paralleling diesel generators, just taking the output to be used elsewhere. There is no difficulty in that unless the idiots run the cables in underground conduits along the sea shore. When your threat is the ocean, you do not run cables where the ocean can have its way with them. Nor do you put connection boxes and pump controllers where the ocean can swamp them. If Fukushima had been designed for a worse case scenario this disaster would never have happened.

 

[daumphys]

One of the problems at this nuclear plant disaster is that we did not know the exact situation after earthquake and tsunami attack. If we knew the exact condition about the nuclear plant, the worst disaster would not happen. Why we did not do proper action at that time? Someone say there was no electricity, we could not do anything. I dare say one of the problems in this power plant design, why we did not make the measuring instrument as dual system. One instrument for controlling the reactor, and the other is for emergency situation. The instrument for emergency situation must have it's own battery and wireless communication system to transfer data to the outside emergency control center. If such design idea were represented at that plant, we could not make such a huge disaster. At any situation we must know the important operating data of nuclear power plant.

 

[Joe Neubarth]

If it is desired to have nuclear reactors along the sea shore, why not build them on massive barges that can ride over a tsunami and will not be shaken in an earthquake and can be towed away from civilization if there is any hint of trouble??

I have been asking this question for many a year, but nobody can come up with an answer.

 

[NUCENG]

Being an electrician, I totally disagree with you. You can easily run the cables out to the reactors from a Diesel Generator building. You could also have several cables between plants that can be used. You can manually switch to them in an emergency in a matter of a few seconds. Nobody said anything about paralleling diesel generators, just taking the output to be used elsewhere. There is no difficulty in that unless the idiots run the cables in underground conduits along the sea shore. When your threat is the ocean, you do not run cables where the ocean can have its way with them. Nor do you put connection boxes and pump controllers where the ocean can swamp them. If Fukushima had been designed for a worse case scenario this disaster would never have happened.

You are right, it would be easy to string cables and install breakers to interconnect the units. But Joe is right too, the problem doesn't stop there. If a diesel needs to carry additional load it needs to be bigger. How many other units need to be carried. Would you design each of the 12 site diesels to be capable of running all the other 5 units? Each unit has been designed to independently carry its own load in a design basis accident. But it could have been designed to carry more. But then when carrying its own load it would be operating at a low fraction of its rated power. A diesel is happiest and most reliable with a steady state load near its rated capacity. Then you need to increase the size of cooling water pumps for the diesels, and increase fuel storage and so on. All this to be able to handle a site wide emergency from any available diesels. By the way how do you get that cooling water without having a pump near sea level, vulnerable to damage from a tsunami? In the end, given everything else, would interconnecting the diesels have prevented the accident?

The basic flaw here was not whether you could interconnect diesels to the other units. It was made in designing for the maximum probable tsunami, which was short of the mark. There have allegedly (I haven't seen them yet) been reports since these plants were built that indicated a bigger tsunami was probable. If so failure to act on those reports was a contributing factor. That is why the regulators are there - to make sure plant operators take action when confronted with new information.

 

[NUCENG]

If it is desired to have nuclear reactors along the sea shore, why not build them on massive barges that can ride over a tsunami and will not be shaken in an earthquake and can be towed away from civilization if there is any hint of trouble??

I have been asking this question for many a year, but nobody can come up with an answer.

Okay, Take Fukushima. The reactors are on BIG barges. The earthquake hits. About 1 hour later the tsunami hits. In that hour you have to disconnect and start towing. How far do you get?

Or if you have to ride it out where it is, the next thing you know the barge is stuck high and dry seven miles inland with no cooling water, no electric power, and smack in the middle of the disaster area. Are you better off?

 

[Joe Neubarth]

Okay, Take Fukushima. The reactors are on BIG barges. The earthquake hits. About 1 hour later the tsunami hits. In that hour you have to disconnect and start towing. How far do you get?

Or if you have to ride it out where it is, the next thing you know the barge is stuck high and dry seven miles inland with no cooling water, no electric power, and smack in the middle of the disaster area. Are you better off?

NUC, I doubt that you are an avid body surfer. The nuc plants can be on barges or ships about a mile or further out to sea with transmission towers linking them to land. That far out to sea the tsunami is just a swell that passes under you. As a body surfer I know that if you do not want to surf the wave you just swim through it. As a swell it only starts to break when it reaches shallow water. The NUC plants that I used to work on forty years ago used to get underway all of the time. We steamed through hurricanes. A little up and down action is no threat as long as you have your rods securely latched and reliable (read dry) diesel generators if you need to do a start up after a scram.

 

[Joe Neubarth]

And for those people who would claim them to be eyesores do that they do in Southern Calefornia where people don't like microwave relay towers. Here, they make them look like palm trees. Put palm tree like microwave relay towers on the barges, name them all Shan-gra-La and convince the people that there are "Tropical Islands" just off shore. They could boost microwave transmission further out to sea, look good to the public and provide uninterrupted power for millions without interruption by earthquakes and tsunamis. The only thing you have to worry about is a hostile nation torpedo attack. Of course, it they were going to do that, they would attack your land plants, as well so you have sort of a push-pull there.

 

[NUCENG]

NUC, I doubt that you are an avid body surfer. The nuc plants can be on barges or ships about a mile or further out to sea with transmission towers linking them to land. That far out to sea the tsunami is just a swell that passes under you. As a body surfer I know that if you do not want to surf the wave you just swim through it. As a swell it only starts to break when it reaches shallow water. The NUC plants that I used to work on forty years ago used to get underway all of the time. We steamed through hurricanes. A little up and down action is no threat as long as you have your rods securely latched and reliable (read dry) diesel generators if you need to do a start up after a scram.

I too was a Navy Nuclear Engineer Officer and went to sea with nuclear propulsion. I have tried board and body surfing in Hawaii and decided that it was too close to drowning for me.

That sounds like trading vulnearability to a rare tsunami for a not so rare vulnerability to storms. Have you never encountered a rogue wave at sea? Being close to shore in a bad storm is not a safe place to be. In a typhoon or hurricane ships still put their bows into the seas and drive through waves. Now your barge becames self propelled and designed for stability. If the barge is underway of course, the connection to shore needs to be disconnected. Even aircraft carrier nuclear plants are dwarfed by the commercial reactors that use low level enriched uranium. Of couse it would be possible to build commercial plants with weapons grade uranium enrichment, but that creates its own issues.

You may be onto something though. With your grasp of obvious solutions, we could find a way around all these problems. Perhaps the next generation of nuclear plants could do it your way. But I have been reading your posts. I suspect even then you won't be in favor of it.

 

[Joe Neubarth]

I am convinced that all potentialities can be accommodated. A structure could be built to present very little wind signature, of course, we would have to do away with all of those fake palm trees. Far enough north in Japan and hurricanes are not as big an issue as in the southern islands. If shipbuilders can build super carriers, they can build commercial reactor plants on structures out at sea. I am not a ship engineer, so I will leave all of the problem resolution to them. If they do decided to go with my plan, I will insist that I get some recognition, though. Everybody needs a pat on the back once in a while.

I just though, the solution to southern California transportation problems is floating airports. Maybe a joint effort could be productive?

 

[Drakkith]

Do you people seriously believe that the safety of a nuclear reactor was just "ignored'?

A. The reactors successfully shut down the moment the earthquake was detected by sensors at the plants.
B. The generators successfully turned on and provided power to the plants until they were swamped by a Tsunamai from THE LARGEST EARTHQUAKE EVER RECORDED IN JAPAN.
C. The backup batteries successfully provided cooling power until they ran out of power.
D. They couldn't connect backup sources because the facility was UNDERWATER where you had to plug in. And I'm assuming the power lines aren't just up on flimsy towers, but most likely buried underground. So that rules out splicing into them unless you have a backhoe on hand or something readily available.


Like what has been said before, there are many many factors to consider when designing and building a nuclear power plant. Why did they build the generator building where it was instead of on a hill? Well, I could think of one reason. Typhoons.

Also, even if they had considered building better protection, it would cost more money. Not their money. Your money. Or rather the people in japan who pay for electricity, either through the government or privately. (I don't know how it works in Japan) Would you, not knowing anything about safety of a Nuclear Reactor really want them to spend 2-3x as much on safety features if you were told that the current ones were already sufficient above and beyond all recorded distasters? Especially if you had to pay for it? Probably not.

And lastly, consider that those reactors had been operational for around 40 years. That means that most of the design is from the 1960's. Do you complain that cars in the 1960's didn't include seatbelts always? Or that the glass tended to break into large shards that impaled people in a crash? No, because safety rules and knowledge have improved since then, just like reactors have.

Before you all start whining about how bad the construction and design of our nuclear plants are, I suggest you go look up newer designs and such. Until then, it's all just whining.

P.S. Most of these suggestions are terrible, unworkable, or accomplish nothing. Sorry that this post is so negative, but I'm tired of listening to people complain about stuff they don't understand. (Yes, even here on PF)

 

[M. Bachmeier]

And for those people who would claim them to be eyesores do that they do in Southern Calefornia where people don't like microwave relay towers. Here, they make them look like palm trees. Put palm tree like microwave relay towers on the barges, name them all Shan-gra-La and convince the people that there are "Tropical Islands" just off shore. They could boost microwave transmission further out to sea, look good to the public and provide uninterrupted power for millions without interruption by earthquakes and tsunamis. The only thing you have to worry about is a hostile nation torpedo attack. Of course, it they were going to do that, they would attack your land plants, as well so you have sort of a push-pull there.

Joe it would make sense if not for two reasons:

1) The protection from earthquake and tsunami offered by open water would leave the structures vulnerable to hurricane, or should I say cyclone. The battering of such a storm would exceed most any earthquake or tsunami potential.

2) The possibility of attack from below could not be adjusted for. If it costs too much to build such a 'superstructure' barge it's not feasible to generate power economically.

There's a reason why navy vessels go to immediate missile alert at first sight of an unidentified target and it's not because they don't like to make friends (and that's from the air; water is much thicker).

 

[Joe Neubarth]

Do you people seriously believe that the safety of a nuclear reactor was just "ignored'?

A. The reactors successfully shut down the moment the earthquake was detected by sensors at the plants.
B. The generators successfully turned on and provided power to the plants until they were swamped by a Tsunamai from THE LARGEST EARTHQUAKE EVER RECORDED IN JAPAN.
C. The backup batteries successfully provided cooling power until they ran out of power.
D. They couldn't connect backup sources because the facility was UNDERWATER where you had to plug in. And I'm assuming the power lines aren't just up on flimsy towers, but most likely buried underground. So that rules out splicing into them unless you have a backhoe on hand or something readily available.Like what has been said before, there are many many factors to consider when designing and building a nuclear power plant. Why did they build the generator building where it was instead of on a hill? Well, I could think of one reason. Typhoons.

Also, even if they had considered building better protection, it would cost more money. Not their money. Your money. Or rather the people in japan who pay for electricity, either through the government or privately. (I don't know how it works in Japan) Would you, not knowing anything about safety of a Nuclear Reactor really want them to spend 2-3x as much on safety features if you were told that the current ones were already sufficient above and beyond all recorded distasters? Especially if you had to pay for it? Probably not.

And lastly, consider that those reactors had been operational for around 40 years. That means that most of the design is from the 1960's. Do you complain that cars in the 1960's didn't include seatbelts always? Or that the glass tended to break into large shards that impaled people in a crash? No, because safety rules and knowledge have improved since then, just like reactors have.

Before you all start whining about how bad the construction and design of our nuclear plants are, I suggest you go look up newer designs and such. Until then, it's all just whining.

P.S. Most of these suggestions are terrible, unworkable, or accomplish nothing. Sorry that this post is so negative, but I'm tired of listening to people complain about stuff they don't understand. (Yes, even here on PF)

I suggest you pay attention. Site construction is not Reactor Construction. I find no fault with reactor construction and upgrades. I find tremendous fault with the site construction as I have posted. All of the Fukushima corrections that should have been made would not have been cost prohibitive. When you are considering the potential loss of millions of people's lives, you do not design a reactor plant site as poorly as the Japanese did at Fukushima. The things they did there can not be explained.

 

[Joe Neubarth]

Joe it would make sense if not for two reasons:

1) The protection from earthquake and tsunami offered by open water would leave the structures vulnerable to hurricane, or should I say cyclone. The battering of such a storm would exceed most any earthquake or tsunami potential.

2) The possibility of attack from below could not be adjusted for. If it costs too much to build such a 'superstructure' barge it's not feasible to generate power economically.

There's a reason why navy vessels go to immediate missile alert at first sight of an unidentified target and it's not because they don't like to make friends (and that's from the air; water is much thicker).

Bachmeier, you are way out in left field and you forgot your glove. A cyclone would not in any way bother a structure as would be required to float several reactors or even one big one for that matter, provided they do not build it up in the air. Not a problem in any way, shape or form. Why would anybody with an engineering degree design such a structure for use at sea with high sail area? Cyclones are not even a consideration as long as the engineers do their job right.

 

[gmax137]

...When you are considering the potential loss of millions of people's lives ...

Why do you keep on saying that? Where's the basis for that number?

 

[M. Bachmeier]

Bachmeier, you are way out in left field and you forgot your glove. A cyclone would not in any way bother a structure as would be required to float several reactors or even one big one for that matter, provided they do not build it up in the air. Not a problem in any way, shape or form. Why would anybody with an engineering degree design such a structure for use at sea with high sail area? Cyclones are not even a consideration as long as the engineers do their job right.

Joe you've expressed your displeasure at having pot shots thrown at you, like, "you are way out in left field and you forgot your glove" @Neubarth. You are also aware I'm a layman with regard to this subject and, last time I checked, this is a learning forum?

That said, my concern in (1) is not wind, but rough seas in storms (re: cumulative stress). Designs of nuclear vessels are likely different from land based installations. Also, probably very expensive. Economic prohibition.

Please address item (2), if you would, re: vulnerability of floating nuclear plant.

 

[joema]

...nuc plants can be on barges or ships about a mile or further out to sea with transmission towers linking them to land. That far out to sea the tsunami is just a swell that passes under you...

That is possible but there are cheaper options with broader effectiveness. The barge strategy only protects against one rare case, and introduces additional cost and risk.

But as you already said, there were multiple options which could have prevented the disaster.

Technical disasters are caused by a chain of events. Break any link in the chain and it doesn't happen.

Any of these changes could have prevented or greatly limited the problem. Not saying they were all applicable in this case, just listing some examples.

(1) Using modern Gen III+ reactors
(2) More realistic tsunami calculations resulting in a higher sea wall
(3) Placing diesel generators and switching equipment in a safer location
(4) Armoring diesel generators in current location like the European EPR reactors.
(5) Having additional on-site emergency generators that were compatible with current equipment
(6) Having a NEST-like emergency team with prearranged, prepositioned, and preallocated assets to handle civil reactor emergencies.
(7) Longer battery life for reactor core isolation cooling system

We must keep in mind the main technical cause of the problem: a single backup which was placed in a vulnerable location. Despite the nuclear mantra of "we have backup systems for our backup systems", in reality there was a single backup.

There is apparently a different mentality in the Japanese civil nuclear power community than in, say, manned aerospace or nuclear navy. In those areas multiple backups, and extreme operational rigor are absolute requirements.

This can be seen in an April 9 New York Times article about a problem at the Higashidori nuclear plant:

http://www.nytimes.com/2011/04/10/world/asia/10japan.html?_r=1

"...lost all outside power. Although it had three backup diesel generators, two were out of service for periodic maintenance. The remaining one worked for a while, but later, after some outside power was restored, it stopped because some of its oil spilled out.

It's crazy to have a maintenance procedure which limits a nuclear plant to a single backup.

The underlying mentality can also be seen in this article:

http://www.houseofjapan.com/local/aftershock-highlights-fragility

"...On April 9, the agency asked power companies to secure at least two diesel-powered generators at each nuclear power plant even if the plants were not in operation. The agency said that its previous stance of saying it was enough to have one generator available was "insufficient..."

But no amount of backups will help if proper site decisions and operational procedures aren't followed. You could have 10 backup generators but if they are all located in a floodable area, or procedures take down 9 at a time for maintenance, you are still exposed!

I don't understand the "single backup is adequate" philosophy concerning a nuclear plant. It is arguably more life critical than any manned space vehicle or nuclear submarine.

 

[NUCENG]

I don't understand the "single backup is adequate" philosophy concerning a nuclear plant. It is arguably more life critical than any manned space vehicle or nuclear submarine.

Reactor safety design ausually assumes that offsite power is lost in any event that has turbine trip or reactor scram as a site centered disturbance to the grid. Then they provide redundant trains of equipment so there would be two different backups for loss of power. What do you see as the single backup philosophy? What I see as the root cause was that the site design provided protection for only a 5.7 m tsunami. That became a single point of failure for onsite AC which led to the accident. Without that failure, the plant should have been able to mitigate this event. With that failure, no amount of redundancy or backup was sufficient.

 

[joema]

...What do you see as the single backup philosophy?...

The previously-quoted statements imply a single backup was the accepted philosophy. Admittedly these are news articles which are often inaccurate.

However they apparently quote TEPCO's statement about more than one backup is now necessary, which obviously means prior to that it was OK.

The two of three generators being down for maintenance at the Higashidori plant might be explained by the reactor being unfueled and only the spent fuel pools required power. Maybe their procedures allow this for SFPs, not operating reactors.

As I already said, you could have 10 backups but if the site design or operational procedures allow a single point of failure it doesn't help.

Backup or any redundant system must be of practical benefit, else it's of little use. That's why the EPR reactors have quadruple diesel backups in two geographically dispersed hardened buildings, to avoid a single point of failure.

Even if Fukushima had gas turbines in addition to diesels it wouldn't have helped, had they been sited in the same vulnerable location as the diesel equipment. So it's true the issue isn't simply degree of redundancy, but overall physical design, site design, and operational procedures.

However the previously-quoted statements seem to imply a single level of backup was viewed as sufficient.

I don't know what current U.S. operational practice is, but in 1981, a station blackout study done at Browns Ferry said it required six of eight diesel generators concurrently operating for safe cooldown (3.7 MB .pdf): http://www.ornl.gov/info/reports/1981/3445600211884.pdf

Since system reliability is the product of individual component reliabilities, the 6 of 8 requirement would be worse than a single monolithic backup. There's a reliability formula for n of r in a parallel system, but I don't have it at hand.

But this shows an additional complication in reliability engineering: if the minimum usable backup system consists of multiple sub-components (all or several of which must be on line), then the overall backup reliability may be worse than first appears.

 

[NUCENG]

The previously-quoted statements imply a single backup was the accepted philosophy. Admittedly these are news articles which are often inaccurate.

However they apparently quote TEPCO's statement about more than one backup is now necessary, which obviously means prior to that it was OK.

The two of three generators being down for maintenance at the Higashidori plant might be explained by the reactor being unfueled and only the spent fuel pools required power. Maybe their procedures allow this for SFPs, not operating reactors.

As I already said, you could have 10 backups but if the site design or operational procedures allow a single point of failure it doesn't help.

Backup or any redundant system must be of practical benefit, else it's of little use. That's why the EPR reactors have quadruple diesel backups in two geographically dispersed hardened buildings, to avoid a single point of failure.

Even if Fukushima had gas turbines in addition to diesels it wouldn't have helped, had they been sited in the same vulnerable location as the diesel equipment. So it's true the issue isn't simply degree of redundancy, but overall physical design, site design, and operational procedures.

However the previously-quoted statements seem to imply a single level of backup was viewed as sufficient.

I don't know what current U.S. operational practice is, but in 1981, a station blackout study done at Browns Ferry said it required six of eight diesel generators concurrently operating for safe cooldown (3.7 MB .pdf): http://www.ornl.gov/info/reports/1981/3445600211884.pdf

Since system reliability is the product of individual component reliabilities, the 6 of 8 requirement would be worse than a single monolithic backup. There's a reliability formula for n of r in a parallel system, but I don't have it at hand.

But this shows an additional complication in reliability engineering: if the minimum usable backup system consists of multiple sub-components (all or several of which must be on line), then the overall backup reliability may be worse than first appears.

You have hit on an important point that should be considered in light of the accident at Fukushima. In terms of physical design, plant designs generally have redundant capability. But that capability my not be required at all times.

The first issue revealed in the Fukushima event is that the tsunami wall has no backup. I did not previously recognize that fact, but I believe it will be the root cause of this accident. Similar issues may exist at plants on the Great Lakes subject to possible seiches. Other plants may get into the same bind due to flooding or hurricane damage if the onsite AC generators are not properly protected. Any single point of failure needs to be over-designed or any potential targets of its failure need to be protected from that failure. That didn't happen at Fukushima.

The second issue is that during normal operation there are allowed outage times (AOT) governed by Technical Specifications which allow a single train to be inoperable. If the redundant train also becomes inoperable, an immediate shutdown is required. The justification for an AOT is that there is less risk if the inoperable train can be returned to service than cycling the plant through an immediate shutdown. During the AOT there is a loss of redundancy.

The third issue is that there are significant relaxations of requirements for redundancy during shutdon operation such as refueling outages. It is not uncommon to have one train of onsite AC (EDG) out of service for maintenance whille shutdown. A Loss of Offsite Power in that condition leaves the plant with a single operable train of onsite AC and no backup. The two functions that would be needed during shutdown are residual heat removal for fuel in the reactor and spent fuel pool cooling.

These last two issues have been accepted practice in order to permit repairs and maintenance. They are controlled by license requirements in the Technical Specifications. It may not be possible to eliminate these last two issues, but the Fukushima lesson seems to require that these allowed outages should be re-evaluated for risk.