Japan Earthquake: Nuclear Plants at Fukushima Daiichi

[NUCENG]

I was just about to write the same reply, but you were faster..

Finally this isolation condenser mystery is starting to make sense: loss of DC results into a (spurious) system isolation due to the fail-safe direction of the valves, and depending on whether or not there was AC available at the time of loss of DC, the inner IC valves (4A and 4B) may have closed at that time.

Since steam was reportedly observed at 18:18 upon opening the 3A valve, it might suggest that the 4A valve would have remained open in spite of the closure signal, but that remains to be seen.

Once again, thank you, Tsutsuji-san - you're helping many people to get understanding of the situation.

Deciding the fail-safe mode of different valves is always a difficult optimization task. In the GE BWR:s, it seems that fail-close has been a very dominating design principle (thinking of the difficulties in lowering the reactor pressure and now this issue of possibly losing the isolation condenser due to the return lines fail-closing). Possibly worth a thought or two at other NPP:s as well.

I would urge a little caution as there are other questions to answer. The F1 operators tried multiple workarounds in venting and other actions they took in the early hours. Isolation signals can be reset or jumpered out. Alternatve power sources can be rigged. Were any of these part of the actions that night?

The information provided by Tsutsuji has been timely and useful, but in our voracious appetite for answers, we should keep in mind that answers can raise more questions.

 

[rmattila]

I would urge a little caution as there are other questions to answer. The F1 operators tried multiple workarounds in venting and other actions they took in the early hours. Isolation signals can be reset or jumpered out. Alternatve power sources can be rigged. Were any of these part of the actions that night?

The information provided by Tsutsuji has been timely and useful, but in our voracious appetite for answers, we should keep in mind that answers can raise more questions.

While all that is true, one must remember that there may be less than an hour to initiate core cooling in order to prevent fuel uncovery. It is very unlikely that workarounds can be fixed to locate the correct instrumentation cabinets, return the DC for the measurement circuits and AC for the inner isolation valves, and then steer the inner valves open in such a short time period. It's complicated enough to get a grip of what's going on and manually open the outer valves within an hour or so - simultaneous spurious closure of the non-hand-manageable inner valves makes the task too challenging to be reliable.

In ASEA BWRs, the logic has been to use check valves as the inner isolation valves whenever possible (=most ingoing lines), since they don't need any electricity or instrumentation to function - and for the outer isolation valves, there's a hand wheel to enable opening and closing of the valve. The isolation condenser relies on relatively small pressure differences, and a check valve in the return line may thus be impossible to arrange, but taking into account the importance of the safety function, loss of both cooling circuits due to a single loss of a DC measuring voltage supply just seems too thin.

 

[NUCENG]

While all that is true, one must remember that there may be less than an hour to initiate core cooling in order to prevent fuel uncovery. It is very unlikely that workarounds can be fixed to locate the correct instrumentation cabinets, return the DC for the measurement circuits and AC for the inner isolation valves, and then steer the inner valves open in such a short time period. It's complicated enough to get a grip of what's going on and manually open the outer valves within an hour or so - simultaneous spurious closure of the non-hand-manageable inner valves makes the task too challenging to be reliable.

In ASEA BWRs, the logic has been to use check valves as the inner isolation valves whenever possible (=most ingoing lines), since they don't need any electricity or instrumentation to function - and for the outer isolation valves, there's a hand wheel to enable opening and closing of the valve. The isolation condenser relies on relatively small pressure differences, and a check valve in the return line may thus be impossible to arrange, but taking into account the importance of the safety function, loss of both cooling circuits due to a single loss of a DC measuring voltage supply just seems too thin.

I agree, just trying to keep everybody up on a questioning attitude.

 

[tsutsuji]

Since the description of the event was complete blackout in some control rooms, and the control room lights are an essential electric load with emergency AC or DC backup, TEPCO may not even have had exit lights in the control room. So when the emergency DC and AC supplies were flooded all lighting was lost. US fire codes would not allow that omission of the emergency exit lights, so it is a lesson that needs to be corrected where it exists.

Early reports also indicated they had to scrounge for flashlights and batteries. But although loss of lighting was a complication, I really doubt it made the difference between success and meltdown.

Actually, what they say in http://www.tepco.co.jp/en/press/corp-com/release/betu11_e/images/110810e21.pdf is that in the unit 1 & 2 main control room, "only the emergency lighting remained on the unit 1 side and the unit 2 side was in total darkness". So these emergency lights were installed. Why those on the unit 2 side of the room remained dark is a mystery, though.

 

[NUCENG]

While all that is true, one must remember that there may be less than an hour to initiate core cooling in order to prevent fuel uncovery. It is very unlikely that workarounds can be fixed to locate the correct instrumentation cabinets, return the DC for the measurement circuits and AC for the inner isolation valves, and then steer the inner valves open in such a short time period. It's complicated enough to get a grip of what's going on and manually open the outer valves within an hour or so - simultaneous spurious closure of the non-hand-manageable inner valves makes the task too challenging to be reliable.

In ASEA BWRs, the logic has been to use check valves as the inner isolation valves whenever possible (=most ingoing lines), since they don't need any electricity or instrumentation to function - and for the outer isolation valves, there's a hand wheel to enable opening and closing of the valve. The isolation condenser relies on relatively small pressure differences, and a check valve in the return line may thus be impossible to arrange, but taking into account the importance of the safety function, loss of both cooling circuits due to a single loss of a DC measuring voltage supply just seems too thin.

That makes sense, and extended, reliable operation of ICs, ECCS systems, and Venting, are already on the action lists.

 

[tsutsuji]

The other day I was watching the following NHK video about manhole covers being ejected　by the tsunami and the new type of covers being designed to remain assembled with the hole even in case of a tsunami : http://www.dailymotion.com/video/xmsci6_3-11-yyyyyyyyyyyy_news

Perhaps this is not off-topic in a nuclear power plant thread as http://www.tepco.co.jp/en/press/corp-com/release/betu11_e/images/110810e21.pdf says "the work was made very difficult due to the darkness, pools of standing water from the tsunami, scattered debris obstructing the roads, missing manhole covers on the roads" (page 5) and "the severe working environment (darkness, scattered obstacles, missing manholes on roads)(...) prevented the work from progressing as expected" (page 44).

http://www.nikkansports.com/general/news/f-gn-tp0-20111002-844020.html According to the records of solar-powered seismometer(s), explosion happened only once on 15 March at 06:12 AM. It is inferred that it is the explosion at unit 4. The reason why no hydrogen explosion occurred at unit 2 is that, by chance, [unit 2's] blowout panel was removed by unit 1's explosion, enabling the hydrogen gas to be released to the outside.

The details on Tepco's seismometer analysis are available in the internal investigation interim report　http://www.tepco.co.jp/cc/press/betu11_j/images/111202c.pdf

*The map on page 87/140 shows the locations of the five seismometers (A, B, C, D, E)
*The records of seismometer D for the unit 1 explosion on 12 March 15:36 and for an earthquake on 12 March at 10:13 are provided as examples on the top of the next page. Then you have plots of the distance from unit 1 in function of the arrival time of P-wave and S-wave at each seismometer during unit 1's explosion. Then you have the same kind of plot for the unit 3 explosion. You can see that wave arrival time and distance are perfectly linearly correlated.
*On page 89/140 you have the plot for the 15 March 6:12 event, showing the distance from unit 2 on the left plot and the distance from unit 4 on the right plot. You can see that only the plot with the distances from unit 4 provides linear correlations.

 

[etudiant]

The other day I was watching the following NHK video about manhole covers being ejected　by the tsunami and the new type of covers being designed to remain assembled with the hole even in case of a tsunami : http://www.dailymotion.com/video/xmsci6_3-11-yyyyyyyyyyyy_news

Perhaps this is not off-topic in a nuclear power plant thread as http://www.tepco.co.jp/en/press/corp-com/release/betu11_e/images/110810e21.pdf says "the work was made very difficult due to the darkness, pools of standing water from the tsunami, scattered debris obstructing the roads, missing manhole covers on the roads" (page 5) and "the severe working environment (darkness, scattered obstacles, missing manholes on roads)(...) prevented the work from progressing as expected" (page 44).


I would guess that it might be safer to simply substitute open grids to cover the man holes, thereby avoiding any pressure differentials. Of course that will mean the service area covered will no longer be dry under normal circumstances, but the pressures generated by the tsunami are surely enough to rupture any such containment or piping if it is enclosed.

 

[tsutsuji]

In the second half of the video you can see the new design and how it is tested.

 

[tsutsuji]

I translated attachments 10-2, 10-3 and 10-4 of the internal investigation interim report on https://www.physicsforums.com/showpost.php?p=3674463&postcount=11913

Now I will translate the report's main text at http://www.tepco.co.jp/cc/press/betu11_j/images/111202c.pdf from page 99/140 to 104/140.

I am wondering about the following:
* Isn't the report of radiations higher than normal at reactor building entrance at 17: 50 the earliest radiation release record for this accident ?
* Why didn't they try to start IC (B) after 18:25 when IC (A) seemed to be broken with no steam observed ? Isn't IC (B) supposed to be the backup of IC (A) ? Could they not open the MO-2B and MO-3B valves as they did with other motor-operated valves ?
* What is the cause of the DC power restoration at 18:18 ?
* What were the plant operator's plans concerning the IC before the 18:18 DC power restoration ?

Translation:

3. Examination of the isolation condenser
As mentioned in the above plant behaviour sequence of events, it can be thought that core damage progressed within a short time interval after the arrival of the tsunami, so that it can be thought that it is possible that the isolation condenser status, as an equipment performing reactor cooling in the initial stage after shutdown, brought consequences on the progression of events. The sequence of events which drew our attention concerning the isolation condenser is collected below.

- - - - - -
Reference: outline of isolation condenser (see construction in attachment 10-2)
* The isolation condenser being for cooling the reactor when the reactor has been isolated, it is an equipment which extracts steam from the reactor, and returns it to the reactor as water after exchanging heat with the coolant water accumulated inside. It is installed in unit 1 only.
* The isolation condenser is composed of two systems, system A and system B, and the steam circuits are built with 4 valves. Isolation condenser entrance and exit are equipped two valves each, in a configuration where the primary containment vessel is interposed between them. The valves inside primary containment vessel are driven by AC power, and those outside by DC power.
* Normally, it is in standby with the valves outside primary containment vessel (valve 3A and valve 3B) being closed, and all the others being fully open. The starting and shutdown of the isolation condenser is performed by opening or closing the 3A and 3B valves.
* Reactor pressure is controlled by intermittent opening and closure of the aforementioned valves.
- - - - - -

< Sequence of events related to the isolation condenser >

11 March 14:52 ; automatic start of isolation condenser
Together with the loss of external power, the power source of the emergency bus was lost, the main steam isolation valve was automatically closed. Due to the "high reactor pressure (7.13 MPa [gage])" signal, both isolation condenser systems started automatically, and as reactor depressurisation and cooling began, reactor pressure started to decline.

Around 15:03 ; manual shutdown of isolation condenser
As the drop of reactor pressure that resulted from the start of the isolation condenser was quick, it was judged that it would not possible to respect the 55°C/h reactor coolant temperature variation speed specified in the operation manual, and the isolation condenser return line valves (MO-3A, 3B) were momentarily turned to "fully closed". The other valves being open, a normal standby status was obtained. As a result, reactor pressure rose again.
After this, in order to regulate reactor pressure at about 6 or 7 MPa, it was judged that one isolation condenser system was enough, and deciding to regulate with system A, and by opening and closing the return line isolation valve (MO-3A), the regulation of reactor pressure began.

15:37 ; loss of electric power
Because of the tsunami flood, all AC power was lost at unit 1. Moreover, DC power was also lost. For that reason, in the central control room, not only lighting but also monitoring instruments and all indicator lamps were extinguished. It created a situation where the isolation condenser's valves open/closed indicators cannot be checked and the isolation condenser's valves cannot be operated.

Around 16:42 ; temporary recovery of water level system
From around 16:40 to around 17:00, it became temporarily possible to check the until then unavailable reactor water level (wide band) (at 16:42, equivalent to TAF (top of active fuel) + 250 cm), and it was confirmed that it had declined since the tsunami arrival.

17:19 ; attempt to check the isolation condenser on location
Because it was impossible to check the isolation condenser from the central control room, it was decided to go to the location where the isolation condenser is installed, and to check such things as the level of condenser shell water, which is the isolation condenser coolant. A plant operator headed for the location, but because the radiation level there (at the entrance of the reactor building) was higher than normal, at 17:50 he temporarily came back.

18:18 ; recovery of DC power for A system outer side isolation valves / opening of A system outer side isolation valves
Whether or not because the DC power had become temporarily unstable in consequence of the tsunami, part of the DC power was later restored and operators found that the isolation condenser's feed line isolation valve MO-2A's and return line isolation valve MO-3A's "closed" green lamps were lit. As the normally open feed line isolation valve (MO-2A) was closed, it might have been thought that all the isolation condenser's isolation valves had been closed following the emission of the "isolation condenser pipe rupture" signal, which is an action toward the safe side following the loss of the DC power used for the detection of "isolation condenser pipe rupture". However, the operators expected that the isolation valves on the primary containment vessel's inner side (MO-1A, 4A) would be open, they performed the valve opening operation of isolation condenser return line isolation valve (MO-3A) and of feed line isolation valve (MO-2A), and the status indicating lamps changed from "closed" to "open".
After valve opening, as the monitoring instruments were not working due to the loss of electric power, and as they had no way to check if the isolation condenser is running, the operators confirmed steam generation from the isolation condenser venting pipe based on the steam generating sound and on the steam that could be seen beyond the reactor building.

18:25 ; A system outer side isolation valve closure
Because steam generation stopped after a while, they closed the isolation condenser's return line isolation valve (MO-3A) and they shut the isolation condenser down.
Moreover, as a response that can be operated in the central control room, they advanced the construction of a water injection line with the fire extinguishing system.
In the midst of unpredictable events occurring one after another, the operators thought about the primary containment vessel's inner side isolation valves (MO-1A, 4A) being closed by the isolation signal, but they worried about the possibility that the shell water, which is the isolation condenser's coolant, had disappeared for some reason. While thinking that the isolation condenser is not functioning, conscious that the construction of the line which is necessary to replenish the shell with water, was not ready, they temporarily closed the return line isolation valve (MO-3A).

Around 20:50 ; construction of reactor water injection line with the fire extinguishing system
The construction of the reactor water injection line with the fire extinguishing system being completed, the diesel driven fire extinguishing pump was started. This brought the prospect of replenishing the isolation condenser shell with coolant water. Later, when operators checked the operation status of the isolation condenser, they found that the closed status indicating lamp of the return line isolation valve (MO-3A) was unstable and starting to fade out.

21:19 ; temporary recovery of reactor water level gauge
It was discovered that the until then unavailable reactor water level was indicating TAF (top of active fuel) + 200 mm.

Around 21:30 ; Opening of valve 3A (start of system A)
Although the reactor water level is above top of fuel, the steam driven high pressure water injection system pump (HPCI)'s electric power faded out and it became impossible to run it. At that time, the isolation condenser was the only high pressure cooling system that could be expected to run. Normally, even if there is no shell replenishment, the isolation condenser can run for about 10 hours. As the diesel driven fire extinguishing pump has been started, it has also become possible to respond to the replenishment of the isolation condenser shell, and as the worry of a lack of water in the shell is diminishing, considering that in the present situation it is not known when the the isolation condenser can be operated again, as the running of the isolation condenser, a high pressure cooling system, is being expected, the opening operation of the return line isolation valve (MO-3A) that had been temporarily closed was performed at around 21:30, the valve opened, and the steam generation was confirmed with the steam generation sound and with the observation of the steam beyond the reactor building. Furthermore, the electric power plant response headquarters' electric power team, going outside of the seismic-isolated building, also confirmed steam generation.

29 March ; recovery of the shell water level gauge
The isolation condenser's shell water level gauge was recovered.

1 April ; check of valves' open or closed status using the isolation condenser's valve control circuit
Forming a part of recovery work, the valves' open or closed status was checked using the conduction status of the isolation condenser's valve control circuit. Due also to the overheat during the accident, it was not possible to check the status of the valves on the inner side of the primary containment vessel, but it was possible to determine the status of those on the outer side. Isolation condenser system A's 3A and 2A valves were open, and isolation condenser system B's 3B and 2B valves were closed.

3 April ; check of isolation condenser shell side water level
As checked with the isolation condenser water level indicator in the central control room, the A system's water level was 63% and that of B system was 83%.

18 October ; inspection on location
The status of the isolation condenser on the outer side of the primary containment vessel could be checked based on a visual inspection on location. Damages were not observed on the main body or on the main pipes, and the valve status was the same as the one checked on 1 April with the circuit inspection. Furthermore, the isolation condenser's water level gauges on location indicated 65% for system A and 85% for system B, and on the same day the values indicated in the central control room were the same.

(to be continued)

 

[tsutsuji]

The examinations noted below are based on the above sequence of events and on the previously presented analysis results.

< evaluation of the action of the isolation condenser immediately after the earthquake >

* Based on the sequence of operations before tsunami arrival, it can be thought that the status of valves at the time of tsunami arrival was (for system A) that valve 3A was closed, and the 3 other valves were fully open. Concerning system B, valve 3B was closed and the 3 other valves were fully open.

* Also, concerning system A, it was confirmed at around 18:18 that valve 2A, which had not been operated until then, was fully closed. Also, concerning system B too, the circuit inspection performed on 1 April confirmed that valve 2B, which had not been operated, was fully closed. (This fact was also confirmed by the inspection on location of degree of openness indicators on 18 October). It follows that although they were in open state before tsunami arrival and although they were not operated later, valves 2A and 2B were later confirmed closed.

* It is possible to confirm the action of valves 2A and 2B from the open/closed records of the transient recorders up to the initial shutdown operation, so that the possibility of an operator mistakenly operating the valves is ruled out. On the other hand, the design of the logic circuits ensures that in case of loss of the DC power supplying that circuit, the interlock is activated and all 4 valves in each isolation condenser system perform valve closure operations. In the present case, it is thought that due to the tsunami, the logic circuit's DC power was lost, and the valve closing order was activated by the aforementioned interlock. [attachment 10-3]

* Furthermore, the time needed to go from valve fully open to valve fully closed is 15 seconds in the case of the outer side valves, and 20 seconds in the case of the inner side valves. DC power was lost because of the tsunami flooding, but during the interval between the activation of the interlock, which is due to the consequences of tsunami flooding on instrumentation DC power, and the loss of driving DC power, the valves automatically performed valve closure operations.

* If driving DC power is lost during closure operation, an intermediate degree of openness is obtained, but as mentioned above, as it was confirmed that valve 2A and valve 2B were fully closed, there is a high probability that power panels were inundated by the tsunami flooding, the isolation signal was sent to the isolation condenser's valves, and they automatically performed full closure before the driving DC power was lost.

* Also, the valves on the inner side of the primary containment vessel are driven by AC power, and their open or closed status depends on the timing of the loss of instrumentation DC power and the loss of AC power. It is not possible to determine the inner side valves' open or closed status, and everything is possible between fully open and fully closed.

* As a result, the isolation condenser's status after tsunami is not determined by its status before tsunami. [attachment 10-4]

< connection with core damage >

* Due to the electric power loss caused by the tsunami, the isolation condenser's automatic isolation interlock was activated, it became impossible to operate the isolation condenser, and its function was lost. According to the accident analysis code (MAAP)'s analysis results, because it was immediately after reactor shutdown when the decay heat is the highest, it can be thought that reactor water level decreased in a short time, and this lead to fuel exposure (at around 17:46 top of active fuel is reached).

* Then, the isolation condenser (system A)'s DC power was restored, at 18:18 the isolation condenser (system A)'s isolation valves (valves 3A and 2A) were opened, steam generation was confirmed, but as steam generation stopped, at 18:25 valve 3A was closed. According to accident analysis code (MAAP), at that point the core was already exposed, and it is estimated that regardless whether the isolation condenser continued to operate or not after 18:18, core damage would have resulted anyway.

< estimate of inner side isolation valve status after tsunami >

* On 18 October, an onsite inspection of the isolation condenser was performed, and based on the onsite water level gauges it was confirmed that A system's water level was 65% and that B system's water level was 85%. It was also confirmed that the same values were displayed in the central control room.

* Because the water level values indicated on the onsite indicators and those read in the central control room are the same, it can be thought that the data transmission is accurate. Hence it can be thought that the values read in the control room in the past were also indicating the output of the onsite indicators.

* It follows that it can be thought that the values obtained in the central control room on 3 April (A system: 63%, B system: 83%) are also reflecting the values of the onsite indicators. Those results are different from those obtained on 18 October, but since April, it is thought that, for some reasons, the indicated value changed by 2%.

* The isolation condenser's 3A valve was open after the tsunami from 18:18 to 18:25 and after 21:30. Due to measuring instrument error, etc. it is difficult to calculate an accurate estimate, but the water level indicated on system A's water level gauge amounts to more than the consumption necessary to cover the heat generated by the reactor between the earthquake and the tsunami arrival. Hence, although it is not possible to determine the degree of openness of A system's inner side valves, it can be thought that they are open. After the tsunami, some amount of heat removal was performed during the running of the isolation condenser, and it is thought that, as a result, the water level declined to 65%.

* This fact is also in accordance with the result of the witness hearing confirming that steam was generated by the isolation condenser's vent pipe when valve 3A was opened at 18:18 and at 21:30.

* However, as a considerable amount of water is remaining in the shell, it can be thought that, as a result, the heat removal performed by isolation condenser system A was limited. [Attachment 10-5]

4 - Summary of plant behaviour

* Due to the electric power loss caused by the tsunami, the isolation condenser's automatic isolation interlock was activated, it became impossible to operate the isolation condenser, and its function was lost. Then, reactor water level decreased in a short time, and this lead to fuel exposure (top of active fuel is reached) and core damage. During that period, it was a situation where, due to loss of electric power, grasping plant status was difficult.

* The isolation condenser (system A) was operated on 11 March at 18:18 and at 21:30, but according to analysis results, it is estimated that regardless whether the isolation condenser continued to operate or not after 18:18, core damage would have resulted anyway.

* On the other hand, on 11 March after 21, when a temporary power source enabled the recovery of the water level gauge, the indication that reactor level was above top of active fuel was obtained, but at that time there is not enough information for generally judging that this is a wrong indication. At the emergency response headquarters (at the plant, at the main office), nothing lead to the awareness that the isolation condenser was not running. Because of the rise of radiation dose in front of the reactor building airlock on 11 March at around 23, and because the drywell pressure measured on 12 March at around 0 midnight was extremely high, there was an awareness of the possibility of core damage.

* On 12 March at around 3, because reactor pressure declines although pressure reduction operation has not been performed, the possibility of reactor coolant pressure boundary damage, resulting from core damage, is being shown and this is a hint that in a short time core damage made a considerable progression.

* Also, according to accident analysis code analysis results, top of active fuel was reached 3 hours after earthquake, core damage started about 4 hours after earthquake, which means that the accident progressed at high speed toward core damage, and this is in accordance with the sequence of real measured phenomenons.

* When venting the suppression chamber, the radiation measured in monitoring car rose temporarily, but the rise of the background level was limited. It is estimated that the hydrogen generated together with core damage could not be perfectly contained in the primary containment vessel, leaked into the reactor building, and was the cause of the reactor building explosion.

(end of translation)

See also attachment 6-8 (3) with the photographs of IC body, pipes, valve openness degree indicators, water level gauges on http://www.tepco.co.jp/cc/press/betu11_j/images/111202f.pdf page 157/314.

 

[Joffan]

Thanks tsutsuji

One of the things that struck me about the IC cooling is that it was inconveniently over-sized for shutdown cooling. The system is turned on for a minute and then off for ten minutes. Another loop that is properly sized for the job could have made a huge difference. (Any professional opinion/correction welcomed).

 

[NUCENG]

Thanks tsutsuji

One of the things that struck me about the IC cooling is that it was inconveniently over-sized for shutdown cooling. The system is turned on for a minute and then off for ten minutes. Another loop that is properly sized for the job could have made a huge difference. (Any professional opinion/correction welcomed).

The sizing of the IC is also intended to remove heat in events where the reactor remains at higher powers due to ATWS. One of the problems of simple solutions is that it may overlook impact on other types of accidents or transients.

 

[nikkkom]

Reference: outline of isolation condenser (see construction in attachment 10-2)
* The isolation condenser being for cooling the reactor when the reactor has been isolated, it is an equipment which extracts steam from the reactor, and returns it to the reactor as water after exchanging heat with the coolant water accumulated inside. It is installed in unit 1 only.
* The isolation condenser is composed of two systems, system A and system B, and the steam circuits are built with 4 valves. Isolation condenser entrance and exit are equipped two valves each, in a configuration where the primary containment vessel is interposed between them. The valves inside primary containment vessel are driven by AC power, and those outside by DC power.
* Normally, it is in standby with the valves outside primary containment vessel (valve 3A and valve 3B) being closed, and all the others being fully closed.

I believe it should be "and all the others being fully opened".

 

[nikkkom]

I don't understand why after tsunami, when situation become not merely a SCRAM, but clearly a serious accident, operators continued to _close_ valve 3A from time to time??

"Then, the isolation condenser (system A)'s DC power was restored, at 18:18 the isolation condenser (system A)'s isolation valves (valves 3A and 2A) were opened, steam generation was confirmed, but as steam generation stopped, at 18:25 valve 3A was closed."

Yeah right. Why not also weld it shut?? We have overheating reactor, let's make sure we wouldn't be able to cool it. /sarcasm off

 

[tsutsuji]

I believe it should be "and all the others being fully opened".

Oops sorry. I edited my post to correct the mistake.

 

[rmattila]

I don't understand why after tsunami, when situation become not merely a SCRAM, but clearly a serious accident, operators continued to _close_ valve 3A from time to time??

After the tsunami, the valve was closed only once, at 18:25. Why it was closed then, has been discussed for several months. Tsutsuji-san's translation above provides one explanation:

18:25 ; A system outer side isolation valve closure
Because steam generation stopped after a while, they closed the isolation condenser's return line isolation valve (MO-3A) and they shutdown the isolation condenser.
Moreover, as a response that can be operated in the central control room, they advanced the construction of a water injection line with the fire extinguishing system.
In the midst of unpredictable events occurring one after another, the operators thought about the primary containment vessel's inner side isolation valves (MO-1A, 4A) being closed by the isolation signal, but they worried about the possibility that the shell water, which is the isolation condenser's coolant, had disappeared for some reason. While thinking that the isolation condenser is not functioning, conscious that the construction of the line which is necessary to replenish the shell with water, was not ready, they temporarily closed the return line isolation valve (MO-3A).

I am not aware of the design basis of the IC: would it be a problem to keep the valve open even if the shell side was empty, or was there some other reason to close it? The arguments given by the plant's management after the accident of not being aware that the valve was closed seem to suggest in the direction that there should from technical point not have been a reason to close it, but it was rather done amidst the confusion of the situation.

Another issue is that it might in any case have been too late at 18:18 due to the possibility of hydrogen build-up to make the IC fully operational, since the venting routes to the steam lines were apparently also closed because of the DC loss.

 

[zapperzero]

I am wondering about the following:
* Isn't the report of radiations higher than normal at reactor building entrance at 17: 50 the earliest radiation release record for this accident ?


17:19 ; attempt to check the isolation condenser on location
Because it was impossible to check the isolation condenser from the central control room, it was decided to go to the location where the isolation condenser is installed, and to check such things as the level of condenser shell water, which is the isolation condenser coolant. A plant operator headed for the location, but because the radiation level there (at the entrance of the reactor building) was higher than normal, at 17:50 he temporarily came back.

From your text, we can place this detection at somewhere between 17:19 and 17:50.
So we can suppose containment breach? Is it coincidence that the simulation says 17:46 is when water level reached TAF?

 

[tsutsuji]

http://www.tepco.co.jp/en/press/corp-com/release/11121606-e.html English translation of 16 December issue of the (short term) roadmap

http://www.meti.go.jp/english/earthquake/nuclear/decommissioning/pdf/111221_01.pdf English digest version of "the Mid-and-long-Term Roadmap towards the Decommissioning"

http://www.meti.go.jp/earthquake/nuclear/abolishment.html Full Japanese version of mid-long term roadmap toward decommissioning

http://www.tepco.co.jp/en/news/topics/11122001-e.html "Regarding the article of Nihon Keizai Newspaper (December 20) page 42 "Units 1 and 2 - misunderstanding in the status of cooling""

 

[nikkkom]

After the tsunami, the valve was closed only once, at 18:25. Why it was closed then, has been discussed for several months. Tsutsuji-san's translation above provides one explanation:

I am not aware of the design basis of the IC: would it be a problem to keep the valve open even if the shell side was empty,

If there is, then IC design is faulty. IC, as an emergency system, should be rugged enough to withstand being left open even if shell side has boiled dry. (Moreover, it should be rugged enough to withstand multiple "boiled dry/refilled with water" cycles, which could happen in some accident scenarios).

or was there some other reason to close it? The arguments given by the plant's management after the accident of not being aware that the valve was closed seem to suggest in the direction that there should from technical point not have been a reason to close it, but it was rather done amidst the confusion of the situation.

In this case, operators made a mistake.

Another issue is that it might in any case have been too late at 18:18 due to the possibility of hydrogen build-up to make the IC fully operational, since the venting routes to the steam lines were apparently also closed because of the DC loss.

If this is true, this would be a design flaw as well.

All in all, we definitely have here either a flaw in IC design, or operator error. Or both.

 

[rmattila]

All in all, we definitely have here either a flaw in IC design, or operator error. Or both.

I'd put it a bit differently. We have a plant with safety systems/operating procedures that will result into a core damage with a total loss of DC, and then we have an external event that caused the total loss of DC.

It's more a philosophical question, whether the error was made in the design against external threats (obviously, taking into account the damage caused by the flooding), in the plant response to a total loss of DC (which should clearly be a beyond design basis, but since the hardware was OK, it would sound sensible to design the plant so that it could survive the event, i.e. reconsider the design of e.g. the inner IC valve isolation logic) or the operating procedures, which apparently did not prioritize the core cooling function to everything else in the early stages of the event. However, since some/all of these issues that could have been solved during the 40 years of plant operation failed, I think it is very unfair to blame the operators for not making the correct decisions in the very short time window they had, in a situation that was way beyond their training.

I don't know if there's a person equivalent to a "safety engineer" in the TEPCO emergency organization, i.e. a person with no direct responsibility of practical control room operations, but a single task of making sure that the main safety functions are in order and giving advice to the shift personnel if necessary - even against the procedures, if there's a reason to deviate from them. Such a specialized person could have had an effect on the outcome, if he could have focused solely on ensuring the status of decay heat removal right after the tsunami without any other responsibilities.

 

[Thalic]

Long time lurker here (back to almost the first few days).

I understand the discussion about the IC and the operators and what/who was to blame that those systems were robust enough, valves opened, etc., but I think we are missing the point. It is my recollection that there was no power at the site for many days (into week(s)) and the site was almost inaccessible due to debris from the tsunami. Even if the operators were adequately trained for this situation and if the IC units operated flawlessly (and were able to be continuously refilled), wouldn't the cores still have been uncovered and compromised at some point during the accident??

 

[nikkkom]

Long time lurker here (back to almost the first few days).

I understand the discussion about the IC and the operators and what/who was to blame that those systems were robust enough, valves opened, etc., but I think we are missing the point. It is my recollection that there was no power at the site for many days (into week(s)) and the site was almost inaccessible due to debris from the tsunami. Even if the operators were adequately trained for this situation and if the IC units operated flawlessly (and were able to be continuously refilled), wouldn't the cores still have been uncovered and compromised at some point during the accident??

Great excuse for not drilling down into the core of the IC issue. This line of reasoning was already aired, and I bet TEPCO will use it to deflect criticism.

I might seem to be ridiculous, but when another reactor will suffer a SBO, I _do_ want ICs and whatnot to be properly designed, stand ready in working order, and to be correctly operated by plant personnel! Is it too much to ask?

 

[nikkkom]

I'd put it a bit differently. We have a plant with safety systems/operating procedures that will result into a core damage with a total loss of DC, and then we have an external event that caused the total loss of DC.

It's more a philosophical question, whether the error was made in the design against external threats (obviously, taking into account the damage caused by the flooding), in the plant response to a total loss of DC (which should clearly be a beyond design basis, but since the hardware was OK, it would sound sensible to design the plant so that it could survive the event, i.e. reconsider the design of e.g. the inner IC valve isolation logic) or the operating procedures, which apparently did not prioritize the core cooling function to everything else in the early stages of the event.

How is this a *philosophical* question? I read "philosophical" as "a question so removed from the real world that the answer doesn't really matter".

In the IC case, the "WTF went wrong with it?" question is a very down-to-earth and important one - we need to know what needs to be fixed in other plants.

 

[Thalic]

Great excuse for not drilling down into the core of the IC issue. This line of reasoning was already aired, and I bet TEPCO will use it to deflect criticism.

I might seem to be ridiculous, but when another reactor will suffer a SBO, I _do_ want ICs and whatnot to be properly designed, stand ready in working order, and to be correctly operated by plant personnel! Is it too much to ask?

I fully agree that it is important to get to the bottom of the IC issue and I don't want to give TEPCO any way to deflect criticism where it is due. Indeed, systems should be robust and redundant to ensure that these things don't happen in the future. My point is that the IC would have eventually failed to cool the reactor within the time period that power and access was unavailable and there would have been a similar result. Am I wrong?

 

[rmattila]

How is this a *philosophical* question? I read "philosophical" as "a question so removed from the real world that the answer doesn't really matter".

In the IC case, the "WTF went wrong with it?" question is a very down-to-earth and important one - we need to know what needs to be fixed in other plants.

As it appears, the IC was designed to cope with the loss of AC, but not with the loss of DC. How to deal with a loss of DC comes down to the same kind of discussion we had with NUCENG regarding the need for the containment to withstand a core melt and the preference between preventive/mitigative actions:

Some say it's enough if we make the loss of DC sufficiently improbable so we don't have to deal with its consequences, i.e. that the design deficiencies are not in the IC design but in the protection of the DC distribution system. Others claim that while doing all that can be done to practically eliminate the situation (loss of DC), it would still be better if the consequences could be coped with.

I personally think that although the main issue is with making sure the DC is never lost (you should really be ably to monitor the plant status in all situations!) it is worth to at least reconsider the IC design to judge if it would be an overall better solution to make it withstand the loss of DC. But such design modifications shall never be done hastily: it's really a matter of optimizing the solution to conflicting goals - the certainty of the isolation function vs. the certainty of the core cooling function.

 

[rmattila]

I fully agree that it is important to get to the bottom of the IC issue and I don't want to give TEPCO any way to deflect criticism where it is due. Indeed, systems should be robust and redundant to ensure that these things don't happen in the future. My point is that the IC would have eventually failed to cool the reactor within the time period that power and access was unavailable and there would have been a similar result. Am I wrong?

As long as there was capability to pump water (which there existed during the entire accident - at least seawater was available all the time), I don't see why the IC should necessarily have failed, if the valves would only have been open all the time.

 

[Most Curious]

As I understand it, an alternative to DC operation of the IC valves was manual operation. (At least those coutside the PCV.) Therefore, other factors prevented use such as might be expected in a severe crisis situation. ie, time to evaluate the problem and send workers to open the valves. If radiation was high, as reported, wasn't core damage already occurring? Likely a shortcoming in the operation manual for the plant, also likely overlooked because of the possibility of DC loss being so remote. After the core was uncovered and hydrogen production began, any action concerning the IC was probably moot.

GE may have seen some limitations to the IC for emergency core cooling as it was replaced in later designs. I wonder how many IC plants are in operation, worldwide? Also consider that those "later designs" without the partially passive cooling capability of the IC ALSO suffered severe core damage.

 

[rmattila]

As I understand it, an alternative to DC operation of the IC valves was manual operation. (At least those coutside the PCV.) Therefore, other factors prevented use such as might be expected in a severe crisis situation. ie, time to evaluate the problem and send workers to open the valves. If radiation was high, as reported, wasn't core damage already occurring? Likely a shortcoming in the operation manual for the plant, also likely overlooked because of the possibility of DC loss being so remote. After the core was uncovered and hydrogen production began, any action concerning the IC was probably moot.

That is very true. The IC should be started within an hour, or you end up with hydrogen problems. However, it can be argued that the isolation interlock and uncertainty of the status of the inner valves may have been a factor contributing to the overall confusion and the time delay. If it would simply have been a matter of going and manually opening the 3A valve that had previously been closed, one hour should have been sufficient, if initiating the core cooling function was recognized as the primary priority. Now it apparently took three hours and the return of DC to be able to get the valve open. Core damages probably started after 2 - 3 hours, and up until that time, the IC would have saved the day.

GE may have seen some limitations to the IC for emergency core cooling as it was replaced in later designs. I wonder how many IC plants are in operation, worldwide? Also consider that those "later designs" without the partially passive cooling capability of the IC ALSO suffered severe core damage.

I have the impression - which may well be false - that the primary reason for replacing the IC with RCIC in the later designs was the increased reactor power and consequent need to increase the capacity of the residual heat removal system without increasing the space reserved by the system. On the other hand, the Toshiba's newest ABWR version that is currently being marketed in Europe has the RCIC again replaced with an IC.

 

[tsutsuji]

Here is a translation of internal investigation interim report attachment 8-2 http://www.tepco.co.jp/cc/press/betu11_j/images/111202f.pdf page 202/314

Fukushima Daiichi unit 1 high pressure injection system

When starting the high pressure injection system (HPCI), the auxiliary oil pump is started first, and as the driving oil is supplied to the turbine stop valve and to the turbine regulator valve, the HPCI turbine is started. However, due to the loss of DC power, it became impossible to start the auxiliary oil pump, and as a result the HPCI became unusable.

HPCI automatic activation signal
activation flow
↓|→[STRIKE]activation of auxiliary oil pump[/STRIKE] → impossible to open turbin stop valve MO-2301-Z9 and regulator valve MO-2301-Z8
↓|→activation of barometric condenser vacuum pump
↓|→HPCI steam supply isolation valve (inner side MO-2301-4, outer side MO-2301-5) "Open"
↓|→HPCI turbine entrance valve MO-2301-3 "Open"
↓|→condensate water tank suction valve MO-2301-6 suction valve "Open"
↓|→injection valve MO-2301-8 "Open"
↓|→minimum flow bypass valve MO-2301-14 "Open"
↓|→cooling water valve MO-2301-240 "Open"
↓|→test bypass valve MO-2301-15, MO-2301-10 "closed"

 

[Most Curious]

Rmattila, thank you for the reply!

That is very true. The IC should be started within an hour, or you end up with hydrogen problems. However, it can be argued that the isolation interlock and uncertainty of the status of the inner valves may have been a factor contributing to the overall confusion and the time delay. If it would simply have been a matter of going and manually opening the 3A valve that had previously been closed, one hour should have been sufficient, if initiating the core cooling function was recognized as the primary priority. Now it apparently took three hours and the return of DC to be able to get the valve open. Core damages probably started after 2 - 3 hours, and up until that time, the IC would have saved the day.

I would suggest that not knowing the position of the AC operated valves inside the PCV should not have affected the decision to manually open the DC operated valves. The one hour window is a maximum and action would surely be appropriate early rather than later? (20-20 hindsight!) You are absolutely correct that when I referred to a likely shortcoming of the Operation Manual in not applying adequate weight to loss of DC power, I failed to include the high priority that should be applied to emergency core cooling. While that seems obvious to us in looking back, it is hard for me to imagine the confusion, lack of authority of many individuals, and utter chaos of the early time period of the accident! We can even second guess the decision to "follow the manual" concerning the cooling rate of the reactor vs what happened when it melted down. Careful examination of these events will surely lead to better operation in the future.

Clearly, the operations manual needs to be improved. Doing so will be a monumental task as every tiny detail will need to be addressed and re-organized so that the most important considerations don't get pushed back to page 54, so to speak. While I have never had the opportunity to read one of these for a nuke plant, I have digested them for other complex systems and almost always found them wanting.

I have the impression - which may well be false - that the primary reason for replacing the IC with RCIC in the later designs was the increased reactor power and consequent need to increase the capacity of the residual heat removal system without increasing the space reserved by the system. On the other hand, the Toshiba's newest ABWR version that is currently being marketed in Europe has the RCIC again replaced with an IC.

Thank you - I just learned another good tidbit - that some newer plants have gone back to the IC system - I didn't know that. Makes it even more important that the failures and shortcomings of both the IC system and the associated operating instructions be re-examined in great detail as IC systems may be in service for many years to come.

I can see some advantage to the IC system vs RCIC for long term SBO. The IC itself is passive except for valves and grants a most important commodity in very short supply - TIME - if used properly. Fire pump supplied water to the IC shell could allow safe level of cooling indefinitely, it would appear. The RCIC, as I understand it, depends on the suppression pool for cooling and that has limits which were reached fairly early at Fukushima due to loss of seawater cooling of the SC heat exchangers. I suppose a flow to the SC HE could be jury rigged but in what time period?? Another area for serious study!

Loss of DC events also will need attention. No doubt some redunadancy needs to be available in the DC system to maintain certain ultra critical water level instruments and a few controls such as for RCIC and IC, for example. My knowledge of any DC redundancy in the plant is nil so what I am suggesting may already exist and just failed like so many other things did in the massive beyond design basis event.

 

[nikkkom]

I fully agree that it is important to get to the bottom of the IC issue and I don't want to give TEPCO any way to deflect criticism where it is due. Indeed, systems should be robust and redundant to ensure that these things don't happen in the future. My point is that the IC would have eventually failed to cool the reactor within the time period that power and access was unavailable and there would have been a similar result. Am I wrong?

We have no idea what would happen if IC(s) would be operating to their fullest capacity.

Maybe operators would find water sources to replenish IC in time to prevent overheating. As a result, maybe Unit 1 wouldn't blow up and spew radiation and more debris all over the place. As a result, saving of Units 2 and 3 maybe would be much easier.

 

[jim hardy]

speaking as an old plant guy, loss of all power is the thing that happens only in one's nightmares.

to their credit , plant operators carried in their car batteries to try and keep some instruments working.


it is now demonstrated that there needs to be in place plans and fixtures to hook up last ditch power supplies and pumps for "all else has failed" scenarios. we did that after TMI, without fanfare.

There exist in the industry cadres of people whose job it is to ask "what if" , and
other cadres of people whose job it is to analyze away such questions.

i guess it's a question of balance. takes real genius to keep things simple.

my former employer had a management strategy of alternating layers of degreed and 'up through the ranks' people - an engineer likely worked for a former craftsman who in turn worked for an engineer, etc. It counteracted "ivory tower syndrome".

old jim

 

[Thalic]

We have no idea what would happen if IC(s) would be operating to their fullest capacity.

Maybe operators would find water sources to replenish IC in time to prevent overheating. As a result, maybe Unit 1 wouldn't blow up and spew radiation and more debris all over the place. As a result, saving of Units 2 and 3 maybe would be much easier.

You are right and it would have been a great result, but given the very trying situation post tsunami that persisted for a great while, highly unlikely. Obviously, there would have been a different series of events throughout the crisis which may have allowed them to prevent some of the catastrophic results.

 

[Most Curious]

The 8 -10 hour operation of the IC with water it already contained (IF that number is accurate) would have bought a lot of time, something that was very precious. I read earlier that temporary piping from the fire pump system to the IC shell reservoir was underway, as it should have been. Sadly, the IC system either failed or was not properly managed.

Agreed total SBO is a nighmare scenario. I applaud the operators carrying in batteries to attempt to deal with it. No doubt a LOT of study will go into how to mitigate SBO in the future, as it should!

 

[Most Curious]

my former employer had a management strategy of alternating layers of degreed and 'up through the ranks' people - an engineer likely worked for a former craftsman who in turn worked for an engineer, etc. It counteracted "ivory tower syndrome".

old jim

Outstanding! Your former employer understood how things work!

KISS is always best if it will do the job. The VERY BEST engineers are those who also know how to use a wrench - and have done so long enough to be good at that, too. Conversely an excellent mechanic knows a lot of theory and engineering.

 

[tsutsuji]

Does anyone have a clue about what happened to the diesel generators in the common pool building first floor (unit 2 DG B and unit 4 DG B) which are marked "unusable" although they are also marked as "not inundated" in table II-2-14 of the second report to IAEA : http://www.meti.go.jp/english/earthquake/nuclear/iaea/pdf/20110911/chapter2.pdf page 72 ? The diesel generators of unit 5 are also both "unusable" and "not inundated", which can mean that only their seawater cooling system was unusable because of damaged seawater pumps. But aren't unit 2 DG B and unit 4 DG B air-cooled ?

The internal investigation interim report tells a few additional remarks about the diesel generators, like diesel generator inundation was generally caused by a tsunami water route via the air intake louver, generally located on the first floor ( http://www.tepco.co.jp/cc/press/betu11_j/images/111202f.pdf page 24/140 ), or that in the USA diesel generators are often not in basements because there are no basements in turbine buildings in the USA, while in Japan anti-seismic rules imply to build buildings on the base rock layer (page 23/140). But I still do not understand what they mean with the diesel generators that are not inundated yet unusable.

 

[Joffan]

The sizing of the IC is also intended to remove heat in events where the reactor remains at higher powers due to ATWS. One of the problems of simple solutions is that it may overlook impact on other types of accidents or transients.

Thanks for the response. You'll notice though I did say an extra loop - I was thinking of smaller piping, not a smaller IC, that could be simply left open once activated. There may of course be good reasons why this is not feasible, and there is always the danger that extra loops bring extra complexity with the potential for additional problems.

 

[etudiant]

Separate topic.
There are reports on Energy News, a generally alarmist website, claiming the NRC believes there was a sustained fire in reactor 2 after the accident sustained by reaction products of the zirconium cladding reacting with the water.
The source appears to be this video:
http://www.youtube.com/watch?v=vSfaJTjvmHo&feature=relmfu
The video, which looks to be an NRC product dating from end Nov, features Frederick (Rick) Hasselberg. who is identified as a reactor engineer and incident response coordinator in NRC’s Office of Nuclear Security and Incident Response (NSIR).

He notes, among other items

At Units 1, 2 and 3, a huge amount of hydrogen was generated as the fuel rods were violently consumed by the self-sustaining zirconium-water reaction.
Core temperatures continued to rise.
You could hardly call them fuel rods anymore, but some of the materials that used to be inside the fuel rods were reaching 3000, 4000, 5000 degrees.

and then goes on to say that the hydrogen produced burned for several days at unit 2, unlike the explosions at 1 and 3.
I've heard nothing of a prolonged fire at reactor 2, although that might help explain why so much of the emissions came from that unit.

Has anyone any comment on the NRC video that is the source for these claims? It seems a fairly well produced piece of work but does not appear to have made much splash.

 

[swl]

But I still do not understand what they mean with the diesel generators that are not inundated yet unusable.

Interesting question. I wonder if the transfer switches could have been inundated, thus rendering the generators unusable?

 

[rmattila]

Does anyone have a clue about what happened to the diesel generators in the common pool building first floor (unit 2 DG B and unit 4 DG B) which are marked "unusable" although they are also marked as "not inundated" in table II-2-14 of the second report to IAEA : http://www.meti.go.jp/english/earthquake/nuclear/iaea/pdf/20110911/chapter2.pdf page 72 ? The diesel generators of unit 5 are also both "unusable" and "not inundated", which can mean that only their seawater cooling system was unusable because of damaged seawater pumps. But aren't unit 2 DG B and unit 4 DG B air-cooled ?

This is just a random guess, but e.g. loss of the fuel supply system, starting system (I don't know if it uses compressed air or battery power), or damage to the outgoing power supply system (switchboards, busbars, cables) would make the EDG unusable even if the engine itself would have survived the tsunami.

 

[zapperzero]

Interesting question. I wonder if the transfer switches could have been inundated, thus rendering the generators unusable?

Well if the design is similar to that of units 1-4, the switching boards are in the basements.

 

[tsutsuji]

This is just a random guess, but e.g. loss of the fuel supply system, starting system (I don't know if it uses compressed air or battery power), or damage to the outgoing power supply system (switchboards, busbars, cables) would make the EDG unusable even if the engine itself would have survived the tsunami.

Thanks for the random guess. I was wondering if there was a way to quickly fix those generators, more quickly than waiting for the power trucks to come. Especially after it was understood that "the [power] trucks exceeded the [helicopter] weight capacity, and neither the JASDF nor the American military could perform the airlift and the plan was abandoned" : http://www.tepco.co.jp/en/press/corp-com/release/betu11_e/images/110810e21.pdf page 4.

5. possible failure to properly install, maintain and/or operate safety-critical equipment such as hydrogen recombiners and ICs (TEPCO, NISA)

This Yomiuri article : http://www.yomiuri.co.jp/dy/national/T111215006237.htm suggests that Japan might have been slower and less effective than European nations in implementing lessons from Chernobyl. On the other hand Japan is not as close to Chernobyl as Western Europe, so perhaps the feeling of danger was less, and the public opinion pressure could have been lower.

 

[zapperzero]

4/5/6. This can't be fixed. The only way to REALLY test emergency procedures and equipment is to have a REAL emergency. Anything less (such as drills) can be - and was! - successfully cheated. It (cheating) will happen again.

I am sorry, but no. Air travel industry is the example to hold up here. It IS possible to build a simulator that handles exactly like the real thing. Of course, it's not the real thing but it builds confidence and skills just fine.

Operating manuals for aircraft get amended all the time, and not just based on black-box data. Speaking of which, I cannot understand why NPPs do not have black boxes. I am sure that much more could have been learned from almost-accidents than the NRC's half-page incident reports would let one suppose.

It is relatively easy to mitigate cheating on simulations - introduce the concept of certified operators/crews, have (re-)certifications dependent on both theoretical tests and randomized simulator runs, make it so that anyone person or crew COULD be up for re-cert at any time and that the regulator is responsible for certification, while the plant operators are responsible for ongoing training.

It is not interesting to find out if some jumper can, indeed, go into a 0.5 Sv/h field and operate some stuck vane. It IS interesting to know that an operator would not do stupid things like relying on a jumper to save his plant...

 

[nikkkom]

I am sorry, but no. Air travel industry is the example to hold up here. It IS possible to build a simulator that handles exactly like the real thing. Of course, it's not the real thing but it builds confidence and skills just fine.

While virtual piece of equipment (such as IC) would work fine in simulator, how do you know that REAL one is in working shape? How do you know that plant owner (think "TEPCO") did not fake its inspections? How would you test that in real emergency something unexpected (think "valve 1A closure commanded by bogus pipe rupture sensor trip") would not render it useless?

 

[tsutsuji]

I found the answer to my question concerning the status of D/G 2B and D/G 4B after tsunami in http://www.nisa.meti.go.jp/earthquake/houkoku6/main.pdf (the 9 September report on the impact of the earthquake on Fukushima Daiichi - Japanese only) page 10: "(11) Operation Auxiliary Common Facility (common pool and diesel generators 2B and 4B): the Operation Auxiliary Common Facility's ground floor was inundated through aeration louver(s) or entrance door(s). Inundation was also confirmed in the basement first floor, the inundation route being via the ground floor, or through cable penetrations, etc. In the area where the D/G 2B and 4B equipments are installed, inundation was not confirmed." And page 11: "Unit 2's D/G 2B, unit 4's D/G 4B and unit 6's D/G 6B are air-cooled diesel generators. Because they are not equipped with seawater pumps, there is no damage caused by the tsunami to their cooling systems. D/G 2B and D/G 4B are installed in the Operation Auxiliary Common Facility, which is located at the south-west of unit 4's reactor building. The diesel generator main bodies did not suffer inundation damage, but the electric room in the basement of the Operation Auxiliary Common Facility suffered inundation damage, the diesel generators' power panels were submerged and lost function."

 

[dezzert]

The other day I was watching the following NHK video about manhole covers being ejected　by the tsunami and the new type of covers being designed to remain assembled with the hole even in case of a tsunami : http://www.dailymotion.com/video/xmsci6_3-11-yyyyyyyyyyyy_news

Perhaps this is not off-topic in a nuclear power plant thread as http://www.tepco.co.jp/en/press/corp-com/release/betu11_e/images/110810e21.pdf says "the work was made very difficult due to the darkness, pools of standing water from the tsunami, scattered debris obstructing the roads, missing manhole covers on the roads" (page 5) and "the severe working environment (darkness, scattered obstacles, missing manholes on roads)(...) prevented the work from progressing as expected" (page 44).

Looking a schematics of the tunnels at Fukushima, and comparing this to early overflight photos, the manholes that were blown off were covering electrical and piping ducts that didn't have a path for inundation like the sewage treatment plant shown in the video posted above. How did the tsunami water get into these closed systems and blow the manholes, some of which were many times the size of the average street manhole covers. For me the above is not a plausible explanation.

 

[tsutsuji]

Looking a schematics of the tunnels at Fukushima, and comparing this to early overflight photos, the manholes that were blown off were covering electrical and piping ducts that didn't have a path for inundation like the sewage treatment plant shown in the video posted above. How did the tsunami water get into these closed systems and blow the manholes, some of which were many times the size of the average street manhole covers. For me the above is not a plausible explanation.

You might be correct. http://gendai.ismedia.jp/articles/print/2350 (April 4) quotes a worker, "Mr A", who was in unit 5 and 6 turbine buildings when the earthquake occurred, and then walked back to his company's office in an office building located nearby. He remembers the documents fallen on the floor in the office, and looking through the window, he saw an iron manhole cover that had moved 3 m away from the hole. He waited with other workers in the office "for about one hour" for Tecpo's instructions. When they received "10 m tsunami is coming" warning messages on their mobile phones, as there was no tsunami evacuation plan other than "take refuge in an elevated place distant from the coast", he and a colleague decided to run away by car to the outside of the plant premises (however, there was a traffic jam at the gate). That manhole cover must have been moved by the earthquake.

 

[zapperzero]

While virtual piece of equipment (such as IC) would work fine in simulator, how do you know that REAL one is in working shape? How do you know that plant owner (think "TEPCO") did not fake its inspections? How would you test that in real emergency something unexpected (think "valve 1A closure commanded by bogus pipe rupture sensor trip") would not render it useless?

You test exactly like that. You announce to your trainees: "ICs A and B are not operational". That is, if you want to coddle them. If not, you just stick to manipulating what the instruments show and say nothing, let them figure out by themselves that there are stuck valves, or hydrogen or whatever. Failing is how we all learn.

EDIT: to clarify, simulator training is about the operators, not about the actual system. Which is why in aviation you get sadistic scenarios like "oh btw your rudder just fell off". There is no telling what the actual system might fail like.

 

[nikkkom]

You test exactly like that. You announce to your trainees: "ICs A and B are not operational". That is, if you want to coddle them. If not, you just stick to manipulating what the instruments show and say nothing, let them figure out by themselves that there are stuck valves, or hydrogen or whatever. Failing is how we all learn.

Thanks. I do understand this.

I am splitting F1 lesson regarding IC into three points

(1) There should be plans how to use IC in the total SBO. Looks like on F1 they thought they will always have at least some power.

(2) Not only plans should be made, but operators should be trained to follow them. I agree that it is possible to do this right, as you described

(3) And finally, IC hardware should be in good order and operate according to plan. In F1, it looks like inaccessible valves 1 and 4 inside containment on strings A and B were wrongly closed, and then powered down. No amount of planning and training would help in this situation.

Judging by past performance of TEPCO, I'd say the worry that they wouldn't do point 3 correctly is real.

 

[Most Curious]

Thanks. I do understand this.

I am splitting F1 lesson regarding IC into three points

(1) There should be plans how to use IC in the total SBO. Looks like on F1 they thought they will always have at least some power.

Well, that IS the design basis! DC power reliability is assumed to be even higher than AC. No doubt further examination of that assumption will be made!

(2) Not only plans should be made, but operators should be trained to follow them. I agree that it is possible to do this right, as you described

(3) And finally, IC hardware should be in good order and operate according to plan. In F1, it looks like inaccessible valves 1 and 4 inside containment on strings A and B were wrongly closed, and then powered down. No amount of planning and training would help in this situation.

Judging by past performance of TEPCO, I'd say the worry that they wouldn't do point 3 correctly is real.

It appears the situation with the AC powered valves inside the PCV is still not clearly determined. VERY unlikely they were closed AFTER the tsunami as they are AC powered and AC was gone after the flood. At some point they had been open as evidenced by steam generation in the IC and as shown by less than 100% full water level well after the tsunami. Water would have been boiled away in proper operation and apparently was.

It seems to me that additional information will be required to determine a few critical facts concerning the IC.