Japan Earthquake: Nuclear Plants at Fukushima Daiichi

[Joffan]

Thanks tsutsuji

One of the things that struck me about the IC cooling is that it was inconveniently over-sized for shutdown cooling. The system is turned on for a minute and then off for ten minutes. Another loop that is properly sized for the job could have made a huge difference. (Any professional opinion/correction welcomed).

 

[NUCENG]

Thanks tsutsuji

One of the things that struck me about the IC cooling is that it was inconveniently over-sized for shutdown cooling. The system is turned on for a minute and then off for ten minutes. Another loop that is properly sized for the job could have made a huge difference. (Any professional opinion/correction welcomed).

The sizing of the IC is also intended to remove heat in events where the reactor remains at higher powers due to ATWS. One of the problems of simple solutions is that it may overlook impact on other types of accidents or transients.

 

[nikkkom]

Reference: outline of isolation condenser (see construction in attachment 10-2)
* The isolation condenser being for cooling the reactor when the reactor has been isolated, it is an equipment which extracts steam from the reactor, and returns it to the reactor as water after exchanging heat with the coolant water accumulated inside. It is installed in unit 1 only.
* The isolation condenser is composed of two systems, system A and system B, and the steam circuits are built with 4 valves. Isolation condenser entrance and exit are equipped two valves each, in a configuration where the primary containment vessel is interposed between them. The valves inside primary containment vessel are driven by AC power, and those outside by DC power.
* Normally, it is in standby with the valves outside primary containment vessel (valve 3A and valve 3B) being closed, and all the others being fully closed.

I believe it should be "and all the others being fully opened".

 

[nikkkom]

I don't understand why after tsunami, when situation become not merely a SCRAM, but clearly a serious accident, operators continued to _close_ valve 3A from time to time??

"Then, the isolation condenser (system A)'s DC power was restored, at 18:18 the isolation condenser (system A)'s isolation valves (valves 3A and 2A) were opened, steam generation was confirmed, but as steam generation stopped, at 18:25 valve 3A was closed."

Yeah right. Why not also weld it shut?? We have overheating reactor, let's make sure we wouldn't be able to cool it. /sarcasm off

 

[tsutsuji]

I believe it should be "and all the others being fully opened".

Oops sorry. I edited my post to correct the mistake.

 

[rmattila]

I don't understand why after tsunami, when situation become not merely a SCRAM, but clearly a serious accident, operators continued to _close_ valve 3A from time to time??

After the tsunami, the valve was closed only once, at 18:25. Why it was closed then, has been discussed for several months. Tsutsuji-san's translation above provides one explanation:

18:25 ; A system outer side isolation valve closure
Because steam generation stopped after a while, they closed the isolation condenser's return line isolation valve (MO-3A) and they shutdown the isolation condenser.
Moreover, as a response that can be operated in the central control room, they advanced the construction of a water injection line with the fire extinguishing system.
In the midst of unpredictable events occurring one after another, the operators thought about the primary containment vessel's inner side isolation valves (MO-1A, 4A) being closed by the isolation signal, but they worried about the possibility that the shell water, which is the isolation condenser's coolant, had disappeared for some reason. While thinking that the isolation condenser is not functioning, conscious that the construction of the line which is necessary to replenish the shell with water, was not ready, they temporarily closed the return line isolation valve (MO-3A).

I am not aware of the design basis of the IC: would it be a problem to keep the valve open even if the shell side was empty, or was there some other reason to close it? The arguments given by the plant's management after the accident of not being aware that the valve was closed seem to suggest in the direction that there should from technical point not have been a reason to close it, but it was rather done amidst the confusion of the situation.

Another issue is that it might in any case have been too late at 18:18 due to the possibility of hydrogen build-up to make the IC fully operational, since the venting routes to the steam lines were apparently also closed because of the DC loss.

 

[zapperzero]

I am wondering about the following:
* Isn't the report of radiations higher than normal at reactor building entrance at 17: 50 the earliest radiation release record for this accident ?


17:19 ; attempt to check the isolation condenser on location
Because it was impossible to check the isolation condenser from the central control room, it was decided to go to the location where the isolation condenser is installed, and to check such things as the level of condenser shell water, which is the isolation condenser coolant. A plant operator headed for the location, but because the radiation level there (at the entrance of the reactor building) was higher than normal, at 17:50 he temporarily came back.

From your text, we can place this detection at somewhere between 17:19 and 17:50.
So we can suppose containment breach? Is it coincidence that the simulation says 17:46 is when water level reached TAF?

 

[tsutsuji]

http://www.tepco.co.jp/en/press/corp-com/release/11121606-e.html English translation of 16 December issue of the (short term) roadmap

http://www.meti.go.jp/english/earthquake/nuclear/decommissioning/pdf/111221_01.pdf English digest version of "the Mid-and-long-Term Roadmap towards the Decommissioning"

http://www.meti.go.jp/earthquake/nuclear/abolishment.html Full Japanese version of mid-long term roadmap toward decommissioning

http://www.tepco.co.jp/en/news/topics/11122001-e.html "Regarding the article of Nihon Keizai Newspaper (December 20) page 42 "Units 1 and 2 - misunderstanding in the status of cooling""

 

[nikkkom]

After the tsunami, the valve was closed only once, at 18:25. Why it was closed then, has been discussed for several months. Tsutsuji-san's translation above provides one explanation:

I am not aware of the design basis of the IC: would it be a problem to keep the valve open even if the shell side was empty,

If there is, then IC design is faulty. IC, as an emergency system, should be rugged enough to withstand being left open even if shell side has boiled dry. (Moreover, it should be rugged enough to withstand multiple "boiled dry/refilled with water" cycles, which could happen in some accident scenarios).

or was there some other reason to close it? The arguments given by the plant's management after the accident of not being aware that the valve was closed seem to suggest in the direction that there should from technical point not have been a reason to close it, but it was rather done amidst the confusion of the situation.

In this case, operators made a mistake.

Another issue is that it might in any case have been too late at 18:18 due to the possibility of hydrogen build-up to make the IC fully operational, since the venting routes to the steam lines were apparently also closed because of the DC loss.

If this is true, this would be a design flaw as well.

All in all, we definitely have here either a flaw in IC design, or operator error. Or both.

 

[rmattila]

All in all, we definitely have here either a flaw in IC design, or operator error. Or both.

I'd put it a bit differently. We have a plant with safety systems/operating procedures that will result into a core damage with a total loss of DC, and then we have an external event that caused the total loss of DC.

It's more a philosophical question, whether the error was made in the design against external threats (obviously, taking into account the damage caused by the flooding), in the plant response to a total loss of DC (which should clearly be a beyond design basis, but since the hardware was OK, it would sound sensible to design the plant so that it could survive the event, i.e. reconsider the design of e.g. the inner IC valve isolation logic) or the operating procedures, which apparently did not prioritize the core cooling function to everything else in the early stages of the event. However, since some/all of these issues that could have been solved during the 40 years of plant operation failed, I think it is very unfair to blame the operators for not making the correct decisions in the very short time window they had, in a situation that was way beyond their training.

I don't know if there's a person equivalent to a "safety engineer" in the TEPCO emergency organization, i.e. a person with no direct responsibility of practical control room operations, but a single task of making sure that the main safety functions are in order and giving advice to the shift personnel if necessary - even against the procedures, if there's a reason to deviate from them. Such a specialized person could have had an effect on the outcome, if he could have focused solely on ensuring the status of decay heat removal right after the tsunami without any other responsibilities.

 

[Thalic]

Long time lurker here (back to almost the first few days).

I understand the discussion about the IC and the operators and what/who was to blame that those systems were robust enough, valves opened, etc., but I think we are missing the point. It is my recollection that there was no power at the site for many days (into week(s)) and the site was almost inaccessible due to debris from the tsunami. Even if the operators were adequately trained for this situation and if the IC units operated flawlessly (and were able to be continuously refilled), wouldn't the cores still have been uncovered and compromised at some point during the accident??

 

[nikkkom]

Long time lurker here (back to almost the first few days).

I understand the discussion about the IC and the operators and what/who was to blame that those systems were robust enough, valves opened, etc., but I think we are missing the point. It is my recollection that there was no power at the site for many days (into week(s)) and the site was almost inaccessible due to debris from the tsunami. Even if the operators were adequately trained for this situation and if the IC units operated flawlessly (and were able to be continuously refilled), wouldn't the cores still have been uncovered and compromised at some point during the accident??

Great excuse for not drilling down into the core of the IC issue. This line of reasoning was already aired, and I bet TEPCO will use it to deflect criticism.

I might seem to be ridiculous, but when another reactor will suffer a SBO, I _do_ want ICs and whatnot to be properly designed, stand ready in working order, and to be correctly operated by plant personnel! Is it too much to ask?

 

[nikkkom]

I'd put it a bit differently. We have a plant with safety systems/operating procedures that will result into a core damage with a total loss of DC, and then we have an external event that caused the total loss of DC.

It's more a philosophical question, whether the error was made in the design against external threats (obviously, taking into account the damage caused by the flooding), in the plant response to a total loss of DC (which should clearly be a beyond design basis, but since the hardware was OK, it would sound sensible to design the plant so that it could survive the event, i.e. reconsider the design of e.g. the inner IC valve isolation logic) or the operating procedures, which apparently did not prioritize the core cooling function to everything else in the early stages of the event.

How is this a *philosophical* question? I read "philosophical" as "a question so removed from the real world that the answer doesn't really matter".

In the IC case, the "WTF went wrong with it?" question is a very down-to-earth and important one - we need to know what needs to be fixed in other plants.

 

[Thalic]

Great excuse for not drilling down into the core of the IC issue. This line of reasoning was already aired, and I bet TEPCO will use it to deflect criticism.

I might seem to be ridiculous, but when another reactor will suffer a SBO, I _do_ want ICs and whatnot to be properly designed, stand ready in working order, and to be correctly operated by plant personnel! Is it too much to ask?

I fully agree that it is important to get to the bottom of the IC issue and I don't want to give TEPCO any way to deflect criticism where it is due. Indeed, systems should be robust and redundant to ensure that these things don't happen in the future. My point is that the IC would have eventually failed to cool the reactor within the time period that power and access was unavailable and there would have been a similar result. Am I wrong?

 

[rmattila]

How is this a *philosophical* question? I read "philosophical" as "a question so removed from the real world that the answer doesn't really matter".

In the IC case, the "WTF went wrong with it?" question is a very down-to-earth and important one - we need to know what needs to be fixed in other plants.

As it appears, the IC was designed to cope with the loss of AC, but not with the loss of DC. How to deal with a loss of DC comes down to the same kind of discussion we had with NUCENG regarding the need for the containment to withstand a core melt and the preference between preventive/mitigative actions:

Some say it's enough if we make the loss of DC sufficiently improbable so we don't have to deal with its consequences, i.e. that the design deficiencies are not in the IC design but in the protection of the DC distribution system. Others claim that while doing all that can be done to practically eliminate the situation (loss of DC), it would still be better if the consequences could be coped with.

I personally think that although the main issue is with making sure the DC is never lost (you should really be ably to monitor the plant status in all situations!) it is worth to at least reconsider the IC design to judge if it would be an overall better solution to make it withstand the loss of DC. But such design modifications shall never be done hastily: it's really a matter of optimizing the solution to conflicting goals - the certainty of the isolation function vs. the certainty of the core cooling function.

 

[rmattila]

I fully agree that it is important to get to the bottom of the IC issue and I don't want to give TEPCO any way to deflect criticism where it is due. Indeed, systems should be robust and redundant to ensure that these things don't happen in the future. My point is that the IC would have eventually failed to cool the reactor within the time period that power and access was unavailable and there would have been a similar result. Am I wrong?

As long as there was capability to pump water (which there existed during the entire accident - at least seawater was available all the time), I don't see why the IC should necessarily have failed, if the valves would only have been open all the time.

 

[Most Curious]

As I understand it, an alternative to DC operation of the IC valves was manual operation. (At least those coutside the PCV.) Therefore, other factors prevented use such as might be expected in a severe crisis situation. ie, time to evaluate the problem and send workers to open the valves. If radiation was high, as reported, wasn't core damage already occurring? Likely a shortcoming in the operation manual for the plant, also likely overlooked because of the possibility of DC loss being so remote. After the core was uncovered and hydrogen production began, any action concerning the IC was probably moot.

GE may have seen some limitations to the IC for emergency core cooling as it was replaced in later designs. I wonder how many IC plants are in operation, worldwide? Also consider that those "later designs" without the partially passive cooling capability of the IC ALSO suffered severe core damage.

 

[rmattila]

As I understand it, an alternative to DC operation of the IC valves was manual operation. (At least those coutside the PCV.) Therefore, other factors prevented use such as might be expected in a severe crisis situation. ie, time to evaluate the problem and send workers to open the valves. If radiation was high, as reported, wasn't core damage already occurring? Likely a shortcoming in the operation manual for the plant, also likely overlooked because of the possibility of DC loss being so remote. After the core was uncovered and hydrogen production began, any action concerning the IC was probably moot.

That is very true. The IC should be started within an hour, or you end up with hydrogen problems. However, it can be argued that the isolation interlock and uncertainty of the status of the inner valves may have been a factor contributing to the overall confusion and the time delay. If it would simply have been a matter of going and manually opening the 3A valve that had previously been closed, one hour should have been sufficient, if initiating the core cooling function was recognized as the primary priority. Now it apparently took three hours and the return of DC to be able to get the valve open. Core damages probably started after 2 - 3 hours, and up until that time, the IC would have saved the day.

GE may have seen some limitations to the IC for emergency core cooling as it was replaced in later designs. I wonder how many IC plants are in operation, worldwide? Also consider that those "later designs" without the partially passive cooling capability of the IC ALSO suffered severe core damage.

I have the impression - which may well be false - that the primary reason for replacing the IC with RCIC in the later designs was the increased reactor power and consequent need to increase the capacity of the residual heat removal system without increasing the space reserved by the system. On the other hand, the Toshiba's newest ABWR version that is currently being marketed in Europe has the RCIC again replaced with an IC.

 

[tsutsuji]

Here is a translation of internal investigation interim report attachment 8-2 http://www.tepco.co.jp/cc/press/betu11_j/images/111202f.pdf page 202/314

Fukushima Daiichi unit 1 high pressure injection system

When starting the high pressure injection system (HPCI), the auxiliary oil pump is started first, and as the driving oil is supplied to the turbine stop valve and to the turbine regulator valve, the HPCI turbine is started. However, due to the loss of DC power, it became impossible to start the auxiliary oil pump, and as a result the HPCI became unusable.

HPCI automatic activation signal
activation flow
↓|→[STRIKE]activation of auxiliary oil pump[/STRIKE] → impossible to open turbin stop valve MO-2301-Z9 and regulator valve MO-2301-Z8
↓|→activation of barometric condenser vacuum pump
↓|→HPCI steam supply isolation valve (inner side MO-2301-4, outer side MO-2301-5) "Open"
↓|→HPCI turbine entrance valve MO-2301-3 "Open"
↓|→condensate water tank suction valve MO-2301-6 suction valve "Open"
↓|→injection valve MO-2301-8 "Open"
↓|→minimum flow bypass valve MO-2301-14 "Open"
↓|→cooling water valve MO-2301-240 "Open"
↓|→test bypass valve MO-2301-15, MO-2301-10 "closed"

 

[Most Curious]

Rmattila, thank you for the reply!

That is very true. The IC should be started within an hour, or you end up with hydrogen problems. However, it can be argued that the isolation interlock and uncertainty of the status of the inner valves may have been a factor contributing to the overall confusion and the time delay. If it would simply have been a matter of going and manually opening the 3A valve that had previously been closed, one hour should have been sufficient, if initiating the core cooling function was recognized as the primary priority. Now it apparently took three hours and the return of DC to be able to get the valve open. Core damages probably started after 2 - 3 hours, and up until that time, the IC would have saved the day.

I would suggest that not knowing the position of the AC operated valves inside the PCV should not have affected the decision to manually open the DC operated valves. The one hour window is a maximum and action would surely be appropriate early rather than later? (20-20 hindsight!) You are absolutely correct that when I referred to a likely shortcoming of the Operation Manual in not applying adequate weight to loss of DC power, I failed to include the high priority that should be applied to emergency core cooling. While that seems obvious to us in looking back, it is hard for me to imagine the confusion, lack of authority of many individuals, and utter chaos of the early time period of the accident! We can even second guess the decision to "follow the manual" concerning the cooling rate of the reactor vs what happened when it melted down. Careful examination of these events will surely lead to better operation in the future.

Clearly, the operations manual needs to be improved. Doing so will be a monumental task as every tiny detail will need to be addressed and re-organized so that the most important considerations don't get pushed back to page 54, so to speak. While I have never had the opportunity to read one of these for a nuke plant, I have digested them for other complex systems and almost always found them wanting.

I have the impression - which may well be false - that the primary reason for replacing the IC with RCIC in the later designs was the increased reactor power and consequent need to increase the capacity of the residual heat removal system without increasing the space reserved by the system. On the other hand, the Toshiba's newest ABWR version that is currently being marketed in Europe has the RCIC again replaced with an IC.

Thank you - I just learned another good tidbit - that some newer plants have gone back to the IC system - I didn't know that. Makes it even more important that the failures and shortcomings of both the IC system and the associated operating instructions be re-examined in great detail as IC systems may be in service for many years to come.

I can see some advantage to the IC system vs RCIC for long term SBO. The IC itself is passive except for valves and grants a most important commodity in very short supply - TIME - if used properly. Fire pump supplied water to the IC shell could allow safe level of cooling indefinitely, it would appear. The RCIC, as I understand it, depends on the suppression pool for cooling and that has limits which were reached fairly early at Fukushima due to loss of seawater cooling of the SC heat exchangers. I suppose a flow to the SC HE could be jury rigged but in what time period?? Another area for serious study!

Loss of DC events also will need attention. No doubt some redunadancy needs to be available in the DC system to maintain certain ultra critical water level instruments and a few controls such as for RCIC and IC, for example. My knowledge of any DC redundancy in the plant is nil so what I am suggesting may already exist and just failed like so many other things did in the massive beyond design basis event.

 

[nikkkom]

I fully agree that it is important to get to the bottom of the IC issue and I don't want to give TEPCO any way to deflect criticism where it is due. Indeed, systems should be robust and redundant to ensure that these things don't happen in the future. My point is that the IC would have eventually failed to cool the reactor within the time period that power and access was unavailable and there would have been a similar result. Am I wrong?

We have no idea what would happen if IC(s) would be operating to their fullest capacity.

Maybe operators would find water sources to replenish IC in time to prevent overheating. As a result, maybe Unit 1 wouldn't blow up and spew radiation and more debris all over the place. As a result, saving of Units 2 and 3 maybe would be much easier.

 

[jim hardy]

speaking as an old plant guy, loss of all power is the thing that happens only in one's nightmares.

to their credit , plant operators carried in their car batteries to try and keep some instruments working.


it is now demonstrated that there needs to be in place plans and fixtures to hook up last ditch power supplies and pumps for "all else has failed" scenarios. we did that after TMI, without fanfare.

There exist in the industry cadres of people whose job it is to ask "what if" , and
other cadres of people whose job it is to analyze away such questions.

i guess it's a question of balance. takes real genius to keep things simple.

my former employer had a management strategy of alternating layers of degreed and 'up through the ranks' people - an engineer likely worked for a former craftsman who in turn worked for an engineer, etc. It counteracted "ivory tower syndrome".

old jim

 

[Thalic]

We have no idea what would happen if IC(s) would be operating to their fullest capacity.

Maybe operators would find water sources to replenish IC in time to prevent overheating. As a result, maybe Unit 1 wouldn't blow up and spew radiation and more debris all over the place. As a result, saving of Units 2 and 3 maybe would be much easier.

You are right and it would have been a great result, but given the very trying situation post tsunami that persisted for a great while, highly unlikely. Obviously, there would have been a different series of events throughout the crisis which may have allowed them to prevent some of the catastrophic results.

 

[Most Curious]

The 8 -10 hour operation of the IC with water it already contained (IF that number is accurate) would have bought a lot of time, something that was very precious. I read earlier that temporary piping from the fire pump system to the IC shell reservoir was underway, as it should have been. Sadly, the IC system either failed or was not properly managed.

Agreed total SBO is a nighmare scenario. I applaud the operators carrying in batteries to attempt to deal with it. No doubt a LOT of study will go into how to mitigate SBO in the future, as it should!

 

[Most Curious]

my former employer had a management strategy of alternating layers of degreed and 'up through the ranks' people - an engineer likely worked for a former craftsman who in turn worked for an engineer, etc. It counteracted "ivory tower syndrome".

old jim

Outstanding! Your former employer understood how things work!

KISS is always best if it will do the job. The VERY BEST engineers are those who also know how to use a wrench - and have done so long enough to be good at that, too. Conversely an excellent mechanic knows a lot of theory and engineering.

 

[tsutsuji]

Does anyone have a clue about what happened to the diesel generators in the common pool building first floor (unit 2 DG B and unit 4 DG B) which are marked "unusable" although they are also marked as "not inundated" in table II-2-14 of the second report to IAEA : http://www.meti.go.jp/english/earthquake/nuclear/iaea/pdf/20110911/chapter2.pdf page 72 ? The diesel generators of unit 5 are also both "unusable" and "not inundated", which can mean that only their seawater cooling system was unusable because of damaged seawater pumps. But aren't unit 2 DG B and unit 4 DG B air-cooled ?

The internal investigation interim report tells a few additional remarks about the diesel generators, like diesel generator inundation was generally caused by a tsunami water route via the air intake louver, generally located on the first floor ( http://www.tepco.co.jp/cc/press/betu11_j/images/111202f.pdf page 24/140 ), or that in the USA diesel generators are often not in basements because there are no basements in turbine buildings in the USA, while in Japan anti-seismic rules imply to build buildings on the base rock layer (page 23/140). But I still do not understand what they mean with the diesel generators that are not inundated yet unusable.

 

[Joffan]

The sizing of the IC is also intended to remove heat in events where the reactor remains at higher powers due to ATWS. One of the problems of simple solutions is that it may overlook impact on other types of accidents or transients.

Thanks for the response. You'll notice though I did say an extra loop - I was thinking of smaller piping, not a smaller IC, that could be simply left open once activated. There may of course be good reasons why this is not feasible, and there is always the danger that extra loops bring extra complexity with the potential for additional problems.

 

[etudiant]

Separate topic.
There are reports on Energy News, a generally alarmist website, claiming the NRC believes there was a sustained fire in reactor 2 after the accident sustained by reaction products of the zirconium cladding reacting with the water.
The source appears to be this video:
http://www.youtube.com/watch?v=vSfaJTjvmHo&feature=relmfu
The video, which looks to be an NRC product dating from end Nov, features Frederick (Rick) Hasselberg. who is identified as a reactor engineer and incident response coordinator in NRC’s Office of Nuclear Security and Incident Response (NSIR).

He notes, among other items

At Units 1, 2 and 3, a huge amount of hydrogen was generated as the fuel rods were violently consumed by the self-sustaining zirconium-water reaction.
Core temperatures continued to rise.
You could hardly call them fuel rods anymore, but some of the materials that used to be inside the fuel rods were reaching 3000, 4000, 5000 degrees.

and then goes on to say that the hydrogen produced burned for several days at unit 2, unlike the explosions at 1 and 3.
I've heard nothing of a prolonged fire at reactor 2, although that might help explain why so much of the emissions came from that unit.

Has anyone any comment on the NRC video that is the source for these claims? It seems a fairly well produced piece of work but does not appear to have made much splash.

 

[swl]

But I still do not understand what they mean with the diesel generators that are not inundated yet unusable.

Interesting question. I wonder if the transfer switches could have been inundated, thus rendering the generators unusable?

 

[rmattila]

Does anyone have a clue about what happened to the diesel generators in the common pool building first floor (unit 2 DG B and unit 4 DG B) which are marked "unusable" although they are also marked as "not inundated" in table II-2-14 of the second report to IAEA : http://www.meti.go.jp/english/earthquake/nuclear/iaea/pdf/20110911/chapter2.pdf page 72 ? The diesel generators of unit 5 are also both "unusable" and "not inundated", which can mean that only their seawater cooling system was unusable because of damaged seawater pumps. But aren't unit 2 DG B and unit 4 DG B air-cooled ?

This is just a random guess, but e.g. loss of the fuel supply system, starting system (I don't know if it uses compressed air or battery power), or damage to the outgoing power supply system (switchboards, busbars, cables) would make the EDG unusable even if the engine itself would have survived the tsunami.