4.3.1. Unit 1 Reactor

Following the earthquake and scram of the Unit 1 reactor, its two isolation condensers (Figures 4.2 and 4.3) started automatically as designed (see Section 2.2 in Chapter 2). Following established operating procedures, the Unit 1 operators¹² used these isolation condensers to control reactor pressure and cooldown rate. They initially shut down both isolation condensers because reactor cooldown rates were too high; they then cycled one of the isolation condensers (the Train A isolation condenser in Figure 4.3) to maintain reactor pressure and cooldown rates within prescribed specifications.¹³

FIGURE 4.2

Schematic illustration of major safety systems in Unit 1 of the Fukushima Daiichi plant. SOURCE: Courtesy of TEPCO.

FIGURE 4.3

Schematic of the isolation condenser systems for Fukushima Unit 1. The unit contains two systems, labeled A and B. Motor-operated (MO) valves are indicated by connected triangles. Black indicates valve closed during normal operations; white indicates valve (more...)

The Train B isolation condenser was on standby at the time of the tsunami. It was inoperable after the tsunami because the operator had closed off the return line valve (valve MO-3B in Figure 4.3) before the tsunami and was unable to open it afterward due to the lack of AC and DC power (Investigation Committee, 2011, p. 117; TEPCO, 2012b, p. 195).

Subsequently, the tsunami flooded the Unit 1 emergency diesel generators and power panels (Figure 4.2), cutting off all AC and DC power to the unit. With no power for instrumentation or controls, the Unit 1 operators lost the ability to monitor plant indicators from the control room. Most critically, they were unable to check the status of the isolation condenser valves¹⁴ or to actuate them from the control room. Attempts to check the status of the valves in the field were unsuccessful because of access limitations and high radiation fields. Attempts to start up the high-pressure coolant injection system (Figure 4.2) also were unsuccessful due to the loss of DC power.

The loss of AC and DC power in Unit 1 caused its isolation condenser to shut down because of failsafe control logic (this logic is described later in this section). As a consequence, Unit 1 essentially lost all cooling function. However, operators and onsite ERC staff did not understand at first that the isolation condenser had stopped functioning because plant indicators and controls were not available. In fact, the Unit 1 operators initially assumed that the isolation condenser was working.

Because of the failure of the safety parameter display systems and lack of definite information from the Unit 1 operators, the staff in the onsite ERC and the site superintendent could not determine if the isolation condenser was functioning. Site Superintendent Yoshida was sufficiently concerned that he immediately reported to Tokyo that there was a failure of the emergency core cooling systems for Units 1 and 2 (Investigation Committee, 2011, p. 114).

The onsite ERC began to take proactive actions to restore the Unit 1 monitoring systems and establish alternative water injection sources. The site superintendent directed onsite ERC staff to give priority to restoring plant indicators, particularly reactor water level and pressure. At approximately 17:10 on March 11, he instructed onsite ERC staff to begin preparation for two alternative water injection strategies: water injection via the diesel-driven fire protection system (this system is depicted in Figure 4.2), a mitigation strategy specified in the plant's accident management procedures, and water injection through the fire protection system using fire engines, a strategy not specified in those procedures.

Around 18:00 on March 11, some DC power was restored in Unit 1. Operators discovered that the isolation condenser valves outside of containment (i.e., valves MO-2A and MO-3A in isolation condenser A; see Figure 4.3) were closed. The fact that valve MO-2A read closed, when it normally should be open (see Section 2.2 in Chapter 2), caused operators to suspect that all of the isolation condenser valves had closed after loss of AC and DC power. At 18:18, operators decided to open valves MO-2A and MO-3A on the possible chance that the valves in containment (MO-1A and MO-4A) had not fully closed.

At this point the operators inferred that the isolation condenser was functioning; this inference was based on indirect audible (i.e., steam generation was heard) and visual (i.e., a steam plume was observed) cues. The operators informed the onsite ERC that the isolation condenser was functioning. However, operators closed the condensate return valve (valve MO-3A in Figure 4.3) shortly thereafter (at 18:25). The reason for this action is unclear¹⁵ and the onsite ERC was not informed that it had been taken.¹⁶

By around 18:30 on March 11 the Unit 1 operators became convinced that the isolation condenser was not functioning. They recognized then that water injection into the reactor was the only option available to cool it. Preparations for injecting water into the Unit 1 reactor using the diesel-driven fire protection system (Figure 4.2) had already been under way for over an hour; these preparations were completed by 20:50. However, the reactor pressure vessel had to be depressurized first (by opening the safety relief valves; see Figure 4.2) before low-pressure water from the fire protection system could be injected.

The operators asked the onsite ERC to provide batteries so that the safety relief valves could be opened from the control room. However, the ERC team member who received this request did not understand its urgency, possibly because the ERC believed that the isolation condenser was still operating normally. In fact, the onsite ERC did not act on this request for several hours.

Miscommunications, combined with misleading water-level indicators in the reactor pressure vessel (e.g., at 21:19 the water level was shown to be 200 mm above the top of active fuel,¹⁷ which was likely not the case¹⁸), caused the onsite and headquarters ERCs to continue to believe that the isolation condenser was operating. By about 22:00 on March 11, rising radiation levels were observed in the reactor, drywell, and turbine buildings, suggesting that fuel degradation and core damage were occurring.¹⁹By 23:50 the site superintendent and other onsite ERC personnel fully understood that the isolation condenser was not operating.

At approximately midnight on March 12, the Unit 1 operators began preparations for venting the containment (Figure 4.2). Operators consulted piping and instrumentation diagrams, valve drawings, and accident management procedures. These procedures assumed that power would be available for remote valve control; consequently, they were not applicable to the then-current situation in Unit 1. The operators needed to develop (in real time) a plan for venting the containment by manual valve operation. This required study of the layout and configuration of the vent valves to determine which valves needed to be opened, their locations, and whether and how they could be opened manually.

Operators confronted a number of additional obstacles for venting containment. These included a need to perform dry runs to keep field work time as short as possible (because of high radiation levels); the need to gather equipment (fireproof clothing, personal air supply, flashlights, full face masks); and the need to perform the work in shifts (three teams of two people) because the reactor building was pitch dark and radiation levels were high.²⁰ Team 1 completed its assigned task but teams 2 and 3 had to turn back because of high radiation levels. Venting was eventually performed from the control room after a compressor was procured and installed to enable remote operation of the large air-operated suppression chamber vent valve (see Figure 4.2). Because of these delays venting did not begin until 14:30 on March 12 when containment pressure had reached over 0.75 MPa (110 psig), almost twice the design value of 0.43 MPa (63 psig).

By 02:45 on March 12 the pressure in the reactor pressure vessel was determined to be near containment pressure²¹; freshwater injection was initiated at 05:46.²² By this time, however, the fuel in the reactor had already been damaged and hydrogen and radioactive materials had likely already leaked into the reactor building. At 15:36 on March 12 a hydrogen explosion occurred on the refueling floor of the Unit 1 reactor building outside of containment. Further discussion of hydrogen generation and the explosion in Unit 1 is provided in Section 4.3.5.

4.3.2. Unit 3 Reactor

Unit 3 did not lose DC power immediately after the tsunami. Consequently, until its batteries became depleted, operators were able to monitor plant indicators from the control room, including reactor pressure and water levels. They were also able to activate, monitor, and control the reactor core isolation cooling and high-pressure coolant injection systems (Figure 4.4).

FIGURE 4.4

Schematic illustration of major safety systems in Units 2 and 3 of the Fukushima Daiichi plant. SOURCE: Courtesy of TEPCO.

Unit 3 operators activated the reactor core isolation cooling system at around 16:00 on March 11. They also cut unnecessary loads on the battery to extend its life. Steam exhaust from the reactor core isolation cooling system to the suppression chamber raised its pressure, prompting operators to initiate suppression chamber spray cooling using the diesel-driven fire protection system (Figure 4.4).

At around 11:36 on March 12, after running for approximately 20 hours, the reactor core isolation cooling system stopped and could not be restarted.²⁶ The safety relief valves cycled to control reactor pressures; as a result, water levels in the reactor pressure vessel dropped and the high-pressure coolant injection system started automatically at 12:35.

The high-pressure coolant injection system was aligned in full-flow test mode with almost all of the pump flow going back to the suppression pool; only enough flow was directed to the reactor pressure vessel to maintain water levels.²⁷ This avoided the constant starts and stops that would have occurred had all of the flow been directed to the reactor pressure vessel. However, in this mode of operation, the system turbine consumes enough steam to depressurize the reactor pressure vessel. The turbine had to be shut down when pressures decreased to the point where operators became concerned about the turbine's ability to work without being damaged.

Starting at approximately 20:36 on March 12, operators could no longer monitor water level in the Unit 3 reactor because the 24VDC power source for the water-level gauge became depleted. Operators became concerned about the continued availability of the high-pressure coolant injection system,²⁸ so they developed an alternative plan for water injection into the reactor. This plan involved

• Shutting down the high-pressure coolant injection system;
• Depressurizing the reactor pressure vessel using the safety relief valves, which would vent steam from the reactor pressure vessel to the suppression pool; and
• Injecting water into the reactor pressure vessel using the diesel-driven fire protection system (Figure 4.4).

The Unit 3 operators informed the members of its team in the onsite ERC of their plan. The team members concurred with the plan but failed to communicate it to the site superintendent and other ERC staff.

Operators stopped the high-pressure coolant injection system at 02:45 on March 13 and switched the fire protection system from suppression chamber spray cooling to reactor pressure vessel injection. Operators attempted but were unable to open the safety relief valves, either because the pressure in the reactor pressure vessel was too low²⁹ or because the batteries were depleted.³⁰ Attempts to restart the high-pressure coolant injection system also failed probably because the battery was depleted.

The operators informed their team members in the onsite ERC that they had stopped the high-pressure coolant injection system but were unable to open the safety relief valves; this information was not immediately passed on to the site superintendent and other staff in the onsite ERC. It was not until 03:55 on March 13 that the site superintendent and the headquarters ERC learned these facts.³¹

The onsite ERC immediately recognized the need to obtain batteries to operate the safety relief valves and fire engines to inject water into the reactor through the fire protection system (Figure 4.4). Plant personnel salvaged batteries from personal automobiles; it took almost 2 hours to collect them and another hour to connect them to the Unit 3 control panel.³² Personnel also repaired an onsite road so that the fire brigade could drive a fire truck to the dock by Unit 3.³³

According to TEPCO (2013, p. 38), reactor pressure reached about 7 MPa (abs) at about 04:30. Reactor pressure then decreased abruptly to below 1 MPa (abs) at about 09:00. The reason for this decrease is not understood at present. Depressurization enabled the injection of freshwater starting at 09:25. By that time, however, the reactor core had been without cooling for over 6 hours³⁴ and was probably already damaged.

The Unit 3 operators and onsite ERC made preparations for venting the containment through the suppression chamber vent valve (Figure 4.4). This valve is operated with compressed air. These preparations were completed at about 08:41 on March 13. At about 09:24, a drop in drywell pressure was noted, leading the onsite ERC to assume that venting had initiated around 09:20.

At approximately 12:20 on March 13 the store of freshwater used for injection ran out so workers proceeded to hook up a previously constructed seawater injection line. Seawater injection began at 13:12 on March 13 but was interrupted when the Unit 3 reactor building exploded at 11:01 on March 14. Seawater injection was restarted at 15:30. As in the case for Unit 1, only a fraction of the injected water appears to have reached the reactor.

The Unit 3 reactor was cooled by water injection for approximately 30 hours, but cooling was inadequate. There may have been insufficient compressed air pressure³⁵ and capacity to keep the suppression chamber vent valve open; consequently, pressure in the containment stayed too high to allow the reactor pressure vessel to be depressurized. The high pressure reduced water injection flow rates into the reactor pressure vessel and likely caused hydrogen and fission products to leak from the containment into the reactor building.

A hydrogen explosion occurred in the Unit 3 reactor building at 11:01 on March 14. The explosion caused severe structural damage to the reactor building and destroyed the fire engine and hoses being used to inject water into the reactor. The explosion also prompted the evacuation of field personnel and delayed recovery efforts.

It is questionable whether the operators' plan for injecting water would have worked even had they succeeded in their initial efforts to open the safety relief valves: the maximum pressure output of the pump in the fire protection system (0.45-0.60 MPa) was likely insufficient to overcome the rapidly climbing pressure in the reactor pressure vessel. The Investigation Committee (2011, p. 221) noted that a

hasty conclusion should be avoided about whether or not the damage of Unit 3 could have been prevented or mitigated by depressurization and/or earlier alternative water injection because there were many uncertain factors…. It could be presumed that, however, if depressurization of Unit 3 had been performed much earlier than it actually had and the alternative method of water injection using fire engines had been conducted smoothly, the progress of core damage might have been slower, radiation dose in the RPV [reactor pressure vessel] would have been less and subsequent work might have been easier.

4.3.3. Unit 2 Reactor

The tsunami flooded the Unit 2 emergency diesel generators, power panels, and batteries, cutting off all AC and DC power to the unit.³⁷ Control room lighting, alarms, plant indicators, and controls were lost as a result. Fortunately, the Unit 2 operators had started the reactor core isolation cooling system (Figure 4.4) just before power was lost. As a consequence, the system's isolation valves failed in the “as is” position (i.e., open) thereby allowing it to continue to operate.³⁸ The system functioned for almost 3 days, although operators could not monitor or control it.³⁹

Operators were unable to verify visually that the system was operating because it was not physically accessible.⁴⁰ They were also unsure of the water level in the reactor pressure vessel. As a consequence, the onsite ERC staff and site superintendent initially doubted that the system was operating and believed that Unit 2 was in more serious difficulty than Unit 1.

The tsunami also flooded the diesel-driven pump for the fire protection system.⁴¹ The onsite ERC requested that the Unit 2 operators locate the fire protection system connections, which are accessible from outside the reactor building, so that water from the makeup-water condensate system (Figure 4.4) could be injected into the reactor pressure vessel using fire trucks. The operators also had to line up the system valves manually (they are normally motor operated) by entering the reactor building; they had great difficulty accomplishing this operation because of a lack of knowledge about the location of the valves, missing keys for locked doors, and the physical effort required to turn the valve wheels. Nevertheless, this operation was completed in Unit 2 late on March 11 after it was first performed in Unit 1. The early timing of this operation was fortuitous because the reactor buildings later became too contaminated for extended entry.

At about 22:00 on March 11, workers entered the Unit 2 reactor building to manually read the reactor pressure vessel water level; they found it was 3,400 mm above the top of active fuel. At this point the onsite ERC staff realized that the reactor core isolation cooling system must be functioning; the ERC's focus then shifted away from providing emergency injection water for Unit 2. By 23:35, operators obtained further indirect confirmation that the reactor core isolation cooling system was functioning when they were able to connect emergency power to a drywell pressure gauge; the gauge reading was 0.14 MPa (abs), as expected for normal operation of the reactor core isolation cooling system.⁴²

During the early hours of March 12, workers visited the equipment room in the basement of the Unit 2 reactor building to check on the status of the system.⁴³ They were equipped with self-contained air breathing sets, small flashlights, and rubber boots. Their attempt to confirm system operation was unsuccessful. However, at approximately 02:55 on March 12 the shift supervisor reported to the onsite ERC that he believed the system was operating because the system pump discharge was higher than the pressure in the reactor. At this point the site superintendent decided to give priority to Unit 1 containment venting.⁴⁴

Operators noticed a decrease in water level of the condensate storage tank (Figure 4.4), which was then being used as the water source for the reactor core isolation cooling system. Operators switched the system water supply from the tank to the suppression pool at around 04:00 on March 12. Operators again checked on the operation of the system during this changeover. However, the operation of the system was not checked again until about 2 days later (at 04:30 on March 14). By that time the pressure in containment had reached 0.4 MPa (abs), approaching its design pressure of 0.48 MPa (abs).

Somewhat surprisingly, the pressure in Unit 2 increased much less rapidly than in Unit 3, suggesting that there was either a leak in the Unit 2 containment or an unusually effective cooling mode, such as external cooling of the suppression pool due to flooding of the torus room. Analyses using MAAP and MELCOR (see Section 4.3.5) by groups in the United States and Japan have been used to support both hypotheses, alone or in combination.

The reactor core isolation cooling system in Unit 2 continued to operate until about 13:30 on March 14.⁴⁵ After the system stopped, the safety relief valves operated mechanically to vent steam from the reactor pressure vessel to the suppression pool. Steam loss from the reactor pressure vessel caused its water levels to drop continuously for the next 5 hours.

At 17:45 on March 14, a safety relief valve was manually actuated to depressurize the reactor pressure vessel. This reduced pressure in the reactor pressure vessel from 7.8 MPa to 0.7 MPa within 45 minutes. Depressurization also discharged a substantial fraction of the reactor pressure vessel's water inventory to the suppression pool, uncovering the reactor core. After the valve was closed the reactor immediately started to repressurize. The safety relief valves were manually actuated several times over the next 10 hours⁴⁶ to keep reactor pressure sufficiently low for water injection to be effective.

Preparations for water injection had begun on March 11. Valves in the fire protection system had been aligned to make it possible to inject water into the reactor pressure vessel using fire trucks (Figure 4.4) once the reactor had been depressurized. However, fire trucks were not hooked up to the Unit 2 fire protection system until after 23:00 on March 14. Prior to that time, all available fire trucks were being used at Units 1 and 3. Moreover, there was not sufficient space in the valve backwash pit (from which seawater was being pumped) to place another suction line.

Additional fire trucks and staff arrived at the site at 05:00 on March 14, and a pumping path from a valve backwash pit was established. However, the fire trucks were placed on standby while seawater in the valve backwash pit was being used to supply Unit 3.⁴⁷

Operators and onsite ERC staff also began making preparations on the evening of March 11 for depressurizing the Unit 2 containment. They had previously vented the containment in Unit 1 through its air-operated suppression chamber vent valve (Figure 4.2). They knew that a powerful compressor and DC batteries would be needed to open this vent in Unit 2. The site superintendent instructed staff to complete preparations for venting Unit 2 by 17:30 on March 12.

Workers located and connected air cylinders that could be used to operate the suppression chamber vent valve. An emergency generator in the control room was used to energize the air solenoid. By 23:00 on March 13 all the valves had been prepared for actuation or actuated; only the rupture disk needed to be broken to vent the unit. The rupture disk was set to break at 0.528 MPa (abs). According to the drywell pressure readings, which continued to increase, it was presumed that the valves failed to stay open. Venting on March 13 or 14 was apparently never successfully accomplished from either the suppression chamber or drywell in Unit 2 (Investigation Committee, 2011, p. 266).

The Prime Minister's office, Nuclear Safety Commission, and TEPCO upper management became concerned about the delays in venting the containment in Unit 2. TEPCO's president ordered the site superintendent to depressurize the reactor pressure vessel without waiting to vent containment. The site superintendent accepted the president's directive and gave instructions to start venting and water injection into the Unit 2 reactor pressure vessel while concurrently continuing preparations for containment venting.⁴⁸

Operators struggled to depressurize the reactor pressure vessel. They had trouble opening the safety relief valves and keeping them open once they were actuated. Additionally, steam exhausted to the suppression pool from the reactor did not condense efficiently because pool temperatures were high. Water injection became possible around 19:00 when the reactor pressure was 0.630 MPa (gauge).⁴⁹ However, the fuel in the reactor had likely been uncovered for some time prior to water injection.

Although the pressure gauges were probably unreliable, the drywell pressure at one point was indicated to be as much as 0.85 MPa (abs), more than twice its design pressure. Reactor pressure was in excess of the maximum fire truck pump head (about 1 MPa; TEPCO, 2013, Attachment 1-4), for substantial periods of time, preventing seawater injection from taking place and placing the containment vessel under significant thermal and pressure stresses.

The operators and onsite ERC struggled through the evening of March 14 and early morning of March 15 to vent containment. Their attempts to open both small and large vent valves in the suppression chamber were unsuccessful.⁵⁰ Attempts to vent the drywell (Figure 4.4) were also unsuccessful.

Pressure in containment remained high until early on March 15 (06:14) when the explosion in the Unit 4 reactor building occurred.⁵¹ Because of the evacuation and the confusion following the explosion, it took some time to understand what had happened. There were apparently two events that occurred on the morning of March 15: (1) a hydrogen explosion in Unit 4 and (2) and a loud noise accompanied by an apparent drop in the suppression chamber pressure in Unit 2. This noise was subsequently determined by TEPCO to be associated with the hydrogen explosion in Unit 4. The drop in suppression chamber pressure appears to be an instrument malfunction (the drywell pressure did not drop and remained above atmospheric for some time). The actual condition of the Unit 2 containment system is still unknown.

Once the Unit 2 reactor core isolation cooling system shut down, measures to cool the Unit 2 reactor were ineffective. The Unit 2 containment was never deliberately vented and it is unclear how or when depressurization occurred. Some fraction of the core is almost certainly highly degraded but the amount and location of core material is unknown. Also unknown are the timing, mechanisms, and magnitude of releases of fission products from Unit 2, although it appears likely that fission products did leak from containment during the period of time that it exceeded its design pressure.

4.3.4. Unit 5 and 6 Reactors

Both Units 5 and 6 were shut down at the time of the earthquake and remained so thereafter. The units experienced thermal transients following the earthquake when active cooling was temporarily lost,⁵³ as described below. The reactors were eventually brought to cold shutdown without damage to the fuel in the core or spent fuel pool. The events at these reactors would likely have been a major story in the annals of nuclear safety had they not occurred in the shadow of the accidents in Units 1-4. In fact, the events at Unit 5 have important implications for safety risks during reactor shutdown conditions.

Unit 5 was undergoing pressure testing⁵⁴ on the day the earthquake occurred. The unit lost all AC power due to flooding of seawater pumps and power panels. As a consequence, lighting and AC-powered instrumentation on the Unit 5 side of the common control room were inoperable; the Unit 5 side of the control room went dark after the batteries for emergency lighting were depleted.

The containment in Unit 5 was open so that visual inspections for leaks could be carried out during pressure testing. The MSIV apparently was also open. A number of safety systems were either unavailable (i.e., reactor core isolation cooling system, high-pressure coolant injection system; residual heat removal system) and some other safety features (e.g., the automatic depressurization system) had been disabled for pressure testing. The safety relief valves had been deactivated by pulling circuit breakers and depressurizing nitrogen lines. Additionally, as part of the pressure test, the low-setpoint safety relief valves had the manual operation locked out by inserting tools into the mechanisms. However, the high-setpoint safety relief valves could still be actuated once nitrogen and power were restored.

The shift supervisor for Unit 5 appears to have taken a strong role in managing the response to the flooding and loss of power because the onsite ERC was occupied with other units at the plant. Nevertheless, the Unit 5 operators and onsite ERC worked together to identify a strategy for depressurizing the reactor. This strategy was identified by 05:00 on March 12 and implemented about an hour later. It involved brute-force prying open of the nitrogen supply line to the vent valve on top of the reactor head from outside the containment.⁵⁵

Workers apparently had to enter the reactor building or containment to connect an ad hoc nitrogen supply line that could be used to activate the safety relief valve that was ultimately used to maintain the reactor pressure at desired levels (Investigation Committee, 2012, p. 110).

A 125V battery that was being used to power some monitoring equipment was depleted at 01:00 on March 12.⁵⁶ The operators used another gauge with independent power to read the reactor water level until the AC crossties to Unit 6 (described below) were completed. A 250V battery was depleted at about 17:00 on March 12, shutting down additional monitoring equipment including the process computer.

An air-cooled emergency diesel generator in Unit 6 survived the tsunami. It was cross-tied to Unit 5 using a cable that had been prepared as part of the unit's accident management strategy. The generator was then able to supply emergency AC power to both units. This was a key element of the successful outcome for these two units relative to Units 1-3. (This was also key evidence that advanced preparation, including advanced positioning of portable equipment, enabled a more effective response than was possible for Units 1-3.) Power was restored to Unit 5 at around 05:00 on March 12, allowing reactor parameters to be read in the main control room.

The Unit 5 operators had decided to use the makeup water condensate system as an alternative cooling method but needed AC power to operate its pump. The laying of the power cables for the pump required cooperation between the electrical contractors and onsite ERC recovery teams. There was also cooperation in laying power cables for instrumentation. The Investigation Committee (2012, p. 112) noted that “Since Units 5 and 6 were undergoing routine inspections, a number of cables were stored in the warehouse of contractors and were used for this task. Regarding the task of interconnecting the power, four members of the ERC Recovery Team laid and connected about 70 m length of cables.”

Some personnel from Units 5 and 6 had been sent to other units to support the accident response. They were recalled on March 16 to restore the residual heat removal system by installing submersible seawater pumps and using portable diesel-driven generators to supply electric power. Cold shutdown of the Unit 5 reactor was achieved on March 20.

The response at Unit 6 was more straightforward given the continued availability of AC power following the earthquake and tsunami. The Unit 6 containment was closed but its vent line was open. Water was supplied to the reactor pressure vessel and the spent fuel pool on a reliable basis from March 13 onward. Cold shutdown was achieved on March 20.

4.3.5. Hydrogen Explosions

Perhaps the most conspicuous and dramatic aspects of the Fukushima Daiichi accident were the hydrogen explosions in the Unit 1, 3, and 4 reactor buildings. These explosions took place at +24.8 hours, +68.2 hours, and about +87.2 hours, respectively (Table 4.1). A hydrogen explosion did not occur in Unit 2, although there were precursor conditions similar to those in Units 1 and 3.

There is a good general understanding of the basic chemical processes that generated the hydrogen that led to these explosions (see Sidebar 4.1); however, there is substantial uncertainty about how hydrogen leaked from reactor containments into the buildings and the specific conditions that led to its ignition. Although no measurements of hydrogen concentrations in Units 1-3 were made, it is likely that large quantities of hydrogen were produced because the reactor cores in these units were not actively cooled for long periods: about 14 hours in Unit 1, 6 hours in Unit 3, and between 5 and 15 hours in Unit 2 (Phillips et al., 2012). Further forensic studies and analyses of hydrogen distribution, combustion, and structural damage to the units are needed to improve the understanding of these explosion events.

SIDEBAR 4.1

Hydrogen Generation and Combustion. Hydrogen is generated in a reactor when zirconium in the fuel cladding reacts with steam at elevated temperatures: 2H₂O + Zr → 2H₂ + ZrO₂.

Video recordings of the explosions in Units 1 and 3 and the visible damage in Units 1, 3, and 4 indicate that significant overpressures consistent with hydrogen combustion occurred. At the present time it is not known if the combustion events were deflagration, detonation (see Sidebar 4.1 for definitions of these terms), or more complex events. The explosions caused extensive damage to the reactor buildings (Figure 4.5), opening up an easier path for the direct release of radioactive materials to the atmosphere and spreading contaminated debris inside and around the units.

FIGURE 4.5

Photos showing damage to the reactor buildings at the Fukushima Daiichi plant from the Unit 1, 3, and 4 hydrogen explosions. (A) Unit 1 exterior; (B) Unit 3 exterior; (C) Unit 3 interior at the operating floor level (i.e., the upper floor of the building where (more...)

The explosions also had a significant impact on the accident response: they injured workers; destroyed equipment and temporary water-line and power cables; prompted evacuations to onsite buildings or offsite facilities that slowed and in some cases halted recovery work; and created a general atmosphere of fear at the plant, throughout Japan, and in other parts of the world. The extensive damage and contamination were totally unexpected by the operators at the Fukushima Daiichi plant and in the view of two U.S. safety experts was a “game changing” event⁵⁷ in the accident.

The current understanding of the accident progression in the Fukushima Daiichi reactors depends substantially on computer simulations of the accident. These simulations are used to make predictions about the state and location of the reactor core and generation of hydrogen during the accident. They are based on detailed physical models of the reactor units (e.g., models of the reactor core, reactor pressure vessel, containment, and reactor building) and information about important operational events that occurred during the accident (e.g., operation of various safety systems and the timing and rates of water injection).

Two simulation tools have been used for this purpose: MELCOR, developed for the U.S. Nuclear Regulatory Commission (USNRC) by Sandia National Laboratories; and MAAP, developed for industry by the Electric Power Research Institute. These models have been extensively compared against a wide range of experiments with simulated accident conditions as well as analysis of the 1979 Three Mile Island accident.⁵⁸ Simulations of the accident using these tools have been carried out to date by Gauntt et al. (2012a,b), TEPCO (2012c), Yamanaka (2012), and EPRI (2013). Some of the key results of these simulations for Units 1-3 are described below.

There is extensive experience with modeling severe accidents in Mark I containments⁵⁹ for the relatively simple accident scenario that occurred in Unit 1: the reactor pressure vessel was isolated except for mechanical venting into the suppression chamber through automatic operation of the safety relief valves, and there were no active cooling measures for at least 14 hours after the earthquake. Consequently, the MELCOR and MAAP simulations for Unit 1 likely have better fidelity to reality than the simulations for the other units.

The results of simulations for Unit 1 are summarized in Table 4.2. They agree reasonably well even though the groups doing the simulations used different assumptions about operator actions, equipment behavior and effectiveness, cooling-water flow rates, and other key events. These simulations are being refined as new information is emerging from TEPCO's continuing investigations into the accident (e.g., Kawabe, 2012; TEPCO, 2013).

TABLE 4.2

Key Results for Accident Progression Simulations in Unit 1.

The simulations suggest the following sequence of events for the accident: With the isolation condenser valves closed and no cooling to the reactor after the loss of all electrical power (see Section 4.3.1 of this chapter), decay heat generated in the fuel boiled the water in the reactor pressure vessel, increasing its pressure and causing the safety relief valves to open. This allowed steam to exit the reactor pressure vessel, dropping its liquid water level. The steam was exhausted to the suppression pool. Condensation of steam in the pool raised its temperature and also increased pressure within the suppression chamber.

Continued depressurization lowered water levels in the reactor pressure vessel. At about +2.5 to +3 hours, all simulations predict that the water level in the Unit 1 reactor pressure vessel dropped enough to expose the active portion of the fuel in the reactor core; within +4.5 to +5 hours, the liquid level dropped below the bottom of the active portion of the fuel. Uncovering of the fuel in the reactor core likely initiated the following sequence of events:

• The temperature of the fuel cladding increased quickly, which accelerated the highly exothermic oxidation reaction between the cladding and steam in the reactor. This reaction generated hydrogen (see Sidebar 4.1) and released heat.
• As temperature continued to increase, pressures inside the fuel rods (from buildup of gaseous fission products) also increased and cladding strength decreased. This caused the cladding to balloon and fail, releasing fission products.
• As temperature increased further, the fuel cladding (and eventually the fuel itself as well as the cladding, control rods, and reactor internals) began to melt, forming a molten mixture referred to as corium.
• The corium flowed downward onto the lower head of the reactor pressure vessel causing it to melt and fail.
• The molten mass flowed onto the concrete floor of the containment. (The simulations estimate that about 139 tonnes of molten material were released into containment.)
• The molten material attacked the concrete and was further oxidized by water that was injected into the reactor starting at about +15 hours.

MELCOR simulations predict that about 900 kg of hydrogen was generated in Unit 1. Production of hydrogen likely started 12-15 hours before the explosion in the unit. The hydrogen and fission product aerosols (particularly iodine and cesium) probably leaked into the reactor building over a similar period of time. Sandia (Gauntt et al., 2012b) proposed that the extended period of high pressure within the containment caused stretching of the bolts fastening the containment head, opening a gap and allowing gas and fission products to flow directly from the containment into the reactor building. TEPCO (2012b, p. 340) suggests a number of potential leakage pathways in addition to the containment head seal, including equipment and personnel access hatches, and/or electrical cable penetrations; or through the standby gas treatment system when the containment was deliberately vented.⁶⁰

The hydrogen explosion in Unit 1 occurred at 15:36 on March 12. The steel siding covering the upper portion of the building (above the refueling floor) was blown off (see Figure 4.5A); five workers were injured and preparations for connecting water injection and power were disrupted. The ignition source for the hydrogen explosion is unknown but could have been a hot surface, an electric arc from damaged electrical wiring, or a spark from exposed contacts on a motor.⁶¹

The explosion was quite disturbing to the plant personnel, who did not initially understand what had happened. Once they recognized that a hydrogen explosion had occurred and realized (Investigation Committee, 2011, pp. 244-247) that explosions could occur in the other units, they began to fear more explosions could take place. Methods were considered for venting the reactor buildings such as removing blowout panels. However, it was not feasible to send personnel into the buildings to remove the panels because of high radiation levels and explosion hazards. Plant personnel considered using a water jet to cut holes in the building, but this type of complex operation was not feasible under the working conditions at the plant.

Videos of the explosions were captured on a camera set up by a local television station and replayed over the Internet and evening news. This contributed substantially to the public's anxiety, particularly in Japan. The videos were, however, useful to the site superintendent and the staff in determining what had happened to the unit.

Simulations similar to those carried out for Unit 1 have been performed for Units 2 and 3. They are not described in detail here in the interests of brevity.

As noted previously, there was no hydrogen explosion in Unit 2. The reasons for this are unclear. Based on the amount of time that the core was uncovered and the estimated hydrogen generation rates, a substantial amount of hydrogen is likely to have been generated. The containment pressure in Unit 2 reached the extreme values (0.75 MPa) between +80 and +90 hours after the reactor core isolation cooling system stopped (at +70 hours) and seawater injection was initiated. This pressure is similar to that reached in Unit 1, and so similar venting of hydrogen from the containment to the reactor building might have occurred.

There is speculation (Investigation Committee, 2012, p. 70; TEPCO, 2012b, p. 342) that a hydrogen explosion was prevented in Unit 2 because a building panel was blown out⁶² from the upper level, just above the refueling deck. The presence of an opening in the building may have created a pathway for hydrogen to flow outside the building, thereby preventing a buildup of an explosive atmosphere. Although plausible, this scenario needs more careful analysis to understand the effectiveness of this vent. Further information about hydrogen generation and transport will likely be obtained as the Unit 2 reactor is dismantled and studied.

The vent effectiveness will depend on the location, rate, and duration of the gas release from the containment, the hydrogen content, and the gas motion within the upper volume of the reactor building. It is unclear if the panel opening (approximately 4.3 × 6 m; see Investigation Committee, 2012, p. 70) would be effective in preventing a flammable atmosphere from being formed. The panel was near the refueling floor, and a substantial portion of the fifth-floor volume was above the upper edge of the opening.

There may be other reasons that an explosion did not occur in Unit 2: for example, insufficient hydrogen may have been generated and released within the Unit 2 reactor building. Alternatively, there may have been a special set of circumstances that resulted in an inert atmosphere or the lack of an ignition source.

The hydrogen explosion in Unit 3 occurred at 11:01 on March 14. It destroyed the upper portion of the reactor building (floors 3 and 4 were heavily damaged and floor 5 was demolished; see Figure 4.5B,C) and injured 11 workers. As noted previously in the chapter (see Section 4.3.2), the debris from this explosion damaged equipment and spread radioactive debris. It also forced field workers to retreat to the onsite ERC, further delaying the accident response.

The hydrogen explosion in Unit 4 (see Figure 4.5D,E) caused much concern at the time of the accident because the reactor did not contain any fuel; it had been offloaded to the spent fuel pool in the reactor building. There was initial concern that spent fuel in the pool had become uncovered and had reacted with the steam to form hydrogen.⁶³This would have likely resulted in large uncontained fission product releases.

In fact, it now appears that the hydrogen in Unit 4 reactor building came from Unit 3, through an unexpected path. There was substantial destruction on the fourth and fifth floors of Unit 4. The pattern suggests that the hydrogen reached the building by flowing back through the ventilation system for the standby gas treatment system.

4.3.6. Spent Fuel Pools

As noted in Chapter 1, the committee has deferred its analysis of spent fuel safety and security to a subsequent report. Consequently, this section provides only a brief discussion of events in the spent fuel pools at the Fukushima Daiichi plant.

A large amount of spent fuel was in storage in pools in the Unit 1-6 reactor buildings at the time of the earthquake and tsunami (Table 4.3). The September 2011 supplemental report by the Japanese government to the International Atomic Energy Agency (Government of Japan, 2011a) concluded that it is a highly likely that spent fuel was not exposed to air in the Unit 1-3 spent fuel pools and that mass damage did not occur in the Unit 4 pool.⁶⁴ Power was restored to the Unit 5 and Unit 6 pools and the common spent fuel pool before their temperatures increased significantly.

TABLE 4.3

Spent Fuel Storage at the Fukushima Daiichi Nuclear Plant on March 11, 2011.

Investigations of the Unit 1-4 spent fuel pools have to date uncovered no evidence to contradict the Japanese Government's initial conclusions. Efforts are now under way by TEPCO to move spent fuel from the Unit 4 pool into the common pool.

Nevertheless, the events at the Fukushima Daiichi plant highlight concerns about the vulnerability of spent fuel pools to severe accidents. These pools are located outside plant containment; consequently, accidents involving loaded spent fuel pools have the potential to produce substantial radioactive material releases.

4.4.1. Loss of Power

The Fukushima Daiichi accident significantly exceeded the beyond-design-basis events that TEPCO postulated and resulted in different conditions than those assumed when accident management strategies were developed (TEPCO, 2012b, p. 51). Neither the plant's engineered systems nor severe accident management procedures were sufficient to handle the situation; in fact, a majority of the “preplanned” response options as embodied in the TEPCO accident management procedures were not applicable to the situations that the plant's operators confronted.

For example, procedures to cool the reactors using various installed emergency core cooling systems (e.g., isolation condenser system, reactor core isolation cooling system, high-pressure coolant injection system) were specified in accident management procedures. Other means of emergency cooling via control-rod-drive hydraulic pressure systems, makeup water condensate system, and the fire protection system were also identified options in these procedures. However, once power was lost, all of the motor-operated systems became inoperable.

Provisions were in place in the plant's accident management procedures to handle loss-of-power incidents. These included multiple emergency diesel generators in each unit to cope with loss of offsite power. In addition, plans were in place to allow high- and low-voltage AC power supply to be fed from adjacent units. This was intended to cope with delays in AC power restoration or unavailability of DC power at one of the units. In spite of these provisions, AC and DC power could not be restored to some plant units for several days.

Loss of AC and DC power also had unanticipated systems effects. The best example is the isolation condenser system and its complex interlocks described in Section 4.3.1.1. In fact, nuclear plants have numerous systems containing complex interlock and failsafe logic that are not readily apparent from user interfaces. It can be a challenge to anticipate the effects of power losses on such systems. Experience in the aviation industry has led to development of principles and guidelines for how to design automated systems so that their behavior can be more readily anticipated (e.g., Norman, 1990; Sarter et al., 1997). This experience base can be leveraged in design of next-generation nuclear plant control rooms, as well as control room upgrades to existing plants, to enable operators to maintain better situational awareness of the status of automated systems and how systems are likely to be affected by events such as loss of power. The nuclear industry's FLEX initiative (NEI, 2012) and the USNRC's station blackout order (USNRC, 2012b) are intended to address potential systems effects in current-generation nuclear plants. (The FLEX initiative and USNRC actions are discussed in Chapter 5 and Appendix F.)

4.4.2. Resources, Procedures, and Training

The majority of the “preplanned” response options embodied in the TEPCO accident management procedures were not applicable to the situations that operating staff confronted following the earthquake and tsunami. Although operators underwent extensive training, that training did not cover the accident scenarios that unfolded at the plant following the March 11 tsunami. For example, although there were procedures and training for venting, these procedures assumed that power would be available to operate the venting valves from the control room. Procedures and training also assumed that plant indicators would be available in the control room. Onsite ERC staff training assumed that the safety display parameter system and communication lines with control rooms would provide good situational awareness of plant state and operator actions.

Operators could not take critical control actions from the control room; instead, they had to take manual actions in the field. Radiation releases in the plant and limited access to personnel dosimeters⁶⁵ hampered the ability of personnel to perform their duties, both in the control room (see Section 4.2) and in the field. Some field activities required multiple teams because of difficult onsite conditions. Flooding, debris, and other hazards caused by the tsunami challenged the field response; hydrogen explosions further set back response activities. The operators encountered situations that went well beyond their training for responding to off-normal conditions.

Unit operators and the onsite ERC staff had to fall back on “first principles” reasoning and problem solving to respond to the rapidly unfolding events at the plant.⁶⁶ This required active diagnosis and tracking of plant conditions, goal identification and prioritization, adaptive problem solving, and development and rehearsal of ad hoc response plans. Plant personnel displayed creativity in responding to the accident. For example, plant operators

• Restored some control room lighting, instrumentation, and control systems using batteries from employee automobiles and portable generators from contractor warehouses;
• Used fire engines to inject cooling water into the reactor, an option not specified in accident management procedures;
• Injected seawater into the reactors when freshwater supplies became unavailable; and
• Developed and implemented a plan to vent containment without power.

Some of these response actions are similar to the accident response actions required under Section B.5.b of the Order for Interim Safeguards and Security Compensatory Measures (described in Chapter 2). These include the use of fire engines for water injection and batteries to restore water-level gauges and operate steam safety relief valves (TEPCO, 2012b, p. 54). However, TEPCO (2012b, p. 54) notes that B.5.b information was not available to private electrical utilities in Japan.⁶⁷

Accidents frequently involve a confluence of interacting faults resulting in situations that have not been previously anticipated, placing a premium on the ingenuity and adaptability of plant personnel. In the committee's judgment, the personnel at the Fukushima Daiichi nuclear plant showed courage and resilience in responding to the March 11, 2011, accident under extraordinarily difficult conditions. Their actions potentially prevented even more severe outcomes at the plant.

The response of operators at the Fukushima Daini plant to the earthquake and tsunami (Sidebar 4.2) demonstrate the successful application of accident management/emergency operating procedures and operator training to extreme accident scenarios. The response at Fukushima Daini was a huge success story in its own right (albeit because some power sources survived the tsunami). However, this success was overshadowed by events at the Fukushima Daiichi plant.

SIDEBAR 4.2

Accident Response at Fukushima Daini. TEPCO's Fukushima Daini nuclear plant (see Chapter 3) sustained severe damage from the March 11, 2011, earthquake and tsunami. However, operators were able to bring the plant's four reactors to cold shutdown by the (more...)

In discussing the difficulties experienced at Fukushima Daiichi, the Investigation Committee (2011, p. 141) noted:

[T]hey did not assume that a situation in which multiple nuclear reactors losing all power sources almost simultaneously would occur and thus did not provide the training and education necessary to implement measures to control such a serious situation.

Koichio Kitazawa (Chairman of the Rebuild Japan Foundation Investigation Commission; see RJIF, 2014) put it more succinctly (NPR interview, March 9, 2012): “You can't adequately prepare for a disaster that you don't admit can ever happen.”

4.4.3. Multiunit Interactions

The colocation and close spacing of Units 1-4 and the extensive sitewide impacts from the tsunami and earthquake also hindered the accident response. In particular, harbor-side tsunami damage, earthquake damage to cisterns and water-supply piping, displacement of road surfaces, landslides, and blockage of roads and building access by debris are examples of damage common to Units 1-4 at the site. This damage impeded efforts to establish alternative cooling water, power, and compressed air sources.

Control rooms at the Fukushima Daiichi plant are shared between pairs of reactor units (see Appendix D). The ventilation systems in Units 1 and 2 and 3 and 4 are also paired together. This pairing apparently allowed hydrogen generated in the damaged Unit 3 reactor to flow into the Unit 4 reactor building. Hydrogen explosions in the Unit 1, 3, and 4 buildings scattered debris and caused substantial ground contamination around the buildings, damaged temporary installations for water injection and electric power, and injured workers. The hydrogen explosions in the Unit 3 and Unit 4 buildings also affected the management of the accident at all units because personnel at the site were reduced to a bare minimum for a time and recovery operations at the reactor units were halted.

The units also competed for physical resources and attention and/or services of the onsite ERC staff. Some of these resource competitions were described previously in the chapter: the competition for fire trucks to pump water into the Unit 1-3 reactors and the limited space in a valve backwash pit to siphon water. These limitations made it impossible to supply seawater to both Unit 3 and Unit 2 simultaneously.

Interviews with onsite ERC staff as reported by the Investigation Committee (2011) suggest that at different points in time, the onsite ERC focused attention on one unit at the possible expense of others. For example, the delay in recognizing that the isolation condenser was shut in Unit 1 was partly explained by the fact that ERC was initially focused on Unit 2 because it could not confirm that its reactor cooling isolation system was functioning.

In contrast, colocation had great value for the accident response at Units 5 and 6 at the Fukushima Daiichi plant and at the Fukushima Daini plant despite the sitewide earthquake and tsunami damage. Colocation enabled power to be cross-connected between units and also enabled mutual aid for the timely recovery of cooling and reactor pressure vessel depressurization, thereby preventing reactor damage.

4.4.4. Communications

Failures to transmit information and instructions in an accurate and timely manner played an important role in shaping actions at certain points during the accident response. These include the inability of operators to get appropriate attention and clear instructions from the onsite ERC. Lack of cooperation between operators and contractors' “partner companies” was also a challenge. The overwhelming nature of the accident and the lack of training to cope with its many challenges may have played key roles in these communication and coordination failures.

The earthquake and tsunami damaged physical communications (voice and data transmission) systems and hampered travel on the site. As noted previously, the failure of instrumentation within the control rooms and lack of operational safety parameter display systems required that data be relayed verbally over a single telephone line between the control rooms and onsite ERC. Data had to be written on whiteboards in the ERC and reported by video or telephone conference to Tokyo. Radios and cell phones had limited functionality in many parts of the site, requiring plant personnel to traverse the debris-strewn site to report findings, coordinate activities with unit operators, and obtain instructions from the onsite ERC.

As the accident progressed the site became progressively contaminated due to the spread of radioactive materials. This further hampered communications, particularly when site personnel were temporarily evacuated following the hydrogen explosion in Unit 3. These same factors also made it difficult for site personnel to communicate with the outside world, including with their families. (A notable aspect of the accident was the fact that the plant personnel remained onsite and worked diligently without news about their families.)

Some notable examples of communication failures were mentioned previously in this chapter:

• Miscommunications about operations of valves and status of the isolation condenser in Unit 1;
• Miscommunications about the need for batteries to operate the safety relief valves in Unit 1;
• Lack of coordination between shift team and firefighters because neither understood the responsibility given to them by the site superintendent for hooking up the fire truck pump to the Unit 1 fire protection system;
• Incorrect battery types (2V instead of 12V) were supplied to depressurize the safety relief valves in Unit 2; plant personnel had to scavenge their automobile batteries instead;
• Portable generators were delivered with incorrect voltage and connectors;
• Miscommunications about why the high-pressure coolant injection system was halted in Unit 3 and the need for an alternative water injection supply; and
• Breakdown in communications among the shift teams, onsite ERC, offsite ERC, NISA, and the prime minister's office about the situation inside and outside of the plant.

4.4.5. ERC Roles and Responsibilities

The lack of clarity about roles and responsibility within the onsite ERC as well as between the onsite ERC and the headquarters ERC in Tokyo proved to be a source of distraction for members of the onsite ERC and may have contributed to response delays. TEPCO personnel, in their presentations to this committee, indicated that there was confusion in the chain-of-command structure due to the complexity and multiunit nature of the accident. In particular, the organizational structure within the onsite ERC (which defined 12 function teams) was effective for situations that were explicitly covered by the accident management procedures, but they proved to be inadequate for the performance of tasks that fell outside the procedures. In particular, defining roles and responsibilities for tasks that were not covered by the procedures (e.g., water injection using fire engines) proved challenging and resulted in substantial response delays.

4.4.6. Staffing Plan

A presentation from TEPCO (Kawano, 2012) and discussions with TEPCO personnel during the committee's November 2012 meeting in Tokyo indicate that staffing levels were inadequate for managing the accident (see also TEPCO, 2012b, pp. 472, 474). TEPCO had not anticipated accident scenarios where multiple units were impacted simultaneously. The staffing plan assumed that operators from one unit could cover for another unit. Consequently, the plan did not cover accidents that involved multiple units.

The staffing plan also did not anticipate accident situations that extended over multiple days. TEPCO indicated to the committee that there were no handoffs during the initial days of the Fukushima accident: The first shift was present for the next three shifts, and the shift manager was present for 2-3 days straight during the accident. TEPCO recognized that this situation was not sustainable.

TEPCO also indicated to the committee that one of the lessons learned was the need to provide additional shifts and shift handovers in a prolonged emergency. TEPCO's plan for the future is to have two shifts in the ERC. They also plan to increase shift team staffing because there were so many things that needed to happen quickly. TEPCO noted to the committee that had the accident occurred at night or on a weekend, the response could have been worse because fewer people would have been present onsite. TEPCO indicated that it plans to increase the number of operators in the night shift from six to eight.

TEPCO also indicated to the committee (Kawano, 2012) that it is taking measures to strengthen the organizational structure for handling simultaneous and compound accidents at multiple units. This includes increasing the number of technical support personnel at the onsite ERC and establishing two technical support rooms in the headquarters ERC to handle the simultaneous occurrence of a nuclear accident and a natural disaster. In a presentation to the committee at its November 2012 meeting in Tokyo, TEPCO General Manager Mr. Arika Kawano specifically noted that TEPCO would

• Designate personnel responsible for individual units to the operation support team and restoration team in the Emergency Response Organization;
• Enhance the night duty structure to strengthen the functions of collecting plant information and external communications immediately after a disaster strikes; and
• Have personnel on standby at each plant 24 hours a day to quickly restore emergency power or inject cooling water.