Lessons Learned from the Fukushima Dai-ichi Accident
and Responses in Regulatory Requirements
Toyoshi Fuketa
Nuclear Regulation Authority

The 23rd International Conference on Nuclear Engineering (ICONE-23)
Panel Session 2 “Nuclear Regulatory Standards in International Cooperation”
International Conference Hall, Makuhari Messe, Chiba, JapanMay 19, 2015

1NRA

Introduction

TEPCO’s Fukushima Dai-ichi accident revealed theweakness of the foregone regulatory requirements, e.g.
Insufficient design provisions against tsunami,
Unpractical management measures under severe
accident conditions, andInsufficient provision for accidents far-exceeding thepostulated design conditions.
We re-realized the importance of the Defense in Depth (DiD)
approach in design and preparations of countermeasuresagainst beyond design basis accidents (b-DBAs).
We learned from the accident that we must evaluate inadvance the potential and consequences of a wide spectrumof internal and external initiators, including earthquake,tsunami, volcanism, aircraft crash, fire, terrorist attack, etc.

2NRAThis presentation covers;

1. Prevention of Structures, Systems and Components(SSCs) failures
2. Measures to Prevent Common Cause Failures (CCFs)
3. Prevention of Core Damage
4. Mitigation of Severe Accident
5. Emergency Preparedness
6. Continuous Improvement of Safety
7. Use of Probabilistic Risk Assessment (PRA)NRA

1. Prevention of SSCs failures
Lessons
The Fukushima Dai-ichi accident revealed vulnerability ofSSCs against extreme loads and conditions caused bysome specific internal/external initiators.
The past nuclear regulation in Japan, of course, defined
design requirements but it focused on provision forrandom failures of SSCs and aseismatic design. Most ofexternal hazards, except earthquakes, had not been
coped with enough to address their respective risks.
These facts underscore the need to revisit the regulatory
requirements for a wide spectrum of external hazards.

3

NRA

1. Prevention of SSCs failures
Responses (1/3)

4

The Nuclear Regulation Authority (NRA), accordingly,
enhanced design requirements significantly.
Due considerations are required for all the significant
internal and external initiators.
Re-evaluation of external hazards is also requested,particularly for natural phenomena, based not only on
historical records but also on expert judgment to cover veryrare events.

NRA

1. Prevention of SSCs failures
Responses (2/3)
As for earthquakes, more stringent criteria are prepared
for active faults, more precise methods are provided fordesign-basis ground motions, etc.
As for tsunami, more comprehensive methods arerequired for defining design-basis tsunami, covering
possible earthquakes or other natural hazards, e.g.,landslides in the ocean bed, as causes of tsunami basedon national and international experiences, andcountermeasures such as coastal levee and watertightdoors are required.

5NRA

1. Prevention of SSCs failures
Responses (3/3)
The NRA develops specific requirements regarding fireand flooding, and includes requirements ofcountermeasures for extremely aggravated situations,e.g., intentional airplane crash.
While many new requirements were developed against
both internal and external initiators, the graded approach
was applied to determine the necessity of such specificdesign provision based on their respective risks.
The new requirements aim at “function-based” approach
to allow flexibility in choosing acceptable measures.

6NRA

2. Measures to Prevent CCFs
Lessons (1/2)

7

In the accident, emergency diesel generators (EDGs) andstation butteries lost their functions simultaneously due to thetsunami since they were located on the floors at similarelevations. This fact highlights the necessity of enhanced
physical separation for safety-related SSCs.
Although all the water-cooled EDGs were lost by tsunami
directly or indirectly, one air-cooled EDG survived andsupplied power to both Units 5 and 6 because it was locatedat a higher elevation. The turbine-driven RCIC (reactor coreisolation cooling) system worked under the station blackout(SBO) conditions at Units 2 and 3, and delayed accident
progressions. These imply the importance of “Diversity” ofsystems.

NRA

2. Measures to Prevent CCFs
Lessons (2/2)

8Loss of station batteries resulted in loss of control room
functions including instrumentation and communication,
closure of isolation valves in isolation condenser at Unit 1,
unavailability of reactor depressurization, loss of control ofRCIC and HPCI (high pressure coolant injection) systems,inoperability of containment venting, etc. These underline theneed to prepare alternative DC power sources.
Electrical power system is essential to actuate and control thesafety-related systems including the control room and its loss
might lead to common cause failures (CCFs) of safety-relatedsystems. Accordingly, the diversity of electric power systems
should be improved to secure the plant safety.

NRA

2. Measures to Prevent CCFs
Responses (1/2)

9The new requirements extend design-basis events andstrengthen protective measures against natural
phenomena and other initiators which may lead to CCFs.
They put a particular importance in due consideration toensure diversity and independence, i.e., shift of emphasis
from “redundancy centered”.
Diversity of operating mechanisms, e.g., diesel and gas
turbine generators, motor-driven and diesel-driven pumps,
is important as well as physical separation.

NRA

2. Measures to Prevent CCFs
Responses (2/2)

10

Safety-related system trains shall be• located at different elevations and/or different areas,• compartmentalized by installing bulkhead, or• distanced enough from each other.
Mobile equipment shall be• stored in different locations, which are not easily
affected by external initiators including intentional
aircraft crash, and• easily and surely connectable to the target system by
preparing spatially-dispersed multiple connecting ports.

NRA

3. Prevention of Core Damage
Lessons

11

Before the accident there was no provision against prolonged
SBO and prolonged loss of ultimate heat sink (LUHS).
Although the regulation had applied the single failure criterion
to the safety analysis of design-basis accidents over years,
the Fukushima Dai-ichi accident suggested that multiple
failures due to specific initiators should be considered more
seriously in the licensing bases and/or safety cases.
The regulation should specify the requirements on AM
measures as a licensing basis, and licensees should prepare
the sophisticated AM measures and procedures inconsideration of multiple failures.

NRA

3. Prevention of Core Damage
Responses
In the new requirements by the NRA, the definitions ofsome DBAs are changed. Design provision is now
required against prolonged SBO and LUHS.
Also required is provision against some b-DBAs
involving multiple failures, including anticipated transient
without scram (ATWS), loss of core cooling, and loss ofreactor depressurization.
The new regulation requires licensees to validate theeffectiveness of countermeasures against b-DBAs.

12

NRA

4. Mitigation of Severe Accident
Lessons

13

In the Fukushima Dai-ichi accident, many attempts toactivate the AM measures were unsuccessful due to theaggravated plant conditions, such as loss of power, loss ofcontrol air, aftershocks, and high radiation.
Considering the extremely severe natural phenomena andterrorisms, flexibility should be incorporated into the designand implementation of AM measures. In addition, plant
personnel should be well trained so that they could execute
the AM procedures under the aggravated conditions in atimely manner.

NRA

4. Mitigation of Severe Accident
Responses
The new regulation requires licensees to design andimplement AM measures for mitigating severe accidentconditions.
The feasibility and effectiveness of AM measures arestrictly examined in licensing processes.
Containment cooling/depressurization system, e.g.,filtered venting system, shall be installed to prevent thecontainment failure due to over-pressurization and tominimize the radioactive consequences.

14

NRA

5. Emergency Preparedness
Lessons

15

The guidelines for emergency preparedness existed before
the Fukushima Dai-ichi accident primarily and excessively
relied on code predictions on source terms and radionuclidediffusion. This was far different from international practices,and SBO in Fukushima Dai-ichi accident paralyzed thecomputational tools for estimating the source terms.
Accordingly, diffusion simulations were made only based on
hypothetical source terms and regarded unpractical.
It is naturally recognized that source term prediction during
severe accident is unrealistic and non-enforceable.
It is risky and improper to prepare protection relying heavily
on simulations and/or multiple judgments.

NRA

5. Emergency Preparedness
Responses
Projected dose and dose that has been received are notmeasurable quantities and cannot be used as a basis forquick actions in an emergency. The new guidelines by
the NRA accordingly introduce operational criteria(values of measurable default quantities or observables,such as the emergency action level, EAL, and theoperational intervention level, OIL) as a surrogate for thegeneric criteria for undertaking different protective
actions and other response actions.
The new guidelines also define requirements on roles
and functions of off-site emergency response centers,
execution of nuclear emergency drills, etc.

16

NRA

6. Continuous Improvement of Safety
Lessons
Before the Fukushima Dai-ichi accident, licensees had
re-evaluated tsunami height and some of them reinforced
the protection against tsunami. As a result, some NPPs
could be brought into a safe shutdown although they
were hit by very high tsunami. This shows theimportance of “Continuous Improvement”.
On the other hand, the regulatory requirements ontsunami were not reviewed over years before theFukushima Dai-ichi accident. This implies lack ofcontinuous improvement in regulation.

17

NRA

6. Continuous Improvement of Safety
Responses (1/2)

18

The amended “Reactor Regulation Act” stipulates
licensees’ responsibility for “safety improvement” andrequires licensees to conduct “self-assessment for safety
improvement” periodically.
This framework strongly encourages licensees’ initiatives
towards continuous improvement of safety by requesting
licensees to prepare the final safety analysis report which
provides “as-built” or “as-is” plant description and to update
it when major design modifications or procedural changes
take place.

NRA

6. Continuous Improvement of Safety
Responses (2/2)
Licensees are also requested to carry out the periodic
safety review (PSR) to incorporate the state-of-the-art
knowledge into the plant design, operation andmaintenance activities.
In addition, it is required to conduct level 1 and 2 PRAs
periodically for both internal and external initiators
including hazard re-evaluation to demonstrate theeffectiveness of the plant modifications.

19

NRA

7. Use of PRA
Lessons

20

The importance of PRA is dependent on initiators.
The priority should be determined according to risk profile,a relative importance of the initiator.
Since natural hazards were thought to be dominant
initiators even before the accident, the IPEEE (individual
plant examination for external events) should have had arelatively higher priority in Japan. However, PRA
technologies for external initiators had not been developed
or improved in Japan where they were most needed.
Although PRAs for external initiators have relatively large
uncertainties, implementing those PRAs can provide
important technical insights regarding, e.g., relative
importance of SSCs.

NRA

7. Use of PRA
Responses (1/2)
The NRA recognizes that the PRA methodology is very
useful and applicable to develop and propose effective
and efficient protection against the specific initiators.
The NRA promotes utilization of PRA recognizing its
usefulness and limitations.
In the new regulatory framework, licensees arerequested to conduct the plant-specific level 1 and 2
PRAs for both internal and external initiators.

21

NRA

7. Use of PRA
Responses (2/2)
Using the plant-specific PRA, licensees shall identify thesevere accident scenarios and classify them into severalgroups. Also, licensees shall check the adequacy andsufficiency of AM measures by conducting accident
analysis for the severest scenario in each group.
Licensees shall analyze all the “generic severe accident
sequence groups” and “generic containment failuremodes” that were defined by the NRA regardless of theresults from the plant-specific PRAs.

2223NRA

Closing Remarks

In the light of the Fukushima Dai-ichi accident, the NRAdeveloped the new design requirements and establishedthe new regulatory framework to ensure the nuclear power
plant safety.
The NRA continues to address the lessons learned fromthe Fukushima Dai-ichi accident, keeps updating
regulatory requirements where appropriate, and neverbecomes complacent.

With thanks toKiyoharu Abe
Masahiro Aoki
Tomoho Yamada
Hiroshi Yamagata
NRA
Norio Watanabe
NSRC, JAEA