Lessons Learned from the Fukushima Dai-ichi Accident
and Responses in NRA Regulatory Requirements

Toyoshi Fuketa
Nuclear Regulation Authority
P1-5, Plenary Session I
Water Reactor Fuel Performance MeetingSendai International Center
Sendai, Miyagi, Japan
September 15, 2014

1NRAIntroduction

TEPCO’s Fukushima Dai-ich accident revealed theweakness of the foregone regulatory requirements, e.g.
Insufficient design provisions against tsunami,
Unpractical management measures under severe
accident conditions, andInsufficient provision for accidents far-exceeding thepostulated design conditions.
We re-realized the importance of the Defense in Depth (DiD)
approach in design and preparations of countermeasuresagainst beyond design basis accidents (b-DBAs).
We learned from the accident that we must evaluate inadvance the potential and consequences of a wide spectrumof internal and external initiators.

2NRAThis presentation covers;

1. Prevention of Structures, Systems and Components(SSCs) failures
2. Measures to Prevent Common Cause Failures (CCFs)
3. Prevention of Core Damage
4. Mitigation of Severe Accident
5. Emergency Preparedness
6. Continuous Improvement of Safety
7. Use of Probabilistic Risk Assessment (PRA)
8. Post-accident Regulation on Fukushima Dai-ichi

NRA

1. Prevention of SSCs failures
Lessons (1/2)
The Fukushima Dai-ichi accident revealed vulnerabilityof SSCs against extreme loads and conditions causedby some specific internal/external initiators.
The past nuclear regulation in Japan, of course, defined
design requirements but it focused on provision for
random failures of SSCs and aseismatic design.
Although all the initiators were conceptually required tobe considered in plant design, most of external hazards,except earthquakes, had not been coped with enough toaddress their respective risks.

3

NRA

1. Prevention of SSCs failures
Lessons (2/2)
In particular for tsunami, its design-basis heights had
been postulated based on the historical records, which
covered only 400 years. There was no countermeasureagainst tsunami with a recurrence period of 1,000 years
or more.
These facts underscore the need to revisit the regulatory
requirements for a wide spectrum of external hazards.

4

NRA

1. Prevention of SSCs failures
Responses (1/4)
The Nuclear Regulation Authority (NRA), accordingly,enhanced design requirements significantly.
Due considerations are required for all the significant
internal and external initiators.
The new requirements include; (i) identification of potential
hazards, (ii) design against hazards exceeding theirrespective thresholds for screening, (iii) definition of designbasis hazard (DBH), (iv) design to cope with the DBH withsafety margin, and (v) evaluation of adequacy of safety
design.

5NRA

1. Prevention of SSCs failures
Responses (2/4)
Re-evaluation of external hazards is also requested,particularly for natural phenomena, based not only on
historical records but also on expert judgment to coververy rare events.
As for earthquakes, more stringent criteria are prepared
for active faults, more precise methods are provided fordesign-basis ground motions, etc.
As for tsunami, design-basis tsunami which exceeds thehighest historical record is postulated, andcountermeasures such as coastal levee and watertightdoors are required.

6NRA

1. Prevention of SSCs failures
Responses (3/4)
The NRA develops specific requirements regarding fireand flooding, and includes requirements ofcountermeasures for extremely aggravated situations,e.g., intentional airplane crash.
While many new requirements were developed against
both internal and external initiators, the graded approach
was applied to determine the necessity of such specificdesign provision based on their respective risks.

7

NRA

1. Prevention of SSCs failures
Responses (4/4)
The new requirements aim at “function-based” approach
to allow flexibility in choosing acceptable measures.
However, based on recognition that adequate
requirements had not been made for fire protection,
specific requirements for physical separation of safetyrelated systems, fire hazard analysis, etc. are introduced
considering current international practices. The NRA, ofcourse, continues the development and application of fire
PRA including data accumulation towards risk-informedregulations.

8NRA

2. Measures to Prevent CCFs
Lessons (1/2)

9

In the accident, emergency diesel generators (EDGs) andstation butteries lost their functions simultaneously due to thetsunami since they were located on the floors at similarelevations. This fact highlights the necessity of enhanced
physical separation for safety-related SSCs.
Although all the water-cooled EDGs were lost by tsunami
directly or indirectly, one air-cooled EDG survived andsupplied power to both Units 5 and 6 because it was locatedat a higher elevation. The turbine-driven RCIC (reactor coreisolation cooling) system worked under the station blackout(SBO) conditions at Units 2 and 3, and delayed accident
progressions. These imply the importance of “Diversity” ofsystems.

NRA2. Measures to Prevent CCFs
Lessons (2/2)

10Loss of station batteries resulted in loss of control room
functions including instrumentation and communication,
closure of isolation valves in isolation condenser at Unit 1,
unavailability of reactor depressurization, loss of control ofRCIC and HPCI (high pressure coolant injection) systems,
inoperability of containment venting, etc. These underline theneed to prepare alternative DC power sources.
Electrical power system is essential to actuate and control thesafety-related systems including the control room and its loss
might lead to common cause failures (CCFs) of safety-relatedsystems. Accordingly, the diversity of electric power systems
should be improved to secure the plant safety.

NRA

2. Measures to Prevent CCFs
Responses (1/2)

11

The new requirements extend design-basis events andstrengthen protective measures against natural
phenomena and other initiators which may lead to CCFs.
They put a particular importance in due consideration toensure diversity and independence (shift of emphasis
from “redundancy centered”).
Diversity of operating mechanisms, e.g., diesel and gas
turbine generators, motor-driven and diesel-driven pumps,
is important as well as physical separation.

NRA

2. Measures to Prevent CCFs
Responses (2/2)

12Safety-related system trains shall be• located at different elevations and/or different areas,• compartmentalized by installing bulkhead, or• distanced enough from each other.
Mobile equipment shall be• stored in different locations, which are not easily
affected by external initiators including intentional
aircraft crash, and• easily and surely connectable to the target system by
preparing spatially-dispersed multiple connecting ports.

NRA3. Prevention of Core Damage
Lessons (1/2)

13Before the accident there was no provision against prolonged
SBO and prolonged loss of ultimate heat sink (LUHS).
The duration of loss of offsite power, 30 minutes, wasassumed based on the operating experience in Japan, whichshowed high reliability and short-term restoration of offsite
power and high reliability of EDGs. As well, theinterconnection of safety busbars between units wasincorporated into accident management (AM) procedures on
an industry’s voluntary basis.
For the ultimate heat sink, the hardened venting system
together with alternative water injection was prepared as oneof the voluntary based AM measures.

NRA

3. Prevention of Core Damage
Lessons (2/2)

14

As a result, SBO and LUHS were regarded as highly unlikely
scenarios, leading to lack of further studies on thesescenarios.
Although the regulation had applied the single failure criterion
to the safety analysis of design-basis accidents over years,
the Fukushima Dai-ichi accident suggested that multiple
failures due to specific initiators should be considered more
seriously in the licensing bases and/or safety cases.
The regulation should specify the requirements on AM
measures as a licensing basis, and licensees should prepare
the sophisticated AM measures and procedures inconsideration of multiple failures.

NRA

3. Prevention of Core Damage
Responses
In the new requirements by the NRA, the definitions ofsome DBAs are changed. Design provision is now
required against prolonged SBO and LUHS.
Also required is provision against some b-DBAs
involving multiple failures, including anticipated transient
without scram (ATWS), loss of core cooling, and loss ofreactor depressurization.
The new regulation requires licensees to validate theeffectiveness of countermeasures against b-DBAs.

15NRA

4. Mitigation of Severe Accident
Lessons (1/2)

16

In 1990s, a series of AM measures were prepared atnuclear power plants (NPPs) in Japan on an industry’s
voluntary basis to improve the plant safety, referring theresults of individual plant examinations (IPEs).
However, these AM measures mainly focused on theprevention of core damage, and a few mitigation measures,such as molten core cooling, had been implemented.
In the Fukushima Dai-ichi accident, many attempts toactivate the AM measures were unsuccessful due to theaggravated plant conditions, such as loss of power, loss ofcontrol air, aftershocks, and high radiation.

NRA

4. Mitigation of Severe Accident
Lessons (2/2)

17

The Fukushima Dai-ichi accident brought to light thenecessity of implementing AM measures for mitigating
severe accident and radiological consequences as well as
those for preventing core damage.
Considering the extremely severe natural phenomena andterrorisms, flexibility should be incorporated into thedesign and implementation of AM measures. In addition,
plant personnel should be well trained so that they could
execute the AM procedures under the aggravatedconditions in a timely manner.

NRA

4. Mitigation of Severe Accident
Responses
The new regulation requires licensees to design andimplement AM measures for mitigating severe accidentconditions.
The feasibility and effectiveness of AM measures arestrictly examined in licensing processes.
Containment cooling/depressurization system, e.g.,filtered venting system, shall be installed to prevent thecontainment failure due to over-pressurization and tominimize the radioactive consequences.

18

NRA

5. Emergency Preparedness
Lessons

19

The guidelines for emergency preparedness existed before
the Fukushima Dai-ichi accident primarily and excessively
relied on code predictions on source terms and radionuclide
diffusion. This was far different from international practices,and SBO in Fukushima Dai-ichi accident paralyzed thecomputational tools for estimating the source terms.
Accordingly, diffusion simulations were made only based on
hypothetical source terms and regarded unpractical.
It is naturally recognized that source term prediction during
severe accident is unrealistic and non-enforceable.
It is risky and improper to prepare protection relying heavily
on simulations and/or multiple judgments.

NRA

5. Emergency Preparedness
Responses
Projected dose and dose that has been received are notmeasurable quantities and cannot be used as a basis forquick actions in an emergency. The new guidelines by
the NRA accordingly introduce operational criteria(values of measurable default quantities or observables,such as the emergency action level, EAL, and theoperational intervention level, OIL) as a surrogate for thegeneric criteria for undertaking different protective
actions and other response actions.
The new guidelines also define requirements on roles
and functions of off-site emergency response centers,
execution of nuclear emergency drills, etc.

20

NRA

6. Continuous Improvement of Safety
Lessons
Before the Fukushima Dai-ichi accident, licensees hadre-evaluated tsunami height and some of them reinforced
the protection against tsunami. As a result, some NPPs
could be brought into a safe shutdown although they
were hit by very high tsunami. This shows theimportance of “Continuous Improvement”.
On the other hand, the regulatory requirements on
tsunami were not reviewed over years before theFukushima Dai-ichi accident. This implies lack ofcontinuous improvement in regulation.

21

NRA

6. Continuous Improvement of Safety
Responses (1/2)

22

The amended “Reactor Regulation Act” stipulates
licensees’ responsibility for “safety improvement” andrequires licensees to conduct “self-assessment for safetyimprovement” periodically.
This framework strongly encourages licensees’ initiatives
towards continuous improvement of safety by requesting
licensees to prepare the final safety analysis report which
provides “as-built” or “as-is” plant description and to update
it when major design modifications or procedural changes
take place.

NRA

6. Continuous Improvement of Safety
Responses (2/2)
Licensees are also requested to carry out the periodic
safety review (PSR) to incorporate the state-of-the-art
knowledge into the plant design, operation andmaintenance activities.
In addition, it is required to conduct level 1 and 2 PRAs
periodically for both internal and external initiators
including hazard re-evaluation to demonstrate theeffectiveness of the plant modifications.

23NRA

7. Use of PRA
Lessons

24

The importance of PRA is dependent on initiators.
The priority should be determined according to risk profile(a relative importance of the initiator).
Since natural hazards were thought to be dominant
initiators even before the accident, the IPEEE (individualplant examination for external events) should have had arelatively higher priority in Japan. However, PRA
technologies for external initiators had not been developedor improved in Japan where they were most needed.
Although PRAs for external initiators have relatively large
uncertainties, implementing those PRAs can provide
important technical insights regarding, e.g., relative
importance of SSCs.

NRA

7. Use of PRA
Responses (1/2)
The NRA recognizes that the PRA methodology is very
useful and applicable to develop and propose effective
and efficient protection against the specific initiators.
The NRA promotes utilization of PRA recognizing its
usefulness and limitations.
In the new regulatory framework, licensees arerequested to conduct the plant-specific level 1 and 2PRAs for both internal and external initiators.

25

NRA

7. Use of PRA
Responses (2/2)
Using the plant-specific PRA, licensees shall identify thesevere accident scenarios and classify them into several
groups. Also, licensees shall check the adequacy andsufficiency of AM measures by conducting accident
analysis for the severest scenario in each group.
Licensees shall analyze all the “generic severe accident
sequence groups” and “generic containment failuremodes” that were defined by the NRA regardless of theresults from the plant-specific PRAs.

26

NRA

8. Post-accident Regulation
on Fukushima Dai-ichi

27

The NRA designated the Fukushima Dai-ichi as “Disasterexperienced Nuclear Power Plant” on November 7, 2012.
In order to keep reducing the existing risk in the Fukushima
Dai-ichi, the NRA should regulate and promote thedecommissioning processes at the same time.
The important challenge is to maintain harmonization
between the implementation and acceleration of thedecommissioning and the protection of people and theenvironment during the processes.
The NRA considers that a risk of water leakage fromunderground trenches connected to the reactor turbine
buildings on the seaward side is significant.

Closing Remarks (1/2)
NRA

In the light of the Fukushima Dai-ichi accident, the NRAdeveloped the new design requirements and establishedthe new regulatory framework to ensure the NPP safety.
The new requirements aim at primarily;
extending the definition of DBAs by including multiple
failures such as prolonged SBO and LUHS,
enhancing preventions against CCFs, in particular thosedue to external hazards, by strengthening thediversity/independence,enhancing protection against core damage by preparingalternative measures with use of mobile equipment, andenhancing mitigation of severe accidents to eliminate alarge radioactive release from the containment and tominimize the radioactive consequences by mobile andimmobile equipment.

28

Closing Remarks (2/2)

29

NRA

The new regulatory framework encourages licensees’
initiatives towards continuous improvement of safety andrequests licensees to:
conduct “self-assessment for safety improvement”
periodically,
prepare and update the final safety analysis report which
provides “as-built” or “as-is” plant description, andcarry out PSR and plant-specific level 1 and 2 PRAs forboth internal and external initiators to demonstrate theeffectiveness of the plant modifications.
The NRA continues to address the lessons learned from theFukushima Dai-ichi accident, keeps updating regulatory
requirements where appropriate, and never becomescomplacent.

With thanks toKiyoharu Abe
Tomoho Yamada
Hiroshi Yamagata
NRA
Norio Watanabe
NSRC, JAEA