E-Journal of Advanced Maintenance Vol.9-2 (2017) 112-117
Japan Society of Maintenology

Safety and Standardization Issues of Nuclear Power Plants in Design andOperation on ISO12100 of Safety Design Principle
Michitsugu Mori 1,*
1

Graduate School of Engineering, Hokkaido Universitykita13 Nishi8, Kita-ku, Sapporo, 060-8628 Japan

ABSTRACT
A huge tsunami induced by the earthquake which occurred on March 11, 2011 in the Pacific Ocean off the coast of the
Tohoku region in Japan led the TEPCO Fukushima Dai-ichi (Number-1) nuclear power station into the station blackout
due to a loss of all external power, and the units 1 to 3 (out of 6 units) have led to the core meltdown by losing all corecooling functions. On the other hand, three BWR units in operation at the Onagawa nuclear power station of Tohoku
Electric Power Company, which is located most closely to the epicenter, could keep safe from any serious damage despite
the fact that the tsunami run-up height had reached to 13.8m. The tough decision was made at the time when the nuclear
power plant at the Onagawa site was newly constructed with the land elevation of the ground height by 14.8m.
Considering such eventual sequences and as lessons learnt, discussions are made on what should be taken into account in
the design and construction, and the operation as the standard and regulation to reduce the risk on ISO12100 of the safety
design principle as the world’s global standard and the confidence-rebuilding measures for future nuclear power plants.
KEYWORDS
Nuclear Power, Safety, Severe Accident, Accident Management,
Standardization , Risk Assessment, ISO12100

ARTICLE INFORMATION
Article history:
Received 7 November 2016
Accepted 27 April 2017

1. Introduction
Huge tsunami following the Pacific Ocean earthquake off the coast of the Tohoku region (the East Japan
Great Earthquake) occurred on March 11, 2011, which led Tokyo Electric Power Company (TEPCO)
Fukushima Dai-ichi (Number-1) nuclear power plants fallen into a loss of all external power, and forced theunits 1 to 3 into the core meltdown due to the station black out by losing all of the reactor core cooling
functions except for the units 4 to 6 which were under the annual inspection. The unit 6 enabled to keep thereactor water level with water supply by the MUWC (make-up water system condensate) and led to the cold
shutdown by a later recovery of external power supply. The unit 5 was also led to cold shutdown by thepower interchanged from the unit 6.
TEPCO Fukushima Dai-ni (Number-2) nuclear power station had one single survived line out of all four
external power lines and the water-cooled DGs (Diesel Generators) were possible in operation at the unit 3
and 4. As a consequence, the reactor core isolation cooling system (RCIC) and MUWC through the accident
management (AM) measures worked as the alternative water injection system and the residual heat removal
system (RHR) by seawater-cooling, and then the all four units were successfully accomplished with the cold
shutdown[1-2].
Tohoku Electric Power Onagawa nuclear power station is the closest to the epicenter. Despite the tsunami
run-up height had reached to 13.8m, there is 14.8m land elevation of the ground height that was made with
tough decision at the time when newly constructed. Although the circulating seawater pump motors werepartially flooded, all of the units came to be cold shutdown because one of the five external power supply
lines could access to the electric power source and the water-cooled DGs of the units 1 to 3 were possible inoperation[3]. In addition, the Onagawa Nuclear Power Station accepted about 240 refugees in the
gymnasium of the Onagawa site from March 11th on the day of the earthquake. It should be known what
factors had made the difference from such serious results, and should be traced for the nuclear power plantson the Pacific Ocean earthquake off the coast of the Tohoku region.
ISO12100 of the safety design principle exhibits that the risk posed by the technology shall meet topreferentially perform the measures by technical design, and the accident prevention by the human*Corresponding author, E-mail: michitsugu.mori@eng.hokudai.ac.jp

ISSN-1883-9894/10 © 2010 – JSM and the authors. All rights reserved.

112

M. Mori / Safety and Standardization Issues of Nuclear Power Plants
in Design and Operation on ISO12100 of Safety Design Principle

management shall be expected as the decisive last resort, meanwhile refraining from performing until themeasures as much as possible to be considered by technology have been applied [4]. Hence, ISO12100
requires the inherently safe and fail-safe design measures for the design and production, and also requires thesafety protection by the system and training in the organization for the users. Further, ISO12100 requires theintroduction of the risk assessment that will make it possible to reduce the risk and provide the benefits
expected in manufacturers as well as in the users. Not a few countries currently operating nuclear power
plants are introducing the probabilistic risk assessment (PRA). However, there exists the different aspect in
the nuclear power from the industrial machinery. Even if the occurrence of failure or accident could show themuch lower probability, there needs the description on the residual risk for the neighboring residents and the
public in the irrecoverable nuclear accident.

2. Safety Concept Required for Nuclear Reactor Siting
The new Guidelines in the Nuclear Reactor Site Evaluation is outlined in “a. Principle Site Conditions”, “b.
Fundamental Goals”, and “c. Guidelines for Site Evaluation” (the conditions for achieving the Fundamental
Goals) by Nuclear Regulation Authority(NRA) of Japan. The each outline, a, b, c, contains the following
three guidelines respectively [5].
a. Principle Site Conditions
a-1. No event to trigger Serious Accidents in the past and in the future, and to expand disasters.
a-2. The reactors are sufficiently distant from the public in combination with their safeguarding facilities.
a-3. The reactor site including the peripheral is in the environment which can take appropriate measures withrespect to the public as required.
b. Fundamental Goals
b-1. Even if the occurrence of Serious Accidents is assumed in the worst case from the technical point of viewin consideration of possible events surrounding the site, the reactor characteristics, and the safeguarding
facilities (hereinafter referred to as "Serious Accidents"), the surrounding public never suffer the radiation
damage.
b-2. Moreover, even if the occurrence of accidents, which will exceed the Serious Accidents and cannot be
considered to take place from the technical viewpoint, is hypothetically assumed, (hereinafter referred toas "Hypothetical Accidents": in which some of safeguarding facilities, though they are expected to work
effectively while the Serious Accident, are assumed not to work with the hypothetical dissipation ofradioactive materials release equivalent to those in the Hypothetical Accident), the surrounding public
never suffer the significant radiation damage.
b-3. The impact on the collective dose is sufficiently small in the case of the Hypothetical Accident.
c. Guidelines for Site Evaluation (the conditions for achieving the Fundamental Goals)
c-1. Establishment of a non-residential area around the reactor up to a certain distance and assurance that noone will live within that area in principle.
c-2. Establishment of a low population zone outside of the non-residential area such that the target radiationdose at the periphery of this low population density zone.
c-3. Still further, the reactor site is separated by a specified distance from the high density population zone.
The Regulatory Guide for Reviewing Nuclear Reactor Siting Evaluation and Application Criteria before the
Fukushima accident also referred to the specified distance away from the nearby population. The safety
design assessment should be required to perform in the Serious Accident through which the dissipation of
released radioactive material is foreseeable under the worst scenario from a technological viewpoint, andalso in the Hypothetical Accident which exceeds the Serious Accident level of radioactive material release
though it could not consider to occur from the technological viewpoint. On the other hand, it was not
explicitly guided in the new Guidelines for Site Evaluation by NRA. The issues also could be pointed outthat the exposure limits was explicitly shown in the previous Guidelines for Site Evaluation [6], which are
missing in the new one.

3. Safety Design Concept for Nuclear Power Reactor
3. 1 Fail-safe and confirming the safety113

M. Mori / Safety and Standardization Issues of Nuclear Power Plants
in Design and Operation on ISO12100 of Safety Design Principle

Current reactors can reach the cold shutdown by “stop, cooling, and confining,” so that the safety is
maintained. However, the loss of total power by station blackout as occurred in the Fukushima accident shallimpel the reactor to get out of control and into the core melting without any counter measures of cooling, on
the process of which the protection system and reactor shutdown system are designed to work as the fail-safe,
but the reactor is eventually not the fail-safe design from the viewpoint to finally stop the reactor.
Shinkansen bullet trains can finally confirm the safety conditions by stopping as a last resort, discarding theirfunctions of running same as other industrial machineries. On the contrary, the nuclear reactor which keeps
generating the decay heat is unable to take such a way to confirm the conditions to be final safety by stopping
as a last resort, and current large-output light water reactors (LWR) are never to be the fail-safe design. If thenuclear power generation should be counted as the main energy source again in the future, it must be provided
with the intrinsically safer reactor than the current LWRs by fail-safe system, in which the safety and security
could be acceptable for the public and especially residents near the nuclear power stations. There doesn’t exist
the absolute safety even if the fail-safe system is taken, considering the fact that unexpectedly occurs beyond
the design basis. However, the possibility of realizing the safety is highly expected in the case that the fail-safe
systems are going on in the operating system [7].
3. 2 Issues on Concept of Nuclear Safety Regulation
After the Fukushima accident, the new nuclear regulations and standards in Japan have tightened to reduce therisks especially against the earthquake, tsunami, and the other natural disasters. Figure 1 shows the concept of
the authority and responsibility of NRA in the nuclear safety regulation performance[8]. NRA has thecommitment to lay down the regulations
and standards, and to perform theconformity assessment and inspection.
Assuming that the regulation level wastentatively at the point of b in Figure 1
before the Fukushima accident, the new
regulation level showed the reduced risk
level as the point of a in Figure 1 after the
Fukushima accident. However, the risk will
obviously be never to be zero as shown in
Figure 1. NRA performs the conformity
assessment whether the evaluated nuclear
power plant can clear the new regulations
and standards requiring the higher risk level
than that shown at the point of a, in which
there will be the remained risk lower thanFigure 1. The concept of nuclear safety regulation.
the point a. It should be considerably
significant that the accountability for theremaining risk is redeemed. The state ofzero risk can never be realized in real life
and therefore it should be considered if theremained risk could be acceptable.

Figure 2. Probability of death per year and Principle of
ALARP/ALARA

114

M. Mori / Safety and Standardization Issues of Nuclear Power Plants
in Design and Operation on ISO12100 of Safety Design Principle

Figure 2 represents the concept of
ALARP or ALARA and the fatal death
probability per year due to risk initiating
events. The acceptable risk is dependent
on the magnitude of the product of theprobability and damage, and the accident
that would cause the irretrievable serious
results becomes unacceptable even if the
product results have low probability. It isconsidered that the risk of the airplane
accident is acceptable with the trade-off
between the risk of the accident and thebenefit for people who use it though theprobability of an airplane crash accident
leading to fatal is three orders ofmagnitude larger than that of a nuclear
power plant.

Figure 3. Safety Countermeasures for Current LWR against
the new regulation after the Fukushima accident

Figure 3 shows the enhanced safety
counter-measures for existing LWRs, some of which would work and keep their functions in the station
blackout and enable to lead the nuclear reactor to cold shutdown. In these cases, the probability of the risk
leading to the severe accident with core meltdown and remaining at the level of the point a in Figure 1 would
be extremely small. It may be acceptable for the people who reside far away from nuclear power plant anddesire inexpensive electric power with stability supply by nuclear power plants. On the other hand, theFukushima residents would hardly accept such risk, especially for those who experienced the severe accident
and forced evacuation for long-term. .

4. Safety Concept in Industrial Machinery and Comparison with Nuclear Power Plant
4.1 Basic Concept of ISO12100
It is the world’s standard in the safety design of machinery by ISO12100 that the risks accompanying withthe machines should be reduced first by the design as much as possible. The safety must be confirmed toattain the certain safety level, but not allowed only by the image. As long as the risk can be foreseeable, thedesign must ensure the safety against the risk and it must not rely on users until all countermeasures bydesign be made. It is the last resort to expect the accident prevention by humans after applying all possible
technical measures.
4.2 Comparison in Safety Systems of Nuclear Power and Industrial Machinery
If the performance and function at the time when they were designed and manufactured are maintained, thesafety can be secured. However, the machine, which cannot be free from being deteriorated and worn, willbe always considered to go wrong in the safety consideration. At that time, if equipment and devices canmeet the fail-safe in the structure design, the structural maintenance can work to improve the availability
factor. On the contrary, in the case that equipment and devices will work worse not to be fail-safe when theirfailures occur, the safety secure will depend heavily on the maintenance to keep their integrity, and further,
the maintenance of quality is related to the safety [7] .
The safety concept of machinery such as Shinkansen takes the way to confirm the safety by stopping it atfirst as mentioned above, and then it is allowed to restart after removing the causes of troubles or accidents
and having ensured the safety operation. On the contrary, the nuclear power plant can intrinsically never takethe same way as Shinkansen’s because the nuclear power plant keeps on generating decay heat and has toabsolutely keep on operating to cool it without stopping. Shinkansen’s brakes are impelled to be free fromthe mechanical braking force by compressed air while running by electric power. Once the power to makethe mechanical brakes free is turned off or lost, the mechanical braking system stops the train. That is, even
if the loss of the entire power supply, Shinkansen can stop passively by the mechanical actuation. The
current large nuclear power plant can never take the same scenario in the station blackout.
4.3 Conflicting Direction of Required Fail-Safe in Accident and Normal Operation

115

M. Mori / Safety and Standardization Issues of Nuclear Power Plants
in Design and Operation on ISO12100 of Safety Design Principle

As shown in Figure 4, when theinternal pressure of the primarycontainment vessel (PCV) rises, thedriving pressure difference in thecylinder of the actuator is reduced
since the PCV internal pressure
becomes back pressure of the piston
in cylinder of the actuator against thenitrogen pressure sent from the N2tank outside of the PCV by adjusting
the regulator. The safety relief valve(SRV) to be closed is the fail-safe in
the normal operation, but the fail-safe
Figure 4. Pressure balance of PCV inside-pressure and supplied
required for the SRV in the severepressure of nitrogen in a main steam safety relief valve (SRV)
accident (SA) is to open in order toprevent the reactor pressure vessel(RPV) from over pressure and to apply the core injection cooling as described above. The isolation
condenser’s (IC’s) lines are directly connected to the primary pressure boundary of the BWR; therefore, theinlet and outlet valves of IC’s are required to usually close but must open in the case of emergency corecooling.
4.4 Idea of Elevating Safety Level
It is safety essential for the large facilities andplants that may cause the irretrievable disaster tokeep taking the preventive steps and maintenancebefore the accident occurs rather than to take thecorresponding recurrence prevention. Otherwise,
the much-excessive requirements should be
imposed on the maintenance to keep safe. The
critical interlock shown in Figure 5 [9] enables toprevent the machine from falling into thecatastrophic situation to cause disasters. If it canbe applied for the nuclear power plant, thenuclear reactor safety concept will be
convincing.

Temp. /Press.

(Core melting)
Critical Event
Critical Judgment

Effects of Doppler
and Void
Vent
Limit on Control
ECCS
Critical Point
Normal Operating
Condition
To stop for Safe Condition
Safe Condition

The nuclear power plant accident would bringTime

the disaster irretrievable to the inhabitant in the
Figure 5. Concept of the critical interlock
large area around the plant as once caused in
Fukushima. It must be deterministically controlled by initiating the critical interlock at the first stage of theaccident before it comes into the uncontrolled state. Hence, the probabilistic risk assessment (PRA) is usefulin considering the strategy of maintenance since the equipment and facilities in the plant can be classified
from the viewpoint of their magnitude to impact the initiation of serious accidents. However, especially forthe residents who were experienced with the nuclear disaster in Fukushima, the evaluation by PRA is still to
be gambling safety even if PRA showed extremely low probabilities of accidents.

5. Cost for Safety and Risk Reduction
There are valuable cases to learn in considering the risk reduction and the required cost from the Great East
Japan Earthquake, which caused enormous disaster by huge tsunami. The Onagawa nuclear power station of
Tohoku Electric Power Company could survive against the huge tsunami whose height was the almost sameas one that attacked the Fukushima Dai-ichi nuclear power station, despite the fact that the Onagawa nuclear
power station is closer to the epicenter than Fukushima. The Onagawa nuclear power station was constructedon the ground level of altitude of about 15m from the sea level which was higher than the required level of
10m, by taking into account a possibility of larger tsunami as illustrated shown in Figure 6 [10]. The surface
facing the sea was reinforced by concrete as shown in Figure 6, considering loss of ground soil by backwash,
and in addition, the seawater circulation pumps were installed inside the ground of 15.5m height and then116M. Mori / Safety and Standardization Issues of Nuclear Power Plants
in Design and Operation on ISO12100 of Safety Design Principle

secured the functions without any serious damages. Tohoku Electric Power Company never eliminated thepossibilities to cause unanticipated damages suffered from tsunami, and much of the cost spent for the land
elevation and reinforcement work could reduce significantly the risk of serious damage at the severe
accident.

6. Concluding Remarks
Discussions were made on the issues of safety andstandardization about severe accidents of nuclear
power plants.
There exist points in the new guideline which
eliminated the explicit exposure limitation fromthe old one for the site evaluation in the accidents;
therefore, it should have the accountability for thesite evaluation and explain clearly in more detailfor the remaining risk. It is definitely important toconvince the public of safety and risk of nuclear
power.
PRA is valid and useful in planning the strategy ofmaintenance; on the contrary, it seems true for theevacuated inhabitant, who experienced the nuclear
disaster, that the evaluation by PRA is still to begambling even if PRA showed extremely low
probabilities of accidents unless the accountability
for the remaining risk is made.

Figure 6. Onagawa nuclear power site land elevation

and reinforcement against tsunami and backwash
The nuclear reactor, due to the decay heatgeneration, is unable to stop to finally confirm thesafety as a last resort. It is extremely difficult to simply attain both fail-safe requirements which conflict eachother in one facility. Once the concept of the critical interlock can be applied for the nuclear power plant on
the basis of the idea of ISO12100, it shall enable to prevent the plant from falling into the catastrophic
situation and then the nuclear reactor safety concept will be convincing.

There should be a lot of things to learn for the fact that much of the cost spent for the land elevation andreinforcement work could have reduced much of the risk of serious damage at the Onagawa nuclear power
station of Tohoku Electric Power Company that never eliminated the possibilities to cause unanticipateddamages suffered from huge tsunami.
References[1] Nuclear and Industrial Safety Agency, “Overview of the accident of Tokyo Electric Power Company
Fukushima Dai-ichi nuclear power station”, Nov., March, 2011[2] Tokyo Electric Power Company, “Actions in Fukushima Dai-ichi and Dai-ni nuclear power station”, June,
2012.
[3] Tohoku Electric Power Company, “Investigation Report on the tsunami caused by the Pacific Ocean
earthquake off the coast of the Tohoku region at the Onagawa nuclear power station”, July, 2012[4] ISO12100-1:2003, Safety of machinery －Basic concepts, general[5] Nuclear Safety Commission, “Guidelines in Reactor Site Evaluation and its guide on application andAssessment.” May, 1965 (partly revised), March, 1989
[6] http://www.nsr.go.jp/data/000050240.pdf[7] Masao Mukaidono, “Useful Safety Science”, Plant Engineer, Feb. 21, 2011, pp.49-50[8] The 21st Century Public Policy Institute, paperback No.47, 2015
[9] Keita Honma, Noboru Sugimoto, “The concept of defense in depth and critical interlock of nuclear power
plant”, Safety Engineering Symposium, 2013, pp,338-341[10] Tohoku Energy Conference, Monthly magazine,”Hiroba”, No.451, August 2015

117