Safety Assurance for Boiling Water Reactors (BWRs) Beyond Design Basis

Abstract

Safety assurance of nuclear power plants cannot be achieved with highly inaccurate design bases coupled with extended operation beyond them as was the case at Fukushima Daiichi Units 1, 2, and 3. They resulted in core melts and radioactivity releases to the environment at the highest level 7 on the International Nuclear Event Scale (INES). The inexplicable low tsunami design basis used at Fukushima has been blamed for most of the extensive flooding and damages at the plants which led to a station blackout (SBO). But “the regulatory guidelines which stated that SBOs need not be considered played a large and negative role in the three core melts that transpired” (1). There were many other relevant Japan regulatory inadequacies which contributed to the severity of the events and they are covered in Section I titled Incorrect Design Basis and Inadequate Regulations. They are preceded by a short Introduction listing previous evaluations of the Fukushima Daiichi accident and providing a summary description of its immediate consequences. Section II covers Fukushima Daiichi Inadequate Operations during Beyond Design Basis Events, including failure to properly operate the isolation condenser (IC) and to recognize the limitations of the reactor core isolation cooling (RCIC). The IC and RCIC were installed to provide short term cooling during BWR SBO followed by injection of firewater to take the reactors to cold shutdown. The three Fukushima core melts could have been avoided by increasing focus upon depressurizing the reactors and using the installed fire water systems which were lined up to operate within one to three hours after the earthquake. They would have been able to add any kind of available water to the three depressurized reactors and take them to and keep them at cold shutdown conditions. Instead, Unit 1decided to shutdown IC for unexplained reasons while Units 2 and 3 chose to delay water addition to their depressurized reactors while RCIC was presumed to be working. Japan operators, management, and regulators may not have taken enough into account that, due to the tsunami failure of the plant ultimate heat sink, after IC stops working and RCIC is no longer certain to be available, the result is that: (1) the containment water is the only heat sink left to absorb the reactor decay heat transported there by the RCIC and reactor relief valves; (2) only a limited number of hours is available to inject any kind of other available water into the depressurized reactors; (3) high containment pressure is to be avoided as well as the ensuing difficulties to vent it; and (4) incorrect reactor water level data should not be relied upon to discourage proper actions as happened at all three Fukushima Daiichi Units. This broad statement is justified in much more details in Section II. Section III takes advantage of all the lessons learned at Fukushima to achieve Safety Assurance Beyond Design Basis. It includes all the necessary elements to avoid and limit future core melts. Most important of all is to have nuclear power plant personnel and management “exhibit very strong safety culture (and safety assurance beyond design basis), believe in them and to live them” as they prevail in US according to M.J. Virgilio, Deputy Executive Director of US NRC (2).