Sunday, July 1, 2012

Fukushima: Station Black Out & Delusion

According to a Japan Times editorial with the title "Nuclear power plant collusion" published online Jun. 23, 2012, industry and government experts appointed by the Japanese Nuclear Safety Commission in 1991 to revise safety standards for station blackouts (SBO) concluded in 1993
“that even if an SBO occurs, it would not lead to a severe accident."
Last year's nuclear reactor disaster at Fukushima Dai-ichi Nuclear Power Station (NPS) in the wake of the great Tohoku-Chihou-Taiheiyou-Oki Earthquake and Tsunami can be considered a station blackout that developed into a severe nuclear accident.

According to Cook and others (1981), “a station blackout is defined as the complete loss of all AC (alternating current, ed.) electrical power to the essential and nonessential switchgear buses in a nuclear power plant.” The authors examined a hypothetical station blackout (SBO) and its consequences, using the boiling water reactor (BWR) at Brown's Ferry NPS Unit 1 as model. The unit produces 1152 MW electrical power, and its design resembles closely that of units 1 - 4 at Fukushima Dai-ichi NPS, except Unit 1 at Fukushima was not equipped with an automatic depressurization system and had an isolation condenser instead of a reactor core isolation cooling (RCIC) system. The description of events at Fukushima Dai-ichi NPS on the day of the earthquake provided in this essay is based on the information the station's operator Tokyo Electric Power Company (TEPCO) has released since the accident.

In the study of Cook and others (1981), the loss of offsite AC power trips the main turbine, scrams the reactor, and the emergency diesel generators fail. Battery-supplied DC power continues to support emergency shutdown systems and components important to reactor safety. The authors explore with models various possible event paths after the batteries are exhausted. Though ground motion rather than a loss of power scrammed the reactors at Fukushima Dai-ichi NPS automatically, the authors' predictions on the worst accident progression converge on the chain of events at Fukushima after 4 p.m. on Mar. 11, 2011. Below, Unit 1 at Fukushima Dai-ichi NPS is used as example.

Systems, Structures, and Components Important to Safety
In conjunction with a high pressure coolant injection (HPCI) system, with which all reactors at Fukushima Dai-ichi as well as at Brown's Ferry are outfitted, RCIC system and isolation condenser constitute crucial components designed to keep the nuclear fuel in the reactor pressure vessel (RPV) covered with water, when the electrical power-generating turbine trips, the main steam isolation valves close, and the reactor scrams. HPCI and RCIC system are described in detail in the appendix of the study of Cook and others (1981).

In a scram, all safety control rods are inserted into the fuel core, instantly disrupting the nuclear chain reaction. The closing of the main steam isolation valves disconnects the reactor from the turbine, and the decay heat that the fuel produces cannot be transferred to the main steam condenser. Alternating current is no longer produced onsite. Other sources must supply power needed to operate the reactor. The offsite electrical grid represents the primary alternative source, and should the grid fail, emergency diesel generators are held in reserve onsite. If the emergency generators fail, battery-supplied direct current (DC) is supposed to support important instrumentation and valves for several hours.

Schema of the isolation condenser at Fukushima Dai-ichi NPS Unit 1, labeled here 'emergency steam condenser.' Note subsystem A and subsystem B are both fed by one coolant supply line. The coolant in the condenser is evaporated, while cooling reactor pressure vessel (RPV) steam. The coolant vapor is vented directly into the environment via a pair of exhaust pipes on the west wall of the reactor building. MO - manual-remote actuated motor operated valves (TEPCO).

The isolation condenser at Fukushima Dai-ichi Unit 1 consists of two identical subsystems of water-cooled heat exchangers designed to reduce reactor pressure vessel (RPV) temperature and pressure by steam condensation. The condensate is returned to the RPV to help keep the fuel covered. Similar to Brown's Ferry Unit 1, however, when the RPV's safety/relief valves open to protect the vessel from overpressure, large volumes of steam escape. The valves lift automatically when a pressure setpoint is reached, but can also be actuated remote-manually from the control room with battery-supplied DC power and compressed air. As a result, the water level falls.

Schema of the high pressure coolant injection (HPCI) system at Fukushima Dai-ichi NPS Unit 1. MO - motor operated, HO - hand operated, and AO - air operated valves. Note the reactor steam-driven turbine that powers pump and booster pump. The feedwater for the reactor pressure vessel (RPV) is alternatively provided by the condensate storage tank or the wetwell (suppression chamber) pool (TEPCO).

Low water level automatically starts the high pressure coolant injection (HPCI) system, a reactor steam-driven pump, which can inject coolant rapidly at high pressure into the RPV, keeping the fuel core covered.

HPCI system with reactor steam turbine-driven pump (source: nuclear tourist).

General Electric's Mark I primary containment system encloses the RPVs of units 1-5 at Fukushima Dai-ichi NPS. The system consists of a pear-shaped drywell, housing the RPV, connected with large-diameter pipes like spokes to a hub to a doughnut-shaped water-filled wetwell, also known as suppression chamber. The pipes are designed to relieve pressure building up in the drywell into the wetwell. By contrast, the safety/relief valves relieve RPV pressure into the wetwell through separate smaller diameter pipes.
Schema of the Mark I containment system inside the reactor building of Fukushima Dai-ichi Unit 1. Note the pear-shaped drywell, housing the reactor pressure vessel, connected with 81-inch pipes to the doughnut-shaped wetwell, also known as suppression chamber, filled halfway with water (courtesy:

The drywell is designed to operate safely up to 138 °C (Cook and others, 1981). When the fuel core in the RPV is uncovered, the core temperature will rise above 1,300 °C, the fuel rods will begin to melt, RPV penetration seals begin to leak, and ambient temperature in the drywell will heat to more than 149 °C, or 300 °F. Above this temperature, valve control solenoids, electrical cable insulation and electrical penetration module seals fail.

Hundreds of kilograms hydrogen are produced at the damaged fuel rods after fuel uncovery, when the super-heated zirconium oxide cladding of the fuel rods reacts with steam. Once the RPV is breached, the hydrogen and gaseous radioactive fission products will escape into the drywell. Once the drywell seals deteriorate in the heat, the gases will vent into the reactor and turbine building. Hence, rising radiation dose rates in these buildings suggest that a fuel meltdown is in progress.

☢ 14:46, the earthquake strikes tripping operating units 1, 2 and 3. Offsite AC power service is lost. The emergency diesel generators start up. Two generators supply Unit 1 (TEPCO press release with the title "Release of the Fukushima Nuclear Accidents Investigation Report" dated Jun. 20, 2012).
☢15:27 and ☢15:35, tsunami waves inundate the generator rooms of units 1 to 5. The diesel generators for Unit 1 trip. In the control room wedged between the reactor and the turbine building, charge indicators flash for a brief moment. Alarms ring out and die. The tsunami also floods DC power distribution panels. In rapid succession, control room illumination, displays, indicators, gauges, annunciators and controls dim. On the ground floor below, water stands 80 cm deep.
☢15:30, the RPV pressure recorder for Unit 1 stops. Minutes later, the RPV temperature recorders halt.
☢15:37, control room crew call SBO for units 1 and 2. The government is notified. Crew arriving from the basement of the turbine building confirm that the emergency diesel generators failed and the corridor lights are out.
☢15:50, all DC power is lost. The operators are left with emergency lights on the Unit 1 side of the control room, and in total darkness on the Unit 2 side, unable to read vital reactor parameters and observe the results of their interventions. Unit 1's isolation condenser status is rendered indeterminable. The status indicator for the HPCI system is turned off. The system has fallen into a non-bootable state. The RPV water level displays cease.
☢16:15, the water level recorders for Unit 1 stop.
☢16:25, the shift supervisor declares the status of the emergency core cooling system and the RPV parameters unobtainable.
☢17:56, preparations begin for fire pumps to inject water into Unit 1's RPV.
☢20:07, crew is able to collect gauge readings in the reactor building for the first time since the SBO's inception, concluding the fuel was covered and RPV pressure held at 6.9 MPa.
☢20:47, some control room power is restored with a portable generator. Auxiliary batteries are connected to the electrical RPV water level displays, re-establishing monitoring capability at 21:19.

The observed RPV water level on the gauge indicated less than a foot above the fuel and may have been underestimated by several feet, because the reference leg of the water level gauge, also known as Yarway gauge, is located in the drywell. The reference leg is needed to account for vessel pressure and temperature. The drywell was progressively heating up, evaporating water in the gauge's reference leg and producing lower than actual water levels, when the drywell temperature exceeded design basis (Hodge and others, 1992).

Emergency Cooling
☢14:52, both subsystems of Unit 1's isolation condenser started automatically. Control room crew notes a drop in RPV pressure believed commensurate with the rapid diminution of temperature attributed to the isolation condenser activation.
☢15:03, in compliance with instructions, an operator closes valves of the isolation condenser loop. According to manual, the rate of change in RPV temperature was not permitted to be greater than 55 ℃/h because of the risk of RPV failure.

Line valves were opened to enable HPCI. The control room crew initially found no indication that Unit 1's HPCI system was inoperable. They reassured themselves that the HPCI system was ready to inject water into the RPV, should the safety/relief valves actuate automatically, that is 7.4 MPa for lifting and 6.9 MPa for reseating, resulting in a drop of RPV water level below the threshold and starting HPCI. However, because the RPV water level seemed to persist at sufficiently high levels, keeping the fuel covered, and pressure remained below safety/relief valve lift point, HPCI was not expected to start before the tsunami struck and was disabled afterwards.

The crew continued to control RPV pressure remote-manually with isolation condenser subsystem A into the next day, intermittently opening and closing the steam line valves. TEPCO believes that the isolation condenser was effective in avoiding an excessive rise in RPV pressure, because no evidence has been found that safety/relief valves lifted.

It is important to note that depressurizing the RPV with the help of the safety/relief valves, while adding sufficient coolant with the isolation condenser or the HPCI system, would have been essential for avoiding an immediate fuel meltdown. The operators actuated safety/relief valves at Units 2 and 3, but not at Unit 1.

In their SBO simulation study on a BWR-4 boiling water reactor, Park and Ahn (2012) assume that battery power will be available for 6 hours. RCIC and HPCI systems are working, but begin to fail, once the batteries are exhausted. Under these conditions, the author's simulation suggests that, without operator intervention, core uncovery and melt will begin 8 and 9 hours into the SBO, respectively. The drywell will fail after 18 hours. TEPCO's simulation assumes that the drywell temperature beyond which leakage begins is crossed 13 hours into the SBO.

By contrast, the almost concomitant loss of AC and DC power at Fukushima accelerated the progression of events. TEPCO estimates that Unit 1's fuel core began to uncover already about 2 hours into the SBO ("Analysis and evaluation of the operation record and accident record of Fukushima Daiichi Nuclear Power Station at the time of Tohoku-Chihou-Taiheiyou-Oki-Earthquake", TEPCO, May 23, 2011).

Wilkie (2011) suggested that the fuel core in the reactor would uncover and begin to melt in slightly less than one hour, if HPCI, RCIC or the isolation condenser and safety/relief valves failed. Similarly, Cook and others (1981) predict that, without any power and without coolant injection into the RPV, fuel is uncovered in about half-an-hour, the core meltdown begins after two hours, and the drywell electrical penetration modules fail after 4.5 hours, venting radioactive noble gas, cesium, and iodine-based fission products into the reactor building (their Table 9.7.).

Furthermore, Cook and others (1981) conclude that the fuel would uncover twice as rapidly, the fuel rods would begin to melt within less than one hour, and the drywell would begin to vent about 20 minutes earlier, that is within a little more than four hours into the SBO, if a loss of coolant through a small breach in the RPV occurred, also known as small-breach LOCA (loss of coolant accident). The breach could consist of a stuck-open safety/relief valve or a hole in the reactor pressure vessel 13.8 cm in diameter.

Lochbaum (2011) suspected a LOCA might have happened, but could not find any evidence in the data TEPCO released at the time of his evaluation. In accord, Tanaka (2011) hypothesized a LOCA as part of the accident progression of Unit 1, and TEPCO's simulations match the reactor data best, when a LOCA is assumed. Below, I discuss events past 4 p.m. on March 11, 2011, that support the occurrence of a small-breach LOCA.

Small-Breach LOCA
☢17:19 crew that had been sent to Unit 1's reactor building to check on the isolation condenser bilge water level ran into hazardous radiation dose rates at the building entrance, forcing them back ("Fukushima Nuclear Accident Analysis Report (Interim Report)," TEPCO, Dec. 2, 2011).
☢23:00, contamination had reached the turbine building. A reconnaissance team recorded 1.2 mSv/h in front of the north side ground floor airlock, which is roughly 20,000 times greater than the 50 nSv/h ordinarily detected on the premises.

The progressive increase in dose rate, already observed shortly after 5:00 p.m. and corroborated at further distance three hours later, suggests that a fuel meltdown was underway already at that time, consistent with a rapid severe accident development. Without cooling, the drywell must have overheated 90 minutes into the SBO, developed leaks, and allowed substantial radioactive gases to vent into the building, leading to the detected dose rate increases. While, no evidence of a massive RPV water loss has been presented to date, a small RPV breach therefore constitutes a probable cause that would explain fuel uncovery and meltdown within less than one hour.

To date, TEPCO has not reported that safety/relief valves were actuated. However, after the loss of power a valve could have failed open unnoticed. Hydrogen produced by the fuel rod cladding/water reaction may have accumulated in the piping. Deflagrating gas could have blown open a valve.

Certainly, we shall learn one day whether a small-breach LOCA occurred at Fukushima Dai-ichi NPS Unit 1. Without doubt, the meltdown at Unit 1 progressed more rapidly than initially believed. The remarkably narrow window of opportunity for operator intervention between station blackout and fuel meltdown should give all stakeholders pause.

I thank the contributors to This evaluation could not have been accomplished without their input.

  • Today NHK WORLD aired a video report with the title “Nuclear Watch: Blind Spot in Nuclear Safety“, documenting that an air monitoring station 5.6 km from Fukushima Dai-ichi Nuclear Power Station registered a greater than anticipated spike in radiation on Saturday Mar. 12, 2011, after hardened venting at the station’s Unit 1 had commenced and before a hydrogen explosion damaged that unit. As the NHK WORLD report explains, hardened venting is supposed to reduce primary containment vessel pressure, filtering most radioactive contaminants out by passing the effluent through the primary containment vessel's suppression pool. TEPCO presumed that only 0.01 percent of the initial radioactivity would vent into the atmosphere. However, the radiation dose rates observed at the monitoring station were magnitudes greater than what they should have been according to TEPCO's presumption. NHK WORLD hypothesizes that the greater than expected radiation release resulted from an increase in suppression pool temperature, diminishing the pool's filtering capacity. In a model experiment, the release was increased 500-fold. NHK WORLD suggests that earlier gas and steam releases from the reactor pressure vessel heated the water in the pool via open safety relief valves. According to TEPCO’s reports to date no safety relief valves were opened at Unit 1. A LOCA releasing gas and steam from the reactor pressure vessel into the primary containment vessel represents an ever more likely possibility (04/30/2014).