As early as 2007, project contractors at Sandia National Laboratories, which was reviewing the SOARCA analysis, were questioning whether all the emergency equipment and procedures would perform as the NRC team predicted. Sandia wanted what it called a “human reliability analysis.”
That year Shawn Burns, a senior technical staff member at Sandia, wrote what proved to be a rather prescient letter to the NRC:
The principal initiating event for the Long Term Site Blackout [at Peach Bottom] . . . is a seismic event of sufficiently large magnitude . . . to cause massive and distributed structural failures . . . the realism of relocating relatively large and heavy mitigation equipment . . . from their storage location(s) through rubble and other obstacles to their connection points in the plant is difficult to support. Similar questions would apply to the other plausible initiating events, including massive internal flood or large internal fire.
He went on to raise questions about other potential difficulties, including unavailability of backup cooling water supplies, electrical connection problems, difficulties with instrumentation, and dead batteries.
But the NRC commissioners had already spoken on this issue: emergency strategies and equipment—the so-called B.5.b. measures—would work in the SOARCA scenarios. Whether this was a reasonable assumption did not seem to figure into their instructions.
The issue bothered many within the ranks of the NRC, however. Computer models were one thing; actual hands-on experience at the nation’s reactors was an entirely different matter. Senior reactor analysts who work in the NRC’s regional offices for the Office of Nuclear Reactor Regulation, and who have all had previous experience as inspectors in the field, had a less optimistic view of the feasibility of these measures than the researchers running computer models at NRC headquarters. The reactor analysts had seen the B.5.b equipment for themselves.
The Advisory Committee on Reactor Safeguards also expressed doubts about the way the SOARCA report seemed to take the success of the B.5.b mitigation measures for granted. The committee asked whether the project staff had actually “walked down” the emergency measures to determine if they’d work under extreme accident conditions. The answer was no. Instead, the staff had based its conclusions on so-called tabletop demonstrations—that is, moving pieces around a toy model of each plant.
To quiet the skeptics, SOARCA staff visited Peach Bottom in Pennsylvania and the Surry plant in Virginia and examined the actual equipment. Internal dissent continued, but the SOARCA staff went on to question the validity of the concerns of critics and conclude that, based on those walkdowns at the plants, the likelihood of everything working was even greater than previously thought.
It was easy to understand why the project team wanted to believe that plant workers had the ability to mitigate the severe accidents that were analyzed: everything else led to core meltdowns—albeit more slowly than previous studies had found.
An example was the SOARCA staff’s analysis of a hypothetical “long term” station blackout at Peach Bottom, which is located about forty-five miles from Baltimore and eighty-five miles from Washington, DC. The accident scenario proceeded through a grim sequence of events. First, all electrically powered coolant pumps would stop working. Using batteries, operators could start up the steam-powered RCIC system, but after four hours, the batteries would fail, and after another hour, so would the RCIC. The temperature and pressure within the reactor vessel would quickly rise, and the safety relief valves on the vessel would eventually stick open, steadily releasing steam. With no makeup water available to replace the steam, the fuel would be uncovered in a matter of minutes.
At about nine hours, the fuel would start to melt, eventually collapsing and falling to the bottom of the reactor vessel. After about twenty hours, the molten fuel would breach the vessel bottom and spill onto the containment floor, where it would spread out and rapidly melt its way through the steel containment liner. A few minutes later, hydrogen leaking from the containment into the reactor building would cause an explosion, opening up the refueling bay blowout panels and blowing apart the building’s roof.
If batteries were not available for those first four hours—if they were flooded from the adjacent Susquehanna, for instance—the resulting “short term” station blackout would be even worse. In that case, the models predicted that core damage would start after one hour and the containment would fail at eight hours.
In either case, once the containment failed a plume of radioactivity would escape the damaged plant and overspread the area. As expected, the calculations predicted no early fatalities from acute radiation syndrome. But the latent cancer fatality numbers told another story. Early SOARCA data supposedly had showed that health consequences were “dramatically smaller” than those predicted by CRAC2. After the SOARCA staff was repeatedly criticized for making assertions like these without ensuring that the two studies were consistently compared, analysts ran new calculations to see what would happen if SOARCA’s methodology was applied to a CRAC2-sized release at Peach Bottom and compared to the SOARCA result for a station blackout. The outcome? The differences in latent cancer risk were not that dramatic.9
Within fifty miles of Peach Bottom, the estimated number of cancer deaths caused by a short-term station blackout, averaged over weather variations, would be 1,000, compared to the 2,500 projected by CRAC2 for a much larger radiation release. From a statistical standpoint, given the uncertainties, the difference was meaningless. And from a human standpoint, 1,000 deaths, while less than 2,500, was still a pretty unacceptable health consequence. Rather than discrediting the old CRAC2 analysis, the SOARCA study had in important respects validated it.10
For the small crowd gathered at the Marriott on March 10, 2011, to hear an update on SOARCA, some key details were missing. The NRC was still unwilling to release the numbers publicly. Anyone who wanted to know what was going on had to resort to Kremlinology to interpret the subtle changes in the statements that the NRC approved for release.
Two years earlier, at the last SOARCA session at the RIC, Jason Schaperow of the study team had reported a preliminary conclusion that “releases are dramatically smaller and delayed” from those projected in CRAC2, news that hardly surprised anyone in the room who had been watching the data contortions over the years. But in 2011, the statement had subtly changed. Patricia Santiago, the latest of several branch chiefs to oversee the SOARCA study, presented a bullet point that “for cases assumed to proceed unmitigated, accidents progress more slowly and usually [emphasis added] result in smaller and more delayed radiological releases than previously assumed/predicted.”
The word usually was key here. It left the door open to the possibility that there were scenarios in which CRAC2’s predictions had not been so far off base after all: perhaps, for instance, a station blackout at Peach Bottom.
Nor did Santiago repeat the now familiar statement about dramatically smaller numbers of cancer deaths. She noted only that “individual latent cancer risk for selected scenarios generally comes from population returning home after [the] event is over.” In other words, most of the dose to the population would be received not during the early stages of the accident by people exposed to radioactive plumes, but long after the accident was over by evacuees who had no choice but to return to their now contaminated homes to live, hardly a consolation.
However, Santiago did highlight one SOARCA conclusion that had not changed over the years: the accident scenarios analyzed as part of the study “could reasonably be mitigated, either preventing core damage or delaying/ reducing the radiation release.”
The next morning, all the tabletop models and computer runs and fingers-crossed assumptions that supported that conclusion would face their first real-world test. At 11:40 a.m. on March 11, Jason Schaperow sent an e-mail to Santiago, his supervisor. “Today’s Japanese earthquake seems to have caused one of the SOARCA scenarios (long-term station blackout).”
“On this morning’s news they said no release,” San
tiago replied. “Time will tell.”
Computer modelers and analysts love to obtain real-time data that they can use to validate the predictions of their models—except, perhaps, if they are simulating disasters. Soon, the SOARCA team would watch as many of the catastrophic events they had deemed improbable unfolded not on a computer screen, but on a television screen. And in the process the limitations of the SOARCA approach—the project in which the NRC had invested so much time and money to win over a skeptical public—would become evident.
Over the years as the SOARCA study progressed, it had revealed the potential for a natural disaster to cause a truly horrific event: an accident that involved multiple reactors, rendered most emergency equipment useless, and contaminated large areas with radiation plumes far beyond emergency planning zones due in part to the vagaries of weather. Yet instead of taking action to prevent such an accident, the NRC convinced itself that even if the accident did happen, the consequences would be minor. Difficult issues were disregarded or put off for another day.
If the NRC had undertaken this study not as an exercise in reinforcing existing biases, but as a roadmap for identifying and fixing safety weaknesses from America to Japan, SOARCA’s most dire predictions might not have made the transition from a PowerPoint presentation to an event that shocked the world.
11
2012: “THE GOVERNMENT OWES THE PUBLIC A CLEAR AND CONVINCING ANSWER”
On January 18, 2012, protesters attempted to gain access to a closed-door meeting of Japan’s Nuclear and Industrial Safety Agency (NISA). More than a hundred uniformed and plainclothes officers arrived to quell the scuffle. A green and yellow sign held aloft by one of the well-dressed demonstrators read: “Nuclear Power? Sayonara.”
Before Fukushima Daiichi, that prospect seemed unlikely. Japan was firmly wedded to nuclear power—economically, politically, and socially. But now, as the consequences of the accident ten months earlier continued to unfold, to many Japanese the marriage was difficult to defend. The demonstrators being jostled in a crowded hallway and chanting “Shame on you” to the authorities sequestered behind the doors were part of a new, vocal constituency intent on having a say on Japan’s energy future. For them, the price of nuclear power was just too high.
Since the accident, much had changed across Japan; 2012 would become a year marked by protests, uncertainty, and shifting political allegiances. Although Fukushima Daiichi officially was in cold shutdown, the popular debate over nuclear power was increasingly active. On numerous occasions, public opinion boiled over at politicians who seemed tone deaf to the concerns of average citizens. The country’s leaders—in government and in the clannish private sector—appeared determined to close the book on the disaster of March 11 as quickly as possible and begin restoring the role of nuclear power as an essential element in Japan’s economic life.
Immediately upon taking office in September 2011, Prime Minister Yoshihiko Noda had made his views clear: Japan needed nuclear energy. Noda proposed a middle ground—one that he hoped would ease public fears about living with nuclear power and corporate Japan’s fears of living without it.
“[I]t is unproductive to grasp nuclear power as a dichotomy between ‘zero nuclear power’ and ‘promotion,’ ” said Noda. “In the mid- to long-term, we must aim to move in the direction of reducing our dependence on nuclear power generation as much as possible. At the same time, however, we will restart operations at nuclear power stations following regular inspections, for which safety has been thoroughly verified and confirmed.” If the public could be convinced that Japan’s reactors were safe, perhaps the marriage could be saved.
The “how safe is safe enough” threshold for many Japanese had soared in the months since March 11, however. In normal times, safety inspections had been largely pro forma, conducted out of view, with little or no public input. Everybody had seen what that produced. If Noda thought his proposal to restart the nation’s reactors would win public support, he quickly discovered otherwise.
Within days, tens of thousands of protesters took to the streets of Tokyo. The September 19, 2011, protest was the largest public demonstration in years in the capital. They wanted every reactor in Japan shut down permanently. A sign held by an elderly protester depicted a mother cradling an infant. It read: “This child doesn’t need nuclear power.”
On September 19, 2011, tens of thousands of protesters clogged the streets of Tokyo, demanding an end to nuclear power in the country. Here protestors gather at the Meiji Shrine Outer Garden in the nation’s capital. Wikipedia
• • •
After being escorted out of their meeting room to avoid the noisy protestors, NISA officials reconvened and approved the restart of two reactors at the Ohi nuclear plant in Fukui Prefecture, on Japan’s west coast. At this point, only three of the country’s fifty-four reactors were still operating, and those would also soon be turned off. Before any could be restarted, all were required to pass the safety checks first ordered by former prime minister Kan and now cited by Noda: a first round of government-ordered “stress tests.” Plants that passed the first-round tests would then undergo a second, more comprehensive round that would determine whether plants were safe enough to continue to operate.
The first-stage tests were designed to verify a reactor’s ability to withstand specific events, such as beyond-design-basis earthquakes, tsunamis, or both. Taking a lead from the European Union, which ordered stress tests for all one hundred thirty operating plants within its jurisdiction after the March 11 accident, the Japanese government directed the nation’s utilities to perform similar tests. However, the guidelines were vague, failing to specify clearly how far beyond the design basis the assumed stresses should go. That made the outcomes of the tests hard to interpret.
The results of the first-stage tests were submitted to NISA, which then passed on its plant restart recommendations to the Nuclear Safety Commission. The commission, in turn, forwarded its decision to the prime minister. Noda and several of his cabinet members would have the final say.
Even as the government proceeded through the formalities of the stress tests, pressure was growing from several influential constituencies to bring the reactors back online as rapidly as possible. A recurrent theme among the restart supporters was that Japan was headed for a major electricity shortage. That moment was approaching, along with the hot, humid months, when energy use normally would rise by about 50 percent. Unless Ohi Units 3 and 4—the first reactors in line in the stress test review process—were restarted, Japan would be nuclear free on May 6, 2012.
That prospect posed a worrisome “what if?” for restart advocates. Suppose Japan successfully made it through the summer without nuclear power. That would make it more difficult to win public support for returning the plants to service.
To add credibility to NISA’s conclusion that the Ohi reactors were safe, the Noda government invited a delegation from the IAEA to review the findings. Based on a preliminary assessment, the IAEA reported that the stress tests were “generally consistent” with its own safety standards and supported “enhanced confidence” in the reactors’ ability to withstand even a disaster similar to that of March 11.
Those findings drew a scathing public rebuke from two nuclear experts who served as NISA advisors. The tests, the two men said, failed to take into account complex accident scenarios as well as critical factors such as human error, design flaws, or aging equipment. At a news conference, Masashi Goto, a former reactor designer, labeled the stress tests “nothing but an optimistic desk simulation based on the assumption that everything will happen exactly as assumed.”1 Goto also argued that the stress test methods should first be applied to Fukushima Daiichi to see if they could correctly simulate the outcome of the accident.
The other expert, Hiromitsu Ino, a professor at the University of Tokyo, accused the IAEA of simply rubberstamping NISA’s decision because of the international agency’s dual role as regulator and promoter of nuclear power. Ino noted tha
t the IAEA had deemed the Kashiwazaki-Kariwa nuclear plant safe after a 2007 earthquake without conducting a full examination of the plant.
Ino’s and Goto’s sharp critiques were echoed two weeks later by another expert: Haruki Madarame, the head of Japan’s NSC, who had been at Prime Minister Kan’s side during the height of the accident. In a declaration that must have surprised many, Madarame asserted forcefully that Japan’s nuclear regulatory framework was flawed, out of date, and below international standards. He claimed that the government’s foremost concern was not protecting the public but promoting nuclear energy. Madarame added that Japan had become overly confident in its technical superiority, failing to acknowledge the risks that nuclear power posed, especially in an earthquake-prone country. Concerning the stress test results, he said: “I hope there is an evaluation of more realistic actual figures.”
The IAEA’s final review of Japan’s stress tests, released in March, appeared to support some of the critics’ concerns. The agency said that NISA had not communicated what its desired safety level was or how the assessments could demonstrate it. Regardless, the IAEA’s overall judgment did not change.
For many Japanese, the epiphanies of such once-staunch nuclear proponents as Kan and Madarame only heightened uncertainty and confusion. Before March 11, 2011, they had been led to believe that their country’s reliance on nuclear power was a prudent choice. Now, knowledgeable insiders were painting the entire nuclear framework as a public threat and an embarrassing fraud. And at the same time, the leadership in Tokyo was pushing to restart reactors.
If criticism from Japan’s own experts wasn’t unsettling enough, international disapprobation soon followed. A group of experts summoned by Yotaro Hatamura’s investigative committee, which was wrapping up its lengthy assessment of the accident, weighed in. Because the Hatamura panel focused on TEPCO and events at Fukushima Daiichi, much of the criticism was directed at the utility, but the message spilled over: the failings were systemic. For example, Richard Meserve, former chairman of the U.S. NRC and president of the Carnegie Institution for Science, said that not only had TEPCO become overly confident but Japanese regulators had followed suit, falling victim to the myth of safety. “There has to be a willingness to acknowledge that accidents can happen,” said Meserve.2
Fukushima: The Story of a Nuclear Disaster Page 29