Japan Earthquake: nuclear plants Fukushima part 2

[Hiddencamper]

There's no need to bring in straw men in the form of fictional action heroes. We already know the plant operators did many unconventional, hazardous and even unprecedented things when they had adapted to the realisation that they were managing a very severe accident with life threatening consequences. Unfortunately that adaptation took about a day and night, even though the factors forcing that adaptation (almost total loss of remote control and monitoring) were present immediately after the tsunami.If you are willing to stifle discussions about the proper response to a beyond design basis accident, then you are really suggesting that you can always design for every accident scenario, which has proven time and time again unfeasible. It's interesting to compare the response in Fukushima 2 that suffered from the same earthquake and tsunami, but maintained effective reactor cooling during the same time period as Fukushima 1 had core melts and hydrogen explosions. The designs and plant systems were hardly different. The significant difference appeared to be that F-2 operators never lost control of their reactors, while F-1 operators never really regained it after the tsunami. It also appears that the most critical factor in losing control was not the loss of control systems, but the loss of incoming information about plant status and subsequent breakdown in effective decission making.

Loss of dc power significantly complicated the unit 1/2 events at daiichi. I personally believe if they didn't lose their dc power the event would have looked more like daiichi. The loss of dc caused an inappropriate focus on unit 2, and contributed to the failure of the IC at unit 1.

 

[nikkkom]

I'm still amazed that so many "emergency cooling" measures don't actually remove heat from the unit, they merely move it around. HPCI, RCIC, they all move hot water/steam from the RPV to various other pools and tanks, and this water eventually goes back into RPV. To me, this looks somewhat stupid.

Only the "old" IC actually does cool the whole damn thing.

 

[Hiddencamper]

I'm still amazed that so many "emergency cooling" measures don't actually remove heat from the unit, they merely move it around. HPCI, RCIC, they all move hot water/steam from the RPV to various other pools and tanks, and this water eventually goes back into RPV. To me, this looks somewhat stupid.

Only the "old" IC actually does cool the whole damn thing.

The RHR heat exchangers are your ultimate heat sink. For a DBA LOCA they are required to be placed in service manually within 10-30 minutes. For LOOP events, you need one heat exchanger in service to prevent exceeding suppression pool design temperature.

My Mark III will get close to 160 degF in a LOOP with one RHR HX in service per our power uprate analysis.

The goal is to always minimize the amount of heat you have to reject to containment. If the condenser is unavailable you have no choice, but even in this scenario the expectation is that you cool down using RCIC taking a suction from the condensate storage tanks to minimize pool heat up. The CST is required to maintain sufficient water to support a RCIC cooldown.

Keeping the pool cooled is a big deal. The operating license has strict limits on pool temp and will mandate a rapid cooldown if you're getting too hot. The EOPs have a heat capacity temperature limit graph, which if exceeded requires immediate cooldown or emergency blowdown to ensure you don't exceed the containment temperature limit during a subsequent line break or emergency blowdown. It's also one of the only places in the EOPs that emphasize containment protection over core cooling, as it mandates exceeding the cooldown rate intentionally to protect the HCTL.

 

[nikkkom]

The RHR heat exchangers are your ultimate heat sink. For a DBA LOCA they are required to be placed in service manually within 10-30 minutes. For LOOP events, you need one heat exchanger in service to prevent exceeding suppression pool design temperature.

This is the part which I find stupid. What's the point in the design which transfers heat from RPV to suppression pool, so now you need to cool the suppression pool? This introduces more failure points, and false sense of security. "RCIC can keep the reactor from overheating", one might think. Wrong. "RCIC can keep the reactor from overheating *if* and *until* suppression pool overheats". Now you need RCIC to not fail *and* RHRs to not fail.

 

[Hiddencamper]

This is the part which I find stupid. What's the point in the design which transfers heat from RPV to suppression pool, so now you need to cool the suppression pool? This introduces more failure points, and false sense of security. "RCIC can keep the reactor from overheating", one might think. Wrong. "RCIC can keep the reactor from overheating *if* and *until* suppression pool overheats". Now you need RCIC to not fail *and* RHRs to not fail.

The original design was just the IC.

The IC has no injection capability though, which for long term events is important. So GE swapped it out for RCIC plus the steam condensing mode of the RHR heat exchangers. The RHR HX are designed to handle reactor steam, and used a level and pressure controller to control cooldown rate. Steam from the RCIC steam line would go to the HX, be condensed on the tubes, then would be fed back to the RCIC pump suction. This provided long term heat sink. I know some plants had issues with this, but I have yet to find the details (astronuc if you can find out why please let me know, I speculate tube damage after Humboldt Bay stayed critical on RCIC/RHRHX for over a day). But most plants ultimately deactivated steam condensing mode. HPCI plants can use it for pressure control. HPCS plants have to lift SRVs which sucks. A lot.

Remember that compared to a PWR, where the turbine driven aux feed loses inventory to the atmosphere and will eventually run out, BWRs never lose inventory. If the containment is being vented, you can remove all decay heat that way and never lose RCIC. There are trade offs between various designs. But due to Recirculation seal leakage during loop events, the IC alone will eventually not be sufficient as water level slowly drops. Loop design leakage is close to 50 gpm, or 1 inch every 4 minutes. Given there's 200 inches of inventory, the IC is not going to protect the core for these events. (These are average/typical levels). (50 gpm is a design limit, typical leakage is much much lower)

 

[nikkkom]

The original design was just the IC.

The IC has no injection capability though, which for long term events is important.

This is another thing which baffles me: the unexplicable desire to keep RPV pressurized. *Of course* you will have difficulty ensuring that RPV water level is high enough if it is pressurized. One, pressurized tanks want to leak. Two, pressurized tanks are difficult to pump water into. Conversely, pumping water into a RPV which is at 1 atm is piece of cake.

What's up with this... er... peculiar desire to keep RPV pressurized (and hot) during accidents? Shouldn't the opposite be done?

 

[Rive]

What's up with this... er... peculiar desire to keep RPV pressurized (and hot) during accidents? Shouldn't the opposite be done?

There was a document linked somewhere back (years ago) about simulated results of handling a complete SBO on GE MK-I containment. As I recall that went exactly on the same way as you. The sooner the PCV depressurized is the better.

However, this contradicts the actual way of thinking about containing an accident with multiple barriers, even if with this the accident might end in a steam bomb slowly pumping up.

 

[Hiddencamper]

There was a document linked somewhere back (years ago) about simulated results of handling a complete SBO on GE MK-I containment. As I recall that went exactly on the same way as you. The sooner the PCV depressurized is the better.

However, this contradicts the actual way of thinking about containing an accident with multiple barriers, even if with this the accident might end in a steam bomb slowly pumping up.

Cooldown is obviously the best way to protect the vessel long term, however an emergency blowdown or cooldown in excess of the ASME code limit has the potential for putting severe stress on the RPV and potentially causing a LOCA. Additionally, pressure changes will affect your water level instruments and make it very hard to control level. For this reason the EOPs direct stabizing pressure and level. Pressure should be stabilized within the 100 degF per hour cooldown limit and held as constant as possible, then level should be stabilized between the high and low water level trips. Once you have everything stabilized you commence a controlled cooldown. You're looking to minimize the challenges to level and pressure control, while also minimizing thermal stress or damage to the RPV. The stresses imposed on the RPV are huge during a blowdown, and the EOPs recognize this by not allowing you to exceed the cooldown limit unless the fuel or containment are challenged, where the risk to the public is larger by keeping the vessel hot than it is to blowdown and potentially have a LOCA.

As for level and pressure: when an srv opens up, you get a 25-35 inch spike in level, due to the swell effect, which continues to grow. The whole time you are losing inventory, with false high water level readings. This can cause your injection sources to trip off on high level. Then when the srv is closed, the shrink can cause another low level scram or ECCS injection signal. It's difficult to control. Additionally if you start rapidly cooling down, you need substantial inventory makeup to deal with inventory loss through steam relief and the water shrink during the cooldown. Something like IC provides no inventory. RCIC does, however it's nominal flow rate is 450-600 gpm, and it does not have sufficient makeup capability for the first 10-15 minutes, and until you let decay heat die a little RCIC doesn't have enough flow to support a rapid cooldown. You would have to rely on ECCS, which stresses your vessel nozzles and can damage fuel (either through foreign material in the suppression pool, or for plants with in-shroud ECCS water impingement on fuel bundles). So there's all these factors that have to be weighed. What we have done, is when we had to cooldown, we let decay heat die for an hour or two, use that time to take care of the secondary, then start cooling down. When you aren't fighting substantial decay heat, it's much easier to control. Also, at lower pressures, a single relief valve is going to pass less steam flow due to lower driving head, so you end up keeping relief valves open longer to achieve any meaningful depressurization which results in larger pool heat ups and larger makeup requirements. Above 500 psig, a single relief valve can almost always handle all decay heat. But below that, you'll need to cycle multiple relief valves which is outside of the containment and relief valve sparger loading analysis. It's assumed in the containment safety analysis that the only time you'll have multiple relief valves opening up for design basis events is during the initial load reject, after that only a single relief valve will be used which minimizes acoustic/water/structural loading on the suppression pool.

If condenser/Feedwater is available you can easily and rapidly cooldown. And in fact BWR procedures will demand a pretty quick cooldown to 500 psig to minimize thermal stress on the Feedwater nozzles, even if a hot restart is coming. But when you are isolated, the faster you move pressure, the harder it is to control the rest of the plant. Staying hot means you keep your steam driven injection sources, have more controllability, minimize stress on the vessel, and avoid spurious trips on your injection systems.

As for SBO, since it's only a 4 or 8 hour event per the design basis, you don't want to depressurize, as this adds heat to containment that can't be removed and also thermally challenges RCIC. Eventually, for long term coping, you either need to restore RHR HX, or wait until the last minute to blow down then reflood with fire pumps and seawater. Typically the suppression pool heat capacity is going to drive you to blowdown, not level, as RCIC/HPCI/HPCS operation is assumed for the coping duration.

 

[jim hardy]

Thank You Hiddencamper for sharing your expertise.

There was a document linked somewhere back (years ago) about simulated results of handling a complete SBO on GE MK-I containment. As I recall that went exactly on the same way as you. The sooner the PCV depressurized is the better.

I'll see if i can find that document i know i have a copy on disk but the link would be betterEDIT found one of them

NUREG/CR-5869 is 214 pages
http://web.ornl.gov/info/reports/1992/3445603689514.pdf

it expands on an earlier one that's far shorter and of course less detailed. will try to track it down, it's easier for us non-BWR folks to absorb

i think this is the one i remember ( it's been five years already ?)
http://www.iaea.org/inis/collection/NCLCollectionStore/_Public/24/072/24072657.pdf
old jim

 

[Rive]

... per the design basis...

Thank you very much for the long explanation.

Regarding the relevance of that document: as I recall it was really about the old GE MK-I containment, designed with a very different, far less demanding design basis. Interesting to see this as kind of historical context of reactor evolution. Actually, as I take it your detailed explanation and reasoning is kind of a result of the experience and simulations on that old design, and the next step (ESBWR?) is already knocking on the door - with the IC brought back in large.

 

[mheslep]

There's no allowable way in the emergency operating procedures to get there in this scenario.

Operation per the EOP is relevant to looking backward and possibly laying blame on operators at this point. That's not of interest to me. I'm interested in what's possible, period, given this BWR, to stop or mitigate the follow-on accident with respect to cooling before loss of power. Given the decay power, it does not superficially appear to me that any amount of cooling for an hour was going to stop the core from eventually becoming uncovered.

 

[jim hardy]

it does not superficially appear to me that any amount of cooling for an hour was going to stop the core from eventually becoming uncovered.

Only if you get pressure down to point some pump , perhaps a portable engine driven one, can inject makeup.

 

[mheslep]

...

Remember that compared to a PWR, where the turbine driven aux feed loses inventory to the atmosphere and will eventually run out, BWRs never lose inventory. If the containment is being vented, you can remove all decay heat that way and never lose RCIC. There are trade offs between various designs. But due to Recirculation seal leakage during loop events, the IC alone will eventually not be sufficient as water level slowly drops. Loop design leakage is close to 50 gpm, or 1 inch every 4 minutes. Given there's 200 inches of inventory, the IC is not going to protect the core for these events. ...

HC, can you expand on that if you have a moment? How is 6MW of decay heat on the first day after scram transferred by venting, given a LOC?

 

[mheslep]

Only if you get pressure down to point some pump , perhaps a portable engine driven one, can inject makeup.

"Some pump"? How does this apply in the Fukushima context? The backup diesel pump power drowned. Did your nuke have secret aux pumps and portable diesels stored separately from the main diesel backup?

 

[Hiddencamper]

Thank you very much for the long explanation.

Regarding the relevance of that document: as I recall it was really about the old GE MK-I containment, designed with a very different, far less demanding design basis. Interesting to see this as kind of historical context of reactor evolution. Actually, as I take it your detailed explanation and reasoning is kind of a result of the experience and simulations on that old design, and the next step (ESBWR?) is already knocking on the door - with the IC brought back in large.

The IC is probably the only real passive cooling solution for light water reactors. The AP1000 essentially uses an IC, which dumps heat to the containment and relies on containment cooling to get that heat to the UHS. The ESBWR uses 4 ICs for the reactor, and I believe 2 for the containment, for design basis load rejects and accidents. With any 3 ICs in service, you should never have to lift relief valves after the initial load reject/MSIV closure. Combined with the non-safety Reactor Water Cleanup system in Shutdown-Cooling mode, the plant will automatically cool to cold shutdown if the operator takes no manual actions following the reactor scram.

What's nice about ICs is that you can fill them up using just about anything. Obviously demineralized water is preferred, but go ahead and dump lake water in if you have to, it's only operating at boiling point, so it's not going to be wrecked like an RPV will be.

As for BWR Mark I/II/III containment, the Mark I was originally qualified looking at just the line rupture. But they later found issues with long term accidents, issues with the "Swell zone" for the suppression pool (the blowdown from a LOCA or ADS actuation would cause a huge swell in pool level and large loads on the suppression chamber). This required substantial re-analysis and upgrades to the design basis requirements for the containment. Even the Mark III, designed with most of this in mind already, found new issues in the 1/4 scale LOCA test facility, several of which had backfit applications to Mark I/II containments.

 

[Hiddencamper]

Operation per the EOP is relevant to looking backward and possibly laying blame on operators at this point. That's not of interest to me. I'm interested in what's possible, period, given this BWR, to stop or mitigate the follow-on accident with respect to cooling before loss of power. Given the decay power, it does not superficially appear to me that any amount of cooling for an hour was going to stop the core from eventually becoming uncovered.

Even if you violated all EOPs and performed a full emergency blowdown and cooled to 200 degF in the first hour, there was sufficient decay heat to damage the unit 1 core. You would have bought some time, maybe enough to recognize something was wrong, but the only real "solution" I personally could have seen was if HPCI was capable of being started and placed in service, you may have bought enough time to get some type of effective response, similar to the Daini site.

 

[Hiddencamper]

HC, can you expand on that if you have a moment? How is 6MW of decay heat on the first day after scram transferred by venting, given a LOC?

What we've learned is that RCIC can really run continuously up to at least 248 degF, which is well above atmospheric boiling point.

The decay heat is going to raise reactor pressure. To maintain pressure, heat from the reactor is transferred to the suppression pool using SRVs and RCIC turbine steam discharge. The pool heats up, and gets pumped back into the reactor. With no RHR HX in service, the pool eventually saturates, and the steam added to the suppression pool will raise containment pressure if it is sealed. If you commence venting at this point (assuming no fuel failure and atmospheric release rates would be in acceptable limits) then rather than raising containment/drywell pressure, you would simply be venting decay heat out the vent. You would lose pool inventory at this time, but you could operate RCIC until the suppression pool was almost entirely drained. You could make up to the suppression pool with almost any injection pump (fire pumps) to continue RCIC operation.

Old EOPs didn't allow this as once the suppression pool HCL was reached you were required to blowdown. New EOPs recognize that you may be relying solely on steam powered cooling systems, and allow you to perform a partial blowdown to continue to use steam driven cooling systems to avoid a transition to Severe accident management procedures.

 

[Hiddencamper]

"Some pump"? How does this apply in the Fukushima context? The backup diesel pump power drowned. Did your nuke have secret aux pumps and portable diesels stored separately from the main diesel backup?

US plants did have diesel driven pumps after 9/11. Japan did not, and even said they should have considered implementing portions of the US's b5b program for extensive damage mitigation after Fukushima occurred.

 

[jim hardy]

"Some pump"? How does this apply in the Fukushima context? The backup diesel pump power drowned. Did your nuke have secret aux pumps and portable diesels stored separately from the main diesel backup?

Actually we did.
Fittings to connect a portable diesel driven high pressure pump for seal injection
A feedwater line from the adjacent fossil plants
an emergency AC tie to five more similar diesels in adjacent fossil plant

not credited in accident analyses , but comforting

ties to adjacent fossil plant were eventually removed as plant upgrades progressed

old jim

 

[Red_Blue]

NUREG/CR-5869 is 214 pages
http://web.ornl.gov/info/reports/1992/3445603689514.pdf

it expands on an earlier one that's far shorter and of course less detailed. will try to track it down, it's easier for us non-BWR folks to absorb

i think this is the one i remember ( it's been five years already ?)
http://www.iaea.org/inis/collection/NCLCollectionStore/_Public/24/072/24072657.pdf

These are quite interesting studies. The Japanese Fukushima reports also mention two papers on hydrogen explosions outside of primary containment, which they consider obscure (one modelling Olkiluoto NPP in Finland and the other Browns Ferry NPP). It appears a lot of theoretical work on severe accident mitigation was simply overlooked or at least not integrated to EOPs. Some of that was even Japanese experiences, such as using plant fire department fire engines for core injection, provisions which had been prepared after earthquake damage to other plants, but formal procedures apparently had not been updated to Fukushima EOP.

A completely another question is that even if there had been much more extensive formal severe accident mitigation guidance available, would they have really implemented it? One of the main human factors issues identified by the Japanese reports, especially the Cabinet ones, is the comparison of how F-2 managed the crisis by always being one step ahead of things. They always had a Plan A in action, while preparing for Plan B to be implemented immediately should there be indication of Plan A failure. And when they were switching Plan A, they tested the viability of implementation of the entire new plan several times before actually carrying the switch over.

In contrast in F-1 this was never achieved when it became obvious that RHR and other sea water reliant systems were going to be out of operation for days. After that, there was over reliance on Plan A continuing to work despite lack of monitoring data and Plan B formulation only started when information came in putting Plan A viability in doubt, sometimes only after several misunderstandings and delays in information flow.

If we accept for Unit 1 that IC in the heavily degraded condition with the internal isolation valves partially closed would not have delayed core uncovery sufficiently for work to fully restore it, even if all PCV external valves had been opened for both trains, and that there was insufficient 125VDC power to start HPCI, then it appears the logical course of action would have been to implement the fire cistern->fire engine->FP system->core spray and car batteries to the MRC for SRV remote manual depressurisation plan ASAP. The question if enough time was available for this would have to look at how long implementing the individual parts of this work took at later stages of the crisis, but with the same resources available.

It appears the biggest problems and longest delays in the accident response all came after the hydrogen explosions and when radiological conditions had degraded both inside key buildings and outside in close vicinity. Another system that took very long time to get to work was SC venting arrangements, which at the end still was only partially successful for Units 1 and 3, being unsuccessful for Unit 2 despite almost a day of trying. In F-2 it was undestood early that any work inside the RBs, including manual valve actuations should be done proactively with anticipated not forced need. They also lined up venting paths, without the need to ever use them. The same was also understood in F-1, but apparently only after observing how things had already gone sour in Unit 1.

Venting however should not have been needed for Unit 1 until many hours or couple days, had core cooling being restored before severe damage, considering how long the other units went with RCIC.

 

[Hiddencamper]

These are quite interesting studies. The Japanese Fukushima reports also mention two papers on hydrogen explosions outside of primary containment, which they consider obscure (one modelling Olkiluoto NPP in Finland and the other Browns Ferry NPP). It appears a lot of theoretical work on severe accident mitigation was simply overlooked or at least not integrated to EOPs. Some of that was even Japanese experiences, such as using plant fire department fire engines for core injection, provisions which had been prepared after earthquake damage to other plants, but formal procedures apparently had not been updated to Fukushima EOP.

A completely another question is that even if there had been much more extensive formal severe accident mitigation guidance available, would they have really implemented it? One of the main human factors issues identified by the Japanese reports, especially the Cabinet ones, is the comparison of how F-2 managed the crisis by always being one step ahead of things. They always had a Plan A in action, while preparing for Plan B to be implemented immediately should there be indication of Plan A failure. And when they were switching Plan A, they tested the viability of implementation of the entire new plan several times before actually carrying the switch over.

In contrast in F-1 this was never achieved when it became obvious that RHR and other sea water reliant systems were going to be out of operation for days. After that, there was over reliance on Plan A continuing to work despite lack of monitoring data and Plan B formulation only started when information came in putting Plan A viability in doubt, sometimes only after several misunderstandings and delays in information flow.

If we accept for Unit 1 that IC in the heavily degraded condition with the internal isolation valves partially closed would not have delayed core uncovery sufficiently for work to fully restore it, even if all PCV external valves had been opened for both trains, and that there was insufficient 125VDC power to start HPCI, then it appears the logical course of action would have been to implement the fire cistern->fire engine->FP system->core spray and car batteries to the MRC for SRV remote manual depressurisation plan ASAP. The question if enough time was available for this would have to look at how long implementing the individual parts of this work took at later stages of the crisis, but with the same resources available.

It appears the biggest problems and longest delays in the accident response all came after the hydrogen explosions and when radiological conditions had degraded both inside key buildings and outside in close vicinity. Another system that took very long time to get to work was SC venting arrangements, which at the end still was only partially successful for Units 1 and 3, being unsuccessful for Unit 2 despite almost a day of trying. In F-2 it was undestood early that any work inside the RBs, including manual valve actuations should be done proactively with anticipated not forced need. They also lined up venting paths, without the need to ever use them. The same was also understood in F-1, but apparently only after observing how things had already gone sour in Unit 1.

Venting however should not have been needed for Unit 1 until many hours or couple days, had core cooling being restored before severe damage, considering how long the other units went with RCIC.

Japan's BWR EOPs were not well updated. My understanding is they were still using rev 1 or 2 (all other plants are on 3 or 4). They had to get dresden's EOPs and SAMGs to use.

They did violate EOPs in that they did not perform a blowdown at unit 1 when required. This resulted in a hot debris ejection which may have contributed to containment leakage. The only way to minimize the damage in this event was exactly as you said, which is also what EOPs say, to blowdown when level was below the fuel and flood vessel or dry well with fire pumps through the core spray header.

With no functioning level indication, and elevated containment temperature causing reference leg boiling, the operators had no indications to go off of. They didn't have enough to demonstrate that reference leg boiling was occurring, could not transition to the flooding EOP, and suffered core damage.

I probably should make another post about BWR EOPs in detail. In all cases they should have blown down the reactor if they didn't know where level was and transitioned to flooding. But they didn't have enough to know if they didn't know where level was. Pretty screwed up.

 

[jim hardy]

It appears a lot of theoretical work on severe accident mitigation was simply overlooked or at least not integrated to EOPs.

yes i recall thinking that at the time.

, then it appears the logical course of action would have been to implement the fire cistern->fire engine->FP system->core spray and car batteries to the MRC

being a PWR guy not BWR i don't know offhand what is a MRC

but i recall thinking "Why don't they hook a gasoline driven welding machine up to the battery bus and get some instruments back ?" I knew exactly where in my plant to hook them, some unused breakers in the DC panels.. Could be their welders were all flooded by the tidal wave i suppose.

The plant is at its simplest a big heat source with several heat sinks and the approach is to assure heat moves from source to sink. That heat transport requires water, and in a PWR pressure above saturation for whatever is temperature.
so yes the need is to get water in there by hook or crook .
If you're using a fire engine you need to get pressure (hence temperature) low enough for your fire engine to overcome it.
I think Mr Hidden' says same, hope I'm not mis-interpreting

With no functioning level indication, and elevated containment temperature causing reference leg boiling, the operators had no indications to go off of. They didn't have enough to demonstrate that reference leg boiling was occurring, could not transition to the flooding EOP, and suffered core damage.

In all cases they should have blown down the reactor if they didn't know where level was and transitioned to flooding.

Loss of DC is the nightmare that wakes you up shaking because even your pumps and diesels need DC to start. The more natural circulation in the heat transport system the better, imho.

I was a maintenance man not an operations guy so my knowledge of EOP's is not very deep. And it's nil for BWR's
But i do remember the dramatic changes to our PWR EOP's post TMI .
In the early days they were failure oriented
"If you have failure X do Y"
the trouble with that is the plant doesn't tell you it has "falure X" it only shows you symptoms, ie strange instrument readings.*
So the procedures were re-written to be symptom oriented :
"If you see indication X do Y "
What a good idea - act on what you see instead of what you think is happening.
I don't know if Tepco's EOP's were similar in that regard to US.
But when batteries failed they no longer had anything to see because the instrument power comes from the batteries..

Sorry for the ramble. A plant was my life for thirty+ years so it's difficult _{er, make that} not possible for me to feel unaffected.

* (well, except for a steamline break outside containment . That one you hear for miles.)

 

[mheslep]

They did violate EOPs in that they did not perform a blowdown at unit 1 when required.

Did they have sufficient control to do so at that point, post tsunami but pre H2 explosion?

 

[Red_Blue]

Did they have sufficient control to do so at that point, post tsunami but pre H2 explosion?

Looking at the timelines, we get this partial information:
15:30 IC trains A and B manually secured, loss of all cooling to Unit 1
18:18 to 18:25 partial operation of train A
18:45 earliest start of Unit 1 core damage per TEPCO November 2011 analysis

March 11 Unit 1 and 2 MCR instrumentation
“late afternoon” battery collection starts
20:00 2 x 12V and 4 x 6V batteries delivered
20:49 temporary AC lighting available
21:19 24V connection to reactor water level gage of unit 1 connected

March 13 Unit 3
06:00 battery collection starts
07:44 ten 12V batteries delivered to MCR, series connection starts
09:08 120V connection to SRV established

It should be noted that there was no initial rush to provide instrumentation power, because after initial loss of DC power from unit batteries, that power returned for a while and only then faded away for good. Also, time was lost in looking over paper wiring diagrams with flashlights in the MCR, when this could have been done in the ERC that had AC backup power and two working phone lines to each MCR to relay instructions with.

In the unit Unit 3 case they collected and connected batteries for the actual case of using the SRV remotely from the MCR, but here the conditions in Unit 3 & 4 MCR were much worse than earlier in Unit 1 & 2 MCR, because this was after the H2 explosion in Unit 3 and everybody had to wear full suits and masks, including rubber gloves for radiation protection. Also at that point there were only flashlights available. Also the battery collection efforts were significantly hampered by radiation and additional debris outside.

I think it would not be unreasonable that the battery collection time for Unit 1 SRV operation could have been reduced to less than an hour in March 11 late afternoon with the conditions then prevailing and also if decision had been made to utilise employee's personal vehicles instead of TEPCO and contractor vehicles, access to which apparently was much delayed.

If this battery collection time had been OTOH used by another team to prepare the connection supplies, tools and wiring instructions from the ERC where PCs and electronic records with better search capabilities were available, I believe it should have been possible to bring the connection time down to less than one hour as well. That would have still left about an hour to come up and decide to implement this plan, which should have been enough even with time to evaluate IC effectiveness before committing.

Obviously, to be really effective it would also have required lining up the FP system injection path and positioning a fire engine for it. This was actually only attempted starting on March 12th 02:00 and the first attempt failed to locate the injection port, because the plan was to just drive around the building and search for it with the directable searchlights of the truck. They were able to locate the correct water connection only after going back to the ERC and getting a person on board who actually knew where it was. Because of this little snafu, it took until 04:00 to do the connection. There was also no other preparatory work for this until after midnight of March 12th, except breaking one electrically locked gate and some road repair work that was being carried out for other purposes. When the water injection to Unit 1 finally started, radiation levels were already high around Unit 1 buildings and required periodic evacuations of contractor personnel.

The actual mission time from when correct personnel was onboard, was from 03:00 to 04:00, so one hour to position the first fire engine and connect the hoses.

It should also be noted that no priority was given to the fire engine plan until the DDFP and plant fire water system plan was tried for many hours and failed. Its failure could have been expected for at least two reasons by the Japanese reports. First is that the DDFP was at a lower level than the external water connection and had less exhaust pressure than the fire engines, so even if it did get water from the system, it would require very low reactor pressure to work. Apparently none of the units achieved low enough RPV pressure for it to work for any of them. Another problem was that the fire water system was damaged plant wide due to the earthquake and tsunami and there was never any assurance that more water than what was in some length of upstream pipes would ever reach the DDFP. The plant fire department had closed valves from the main filtered water tank due to extensive leaks in many fire water lines.

However, the valve line up work for the FP injection from either the DDFP or the fire engine connection via MUWC and CS took from 18:30 to 20:50. Work was hampered by the same team having several tasks, poor instructions and wrong keys, having to return to the MRC several times and then back to the RB to continue the work. With even a little better planning or execution this task might have been condensed to two hours as well.

I have not seen a clear accounting of personnel in any of the reports, but it appears to me like additional manpower resources were only sent to the main control rooms (in addition to about 12 per unit in the regular shift) for particular recovery work tasks from the ERC and everything else had to be done with the regular shift that also had to have people manually record unit data and communicate with the ERC. That could not have left many 2 man teams to simultaneously do several control or recon missions from the MRC to the RB or TB. I would have expected much faster actions with more people available, essentially standing by at the MRC and waiting for new tasks that might arise either locally or from instructions from the ERC, without the ERC having to gather and then send the necessary extra personnel from the ERC to the unit needing it.

 

[etudiant]

NHK reports that a sarcophagus structure is under consideration, to seal off the buildings with the fuel inside.
Given the groundwater issues, is this a plausible option for even the relatively short term?

http://www3.nhk.or.jp/nhkworld/en/news/20160713_25/

 

[jim hardy]

I'll not criticize those guys
i still remember the shock at what Hurricane Andrew did to my plant . We sat on our diesels for a week while system folks put the grid back together. Meantime we fixed the water treatment plant and put security fences back up.

Fukushima Lessons Learned are here, i only noticed these pages a few minutes ago
http://www.nrc.gov/reactors/operating/ops-experience/japan-dashboard.html
http://www.nrc.gov/reactors/operating/ops-experience/japan-dashboard/priorities.html
It will be interesting to explore them.

 

[mheslep]

I'll not criticize those guys...

Which guys? If you mean the operators on the job at the time, maybe they did the best they could with what they knew. Yet three reactors are a total loss, most of the reactors across Japan were shut down for some years, people are excluded from the area for some years, and all of this was avoidable with either better designs or better preparation. Criticism is appropriate for those who could have taken action before the fact. Criticism is necessary if clean nuclear power is to flourish, else expect more of the same.

 

[jim hardy]

Which guys? If you mean the operators on the job at the time,

that's indeed to whom i refer.

Criticism is appropriate for those who could have taken action before the fact.

I've said consistently that blame lies with " responsible design organization " who dismissed historical reports of huge tidal waves that surfaced i think in the 1990's.

Recall my allusion a few days ago to "bureaucratic potato toss" .old jim

 

[etudiant]

When considering the available options, was there no way to use the power from Daiichi 5 and 6 to serve the remainder of the site?
Afaik, they were fully operable even after the earthquake and had escaped the tsunami.

 

[Hiddencamper]

When considering the available options, was there no way to use the power from Daiichi 5 and 6 to serve the remainder of the site?
Afaik, they were fully operable even after the earthquake and had escaped the tsunami.

5/6 were physically separated from 1-4.

Additionally the switchgear, breakers, motor controllers at 5/6 weren't submerged like at 1-4 As 5/6, were built at higher elevation.

So even if you could get power to 1-4, there wasn't any way to power up pumps.

Plus there is the issue of Diesel engine loading. You can expect a LPCI pump to be between 0.7 and 1.2 MW. Meaning a large twin 20 cylinder engine could power 4 LPCI pumps, but more standard engines could only power 2.

 

[etudiant]

I understand there would be huge obstacles, it is just surprising to me that this considerable resource could not be made available in any way.
Even just to charge the batteries might have helped some.
To lose three reactors in good part because there is no power while there are gigawatts standing idle just up the street is truly 'stranger than fiction'.
Presumably there is no provision for site self support power at other nuclear complexes either. Would such an internal link not be feasible and possibly helpful?

 

[Hiddencamper]

I understand there would be huge obstacles, it is just surprising to me that this considerable resource could not be made available in any way.
Even just to charge the batteries might have helped some.
To lose three reactors in good part because there is no power while there are gigawatts standing idle just up the street is truly 'stranger than fiction'.
Presumably there is no provision for site self support power at other nuclear complexes either. Would such an internal link not be feasible and possibly helpful?

The "self power" thing is complex. I'm assuming you are talking about keeping the reactor online on house loads only after a grid disturbance.

First: the vast majority of nuclear units do not have 100% load reject capability. That means at full power, a turbine or generator trip WILL result in a reactor trip, as the steam side isn't rated or designed to handle the pressure/temperature excursions.

Some plants have or had complex logic and systems actuations to rapidly runback the reactor, temporarily relive steam pressure (even at the cost of condenser vacuum or lifting relief valves), and hopefully steadying out at a low power level with the generator supplying house loads only. Problems: if anything goes wrong or the initiating event knocked out one of the systems required for the runback, you usually end up with a much more severe transient on the plant and reactor than if you just allowed the trip to happen. For plants with full generator load reject capability, they typically have to take a thermal limit penalty on the core due to this.

Talking to the BWR/6 in Germany, I've been told their version of this works half of the time at best. Also in the case of Fukushima this would require no seismic damage to the secondary side of the plant, which is not rated for seismic protection and had known damage. Some other things to consider: modern high efficiency mono block turbines do not like low load or temperature swings, and would likely vibrate and damage/rub if left in this mode for too long (house loads only isn't enough to keep mono locks stable).

Furthermore, at least in the Fukushima case, this would not have been able to work as the tsunami still flooded all the electrical distribution. The secondary side of the plant was completely out of commission.

 

[jim hardy]

the tsunami still flooded all the electrical distribution.

@etudiant
salt water in switchgear renders it unuseable .

I used to live by saltwater
if an ordinary extension cord falls in,
the end smokes, starts sparking and burns itself up
and that's at just 115 volts. Imagine what 4.2 or 6.9 kv would do.
Design constraints:
One places his diesels low in the building.
They're massive locomotive engines, and F=MA, and an earthquake is all A.
The heavy diesels go in the basement so earthquakes don't amplify the ground acceleration and whip them around even more as the building flexes like a bullwhip.
One places the electrical switchgear near the diesels so as to keep those runs of huge cable not very long.
So, diesels and switchgear in the basement is a good for earthquakes but not so good for flooding.
They needed a submarine hull around them.
I keep coming back to somebody dismissed the possibility of huge tidal waves .

I have a saying -
"If you want to guarantee that something will happen-
just stand up, slam the table, and publicly stake your reputation that it won't."
old jim

 

[Rive]

I understand there would be huge obstacles, it is just surprising to me that this considerable resource could not be made available in any way.

I might be wrong, but as I recall they already had to crosswire U5 and U6 diesels to maintain cold shutdown there, because one of those diesels were down too.

 

[Hiddencamper]

I might be wrong, but as I recall they already had to crosswire U5 and U6 diesels to maintain cold shutdown there, because one of those diesels were down too.

They did.