iaea ™ omoto final · 2013. 11. 6. · 12.6.27! 1!...
TRANSCRIPT
12.6.27
1
Accident at TEPCO’s Fukushima-‐Daiichi NPP Possible underlying factors influencing decision-making,
preparedness and risk management
Accident at TEPCO’s Fukushima-‐Daiichi NPP
Fukushima-‐Daini-‐1 Fukushima-‐Daiichi-‐4
Akira OMOTO Professor, Tokyo Institute of Technology, and Commissioner, Atomic Energy Commission
[Note] The views expressed in these slides do not represent the consensus official view of AEC, Titech, NISA nor Utilities
Outline
IAEA Technical Meeting, 2012June, A. Omoto 2
Introduc.on
Four cri.cal areas
UT study
Accident Inves.ga.on Commi:ees
Discussion
Concluding remarks
12.6.27
2
Hazard source
Radiological consequence to human
1. Preven9on by design -‐Natural hazard
2. (level4) Accident Management 3. (level5)Emergency Plan
Avoid Core Melt
Avoid large release
-‐SBO and LUHS
4. Safety regulation
Try to extract possible underlying issues that may have existed in the background from cri9cal areas that failed to prevent migra9on to disaster, and
from UT (University of Tokyo) study from Accident Inves9ga9on CommiTees’ reports
“Four cri9cal areas” in Fukushima Accident using Swiss cheese model
Overall approach
IAEA Technical Meeting, 2012June, A. Omoto 3
Why [may] have existed? No explicit causal rela9onship study yet that includes cultural, organiza9onal and societal issues
What is meant by “underlying factors”? Factors influencing decision-‐making and resultant causal chain of events; Culture Competence, knowledge and understanding Safety management and oversight Interac9on between nuclear experts
• and organiza9on, • and society, • and experts in other disciplines
Possibly formulated in the history of NE programme
Overall approach
IAEA Technical Meeting, 2012June, A. Omoto 4
12.6.27
3
created contribu9ng factors
IAEA Technical Meeting, 2012June, A. Omoto 5
Company, Management, Government, Regulator, Society
Causal chain of event
Evolving from classical technical causal chain model to involve managerial and societal factors to a new model such as
Accident is the result of flawed processes involving interac=ons among people, societal and organiza=onal structures, engineering ac=vi=es, and physical system components that lead to viola=ng the system safety constraints. (Nancy G. Leveson, “Engineering a Safer World”)
underlying factors
Introduc.on
Four cri.cal areas
UT study
Accident Inves.ga.on Commi:ees
Discussion
Concluding remarks
IAEA Technical Meeting, 2012June, A. Omoto 6
12.6.27
4
Critical area 1) Design
1. ProtecAon against natural hazard Recognizing uncertain9es in natural science Preparedness to “beyond assumed condi9ons”
2. Plant capability against SBO (StaAon Blackout w/o any AC/DC) and isolaAon from UHS (UlAmate Heat Sink)
IAEA Technical Meeting, 2012June, A. Omoto 7
Tsunami earthquake
[SOURCE] T. Lay et al, “Outer trench-‐slope faul=ng and the 2011 Mw9.0 off the Pacific coast of Tohoku Earthquake”, Earth Planets Space, 63, 713-‐718, 2011
Japan trench
Plate boundary earthquakes
Outer trench-‐slope faulAng
Three Tsunami source areas
IAEA Technical Meeting, 2012June, A. Omoto 8
12.6.27
5
2002 JSCE (Japanese Society of Civil Engineers) guideline on design protec9on against Tsunami at nuclear power plants Modifica9on by U9li9es in 2002 based on this guideline
2002.7 Long-‐tern Projec9on by Earthquake Research Hq. : Tsunami earthquake may occur anywhere along J trench in Tohoku area
Tsunami Probabilis9c Hazard study U9li9es joint study on probabilis9c Tsunami hazard (2002-‐) and source model TEPCO’s analy9cal results (2006) did not lead to prac9cal ac9ons [SOURCE] TEPCO’s final inves=ga=on report, 20June2012
Methodology guide from JSCE using logic tree to represent epistemic uncertain9es (2007)
[SOURCE] T. Annaka, “Logic-‐tree Approach for Probabilis=c Tsunami Hazard Analysis and its Applica=ons to the Japanese Coasts”, Pure and Applied Geophysics, 164(2007) 577-‐592, 2007
ProtecAon against Tsunami
IAEA Technical Meeting, 2012June, A. Omoto 9
Off-‐Fukushima coast Historically limited Tsunami record of significant inunda9on height Es9mated weak coupling and con9nuous slip in this region [SOURCE] T. Matsuzawa, Kagaku (Science), 2011 Vol 81 No.10
TEPCO’s Tsunami study (2008) by hypothe9cally assuming M8.3 “off-‐Sanriku” (N. of J trench) earthquake source at off-‐Fukushima coast
• Resultant inunda9on height of 15.7m • TEPCO had asked JSCE to review
[SOURCE] TEPCO’s final Inves=ga=on report, 20June2012, hgp://www.tepco.co.jp/en/press/corp-‐com/release/2012/1205638_1870.html
Nevertheless, in hindsight, delibera9on of “what happens if the calculated inunda9on height in 2008 study was correct?” for defense-‐in-‐depth, this could have changed the whole story
IAEA Tsunami workshop at Kalpakkam 2005 23 cases of NPP external flooding [SOURCE] A. Godoy, Kalpakkam WS
IAEA Technical Meeting, 2012June, A. Omoto 10
12.6.27
6
1. Probabilis9c Tsunami Hazard Analysis In 2006, TEPCO conducted a hypothe9cal analysis u9lizing this JSCE Probabilis9c Tsunami Hazard Analysis methodology and it showed that the occurrence of a tsunami exceeding 10 m could only occur once every 100 thousand to a million years. However, this analysis was conducted for the purpose of confirming adaptability and improving methods that at the 9me were s9ll in development. Thus, TEPCO did not interpret this figure to literally mean the actual frequency of tsunamis that could strike the nuclear power plant in Fukushima. 2. Asked for JSCE review …in 2008, TEPCO conducted another trial calcula9on u9lizing the wave source model of the Meiji Sanriku-‐oki Earthquake along the trench off-‐shore Fukushima (the result: 15.7 m). However, the validity of this wave source model had been in ques9on. TEPCO has requested that JSCE review the suitability of this hypothesis….. 3. Jogan Tsunami (year 869) TEPCO conducted tsunami deposit surveys, and as a result, an al9tude of about 4m in the northern part of Fukushima Prefecture was confirmed for the tsunami deposits carried by the Jogan tsunami while no tsunami deposits were found in the southern part. As there were inconsistencies between the results of the inves9ga9on and the trial calcula9on via using the proposed wave source model (the result: 9.2 m), TEPCO considered it necessary to conduct further inves9ga9on and research in order to determine the wave source of the Jogan tsunami.
* TEPCO’s argument
IAEA Technical Meeting, 2012June, A. Omoto 11
[SOURCE] www.tepco.co.jp/en/nu/fukushima-‐np/info/index-‐e.html
Report from the Central Disaster Management Council, 2011Sept28
3.11 was caused by simultaneous occurrence of “Japan trench earthquakes “ & “Tsunami earthquake”
Former principles for hazard assump9on [note] need to be fundamentally reviewed
[note] Seismic intensity and Tsunami heights not reproducible by the seismic source model was regarded as having low probability of occurrence [SOURCE] hgp://www.bousai.go.jp/jishin/chubou/higashinihon/houkoku.pdf
IAEA Technical Meeting, 2012June, A. Omoto 12
12.6.27
7
IAEA Technical Meeting, 2012June, A. Omoto 13
Tsunami earthquake : a dominant source
Underlying issues that may have existed in the background
1. Interpreta9on of uncertain9es in natural science 2. Understanding of difficulty in decision-‐making under uncertain9es
3. Cau9ous assessment and prepara9on to beyond assumed condi9on (yet, to what extent?)
What if the assumed condi9on by Tsunami experts was wrong(2002, 2006) or right(2008)?
Flooding analysis* could have strengthened level of protec9on
* Limited-‐scope study was done on flooding in “beyond assumed condi9ons” for intake structure • Reliance on Air-‐cooled EDG capability, if UHS is lost • Feed and Bleed capability of BWR in the case UHS is lost
was well understood
IAEA Technical Meeting, 2012June, A. Omoto 14
12.6.27
8
SBO rule comply with US 1988 SBO rule “30 minutes rule”: Not a decisive factor as following operaAon shows 0-24hrs into the accident: Core water makeup by use of stored energy (RCIC/HPCI)) 24 hrs: Depressurize RCS and LP injection 32 hrs: Heat dissipation to the alternative heat sink by containment scrubbing venting
Depressurization
Depressurization
Rx Pressure
RCIC Flow
Depressurization Venting
Drywell Pressure
Wetwell Temperature
Wetwell Pressure
Drywell Temperature
2Pd
Pd
FP Flow
Loss of water inventory equivalent to Decay Heat
RPV water level
Fuel uncovered time period is short. (less than 1 hour)
IAEA Technical Meeting, 2012June, A. Omoto 15
14 NPPs affected by Tsunami: What made differences?
Onagawa (3 units; 2 in operation)
Fukushima-I (6 units; 1,2,3 in operation)
Fukushima-II (4 units in operation)
Tokai (1 unit in operation)
GL>Tsunami
GL>Tsunami
Tsunami Inundation height SBO
Isolation from UHS
GL(10-13m) < Tsunami (11.5-15.5m)
GL(12m) < Tsunami (12-14.5m)
Power available
- All offsite Pwr& EDG were lost except for 1F6 air-cooled EDG - 1F5 power supplied from 1F6
Not completely
Completely isolated from the sea
Almost complete isolation
- One offsite power was available
Availability of power (offsite or EDG + in-‐plant power center) and SAM implementaAon was a decisive factor, especially;
Ground Level height & enclosure against Tsunami [saved Onagawa and Tokai] Emergency power using alterna9ve heat sink & loca9on of power supply equipments [saved 1F6] SAM for power inter-‐connec9on with adjacent unit [saved 1F5] SAM using a single available offsite power [saved 2F]
Not completely
IAEA Technical Meeting, 2012June, A. Omoto 16
12.6.27
9
1. Robust and workable Accident Management
2. The role of containment system in SA condiAon Suspected significant leakage (reduced drywell pressure) from 1F2
containment due to over-‐temperature (3.15AM) [SOURCE] K. Miyata, AESJ,
26May2012: possibly leading to significant fallout in the North-‐West due to precipita9on
High level assurance of avoiding land contamina9on (filter, over-‐pressure & over-‐temperature protec9on)
2ndary containment management (external event, hydrogen combus9on outside of the CV)
CV isola9on vs. over-‐riding to enable cooling
Critical area 2) Level 4 Defense-‐in-‐depth
IAEA Technical Meeting, 2012June, A. Omoto 17
Level 4 Defense-in-depth (INSAG-10): Control of severe conditions including prevention of accident progression and mitigation of the consequences of severe accident
AMG not robust enough to be effec9ve/executable under plant damage condi9ons by high Tsunami
Robustness of AMG
IAEA Technical Meeting, 2012June, A. Omoto 18
12.6.27
10
Short term Reactor water makeup by AC-‐independent IC/RCIC/HPCI
Then, while trying to restore AC/DC power and Heat Sink Depressurize Reactor Coolant System by Safety/Relief Valves Ac9vate Low Pressure injec9on systems Containment vent to avoid over-‐pressure failure
14.46 Earthquake, Loss of offsite power, Start of EDG, IC/RCIC 15.27-‐ Tsunami followed by Loss of AC/DC, Isola9on from UHS
Given this situaAon, operaAon to avoid core damage
Core degrada9on followed by Hydrogen explosion
Require workable/effec9ve AM
Failure of RCIC/HPCI on the 3rd and 4th day Delayed ven9ng, de-‐pressuriza9on of RCS and LP injec9on
IAEA Technical Meeting, 2012June, A. Omoto 19
Limited available resources and scaTered debris/tanks Field works risked their lives under devasta9on/radia9on and fear
of hydrogen explosions and asershock (TEPCO report)
Limited available resources under harsh environment
IAEA Technical Meeting, 2012June, A. Omoto 20
12.6.27
11
a) External cooling of containment Over-‐temperature protecAon
b) Filtered venAng Over-‐pressure protecAon Land contaminaAon
[SOURCE]hgp://www.aec.go.jp/jicst/NC/tyoki/sakutei/siryo/sakutei13/siryo1-‐3.pdf
IAEA Technical Meeting, 2012June, A. Omoto 21
Japanese UAliAes announced measures to over-‐temperature failure and Filtered venAng (2012Feb)
1. Sensi9vity to risks arising from external events and their impact to AMG ac9ons
2. “Accident will not happen here” leading to lack of realism in SAM
3. Lack of societal safety goal, by considera9on of offsite cost, power replacement costs, in addi9on to acute and latent cancer fatali9es
4. Con9nuous safety improvement hindered by; a) “prisoner’s dilemma” situa9on with the society under distrust
Safety modifica9on is taken as evidence of unsafe plant b) insufficient learning from good prac9ces in risk management
From modifica9ons based on findings in IPEEE From protec9ons under B5b clause [informed to regulatory body (NISA/JNES)
from USNRC in 2003/2007, but no ac9on by them] IAEA Technical Meeting, 2012June, A. Omoto 22
Underlying factors that may have existed in the background
12.6.27
12
[SOURCE] Courtesy of K. Tateiwa, Presenta=on to US-‐EPA, 20January2012
Yet, high moral among field workers at Fukushima Ref.: Voices of TEPCO’s field workers from TEPCO report’s Appendix (hgp://www.tepco.co.jp/cc/press/betu11_j/images/111222p.pdf)
Offsite center’s func9on was lost Implementa9on of EP (No9ce to the public on evacua9on, vehicle, Iodine tablet etc) Delinea9on of responsibility including PM’s role Poor communica9on (PM office and Gov officials in CMC etc) Misunderstanding between PM office and TEPCO on “withdrawal” Systema9c collec9on of informa9on and sharing/dissemina9on Poor record-‐keeping on Government’s decision-‐making process
Needs to revisit Delinea9on of responsibility, command line, coordina9on, Design and func9on of “offsite center” Offsite emergency plan (scope of EPZ, preparedness) Communica9on system Mobile equipments
CriAcal area 3) Level 5: Emergency Plan and Crisis Management
Observed problems (ICANPS interim report, NAIIC statement and others)
IAEA Technical Meeting, 2012June, A. Omoto 24
12.6.27
13
1. Emergency Plan: Poten9al “assump=ons” problem in the most basics level of safety culture hierarchy model “Accident will not happen here” Leading to lack of realism in seung offsite center facili9es and
evacua9on plan (communica9on tool, vehicles for evacua9on, road…) [source] report from the associa=on of municipali=es having NPPs
hgp://www.aec.go.jp/jicst/NC/iinkai/teirei/siryo2012/siryo19/siryo1-‐1.pdf
2. Understanding of delinea9on of responsibility Interna9onal prac9ces is Onsite primarily by Operator and
Offsite by local government, both under advices from regula9on etc
No FEMA in Japan
IAEA Technical Meeting, 2012June, A. Omoto 25
Underlying factors that [may] have existed in the background
HOW A NEW EMPLOYEE LEARNS THE WORK CULTURE
Assumptions
Concepts Knowledge
Slogans, Values
Use of Time
Patterns of Behaviour
Physical Things
“Social Fabric”
Assumptions
Espoused Values
Artefacts
Invisible
Visible
Documents Language
SOURCE: IAEA-‐TECDOC-‐1329, Safety culture in nuclear installa.ons
IAEA Technical Meeting, 2012June, A. Omoto 26
12.6.27
14
Regula9on Responsibili9es not in a single regulatory body (Ex) development of regulatory guide by NSC, licensing by NISA Technical competence/Effec9veness in safety regula9on (Ex) Requirements on SBO, SAM (Severe Accident Management)
U9lity Effec9veness of risk management as primary responsible body
• Use of risk informa9on to address vulnerabili9es • “Sensi9vity “to safety-‐related issues/informa9on • Technical competence and autude towards “uncertain9es” • Effec9veness of JANTI, established in 2004 emula9ng INPO
Regula9on/U9lity Focus on Quality Assurance/Compliance rather than risks, seemingly especially on formality of documents and evidences rather than substance (aser 2002) Avoidance of land contamina9on: should have had higher priority
CriAcal area 4) Safety regulaAon (and assurance of safety)
IAEA Technical Meeting, 2012June, A. Omoto 27
1. Technical exper=se and regulatory effec=veness to reduce risks of regulatory body
2. Risk management for responsible use addressing vulnerabili9es ATen9veness to good prac9ces in the world con9nuous improvement approach
3. Assump=on relevant to severe accident? “Accident will not happen here”
IAEA Technical Meeting, 2012June, A. Omoto 28
Underlying factors that may have existed in the background
12.6.27
15
Introduc.on
Four cri.cal areas
UT study
Accident Inves.ga.on Commi:ees
Discussion
Concluding remarks
IAEA Technical Meeting, 2012June, A. Omoto 29
Technical issues leading to nuclear disaster: Mostly understood University of Tokyo’s GONERI (Nuclear GCOE) project to study “Why nuclear community in Japan failed to prevent this accident”
A series of interviews by GCOE members to 24 recognized nuclear experts (University, Regulator, AEC, U9lity, Industry, research ins9tute, NPO cri9cs)
To help changes; -‐ Iden9fy weakness in culture/organiza9on/interface -‐ Avoid accidents of different types but by similar root causes
Changes in such areas as Organiza9onal Culture Interac9on with Natural Science and understanding of
uncertain9es on the part of Natural Science Risk management by Owner/Operator
Results presented at GLOBAL 2011 “Safety and Security issues in the light of the accident at TEPCO’s Fukushima-‐Daiichi NPP” (A. Omoto, K. Juraku, S. Tanaka)
UT project to find vulnerability and strengthen safety
IAEA Technical Meeting, 2012June, A. Omoto 30
12.6.27
16
Degraded safety culture (complacency, lack of sensi9vity to informa9on, delayed ac9on to alert, over-‐confidence on NPP safety) Lack of tension between Regulators/Operators Too busy in caring day-‐by-‐day problems Inappropriate crisis management Society takes risk-‐related ac9ons, modifica9ons as evidence of unsafe plants Failure of safety regula9on No cross-‐cuung safety experts in Japan Why nuclear experts had accepted risks that (in hindsight) the society cannot accept?
Why cauAous acAons against Tsunami was not enough?
WHY FAILED TO PREVENT (incl. accident progression & consequence) ?
Why prevenAon/miAgaAon against BDBE was not enough or did not funcAon well?
Focus on internal events Not enough aTen9on to localiza9on of designs from US origin, by considering natural environment, intensive use of coastal area Lack of communica9on & mutual understanding between natural science and engineering on uncertainty and design margin
Expressed views and discussions in the interviews
IAEA Technical Meeting, 2012June, A. Omoto 31
Issues identifiable even before Fukushima
Isola9on from global safety regime Experts in a cacoon, lack of dialogue with the society No cross-‐cuung safety experts Lack of sense of responsibility as an individual
What prevent taking corrective actions? Operator is a King, no cri9cism No ques9on asked to NE programme implemented under the Na9onal Policy “Loose lips sink ships” Too busy to care
If you had recognized such issues, what acAons were taken?
Improved Emergency preparedness in the light of 2007 KK earthquake such as construc9on of seismic isola9on ERC Rainey project, CAP “Safety alert” reports Crea9on of local commiTee at KK to improve safety (equally manned by pro-‐, an9-‐ and neural)
Issues identifiable even before Fukushima
Actions were taken …but not enough (TEPCO)
Actions were not necessarily taken
IAEA Technical Meeting, 2012June, A. Omoto 32
12.6.27
17
Accident was caused by defects in regulatory system Delay in reflec9ng new scien9fic/technical findings
Delayed regulatory ac9ons to review Tsunami Lack of sensi9vity to interna9onal trends and incidents and delayed ac9ons (Ex. IPEEE, B5b) Focus on hardware and structural integrity issue Inappropriate delinea9on of responsibility between NISA and NSC (Ex. Licensing criteria by NSC, while NISA to use it) Poor technical exper9se in NPP design and opera9on
(frequent staff shuffling system in Japanese government) Japanese regulatory body put emphasis on hardware, rather than focus on elements raised in IAEA’s safety fundamentals (or INSAG-‐12) Heavy focus by NISA on QA drove NPP staff completely occupied by documenta9on and no 9me to visit plants or to think about safety
Expressed views on regulation
IAEA Technical Meeting, 2012June, A. Omoto 33
Degraded safety culture Appoin9ng non-‐technical staff to plant manager by placing high priority for interface with local community/government Lack of sensi9vity and learning autude from interna9onal trends and foreign incidents Not willing to take ac9ons before something happens (Ex. 2007 KK Earthquake was an alarm signal, without which U9lity would have taken no serious ac9on to natural hazards) Lack of knowledge in opera9on by NPP staff members other than those in Opera9ons Department
Complacency : 2007 KK Earthquake had proved that safety can be maintained even by an earthquake exceeding Design Basis Misunderstanding may existed that safety is assured by compliance to regulatory requirements
Expressed views on UAlity’s aktude to safety
IAEA Technical Meeting, 2012June, A. Omoto 34
12.6.27
18
(Natural hazards) U9lity adhered to US-‐origin design; delay in localiza9on by paying aTen9on to Japanese unique condi9ons (natural hazard, highly-‐populated coastal line) Focus on internal events, not on external or security-‐related events Lack of dialogue may have led to misunderstanding of “uncertain9es” in Natural Science
(Blinded by day-‐by-‐day business) Blinded by day-‐by-‐day business and put safety issues aside Less opportunity to think about design and safety. Increased focus on day-‐by-‐day Opera9on & Maintenance, and on QA documenta9on
(Experts of nuclear safety) Decline in the Nr. of safety experts as SAM “had completed” Defense-‐in-‐depth not appropriately interpreted, forgot residual risks Focus on probability rather than consequence No cross-‐cuung safety experts in Japan
Expressed views on Nuclear community’s generic aktude to safety
IAEA Technical Meeting, 2012June, A. Omoto 35
(Interac9on with Society) Engineers are supposed to create societal value, but had limited communica9on with the society on what the society expects Con9nuous improvements by nuclear u9lity hindered by fear that the society may take safety-‐related modifica9ons as evidence of unsafe plants (amid sharply polarized views on NP)…like prisoner’s dilemma, failure to achieve a goal (safety) due to distrust to each other
(U9lity business environment and organiza9onal culture) Deregula9on changed Management autude towards compe99veness of nuclear power in power genera9on op9ons Giant coopera9on. Delay in ac9ons. Arrogant Risk Management focused rela9onship with the local community, not LPHC risk
(Experts in nuclear community) Weakness in taking responsibility as an individual “Communica9on specialists” may have reduced opportuni9es for experts dialogue with the society
Expressed views on InteracAon with Society, Culture, OrganizaAon
IAEA Technical Meeting, 2012June, A. Omoto 36
12.6.27
19
Three-level model of Safety Culture Artefacts-‐Visible Signs (gree9ng rituals, dress, housekeeping – visible)
Espoused Values (values that are adopted and supported by a person or organiza=on based on strategies/ goals)
Basic Assump.ons (Such as “human nature good or evil”)
Assumptions
Espoused Values
Artefacts
“Social Fabric”
visible
invisible
[SOURCE] originally by Edgar Schein, former professor at the MIT Sloan School of Management, expert on organizational culture
IAEA Technical Meeting, 2012June, A. Omoto 37
Severe Accident will not happen here Safety is assured by satisfying regulatory requirements Plant manager’s priority is relationship with locals Loose lips sink ships Nuclear power is supported by a nationally endorsed policy
“Safe and feel safe (by the society)”
Use of time Blinded by day-by-day business and became insensitive to LPHC risks or put aside safety issues for later actions Seal-in questions
Visible Signs
Espoused Values
Action pattern Poor consideration of external event risks Lack of learning attitude from global best practices Not sensitive to criticism from outside
Observation: By way of analogy
Suspected “Basic Assump.ons”
Slogan
IAEA Technical Meeting, 2012June, A. Omoto 38
12.6.27
20
Prof. D. Klein (Former chairman of USNRC, Ripon Forum, Summer 2011) The LL from Fukushima are many, but what may be surprising is how few may actually apply to US plants. In a culture where it is impolite to say “no” and where ritual must be observed before all else, I think that Western style “safety culture” will be very hard for the Japanese to accept Ludger Mohrbach, VGB PowerTech (April 15, 2011) Ques9on: Is this accident a maTer of residual risk of nuclear energy?No, it is rather a maTer of obviously having ignored a high specific risk Prof. Oka (Waseda University, HP) The accident is deeply rooted in Japanese society and culture; lack of responsibility by the Government, lack of open dialogue, closed experts’ community Prof. Yagawa (AESJ journal) World-‐class manufacturing but not built on basic R&D on NP Prof. Hatamura (in his book on “Assume condi9ons not assumed”) If you do not think beyond assumed condi9ons, you are not prepared enough
CollecAng informaAon from other analysis/statements
IAEA Technical Meeting, 2012June, A. Omoto 39
Prof. S. Takemori (in his book on na9onal nuclear policy and u9lity) “Implicit protec9on” by the Government over u9lity’ implementa9on of NP policy (business) caused poor risk management by u9li9es and the financial market relied on this “protec9on”
Prof. T. Kikkawa (in his book on TEPCo – the root cause of failure) Failed to recognize that poor risk management to nuclear accident was the largest threat to the company Expecta9on on “implicit protec9on” by the Government over u9li9es implemen9ng na9onal NP policy
Prof. J. Ahn (UCB, Iwanami “Science”) The way NE policy is determined and implemented needs scru9ny
CollecAng informaAon from other analysis/statements
IAEA Technical Meeting, 2012June, A. Omoto 40
12.6.27
21
Weakness in achieving responsible use:
1) Interac9on with outside (society, scien9fic community, safety experts in other area, global nuclear safety regime)
2) Addressing societal value
3) Tension and sensi9vity
4) Effec9ve safety management and oversight
ObservaAons
IAEA Technical Meeting, 2012June, A. Omoto 41
Introduc.on
Four cri.cal areas
UT study
Accident Inves.ga.on Commi:ees
Discussion
Concluding remarks
IAEA Technical Meeting, 2012June, A. Omoto 42
12.6.27
22
Government report to the IAEA (June/September2011) : 28 Lessons in 5 specific areas (Preven9on of Severe Accident, Severe Accident Management (SAM), Emergency response, Safety infrastructure, culture)
Key points are; 1. Design considera9ons against natural hazards 2. Design considera9ons against SBO (Sta9on Blackout) and Isola9on from UHS (Ul9mate Heat Sink) 3. Completeness/effec9veness of SAM 4. Emergency Management 5. Safety regula9on and safety culture 6. Mul9ple unit installa9on 7. Spent Fuel Pool design
[source] hgp://www.me=.go.jp/earthquake/nuclear/backdrop/20110911.html
Government reports and Lessons Learned
IAEA Technical Meeting, 2012June, A. Omoto 43
NPO “Rebuild Japan” [RJIF] (report published, February2012)
Prevailed “safety myth” leading to lack of precau9ons by considering “beyond assumed condi9ons”
Capability of regulators as compared with TEPCO’s Weak risk governance under implementa9on of Government-‐
endorsed NE policy by U9li9es Crisis management and leadership (conflic9ng view on PM’s role
from Congressional CommiTee) [source] hgp://rebuildjpn.org/en/project
Diet (Congressional) Inves9ga9on CommiTee [NAIIC] (ongoing, to be released in June2012) : Informa9on released
9June2012 centered around the role by PM and the Cabinet PM’s role in crisis management and crisis management system Dissemina9on of informa9on (predic9on of FP dispersion) Priority not on protec9on of health of the local residents [source] hgp://www.naiic.jp/wp-‐content/uploads/2012/06/RontenSeiri2F_20120609.pdf
Key issues raised by the three invesAgaAon commimees
IAEA Technical Meeting, 2012June, A. Omoto 44
12.6.27
23
Government Inves9ga9on CommiTee [ICANPS] (interim report in Dec 2011, final report to be released in July2012))
Emergency response center (local/government-‐TEPCO) and evacua9on
TEPCO’s Accident Management Measures against natural hazard and severe accident
Raised issues of; • Insufficient measures by TEPCO in preven9on • Insufficient capability of regulatory body • Failure in risk communica9on • Fragmented exper9se in diverse disciplines
[SOURCE] hgp://icanps.go.jp/eng/interim-‐report.html
Key issues raised by the three invesAgaAon commimees
IAEA Technical Meeting, 2012June, A. Omoto 45
Corporate risk management programme (since 2007) Fully recognized high risks associated with Earthquake and
Tsunami Failed short of recognizing the risk of complete loss of safety
func9ons by high Tsunami
Reported ac9ons for safety culture, based on 2002 falsifica9on issue and WANO corporate peer review 2008 7 traits of safety culture
[SOURCE] TEPCO’s final inves9ga9on report, 20June2012, hTp://www.tepco.co.jp/en/press/corp-‐com/release/2012/1205638_1870.html
TEPCO’s invesAgaAon commimee report
IAEA Technical Meeting, 2012June, A. Omoto 46
12.6.27
24
IAEA Technical Meeting, 2012June, A. Omoto 47
Introduc.on
Four cri.cal areas
UT study
Accident Inves.ga.on Commi:ees
Discussion
Concluding remarks
1) Weakness of “nuclear professionals’ community” in interac9on with outside (society, scien9fic community, safety experts in other area, global nuclear safety regime)
Lack of societal safety goal, for assurance of no/limited land contamina9on
Interpreta9on of uncertainty in natural science Failure of risk communica9on
2) “Prisoner’s dilemma” situa9on in safety improvement under distrust to each other amid polariza9on on nuclear issues
3) Possible lack of tension between Operator and Regulator (Government) due to implicit view of Government-‐endorsed NE policy implemented by Nuclear U9li9es.
4) Some concern that individuals were not willing to take responsibility in an organiza9on in an environment of “loose-‐lip-‐sunk-‐ship”. (UT study)
Key underlying factors (I) InteracAon of individual, organizaAon & society
IAEA Technical Meeting, 2012June, A. Omoto 48
12.6.27
25
1) Assump9ons in the most basic level of safety culture “Accident will not happen here” (AM, EP) Over-‐confidence in safety due to equipment reliability (system
safety vs focus on equipment reliability)
2) Priority (U: U9li9es, G: General in community, R: Regulator) (U) Interac9on with the local government and township (R) Formality of QA and compliance, rather than risk management (U, R) Equipment reliability and maintenance
3) Weakness in responsible use [Operator] Risk management in “Government-‐endorsed-‐business” Individual’s responsibility in Japanese organiza9on Yet, high moral among TEPCO’s field workers at Fukushima in managing the Accident (as evidenced by 22Dec2011TEPCO report)
4) Weakness in responsibility to protect public health and environment [Government]
hgp://www.aec.go.jp/jicst/NC/iinkai/teirei/siryo2012/siryo19/siryo1-‐1.pdf
Key underlying factors (II) Cultural factors
IAEA Technical Meeting, 2012June, A. Omoto 49
1) Priority on Technical competence/knowledge in safety: Not necessarily high in Operator nor Regulator (Examples)
Frequent shuffling of regulatory staff in Government Head of NISA when 3.11 occurred Plant manager: Operator’s priority on interac9on with the local government
and township (Plant Manager, for instance) Heavy outsourcing by Operator to Contractors
• Staff/GWe at NPP: 150 (TEPCo) vs 350-‐800 (world average)
2) Competence/knowledge/Understandings of: Cliff edge characteris9cs associated with flooding as compared with
earthquake Decision-‐making under epistemic uncertain9es & defense-‐in-‐depth Status and behavior of IC (as reported in ICANPS report) Iodine tablet Re-‐cri9cality
Key underlying factors (III) Competence/Knowledge/Understanding
IAEA Technical Meeting, 2012June, A. Omoto 50
12.6.27
26
1) Organiza9onal seung to manage safety-‐related issues Safety is everybody’s business Decision process on mul9-‐disciplinary issues
2) Effec9ve independent safety oversight
3) Historical evolu9on Response to TMI/Chernobyl Falsifica9on issue that surfaced in 2002 as an alarming
sigh of cultural issue Earthquake at Kashiwazaki-‐Kariwa site in 2007 as an
alarming sign of site characteriza9on and preparedness to LPHC risk
Ref. CAIB report on NASA
Key underlying factors (IV) EffecAve safety management and oversight
IAEA Technical Meeting, 2012June, A. Omoto 51
All the above (Interac9on of Individual/Organiza9on/Society, Culture and Competence/Knowledge/Understanding) would influence decision-‐making, preparedness and ac9ons for risk management
Decision-‐making on • Precau9onary measures against LPHC events • Level 4 &5 Defense-‐in-‐Depth
Typical ques9ons required before decision-‐making; • ”Do we really know implicit assump9ons in the analysis?” • “What if the assumed condi9on was wrong?” • “What is our bias in our organiza9onal culture?” • “What are the global best prac9ces?”
Leading to inappropriate decision-‐making, preparedness and acAons for risk management
IAEA Technical Meeting, 2012June, A. Omoto 52
12.6.27
27
Lack of basic Understanding (21%)
Over-confidence (17%)
Lack of attention to multi-disciplinary aspect (17%)
Pressure (Time/ Management) (15%)
Illusive delineation of responsibility (10%)
Others (21%)
(Performance Improvement Interna=onal, MIT seminar, 1994)
Analysis of failure of decision-‐making on technical issues
IAEA Technical Meeting, 2012June, A. Omoto 53
LimitaAon: You have limited knowledge/experience & Your imaginaAon is limited “I know one thing, that I know nothing” (Socrates ) Collect and Use database / best prac9ces / Lessons Learned Yet there are uncertain9es (aleatoric & epistemic: data, scenario,
modeling) Intensive discussion with experts from different disciplines
Bias: Your have a bias you yourself do not recognize Analyze why your (your organiza9on) made bad decisions Independent review
AssumpAons: “What are the assumed condiAons in your decision?” What if the assumed condi9on is wrong?
For knowledgeable decision making
IAEA Technical Meeting, 2012June, A. Omoto 54
12.6.27
28
Poten9al key underlying factors Interac9on of individual, organiza9on and society Cultural factors Competence/Knowledge/Understainding Effec9ve safety management and oversight
Change of interac9on/culture/process relevant to underlying issues to avoid another severe accident by different accident scenario but
by similar root cause
CONCLUDING REMARKS
IAEA Technical Meeting, 2012June, A. Omoto 55
Thank you for your a:en.on