IAEA ™ Omoto Final · 2013. 11. 6. · 12.6.27! 1!...

12.6.27

1

Accident at TEPCO’s Fukushima-‐Daiichi NPP Possible underlying factors influencing decision-making,

preparedness and risk management

Accident at TEPCO’s Fukushima-‐Daiichi NPP

Fukushima-‐Daini-‐1 Fukushima-‐Daiichi-‐4

Akira OMOTO Professor, Tokyo Institute of Technology, and Commissioner, Atomic Energy Commission

[Note] The views expressed in these slides do not represent the consensus official view of AEC, Titech, NISA nor Utilities

Outline

IAEA Technical Meeting, 2012June, A. Omoto 2

  Introduc.on

Four cri.cal areas

UT study

Accident Inves.ga.on Commi:ees

Discussion

Concluding remarks

12.6.27

2

Hazard source

Radiological consequence to human

1. Preven9on by design -‐Natural hazard

2. (level4) Accident Management 3. (level5)Emergency Plan

Avoid Core Melt

Avoid large release

-‐SBO and LUHS

4. Safety regulation

 Try to extract possible underlying issues that may have existed in the background  from cri9cal areas that failed to prevent migra9on to disaster, and

 from UT (University of Tokyo) study  from Accident Inves9ga9on CommiTees’ reports

 “Four cri9cal areas” in Fukushima Accident using Swiss cheese model

Overall approach


 Why [may] have existed?  No explicit causal rela9onship study yet that includes cultural, organiza9onal and societal issues

 What is meant by “underlying factors”?  Factors influencing decision-‐making and resultant causal chain of events;   Culture   Competence, knowledge and understanding   Safety management and oversight   Interac9on between nuclear experts

•  and organiza9on, •  and society, •  and experts in other disciplines

 Possibly formulated in the history of NE programme

Overall approach


12.6.27

3

created contribu9ng factors


Company, Management, Government, Regulator, Society

Causal chain of event

Evolving from classical technical causal chain model to involve managerial and societal factors to a new model such as

Accident is the result of flawed processes involving interac=ons among people, societal and organiza=onal structures, engineering ac=vi=es, and physical system components that lead to viola=ng the system safety constraints. (Nancy G. Leveson, “Engineering a Safer World”)

underlying factors

Introduc.on

  Four cri.cal areas

UT study


Discussion

Concluding remarks


12.6.27

4

Critical area 1) Design

1. ProtecAon against natural hazard   Recognizing uncertain9es in natural science   Preparedness to “beyond assumed condi9ons”

2.   Plant capability against SBO (StaAon Blackout w/o any AC/DC) and isolaAon from UHS (UlAmate Heat Sink)


Tsunami earthquake

[SOURCE] T. Lay et al, “Outer trench-‐slope faul=ng and the 2011 Mw9.0 off the Pacific coast of Tohoku Earthquake”, Earth Planets Space, 63, 713-‐718, 2011

Japan trench

Plate boundary earthquakes

Outer trench-‐slope faulAng

Three Tsunami source areas


12.6.27

5

  2002 JSCE (Japanese Society of Civil Engineers) guideline on design protec9on against Tsunami at nuclear power plants   Modifica9on by U9li9es in 2002 based on this guideline

  2002.7 Long-‐tern Projec9on by Earthquake Research Hq. : Tsunami earthquake may occur anywhere along J trench in Tohoku area

  Tsunami Probabilis9c Hazard study   U9li9es joint study on probabilis9c Tsunami hazard (2002-‐) and source model   TEPCO’s analy9cal results (2006) did not lead to prac9cal ac9ons [SOURCE] TEPCO’s final inves=ga=on report, 20June2012

  Methodology guide from JSCE using logic tree to represent epistemic uncertain9es (2007)

[SOURCE] T. Annaka, “Logic-‐tree Approach for Probabilis=c Tsunami Hazard Analysis and its Applica=ons to the Japanese Coasts”, Pure and Applied Geophysics, 164(2007) 577-‐592, 2007

ProtecAon against Tsunami


 Off-‐Fukushima coast  Historically limited Tsunami record of significant inunda9on height  Es9mated weak coupling and con9nuous slip in this region [SOURCE] T. Matsuzawa, Kagaku (Science), 2011 Vol 81 No.10

 TEPCO’s Tsunami study (2008) by hypothe9cally assuming M8.3 “off-‐Sanriku” (N. of J trench) earthquake source at off-‐Fukushima coast

•  Resultant inunda9on height of 15.7m •  TEPCO had asked JSCE to review

[SOURCE] TEPCO’s final Inves=ga=on report, 20June2012, hgp://www.tepco.co.jp/en/press/corp-‐com/release/2012/1205638_1870.html

 Nevertheless, in hindsight, delibera9on of “what happens if the calculated inunda9on height in 2008 study was correct?” for defense-‐in-‐depth, this could have changed the whole story

 IAEA Tsunami workshop at Kalpakkam 2005  23 cases of NPP external flooding [SOURCE] A. Godoy, Kalpakkam WS


12.6.27

6

1. Probabilis9c Tsunami Hazard Analysis In 2006, TEPCO conducted a hypothe9cal analysis u9lizing this JSCE Probabilis9c Tsunami Hazard Analysis methodology and it showed that the occurrence of a tsunami exceeding 10 m could only occur once every 100 thousand to a million years. However, this analysis was conducted for the purpose of confirming adaptability and improving methods that at the 9me were s9ll in development. Thus, TEPCO did not interpret this figure to literally mean the actual frequency of tsunamis that could strike the nuclear power plant in Fukushima. 2. Asked for JSCE review …in 2008, TEPCO conducted another trial calcula9on u9lizing the wave source model of the Meiji Sanriku-‐oki Earthquake along the trench off-‐shore Fukushima (the result: 15.7 m). However, the validity of this wave source model had been in ques9on. TEPCO has requested that JSCE review the suitability of this hypothesis….. 3. Jogan Tsunami (year 869) TEPCO conducted tsunami deposit surveys, and as a result, an al9tude of about 4m in the northern part of Fukushima Prefecture was confirmed for the tsunami deposits carried by the Jogan tsunami while no tsunami deposits were found in the southern part. As there were inconsistencies between the results of the inves9ga9on and the trial calcula9on via using the proposed wave source model (the result: 9.2 m), TEPCO considered it necessary to conduct further inves9ga9on and research in order to determine the wave source of the Jogan tsunami.

* TEPCO’s argument


[SOURCE] www.tepco.co.jp/en/nu/fukushima-‐np/info/index-‐e.html

 Report from the Central Disaster Management Council, 2011Sept28

 3.11 was caused by simultaneous occurrence of “Japan trench earthquakes “ & “Tsunami earthquake”

 Former principles for hazard assump9on [note] need to be fundamentally reviewed

[note] Seismic intensity and Tsunami heights not reproducible by the seismic source model was regarded as having low probability of occurrence [SOURCE] hgp://www.bousai.go.jp/jishin/chubou/higashinihon/houkoku.pdf


12.6.27

7


Tsunami earthquake : a dominant source

Underlying issues that may have existed in the background

1. Interpreta9on of uncertain9es in natural science 2. Understanding of difficulty in decision-‐making under uncertain9es

3. Cau9ous assessment and prepara9on to beyond assumed condi9on (yet, to what extent?)

  What if the assumed condi9on by Tsunami experts was wrong(2002, 2006) or right(2008)?

  Flooding analysis* could have strengthened level of protec9on

* Limited-‐scope study was done on flooding in “beyond assumed condi9ons” for intake structure •  Reliance on Air-‐cooled EDG capability, if UHS is lost •  Feed and Bleed capability of BWR in the case UHS is lost

was well understood


12.6.27

8

SBO rule  comply with US 1988 SBO rule  “30 minutes rule”: Not a decisive factor as following operaAon shows  0-24hrs into the accident: Core water makeup by use of stored energy (RCIC/HPCI))  24 hrs: Depressurize RCS and LP injection  32 hrs: Heat dissipation to the alternative heat sink by containment scrubbing venting

Depressurization

Depressurization

Rx Pressure

RCIC Flow

Depressurization Venting

Drywell Pressure

Wetwell Temperature

Wetwell Pressure

Drywell Temperature

2Pd

Pd

FP Flow

Loss of water inventory equivalent to Decay Heat

RPV water level

Fuel uncovered time period is short. (less than 1 hour)


14 NPPs affected by Tsunami: What made differences?

Onagawa (3 units; 2 in operation)

Fukushima-I (6 units; 1,2,3 in operation)

Fukushima-II (4 units in operation)

Tokai (1 unit in operation)

GL>Tsunami

GL>Tsunami

Tsunami Inundation height SBO

Isolation from UHS

GL(10-13m) < Tsunami (11.5-15.5m)

GL(12m) < Tsunami (12-14.5m)

Power available

- All offsite Pwr& EDG were lost except for 1F6 air-cooled EDG - 1F5 power supplied from 1F6

Not completely

Completely isolated from the sea

Almost complete isolation

- One offsite power was available

Availability of power (offsite or EDG + in-‐plant power center) and SAM implementaAon was a decisive factor, especially;

  Ground Level height & enclosure against Tsunami [saved Onagawa and Tokai]   Emergency power using alterna9ve heat sink & loca9on of power supply equipments [saved 1F6]   SAM for power inter-‐connec9on with adjacent unit [saved 1F5]   SAM using a single available offsite power [saved 2F]

Not completely


12.6.27

9

1.   Robust and workable Accident Management

2.   The role of containment system in SA condiAon   Suspected significant leakage (reduced drywell pressure) from 1F2

containment due to over-‐temperature (3.15AM) [SOURCE] K. Miyata, AESJ,

26May2012: possibly leading to significant fallout in the North-‐West due to precipita9on

  High level assurance of avoiding land contamina9on (filter, over-‐pressure & over-‐temperature protec9on)

  2ndary containment management (external event, hydrogen combus9on outside of the CV)

  CV isola9on vs. over-‐riding to enable cooling

Critical area 2) Level 4 Defense-‐in-‐depth


Level 4 Defense-in-depth (INSAG-10): Control of severe conditions including prevention of accident progression and mitigation of the consequences of severe accident

AMG not robust enough to be effec9ve/executable under plant damage condi9ons by high Tsunami

Robustness of AMG


12.6.27

10

Short term   Reactor water makeup by AC-‐independent IC/RCIC/HPCI

Then, while trying to restore AC/DC power and Heat Sink   Depressurize Reactor Coolant System by Safety/Relief Valves   Ac9vate Low Pressure injec9on systems   Containment vent to avoid over-‐pressure failure

14.46 Earthquake, Loss of offsite power, Start of EDG, IC/RCIC 15.27-‐ Tsunami followed by Loss of AC/DC, Isola9on from UHS

Given this situaAon, operaAon to avoid core damage

Core degrada9on followed by Hydrogen explosion

Require workable/effec9ve AM

Failure of RCIC/HPCI on the 3rd and 4th day Delayed ven9ng, de-‐pressuriza9on of RCS and LP injec9on


  Limited available resources and scaTered debris/tanks   Field works risked their lives under devasta9on/radia9on and fear

of hydrogen explosions and asershock (TEPCO report)

Limited available resources under harsh environment


12.6.27

11

a) External cooling of containment   Over-‐temperature protecAon

b) Filtered venAng   Over-‐pressure protecAon   Land contaminaAon

[SOURCE]hgp://www.aec.go.jp/jicst/NC/tyoki/sakutei/siryo/sakutei13/siryo1-‐3.pdf


Japanese UAliAes announced measures to over-‐temperature failure and Filtered venAng (2012Feb)

1.  Sensi9vity to risks arising from external events and their impact to AMG ac9ons

2. “Accident will not happen here” leading to lack of realism in SAM

3. Lack of societal safety goal, by considera9on of offsite cost, power replacement costs, in addi9on to acute and latent cancer fatali9es

4. Con9nuous safety improvement hindered by; a) “prisoner’s dilemma” situa9on with the society under distrust

  Safety modifica9on is taken as evidence of unsafe plant b) insufficient learning from good prac9ces in risk management

  From modifica9ons based on findings in IPEEE   From protec9ons under B5b clause [informed to regulatory body (NISA/JNES)

from USNRC in 2003/2007, but no ac9on by them] IAEA Technical Meeting, 2012June, A. Omoto 22

Underlying factors that may have existed in the background

12.6.27

12

[SOURCE] Courtesy of K. Tateiwa, Presenta=on to US-‐EPA, 20January2012

Yet, high moral among field workers at Fukushima Ref.: Voices of TEPCO’s field workers from TEPCO report’s Appendix (hgp://www.tepco.co.jp/cc/press/betu11_j/images/111222p.pdf)

  Offsite center’s func9on was lost   Implementa9on of EP (No9ce to the public on evacua9on, vehicle, Iodine tablet etc)   Delinea9on of responsibility including PM’s role   Poor communica9on (PM office and Gov officials in CMC etc)   Misunderstanding between PM office and TEPCO on “withdrawal”   Systema9c collec9on of informa9on and sharing/dissemina9on   Poor record-‐keeping on Government’s decision-‐making process

Needs to revisit  Delinea9on of responsibility, command line, coordina9on,  Design and func9on of “offsite center”  Offsite emergency plan (scope of EPZ, preparedness)  Communica9on system  Mobile equipments

CriAcal area 3) Level 5: Emergency Plan and Crisis Management

Observed problems (ICANPS interim report, NAIIC statement and others)


12.6.27

13

1. Emergency Plan: Poten9al “assump=ons” problem in the most basics level of safety culture hierarchy model   “Accident will not happen here”   Leading to lack of realism in seung offsite center facili9es and

evacua9on plan (communica9on tool, vehicles for evacua9on, road…) [source] report from the associa=on of municipali=es having NPPs

hgp://www.aec.go.jp/jicst/NC/iinkai/teirei/siryo2012/siryo19/siryo1-‐1.pdf

2. Understanding of delinea9on of responsibility   Interna9onal prac9ces is Onsite primarily by Operator and

Offsite by local government, both under advices from regula9on etc

  No FEMA in Japan


Underlying factors that [may] have existed in the background

HOW A NEW EMPLOYEE LEARNS THE WORK CULTURE

Assumptions

Concepts Knowledge

Slogans, Values

Use of Time

Patterns of Behaviour

Physical Things

“Social Fabric”

Assumptions

Espoused Values

Artefacts

Invisible

Visible

Documents Language

SOURCE: IAEA-‐TECDOC-‐1329, Safety culture in nuclear installa.ons


12.6.27

14

Regula9on  Responsibili9es not in a single regulatory body (Ex) development of regulatory guide by NSC, licensing by NISA  Technical competence/Effec9veness in safety regula9on (Ex) Requirements on SBO, SAM (Severe Accident Management)

U9lity  Effec9veness of risk management as primary responsible body

•  Use of risk informa9on to address vulnerabili9es •  “Sensi9vity “to safety-‐related issues/informa9on •  Technical competence and autude towards “uncertain9es” •  Effec9veness of JANTI, established in 2004 emula9ng INPO

Regula9on/U9lity  Focus on Quality Assurance/Compliance rather than risks, seemingly especially on formality of documents and evidences rather than substance (aser 2002)  Avoidance of land contamina9on: should have had higher priority

CriAcal area 4) Safety regulaAon (and assurance of safety)


1. Technical exper=se and regulatory effec=veness to reduce risks of regulatory body

2. Risk management for responsible use   addressing vulnerabili9es   ATen9veness to good prac9ces in the world   con9nuous improvement approach

3. Assump=on relevant to severe accident?   “Accident will not happen here”


Underlying factors that may have existed in the background

12.6.27

15

Introduc.on

Four cri.cal areas

  UT study


Discussion

Concluding remarks


  Technical issues leading to nuclear disaster: Mostly understood   University of Tokyo’s GONERI (Nuclear GCOE) project to study “Why nuclear community in Japan failed to prevent this accident”

  A series of interviews by GCOE members to 24 recognized nuclear experts (University, Regulator, AEC, U9lity, Industry, research ins9tute, NPO cri9cs)

  To help changes; -‐ Iden9fy weakness in culture/organiza9on/interface -‐ Avoid accidents of different types but by similar root causes

 Changes in such areas as   Organiza9onal Culture   Interac9on with Natural Science and understanding of

uncertain9es on the part of Natural Science   Risk management by Owner/Operator

 Results presented at GLOBAL 2011 “Safety and Security issues in the light of the accident at TEPCO’s Fukushima-‐Daiichi NPP” (A. Omoto, K. Juraku, S. Tanaka)

UT project to find vulnerability and strengthen safety


12.6.27

16

 Degraded safety culture （complacency, lack of sensi9vity to informa9on, delayed ac9on to alert, over-‐confidence on NPP safety）  Lack of tension between Regulators/Operators  Too busy in caring day-‐by-‐day problems  Inappropriate crisis management  Society takes risk-‐related ac9ons, 　modifica9ons as evidence of unsafe plants  Failure of safety regula9on  No cross-‐cuung safety experts in Japan  Why nuclear experts had accepted risks that (in hindsight) the society cannot accept?

Why cauAous acAons against Tsunami was not enough?

WHY FAILED TO PREVENT (incl. accident progression & consequence) ?

Why prevenAon/miAgaAon against BDBE was not enough or did not funcAon well?

 Focus on internal events  Not enough aTen9on to localiza9on of designs from US origin, by considering natural environment, intensive use of coastal area  Lack of communica9on & mutual understanding between natural science and engineering on uncertainty and design margin

Expressed views and discussions in the interviews


Issues identifiable even before Fukushima

 Isola9on from global safety regime  Experts in a cacoon, lack of dialogue with the society  No cross-‐cuung safety experts  Lack of sense of responsibility as an individual

What prevent taking corrective actions?  Operator is a King, no cri9cism  No ques9on asked to NE programme implemented under the Na9onal Policy  “Loose lips sink ships”  Too busy to care

If you had recognized such issues, what acAons were taken?

  Improved Emergency preparedness in the light of 2007 KK earthquake such as construc9on of seismic isola9on ERC   Rainey project, CAP   “Safety alert” reports   Crea9on of local commiTee at KK to improve safety (equally manned by pro-‐, an9-‐ and neural)

Issues identifiable even before Fukushima

Actions were taken …but not enough (TEPCO)

Actions were not necessarily taken


12.6.27

17

  Accident was caused by defects in regulatory system  Delay in reflec9ng new scien9fic/technical findings

 Delayed regulatory ac9ons to review Tsunami  Lack of sensi9vity to interna9onal trends and incidents and delayed ac9ons (Ex. IPEEE, B5b)  Focus on hardware and structural integrity issue  Inappropriate delinea9on of responsibility between NISA and NSC (Ex. Licensing criteria by NSC, while NISA to use it)  Poor technical exper9se in NPP design and opera9on

(frequent staff shuffling system in Japanese government)  Japanese regulatory body put emphasis on hardware, rather than focus on elements raised in IAEA’s safety fundamentals (or INSAG-‐12)   Heavy focus by NISA on QA drove NPP staff completely occupied by documenta9on and no 9me to visit plants or to think about safety

Expressed views on regulation


 Degraded safety culture  Appoin9ng non-‐technical staff to plant manager by placing high priority for interface with local community/government  Lack of sensi9vity and learning autude from interna9onal trends and foreign incidents  Not willing to take ac9ons before something happens (Ex. 2007 KK Earthquake was an alarm signal, without which U9lity would have taken no serious ac9on to natural hazards)  Lack of knowledge in opera9on by NPP staff members other than those in Opera9ons Department

 Complacency : 2007 KK Earthquake had proved that safety can be maintained even by an earthquake exceeding Design Basis  Misunderstanding may existed that safety is assured by compliance to regulatory requirements

Expressed views on UAlity’s aktude to safety


12.6.27

18

(Natural hazards)  U9lity adhered to US-‐origin design; delay in localiza9on by paying aTen9on to Japanese unique condi9ons (natural hazard, highly-‐populated coastal line)   Focus on internal events, not on external or security-‐related events  Lack of dialogue may have led to misunderstanding of “uncertain9es” in Natural Science

(Blinded by day-‐by-‐day business)  Blinded by day-‐by-‐day business and put safety issues aside  Less opportunity to think about design and safety. Increased focus on day-‐by-‐day Opera9on & Maintenance, and on QA documenta9on

(Experts of nuclear safety)  Decline in the Nr. of safety experts as SAM “had completed”  Defense-‐in-‐depth not appropriately interpreted, forgot residual risks  Focus on probability rather than consequence  No cross-‐cuung safety experts in Japan

Expressed views on Nuclear community’s generic aktude to safety


（Interac9on with Society）  Engineers are supposed to create societal value, but had limited communica9on with the society on what the society expects  Con9nuous improvements by nuclear u9lity hindered by fear that the society may take safety-‐related modifica9ons as evidence of unsafe plants (amid sharply polarized views on NP)…like prisoner’s dilemma, failure to achieve a goal (safety) due to distrust to each other

（U9lity business environment and organiza9onal culture）  Deregula9on changed Management autude towards compe99veness of nuclear power in power genera9on op9ons  Giant coopera9on. Delay in ac9ons. Arrogant  Risk Management focused rela9onship with the local community, not LPHC risk

（Experts in nuclear community）  Weakness in taking responsibility as an individual  “Communica9on specialists” may have reduced opportuni9es for experts dialogue with the society

Expressed views on InteracAon with Society, Culture, OrganizaAon


12.6.27

19

Three-level model of Safety Culture Artefacts-‐Visible Signs (gree9ng rituals, dress, housekeeping – visible)

Espoused Values (values that are adopted and supported by a person or organiza=on based on strategies/ goals)

Basic Assump.ons (Such as “human nature good or evil”)

Assumptions

Espoused Values

Artefacts

“Social Fabric”

visible

invisible

[SOURCE] originally by Edgar Schein, former professor at the MIT Sloan School of Management, expert on organizational culture


 Severe Accident will not happen here  Safety is assured by satisfying regulatory requirements  Plant manager’s priority is relationship with locals  Loose lips sink ships  Nuclear power is supported by a nationally endorsed policy

“Safe and feel safe (by the society)”

Use of time  Blinded by day-by-day business and became insensitive to LPHC risks or put aside safety issues for later actions  Seal-in questions

Visible Signs

Espoused Values

Action pattern  Poor consideration of external event risks  Lack of learning attitude from global best practices  Not sensitive to criticism from outside

Observation: By way of analogy

Suspected “Basic Assump.ons”

Slogan


12.6.27

20

Prof. D. Klein (Former chairman of USNRC, Ripon Forum, Summer 2011)  The LL from Fukushima are many, but what may be surprising is how few may actually apply to US plants.  In a culture where it is impolite to say “no” and where ritual must be observed before all else, I think that Western style “safety culture” will be very hard for the Japanese to accept Ludger Mohrbach, VGB PowerTech (April 15, 2011）  Ques9on: Is this accident a maTer of residual risk of nuclear energy?No, it is rather a maTer of obviously having ignored a high specific risk Prof. Oka (Waseda University, HP)  The accident is deeply rooted in Japanese society and culture; lack of responsibility by the Government, lack of open dialogue, closed experts’ community Prof. Yagawa (AESJ journal)  World-‐class manufacturing but not built on basic R&D on NP Prof. Hatamura (in his book on “Assume condi9ons not assumed”)  If you do not think beyond assumed condi9ons, you are not prepared enough

CollecAng informaAon from other analysis/statements


Prof. S. Takemori (in his book on na9onal nuclear policy and u9lity)  “Implicit protec9on” by the Government over u9lity’　implementa9on of NP policy (business) caused poor risk management by u9li9es and the financial market relied on this “protec9on”

Prof. T. Kikkawa (in his book on TEPCo – the root cause of failure)  Failed to recognize that poor risk management to nuclear accident was the largest threat to the company  Expecta9on on “implicit protec9on” by the Government over u9li9es implemen9ng na9onal NP policy

Prof. J. Ahn (UCB, Iwanami “Science”)  The way NE policy is determined and implemented needs scru9ny

CollecAng informaAon from other analysis/statements


12.6.27

21

Weakness in achieving responsible use:

1) Interac9on with outside (society, scien9fic community, safety experts in other area, global nuclear safety regime)

2) Addressing societal value

3) Tension and sensi9vity

4) Effec9ve safety management and oversight

ObservaAons


Introduc.on

Four cri.cal areas

UT study

  Accident Inves.ga.on Commi:ees

Discussion

Concluding remarks


12.6.27

22

  Government report to the IAEA (June/September2011) : 28 Lessons in 5 specific areas (Preven9on of Severe Accident, Severe Accident Management (SAM), Emergency response, Safety infrastructure, culture)

Key points are; 1. Design considera9ons against natural hazards 2. Design considera9ons against SBO (Sta9on Blackout) and Isola9on from UHS (Ul9mate Heat Sink) 3. Completeness/effec9veness of SAM 4. Emergency Management 5. Safety regula9on and safety culture 6. Mul9ple unit installa9on 7. Spent Fuel Pool design

[source] hgp://www.me=.go.jp/earthquake/nuclear/backdrop/20110911.html

Government reports and Lessons Learned


 NPO “Rebuild Japan” [RJIF] (report published, February2012)

  Prevailed “safety myth” leading to lack of precau9ons by considering “beyond assumed condi9ons”

  Capability of regulators as compared with TEPCO’s  Weak risk governance under implementa9on of Government-‐

endorsed NE policy by U9li9es   Crisis management and leadership (conflic9ng view on PM’s role

from Congressional CommiTee) [source] hgp://rebuildjpn.org/en/project

  Diet (Congressional) Inves9ga9on CommiTee [NAIIC] (ongoing, to be released in June2012) : Informa9on released

9June2012 centered around the role by PM and the Cabinet   PM’s role in crisis management and crisis management system   Dissemina9on of informa9on (predic9on of FP dispersion)   Priority not on protec9on of health of the local residents [source] hgp://www.naiic.jp/wp-‐content/uploads/2012/06/RontenSeiri2F_20120609.pdf

Key issues raised by the three invesAgaAon commimees


12.6.27

23

  Government Inves9ga9on CommiTee [ICANPS] (interim report in Dec 2011, final report to be released in July2012))

  Emergency response center (local/government-‐TEPCO) and evacua9on

  TEPCO’s Accident Management  Measures against natural hazard and severe accident

Raised issues of; •  Insufficient measures by TEPCO in preven9on •  Insufficient capability of regulatory body •  Failure in risk communica9on •  Fragmented exper9se in diverse disciplines

[SOURCE] hgp://icanps.go.jp/eng/interim-‐report.html

Key issues raised by the three invesAgaAon commimees


  Corporate risk management programme (since 2007)   Fully recognized high risks associated with Earthquake and

Tsunami   Failed short of recognizing the risk of complete loss of safety

func9ons by high Tsunami

  Reported ac9ons for safety culture, based on 2002 falsifica9on issue and WANO corporate peer review 2008   7 traits of safety culture

[SOURCE] TEPCO’s final inves9ga9on report, 20June2012, hTp://www.tepco.co.jp/en/press/corp-‐com/release/2012/1205638_1870.html

TEPCO’s invesAgaAon commimee report


12.6.27

24


Introduc.on

Four cri.cal areas

UT study


  Discussion

Concluding remarks

1) Weakness of “nuclear professionals’ community” in interac9on with outside (society, scien9fic community, safety experts in other area, global nuclear safety regime)

  Lack of societal safety goal, for assurance of no/limited land contamina9on

  Interpreta9on of uncertainty in natural science   Failure of risk communica9on

2) “Prisoner’s dilemma” situa9on in safety improvement under distrust to each other amid polariza9on on nuclear issues

3) Possible lack of tension between Operator and Regulator (Government) due to implicit view of Government-‐endorsed NE policy implemented by Nuclear U9li9es.

4) Some concern that individuals were not willing to take responsibility in an organiza9on in an environment of “loose-‐lip-‐sunk-‐ship”. (UT study)

Key underlying factors (I) InteracAon of individual, organizaAon & society


12.6.27

25

1)  Assump9ons in the most basic level of safety culture   “Accident will not happen here” (AM, EP)   Over-‐confidence in safety due to equipment reliability (system

safety vs focus on equipment reliability)

2) Priority (U: U9li9es, G: General in community, R: Regulator)   (U) Interac9on with the local government and township   (R) Formality of QA and compliance, rather than risk management   (U, R) Equipment reliability and maintenance

3) Weakness in responsible use [Operator]   Risk management in “Government-‐endorsed-‐business”   Individual’s responsibility in Japanese organiza9on   Yet, high moral among TEPCO’s field workers at Fukushima in managing the Accident (as evidenced by 22Dec2011TEPCO report)

4) Weakness in responsibility to protect public health and environment [Government]

hgp://www.aec.go.jp/jicst/NC/iinkai/teirei/siryo2012/siryo19/siryo1-‐1.pdf

Key underlying factors (II) Cultural factors


1) Priority on Technical competence/knowledge in safety: Not necessarily high in Operator nor Regulator (Examples)

  Frequent shuffling of regulatory staff in Government   Head of NISA when 3.11 occurred   Plant manager: Operator’s priority on interac9on with the local government

and township (Plant Manager, for instance)   Heavy outsourcing by Operator to Contractors

•  Staff/GWe at NPP: 150 (TEPCo) vs 350-‐800 (world average)

2) Competence/knowledge/Understandings of:   Cliff edge characteris9cs associated with flooding as compared with

earthquake   Decision-‐making under epistemic uncertain9es & defense-‐in-‐depth   Status and behavior of IC (as reported in ICANPS report)   Iodine tablet   Re-‐cri9cality

Key underlying factors (III) Competence/Knowledge/Understanding


12.6.27

26

1)  Organiza9onal seung to manage safety-‐related issues Safety is everybody’s business Decision process on mul9-‐disciplinary issues

2) Effec9ve independent safety oversight

3)  Historical evolu9on   Response to TMI/Chernobyl   Falsifica9on issue that surfaced in 2002 as an alarming

sigh of cultural issue   Earthquake at Kashiwazaki-‐Kariwa site in 2007 as an

alarming sign of site characteriza9on and preparedness to LPHC risk

Ref. CAIB report on NASA

Key underlying factors (IV) EffecAve safety management and oversight


  All the above (Interac9on of Individual/Organiza9on/Society, Culture and Competence/Knowledge/Understanding) would influence decision-‐making, preparedness and ac9ons for risk management

  Decision-‐making on •  Precau9onary measures against LPHC events •  Level 4 &5 Defense-‐in-‐Depth

  Typical ques9ons required before decision-‐making; •  ”Do we really know implicit assump9ons in the analysis?” •  “What if the assumed condi9on was wrong?” •  “What is our bias in our organiza9onal culture?” •  “What are the global best prac9ces?”

Leading to inappropriate decision-‐making, preparedness and acAons for risk management


12.6.27

27

Lack of basic Understanding (21%)

Over-confidence (17%)

Lack of attention to multi-disciplinary aspect (17%)

Pressure (Time/ Management) (15%)

Illusive delineation of responsibility (10%)

Others (21%)

(Performance Improvement Interna=onal, MIT seminar, 1994)

Analysis of failure of decision-‐making on technical issues


  LimitaAon: You have limited knowledge/experience & Your imaginaAon is limited   “I know one thing, that I know nothing” (Socrates )   Collect and Use database / best prac9ces / Lessons Learned   Yet there are uncertain9es (aleatoric & epistemic: data, scenario,

modeling)   Intensive discussion with experts from different disciplines

  Bias: Your have a bias you yourself do not recognize   Analyze why your (your organiza9on) made bad decisions   Independent review

  AssumpAons: “What are the assumed condiAons in your decision?”   What if the assumed condi9on is wrong?

For knowledgeable decision making


12.6.27

28

  Poten9al key underlying factors   Interac9on of individual, organiza9on and society   Cultural factors   Competence/Knowledge/Understainding   Effec9ve safety management and oversight

  Change of interac9on/culture/process relevant to underlying issues to avoid another severe accident by different accident scenario but

by similar root cause

CONCLUDING REMARKS


Thank you for your a:en.on

IAEA ™ Omoto Final · 2013. 11. 6. · 12.6.27! 1!...

Documents

Transcript of IAEA ™ Omoto Final · 2013. 11. 6. · 12.6.27! 1!...