1 Introduction

1The combined effects of the massive earthquake and tsunami of March 11, 2011 have had severe consequences on the Fukushima Daiichi Nuclear Power Plant (NPP). As of April 19, 2011, thanks to various dedicated support from overseas and within Japan, the situation has become less tense compared to a month ago due to the reduced risk of large-scale release of radioactive materials. Nevertheless, there is a long way to go to establish the target state of the NPP, namely a stable cold shutdown. Frequent large-magnitude aftershocks pose a serious threat to on-site workers. Unexpected obstacles such as equipment malfunctions, sporadic minor fires, flooding of contaminated water, spillage of radioactivity into the ocean, are also hindering and endangering the recovery effort. Since the status of the NPP remains unstable, it might seem too early to review the accident scenario and find lessons for the future.

2Even at this stage, however, it is possible to extract valuable lessons from the accident. Historically, it is obvious that nuclear safety has been greatly improved by applying the lessons learned from experience. In particular, the lessons from the accident at Three Mile Island (TMI) Unit 2 and at Chernobyl Unit 4 have influenced the nuclear industry worldwide. Outcomes of the lessons have been incorporated in design, operation, maintenance and regulatory activities. Nevertheless, it was not enough to prevent the disaster at the Fukushima Daiichi NPP. The reasons for this insufficiency must be carefully reviewed and resolved, irrespective of future nuclear policy in Japan as well as in other countries. We must fully utilize the harsh experience of this disaster to ensure a better future. This article reviews this issue from a perspective of resilience engineering to make best use of the lessons learned from this appalling disaster for the benefit of future generations.

2 Past Lessons

3The lessons extracted from the TMI accident include the necessity for wide-ranging improvement such as in human-interface design, personnel training, and accident management. However, the knowledge gained was not sufficient to prevent the Chernobyl accident. After the overwhelming events at Chernobyl, the international nuclear community, led by the IAEA, made tremendous efforts to learn from the accident that had threatened world safety. The results revealed that a safety culture was of paramount importance, and this led to a greatly strengthened regulatory policy and international mutual support program including peer review by the World Association of Nuclear Operators (WANO). Nevertheless, even this was not sufficient to prevent the JCO accident. And all the studies on these nuclear accidents and experiences did not prevent the March 11 disaster, which was designated as a Level 7 disaster, conceptually comparable to Chernobyl.

4The way in which we extract post-accident lessons requires a more critical review.

5A careful revisit of the TMI accident reveals that the issue of safety culture could have been detected if properly studied. The TMI Unit 2 reactor was operating with several mechanical failures unattended. Also, a status tag tentatively attached to the main control panel might have made it difficult for operators to detect that the auxiliary feedwater valve was not open. Several warning reports about the risk of the relief valve being stuck in the open position had been issued prior to the accident. The potential danger of a small-scale leakage, rather than a large-scale pipe fracture, had also been pointed out, but unfortunately these warnings were ignored. These observations, if accurately interpreted, could be related to a poor safety culture.

6After the Chernobyl accident, nuclear experts in Japan learned the importance of safety culture, but what they learned turned out to be superficial. They simply believed that the accident was mainly due to the faulty design of the reactor (e.g., no containment vessel and positive reactivity coefficient at low power operation), and the poor discipline of the operators and managers. Although this understanding was not totally wrong, it did not include one key lesson of the crucial importance of observing regulations, and self-made rules and guidelines. This lack of recognition, together with complacency, eventually resulted in the criticality accident at JCO Company, and the falsification of information at NPPs owned by Tokyo Electric Power Company (TEPCO).

7These experiences clearly indicate that the learning process is inadequate. The failure to prevent future accidents may be caused by the shortsighted identification of causes of accidents. In other words, the impact of hindsight (Hollnagel 2005; Dekker 2008) of an examined accident dominated the observation of broader cause–consequence relationships. It would have been more productive if the lessons were extracted from a wider viewpoint (Kitamura 2009). Lesson extraction based on hindsight is reasonable to a certain extent, but the bias effect of highlighting only the shortsighted view must be avoided.

3 Direct Lessons

8Three weeks after the accident, the Nuclear and Industrial Safety Agency (NISA) issued a request to utilities in Japan to modify their safety measures to manage or mitigate the effects of a huge tsunami. The utilities promptly responded and announced various measures such as providing auxiliary power supply cars, fire engines with high-power water injection, installation of watertight doors for buildings containing important equipment, and alternative cooling systems for spent fuel pools. These new safety measures will undoubtedly enhance NPP safety.

9We can also learn additional lessons from historical records of the disaster reported in public documents. Timely decision-making for venting (i.e. a controlled release of vapour from containment vessel) to reduce the chance of a hydrogen explosion may be the most important lesson. Timely injection of sea water to supplement fresh water for cooling the reactor core is another important lesson. Although these lessons are certainly useful for managing future nuclear accidents, they are still based on shortsighted hindsight.

10Can these lessons be used to prevent other types of accidents? Further elaboration of measures based on in-depth analysis of the accident is imperative for enhancing the intrinsic safety of NPPs to withstand severe events that are presently unknown but likely to happen in future.

4 Typology of “Unknown” Events

11It is commonly accepted that an unknown event is unidentifiable by definition and therefore accidents caused by such events cannot be prevented. However, this is a typical shortsighted view. The word “unknown” should be replaced by “unforeseen”, since most events identified a posteriori are not unknown. Such events were simply disregarded or rejected from serious consideration. It may be useful to categorize unforeseen events in terms of the reason for disregarding or rejecting them.

12In categorizing unforeseen events, it would also be helpful to consider categorization of human errors known in the area of human factors (Swain & Guttman 1983, Reason 1990) since disregard and rejection are clearly human errors. A preliminary list of categories is given below.

13C1. Simple neglect. An unforeseen event in this category can be introduced by ignorance or by fault. Obviously, this type of neglect is equivalent to an “error of omission.” In order to reduce the risk of such events, human redundancy may be an efficient method. Extensive review of previous accident scenarios is another useful option.

14C2. Underestimation of the risk of a single event. This event is recognized but falls into the category of unforeseen events due to faulty evaluation of risk or through subjective screening. This type of neglect is analogous to an “error of commission.” Similar to C1 event reduction, employment of human redundancy and extensive review may be effective for reducing C2 events as well.

15C3. Combinatorial events caused by a “common cause.” This is well-known terminology in the area of PRA. Typical examples of an event in this category are earthquakes, floods, fires, etc. At Fukushima, the combined earthquake and tsunami disaster, which had a low probability, actually happened. Note that Units 1 to 4 of the Fukushima NPP would have survived either the earthquake or tsunami alone. Based on the lessons, we can expand our scope to cover a wider class of common causes that may lead to the simultaneous occurrence of severe events. The failure to prevent the Fukushima disaster was caused by incorrectly estimating the probability of the combined occurrence of an earthquake and tsunami. In hindsight, it is clear that the two events are not independent at all.

16C4. Poor sensitivity to warnings. This category is somewhat different from the previous ones. In conjunction with the Fukushima accident, reports on the possibility of gigantic tsunami have been published in recent years. The studies were based on historical survey and geological inspection and the reports paid maximum attention to an ancient tsunami in 869, more than 1,100 years ago. Warnings about the possibility of tsunami recurrence are indeed significant when it has been 1,100 years since the previous one. The reports were issued by researchers at the National Institute of Advanced Industrial Science and Technology (AIST) and by civil engineering professors at Tohoku University. It is obvious that the warning reports were neglected by nuclear community.

17It is easy to argue that these reports gave such short notice that it was impossible to take effective measures such as modifying the seawall height and improving the watertightness of the reactor building. This argument has some validity, but it does not justify neglecting to employ other faster measures such as preparing auxiliary power supply cars and high-performance fire engines. In fact, these measures were implemented within three weeks of the request from NISA.

18The events in this category, i.e., neglect of early warnings, were experienced at the TMI and Chernobyl accidents, and so are not new to safety engineers. The Fukushima accident should be the last accident characterized by neglect of early warnings.

19These categories are not mutually exclusive. However, a systematic surveillance effort to identify unforeseen events can be conducted more extensively by taking this categorization into consideration.

5 Assessment of Countermeasures

20In addition to systematic surveillance and evaluation of unforeseen events, it is necessary to provide guidelines to assess the usability of candidate safety measures to minimize the effect of the identified events. A standard practice is to evaluate the cost effectiveness of the candidates, but the definition of cost effectiveness should be carefully examined as described below. Also, the effectiveness of the measures must be evaluated taking into account diversity of possible uses.

21Cost effectiveness. Recommendations by safety engineers may receive a negative or indifferent response from managers or even top management. This may be understandable since management is reluctant to accept a plan that will incur extra costs. However, the cost effectiveness of safety measures should be evaluated in the long term. As mentioned in the introductory remarks (Woods & Hollnagel 2005) of resilience engineering, “This (= increased cost is undesirable for companies) is, however, not an inevitable consequence, especially if the company takes a longer time perspective.” The lessons from the Fukushima disaster can be applied most fruitfully by seriously considering this statement.

22Diverse applicability to unforeseen events. The applicability of safety measures must be evaluated in terms of their diversity in application. This requirement is necessary to attain resilience of the system through usage of the safety measures across multiple events, including unforeseen ones. For example, the main mission of the high-performance fire engine is of course to spray water to extinguish a fire. In addition, the fire engines of the Tokyo Fire Department have been extensively used to inject water into the spent fuel pool located at 40 m height from the ground level of Unit 4. This is an outstanding example of diverse applicability.

23Another measure can be the passive heat exchanger without using electricity called Isolation Condenser System (ICS). The ICS was implemented only in unit 1, i.e., the oldest reactor. In the other units, the passive ICS has been replaced by an active cooling system because the latter was judged to have a higher performance. However, the ICS of unit 1was confirmed to be useful under conditions such as loss of power accidents. It worked for a while to provide cooling of reactor core but ceased to function since its heat exchange capability is limited. If the ICS is modified to have a higher performance, it can become a dependable countermeasure to be employed to replace failed heat exchangers in various cooling systems. This means that the ICS has diverse applicability and is thus desirable for improving the resilience of future NPPs.

6 Lessons for Safer Nuclear Power Plants

24Combine use of guidelines. An extensive survey of accident avoidance and/or mitigation can be conducted through the combined use of knowledge concerning unforeseen events and the assessment of countermeasures. In addition to claiming safety improvement of NPP by passive employment of countermeasures, it can also be claimed that the NPP has become more resilient to “unknown” events, which are now categorized as “previously unforeseen” events already identified and taken into consideration. It cannot be claimed that all the unknown events are covered, but the threat of unknown events is reduced, at least partly, by the present approach.

25Resilience implementation. The magnitude of nuclear accidents has increased with time from TMI to Chernobyl and now Fukushima. This description might be misleading in the sense that the amount of radioactivity released and the number of casualties at Fukushima Daiichi are significantly smaller compared to the Chernobyl accident. However, the potential danger is much greater at Fukushima since four out of six nuclear reactor units are in serious condition with fuel damage, considerable leakage from primary coolant circuits, loss of integrity of the containment vessel and hydrogen explosions in the reactor building.

26Ironically, this trend of increasing magnitude may indicate that nuclear safety is improved by incorporating lessons from preceding accidents. Since a single failure, and a combination of a small number of trigger events as well, has already been taken into consideration, the remaining risk is likely to come from a combination of more trigger events. Such a combination is less likely to happen, but carries a greater risk. The nuclear industry, and industries with low-probability, high-consequence technology as well, must consider such combination scenarios. The attempts described in this paper focusing on systematic surveillance and reduction of unforeseen events, together with guidelines for assessing countermeasures, could improve the resilience of the target system against events possibly regarded as unknown.

7 Concluding Remarks

27Nuclear experts in Japan must admit that the risk recognition of people around the world has been significantly underestimated. When challenged by the negative response of Japanese citizens to seemingly minor troubles in nuclear facilities, the general stereotypical excuse is “Japanese people are allergic to the risk of radioactivity because of memories of the atomic bomb.” This excuse has proven to be totally wrong, since such negative, often allergic, responses are found everywhere in the world. Therefore, for nuclear power to be accepted in many countries, it is crucial to avoid another major accident. The methodology of resilience engineering is a promising approach to meeting this need since it focuses on attaining safety in a proactive, rather than reactive manner. This paper is a small first step toward the ultimate goal.