The Lessons of Fukushima--Taiwan's Nuclear Power Industry Under Scrutiny

Japan's March 2011 Tohoku earthquake ultimately led to explosions at four reactors in the nearby Fukushima Daiichi Nuclear Power Plant. News reports broadcast a steady stream of images of white smoke oozing out of the reactor buildings and of helicopters attempting to save the facility by dropping water from above. Viewers were terrified on behalf of the 50 heroic volunteers who worked inside the plant to avert disaster while exposed to radiation levels comparable to those of the Chernobyl accident of 25 years ago.

Now that people have calmed down and the true dimensions of the disaster have begun to emerge, it's time for a coldly rational look at what lessons the Fukushima disaster offers Taiwan, which is similarly located in an earthquake zone. Understanding the results of the review requires that we know something about the nuclear power industry. By becoming more knowledgeable, we can become less fearful.

This year's nuclear safety drills at our No. 1 and 2 plants utilized a complex-disaster scenario. Weak points uncovered by the drill will be incorporated into the comprehensive review.

Lee Min, a professor with the Institute of Nuclear Engineering and Science at National Tsinghua University (NTHU), explains that the radioactive materials in the reactor of a nuclear power plant constitute its greatest safety risk. Reactors are therefore designed with multiple barriers to radioactive release: the fuel pellets themselves, the fuel rod cladding, the closed water cooling system, and containment vessels are all used to control and contain the radioactive materials.

When a nuclear power plant is operating, the fission taking place inside the reactor produces radioactive fission products. As these accumulate over time, they become highly radioactive. But these fission products are unstable and therefore decay, releasing large amounts of decay heat as they form more stable isotopes. If this heat is not removed from the system, the reactor core will melt.

Plants are equipped with multiple safety injection and heat removal systems to ensure that they can safely shut down reactors and continue to remove heat in the event of an accident, such as an earthquake or an airplane impact.

There are two ways in which radioactive materials might escape. The first involves loss of control of the fission reaction leading to a failure of the reactor vessel. This is what happened at Chernobyl.

The second can occur after fission has been halted, as when a plant undergoes an automatic shutdown as a result of an earthquake. In such an event, the fission products in the core will continue to generate heat as they decay. If this heat is not removed, it can result in a core meltdown, the failure of safety systems and, ultimately, radiation leaks. This is what happened at Fukushima.

When a reactor is shut down, the safety systems-water injection and heat removal-must be activated. Since these require power, plants incorporate multiple power sources, including AC power and steam turbines, into their designs. But where does the power come from if the electrical grid is down? Each reactor also has two emergency diesel generators for AC power, batteries for DC power, and air compressors to deliver air.

All of the above are standard equipment at nuclear plants around the world. In Taiwan, where the grid is less reliable, every plant also has two gas turbine generators, as well as a fifth emergency diesel generator.

All of Taiwan's nuclear power plants are equipped with air-cooled natural-gas turbine generators that can be started within 10 minutes. Since these are installed at elevations of 22-35 meters, they are unlikely to be damaged by a tsunami.

Next, all the safety systems and the buildings themselves have to be designed to withstand earthquakes, fire and flooding (tsunamis).

"Just as the design basis of a presidential vehicle is different from that of an ordinary car," says Lee, the design basis for every nuclear power plant begins with a hypothetical worst-case scenario, e.g. the biggest quake in the site's history (1,000-10,000 years) or the largest tsunami, then adds a safety margin.

But, even having established all possible protections, nuclear power experts well know that "man proposes but God disposes." They therefore have developed the Severe Accident Management Guidance (SAMG) system to address the possibility of beyond-design-basis accidents. Plant operators are trained in what sort of extreme measures (such as introducing seawater into the plant) to employ to prevent accidents from worsening.

The problem is that even with multiple tiers of safety features and preparations for beyond-design-basis accidents, four Fukushima reactors released radioactive materials. Why?

Tsai Chuen-horng, who is minister of the Atomic Energy Council as well as a professor with the Institute of Nuclear Engineering and Science at NTHU, says that the tsunami that struck Fukushima affected 14 reactors at four power plants in northeastern Japan, but the four reactors at the Fukushima Daiichi plant were the only ones to be seriously impacted; the other 10 reactors survived without incident. The Fukushima Daiichi reactors fared so poorly largely because the event exceeded the design basis of their safety systems and because their tsunami protections were inadequate.

After the earthquake struck, the area's 11 operating reactors were all successfully shut down (the other three were offline for maintenance). But the magnitude 9.0 earthquake took down the power grid. Operators at the Fukushima Daiichi plant therefore attempted to start the emergency diesel generators, only to learn that the tsunami had destroyed the generators at Units 1, 2, and 3, leaving them completely unpowered.

The first- and second-line water injection systems were unable to operate without outside power. The third-line system, which relied on batteries, was able to continue providing water. But operators were still unable to start the backup power generation equipment in the plant and unable to connect to outside power when the batteries were exhausted after eight hours of use. As a result, the cooling water in the core began evaporating, the water level fell, and the fuel was exposed.

Natural disasters are difficult to forecast. If a nuclear power plant experiences a beyond-design-basis accident, operators must respond both quickly and accurately. This can be a serious challenge. The photo shows the control room of Taiwan's No. 2 nuclear power plant.

The temperature of the exposed fuel rods then soared, causing the fuel pellets to leach radioactive materials (cesium and iodine) into the primary containment vessel (the flask-shaped object in Figure 1). The high temperatures also created steam. When the zirconium in the fuel rods' cladding reacted with the steam, it produced large amounts of hydrogen. This was not when the hydrogen exploded, however, because the primary containment vessel was oxygen free.

As this was happening, a tremendous amount of heat was building up in the primary containment vessel, increasing the pressure inside. Seeking to maintain the integrity of the containment vessel (and prevent the release of large amounts of radiation), operators acting in accordance with the SAMG intermittently released pressure. Normally the vented materials (steam, hydrogen, and small amounts of radioactive materials) would pass through a filter and thence into the atmosphere. But plant operators, who were likely seeking to minimize the amount of escaping radiation, decided to vent the materials into the secondary containment vessel (the reactor building itself, the exterior square in Figure 1) before filtering it and releasing it into the atmosphere. But when the hydrogen gas formed in the primary containment vessel entered the reactor building, it encountered oxygen and exploded.

That's what caused the explosions at Units 1 and 3. However, since the primary containment vessels remained intact, very little radioactive material escaped.

The Fukushima Daiichi nuclear power plant's reactor units 1-4 all experienced hydrogen explosions. Though the roof stayed on the Unit 2 reactor building, the reactor's primary containment vessel was damaged, resulting in a serious radiation leak.

Lee says that the situation at Unit 2 was more dire than that at Units 1 and 3. Once Unit 2 lost the ability to cool itself, the Japanese, probably hoping to avoid an explosion like those that had occurred at Units 1 and 3, vented material from primary containment into the lower part of the building. Contrary to their hopes, an explosion occurred, damaging the pressure suppression system located beneath the primary containment vessel.

Unit 4, which was offline for maintenance at the time of the earthquake, also experienced a hydrogen explosion. At the time, Japanese officials believed it had originated in the spent fuel pool. Though explanations now vary, there is no question that the earthquake has exposed issues related to protection of spent fuel.

Water storage pools sited at higher elevations than the reactors hold tens of thousands of tons of water. In an emergency, gravity would deliver this water into the reactor core. As a result of the comprehensive review of our nuclear plants, these pools are soon to be strengthened to better withstand earthquakes.

Chen Yi-pin, director of the AEC's Department of Nuclear Regulation, says that because spent fuel is still highly radioactive, bundles of spent fuel rods are stored in a pool inside the reactor building. The pool holds a large amount of water and has its own cooling system. The fuel rods themselves rest at least six feet below the surface of the pool. In the event that the power goes out and the cooling system ceases to function, this large volume of water helps keep the spent fuel cool for a time. But if the fuel rods are exposed, their temperature quickly rises and their cladding reacts with steam, producing hydrogen and permitting highly volatile radioactive materials to escape.

Chen says that TEPCO, the Fukushima plant's operator, estimated that the water in the pools would keep the temperature under control for eight to nine days. Why then did a hydrogen explosion occur after just three or four days? At the time, it seemed possible that the earthquake had cracked the pool, accelerating the loss of water. But the interiors of the pools were constructed from stainless steel, and the exteriors from reinforced concrete. While the outer layer could crack, the inner could not. International nuclear power experts were therefore puzzled.

"It was probably a false alarm," says Chen. When Japanese experts viewed footage from a camera attached to an articulating arm extended from a truck pumping water into the building and sent robots into the building to check the status of the pool, they discovered that the spent fuel rods were undamaged. They hypothesized that a Unit 3 valve opened as a result of the power outage may have allowed hydrogen from Unit 3 to leak into Unit 4. But with people still unable to enter the building to make an onsite inspection, this remains purely a hypothesis.

With the underlying causes of the Fukushima disaster firmly in mind, Taipower has undertaken a comprehensive review of Taiwan's own nuclear power plants in two stages. The first of these is studying the plants' equipment, workforce, and design basis to determine whether they meet design standards and whether these standards need to be improved. The second is looking at how the plants would address a beyond-design-basis accident.

From the standpoint of the current design basis, we have no concerns about plant safety. The comprehensive review's focus has therefore turned to responses to beyond-design-basis accidents, including items like dispatchable backup power, water supplies, and the development of a series of "extreme measures."

"The first step is a comprehensive evaluation of all our power sources," says Hsu Hwai-chiung, vice president of Taipower. He explains that the most important of safety protections-water injection and heat removal-require power. Taipower has therefore taken inventory of and improved all its power sources. For example, the capacity of the fifth diesel generators has been increased. Where they used to be able to generate power for only one reactor, they can now supply two at the same time. Battery power backup capacity has also been increased from eight hours to at least 24 by moving chargers to high points or to locations outside the reactor buildings and by purchasing portable diesel generators to power the chargers. Taipower has also purchased truck-mounted generators to provide supplemental power to safety systems and portable compressors to deliver air.

Hsu says that the biggest lesson from Fukushima is how to make rapid, accurate policy decisions in the face of a complex disaster.

Time is of the essence in responding to an accident. Traditionally, action guidelines have been structured as responses to the condition of the reactor vessel. These have now been proven to be ineffective. Taipower's new "extreme measures" focus on devoting limited resources to injecting water into the reactor vessel, venting pressure from the reactor vessel, and preparing to vent air from the containment vessel in the shortest possible time. This will ensure that the reactor vessel and spent fuel pool remain filled with water, preventing radiation leakages and large-scale public exposure.

Hsu explains that the criteria for initiating the extreme measures would be the loss of the ability to add water to the reactor vessel in the wake of a major earthquake or tsunami, or a complete loss of power to a facility. The process calls for workers to turn on or prepare all possible means of getting water into the reactor vessel within one hour, such as connecting portable power sources to water supply valves and backup systems.

"At this point, operators wouldn't know which path might have been disrupted," says Hsu. "They would not be able to rely on their instruments and would have to employ emergency measures immediately." Hsu says that, given likely disruptions in communications, the manager on duty would be authorized to decide when to inject water and vent pressure.

Nuclear power is a complicated subject. A layman might well be inclined to ask whether, now that the comprehensive review has been completed, our power plants are unequivocally safe.

The AEC's Tsai Chuen-horng says claims that they are unequivocally safe would be construed as professional arrogance, while statements that their safety cannot be guaranteed would cause the general public to worry. In any case, the AEC will monitor Tai-power to ensure it is in compliance with new legal requirements. With regard to beyond-design-basis accidents, the AEC will ensure that Taipower maintains adequate response capabilities. The AEC has already asked the company to undertake tests that accord with the EU's stress-test specifications.

Hsu explains that stress tests estimate the adequacy of a plant's protections against natural disasters and its response capabilities, looking for weak points. The testing is similar to a military training exercise in that it utilizes a steadily worsening scenario that challenges a plant's equipment and response capabilities. For example, it might test whether operators can bear the pressure when 10 power sources and 11 water injection systems have failed.

The EU has stated that if an extant nuclear power plant fails the stress test, it must be improved or closed down, a proposal that even nations that are major users of nuclear power have accepted. In Taiwan, environmental groups are pushing for the results of our stress test to be made available to the public, outside experts, and NGOs for evaluation.

Tsai says that whether pro- or anti-nuclear power, the safety of plants is a yes-or-no proposition, unlike the much more complex questions of whether to extend the lives of plants or retire them early.

In the event that the comprehensive review and stress testing reveal an immediate safety concern at any of Taiwan's three nuclear power plants or strengthening measures cost more than Taipower is willing to pay, the AEC won't rule out shuttering plants. The AEC will hold Taipower to stringent standards, will make public the process it uses for the stress tests, and will be receptive to public discussion. Given Taiwan's small size and large population, we simply cannot bear the cost of a nuclear accident.