3 ms·

The Fukushima disaster could have been averted simply by putting the backup electric generators on a platform, and venting the hydrogen gases outside.

mpweiher 6mo ago
Yes. Or not having your plant destroyed by the biggest Tsunami in recorded Japanese history, much larger than the size they planned for when they built the plant. Or upgrading the seawall to the size mandated after scientists found out that Tsunamis of that size could actually happen, despite having no historical record of them. One of the reasons TEPCO was culpable. A sister plant of the Fukushima plant actually survived a slightly higher crest and was even used as a shelter for Tsunami victims, because one engineer had insisted on the sea wall being higher. German plants for example, despite facing no immediate Tsunami risks, have bunkered and distributed backup generators as well as mandatory hydrogen recombinators. Any German plant at the same location would have survived largely unscathed.
- WalterBright 6mo ago
  A larger seawall can still fail. Better to put the generators on a platform. Simple and cheap. Another backup would have been a pipe leading away from the reactor, where one can, from a short distance, pump water into it and it would cool the reactor.
ViewTrick1002 6mo ago
Everything is "simple" with hindsight in mind. After SL-1 we realized that that we needed to allow a reactor to fully shut down even with the most important control rod stuck in a fully withdrawn position. https://en.wikipedia.org/wiki/SL-1#Accident_and_response https://en.wikipedia.org/wiki/SL-1#Accident_and_response
- WalterBright 6mo ago
  > Everything is "simple" with hindsight in mind. The fixes are still simple and cost little. I used to work at Boeing on airliner design. The guiding principle is "what happens when X fails" and design for that. It is not "design so X cannot fail", as we do not know how to design things that cannot fail. For Fukushima, it is "what happens if the seawall fails", not "the seawall cannot fail". Airliners are safe not because critical parts cannot fail, but because there is a backup plan for every critical part. Venting explosive gas into the building seems like a complete failure to do a proper failure analysis.
  - bumby 6mo ago
    >at Boeing on airliner design. The guiding principle is "what happens when X fails"...Airliners are safe not because critical parts cannot fail, but because there is a backup plan for every critical part. And yet creating a culture that is vigilant and consistently applies due diligence is hard. To that point: Boeing identified the 737-Max MCAS as 'hazardous' in their analysis. Putting aside that 'catastrophic' was the more appropriate rating, they still did not appropriately design their system when that system failed. (By their own processes, 'hazardous' meant it should not be designed with single-point hardware failures)* That implies it is as much a human/cultural issue as a technical one. * before any claims that the system was designed just fine because the pilots could have avoided the issue with the appropriate actions, those are administrative hazard mitigations which are generally considered less desirable than hardware fixes, especially when engineering mitigations are already installed but not used. Removing the hazard >> engineering controls >> administrative controls >> PPE. To the GPP point, hindsight is easy, managing risk, people, and processes is hard.
    - WalterBright 6mo ago
      The backup for MCAS was simple: 1. restore normal trim using the thumb switches (which override MCAS inputs) 2. turn the trim system off. The proof of that is that's what the crew did in the first MCAS incident, and they landed safely.
      - 6mo ago

mpweiher 6mo ago

Yes. Or not having your plant destroyed by the biggest Tsunami in recorded Japanese history, much larger than the size they planned for when they built the plant. Or upgrading the seawall to the size mandated after scientists found out that Tsunamis of that size could actually happen, despite having no historical record of them. One of the reasons TEPCO was culpable. A sister plant of the Fukushima plant actually survived a slightly higher crest and was even used as a shelter for Tsunami victims, because one engineer had insisted on the sea wall being higher. German plants for example, despite facing no immediate Tsunami risks, have bunkered and distributed backup generators as well as mandatory hydrogen recombinators. Any German plant at the same location would have survived largely unscathed.

WalterBright 6mo ago
A larger seawall can still fail. Better to put the generators on a platform. Simple and cheap. Another backup would have been a pipe leading away from the reactor, where one can, from a short distance, pump water into it and it would cool the reactor.

ViewTrick1002 6mo ago

Everything is "simple" with hindsight in mind. After SL-1 we realized that that we needed to allow a reactor to fully shut down even with the most important control rod stuck in a fully withdrawn position. https://en.wikipedia.org/wiki/SL-1#Accident_and_response https://en.wikipedia.org/wiki/SL-1#Accident_and_response

WalterBright 6mo ago
> Everything is "simple" with hindsight in mind. The fixes are still simple and cost little. I used to work at Boeing on airliner design. The guiding principle is "what happens when X fails" and design for that. It is not "design so X cannot fail", as we do not know how to design things that cannot fail. For Fukushima, it is "what happens if the seawall fails", not "the seawall cannot fail". Airliners are safe not because critical parts cannot fail, but because there is a backup plan for every critical part. Venting explosive gas into the building seems like a complete failure to do a proper failure analysis.
- bumby 6mo ago
  >at Boeing on airliner design. The guiding principle is "what happens when X fails"...Airliners are safe not because critical parts cannot fail, but because there is a backup plan for every critical part. And yet creating a culture that is vigilant and consistently applies due diligence is hard. To that point: Boeing identified the 737-Max MCAS as 'hazardous' in their analysis. Putting aside that 'catastrophic' was the more appropriate rating, they still did not appropriately design their system when that system failed. (By their own processes, 'hazardous' meant it should not be designed with single-point hardware failures)* That implies it is as much a human/cultural issue as a technical one. * before any claims that the system was designed just fine because the pilots could have avoided the issue with the appropriate actions, those are administrative hazard mitigations which are generally considered less desirable than hardware fixes, especially when engineering mitigations are already installed but not used. Removing the hazard >> engineering controls >> administrative controls >> PPE. To the GPP point, hindsight is easy, managing risk, people, and processes is hard.
  - WalterBright 6mo ago
    The backup for MCAS was simple: 1. restore normal trim using the thumb switches (which override MCAS inputs) 2. turn the trim system off. The proof of that is that's what the crew did in the first MCAS incident, and they landed safely.
    - 6mo ago