STAMP Applied to Fukushima Daiichi Nuclear Disaster and the Safety of Nuclear Power Plants in Japan by Daisuke Uesako M.E., Environmental & Ocean Engineering, University of Tokyo, 2007 B.E.., Systems Innovation, University of Tokyo, 2005 Submitted to the System Design and Management Program in partial fulfillment of the requirements for the degree of Master of Science in Engineering and Management MASSACHUSETTS INSTITUTE OF TECHNOWGY at the Massachusetts Institute of Technology OCT 26 2016 June 2016 LIBRARIES 2016 Daisuke Uesako. All rights reserved. ARCHIVES The author hereby grants to MIT permission to reproduce and to distribute publicly paper and electronic copies of this thesis document in whole or in part in any medium now known or hereafter created. Signature of Author: Signature redacted Daisuke Uesako System Design and Management Program May 6, 2016 Certified by: _ Signature redacted Nancy Leveson r , Professor of Aeronautics and Astronautics Thesis Supervisor Accepted by: _ oignalure redacted Patrick Hale Director System Design and Management Program STAMP applied to Fukushima Daiichi nuclear disaster and the safety of nuclear power plants in Japan by Daisuke Uesako Submitted to the System Design and Management Program on May 6, 2016 in Partial Fulfillment of the Requirements for the Degree of Master of Science in Engineering and Management' ABSTRACT On March 11, 2011, a huge tsunami generated after the Great East Japan Earthquake triggered an extremely severe nuclear accident at the Fukushima Daiichi Nuclear Power Plant. This thesis analyzes why the stakeholders could not prevent the Fukushima Daiichi nuclear disaster, and, with regard to the future nuclear safety in Japan, what the potentially hazardous control actions could be. Because of the complex sociotechnical nature of nuclear power plants, System-Theoretic Accident Model and Processes (STAMP)-specifically, Causal Analysis based on STAMP (CAST) and System-Theoretic Process Analysis (STPA)-is used for these analyses. The CAST process reveals the whole picture of the unsafe control actions by multiple stakeholders, as well as their flawed communication and coordination, which significantly damped the overall control structure for the Fukushima Daiichi Nuclear Power Plant. It becomes clear that all the stakeholders were inadequate to fulfill their safety requirements regarding the safety design, safety management and emergency response. The shared notion of the "Safety Myth," which emerged as an "explanation on safety" for the purpose of promoting the use of nuclear power and was enhanced, among others, by administrative issues such as lack of leadership on nuclear safety, flawed safety culture, lack of resources at the regulatory bodies and bureaucracy, restricted the efforts by the stakeholders to ensure the actual safety against severe accidents or compound nuclear disasters. The STPA process identifies a number of unsafe control actions in the control structure for the safety of nuclear power plants in Japan, the causal scenarios by which these unsafe control actions could occur, and possible safety requirements to prevent these causal scenarios. It is demonstrated that, despite extensive improvements by the stakeholders after the Fukushima Daiichi nuclear disaster including the establishment of a new regulatory body, the "Safety Myth" or administrative issues might still come into play as causal factors, while investment for safety and sound safety culture can be possible safety requirements that subdue these causal factors. Finally, recommendations to strengthen the current safety control structure are developed for some key stakeholders, based on the findings of these analyses. Thesis Supervisor: Nancy Leveson Title: Professor of Aeronautics and Astronautics [Page intentionalv left blank] ACKNOWLEDGMENTS I would first like to thank my thesis advisor Professor Nancy Leveson of the Department of the Aeronautics and Astronautics at Massachusetts Institute of Technology (MIT). She showed me a new way to look at system safety, and when I asked her to become my thesis advisor, she gladly accepted my request, stating her passion for my research interest. She consistently allowed this paper to be my own work, but steered me in the right direction. I would also like to thank Doctor Bryan Moser of the System Design and Management (SDM) Program at MIT, who gave me valuable insights in the conceptual stage of my research, and Professor John Carroll, the Gordon Kaufman Professor of Management at MIT, who taught me the managerial aspects of nuclear safety and gave me the name of a professor specifically working on those of the Fukushima Daiichi. Without their passionate participation and input, this research could not have been successfully formed or conducted. I would also like to acknowledge Doctor Masaru Nagura, an SDM fellow, who willingly shared with me his work experience at the Nuclear Regulation Authority (NRA), Japan, and I am gratefully indebted to him for his valuable inputs on NRA. Finally, I must express my very profound gratitude to my employer-the Ministry of the Environment Japan-, my friends, and especially my parents for providing me with unfailing support and continuous encouragement throughout my years of study and through the process of researching and writing this thesis. This accomplishment would not have been possible without them. Thank you. Daisuke Uesako Cambridge, Massachusetts May 2016 Contents Chapter 1. Introduction .......................................................................................... 9 1.1 The Nuclear Disaster ............................................................................................................................. 9 1.2 History of Nuclear Industry in Japan....................................................................................................11 1.3 TEPCO and Fukushim a Daiichi Nuclear Power Plant .................................................................... 14 1.4 System ic Complexity .......................................................................................................................... 15 1.5 STAM P- Accident M odel Based on Systems Theory.................................................................... 16 1.5.1 CAST........................................................................................................................................... 17 1.5.2 STPA ........................................................................................................................................... 18 1.6 Purpose of the Analysis ....................................................................................................................... 20 1.7 References ........................................................................................................................................... 21 Chapter 2. Accident Analysis Using the CAST Process..........................................23 2.1 Stakeholders and Safety Constraints ............................................................................................... 23 2.1.1 Tokyo Electric Power Company (TEPCO) ............................................................................ 24 2.1.2 Nuclear and Industrial Safety Agency (NISA)........................................................................ 25 2.1.3 Off-site Center (Local NERHQ) ............................................................................................. 26 2.1.4 Nuclear Safety Commission (N SC)......................................................................................... 26 2.1.5 Prime M inister's Office (NERHQ)........................................................................................... 27 2.1.6 Ministry of Education, Culture, Sports, Science and Technology (MEXT)............................. 27 2.1.7 Fukushima Prefectural Government and M unicipal Governments .......................................... 28 2.1.8 General Electric ........................................................................................................................... 29 2.1.9 Other stakeholders....................................................................................................................... 29 2.2 Safety Control Structure...................................................................................................................... 31 2.3 Unsafe Control Actions ....................................................................................................................... 33 2.3.1 Tokyo Electric Power Company (TEPCO) .............................................................................. 33 2.3.2 Nuclear and Industrial Safety Agency (NISA)........................................................................ 39 2.3.3 Off-site Center (Local NERHQ) ............................................................................................. 44 2.3.4 Nuclear Safety Comm ission (N SC)......................................................................................... 45 2.3.5 Prime M inister's Office (NERHQ)........................................................................................... 47 2.3.6 Ministry of Education, Culture, Sports, Science and Technology (MEXT)............................. 49 2.3.7 Fukushima Prefectural Government and M unicipal Governments .......................................... 50 2.3. 8 General Electric ..........................................................................................................................