TEPCO / Fukushima Daiichi — tsunami design-basis escalation not translated into plant hardening (2002–2011)

1. Episode summary

Fukushima Daiichi is a six-unit boiling-water-reactor station on the Pacific coast of Fukushima Prefecture, operated by the Tokyo Electric Power Company (TEPCO) and commissioned from 1971. The 1966 siting calculations set the design-basis tsunami at about 3.1 metres above sea level; the reference was later revised to 5.7 metres, and critical emergency equipment — including the emergency diesel generators for Units 1–4 — remained in low-lying locations, predominantly in turbine-building basements. Between 2002 and 2009, Japanese seismic authorities and TEPCO's own engineers progressively revised upward the plausible tsunami source models affecting the Japan Trench, drawing on paleotsunami evidence for the 869 Jōgan event and on the Headquarters for Earthquake Research Promotion's 2002 long-term evaluation. In 2008, a TEPCO internal trial calculation using the HERP source model produced a maximum run-up of 15.7 metres at the Daiichi site; the figure was treated as provisional, referred to a civil-engineering sub-committee for further study, and not translated into hardening action before 11 March 2011. That day, a magnitude-9.0 earthquake off Tōhoku generated a tsunami whose largest waves reached 14–15 metres at the site, overtopping the 5.7-metre seawall, flooding the turbine buildings, and disabling 12 of 13 backup diesel generators. Loss of all AC power at Units 1, 2 and 3 led to core melt, hydrogen explosions, and a large release of radioactive material. The strategic question the episode turned on: once the escalated tsunami source models became internally known, did the operator have an obligation — and the institutional means — to act on the largest plausible hazard rather than defer to further study?

2. Sources

Primary:

1. National Diet of Japan Fukushima Nuclear Accident Independent Investigation Commission (NAIIC), The Official Report of the Fukushima Nuclear Accident Independent Investigation Commission (executive summary and main report), Tokyo, 5 July 2012. Key findings at executive-summary §§1–3 and chapter 5 on regulatory capture and foreseeability.
2. Investigation Committee on the Accident at the Fukushima Nuclear Power Stations of Tokyo Electric Power Company (ICANPS / Hatamura Committee), Final Report, Cabinet Secretariat, Tokyo, 23 July 2012 (448-page government-appointed panel report).
3. International Atomic Energy Agency, The Fukushima Daiichi Accident — Report by the Director General, STI/PUB/1710, Vienna, 2015, including Technical Volumes 1 (Description and Context) and 2 (Safety Assessment).
4. Tokyo Electric Power Company, Fukushima Nuclear Accident Analysis Report (Final), TEPCO Holdings, Tokyo, 20 June 2012, and subsequent internal investigative reports published on TEPCO's decommissioning-information portal.

Secondary (with justification):

1. David Lochbaum, Edwin Lyman and Susan Q. Stranahan (with the Union of Concerned Scientists), Fukushima: The Story of a Nuclear Disaster, The New Press, New York, 2014 — synthesises the primary investigations with reactor-engineering explanation; used for timeline reconstruction and technical exposition.
2. Charles D. Ferguson and Mark Jansson, Why Fukushima Was Preventable, Carnegie Endowment for International Peace, Washington DC, 6 March 2012 — independent policy analysis summarising the foreseeability case against TEPCO and NISA.
3. Kiyoshi Kurokawa et al., Review of five investigation committees' reports on the Fukushima Dai-ichi nuclear power plant severe accident, Journal of Nuclear Science and Technology, 2014 (Taylor & Francis) — peer-reviewed comparative synthesis of the five principal Japanese investigation reports.

Tertiary (flagged):

1. World Nuclear Association, "Fukushima Daiichi Accident" information library entry, updated post-2015 — flagged tertiary; used only for chronological framing and design-basis figures cross-checked against the IAEA report.

3. OTA narrative

Observe. The observation apparatus produced the relevant signal well before the event. The 2002 HERP long-term evaluation of earthquake activity along the Japan Trench, the paleotsunami work on the 869 Jōgan tsunami, and TEPCO's own 2008 trial calculation yielding a 15.7-metre run-up at Daiichi all reached the operator in documentary form. The NAIIC and ICANPS reports both record that TEPCO's civil-engineering group held the 15.7-metre figure internally in 2008 and briefed senior management; the Active Fault and Earthquake Research Center in 2009 pressed NISA and TEPCO to revise assumptions upward on the basis of the Jōgan evidence. The observation, in other words, was both available and specifically acquired. For the global commercial-nuclear peer group operating seismic-exposed coastal BWR sites, resolving paleotsunami and updated seismic-source evidence into a revised design-basis flood was a routine analytical move — other operators in comparable tectonic settings had performed it. Observe is therefore classified Correct at the easy end of the task-difficulty axis — the signal was produced and delivered. Observe was not a root cause; it functioned as a transmission step that carried a correct signal forward into the reasoning and execution phases where the failure occurred.

Think. The reasoning step was where the episode turned, and it was wrong. Presented with an internally generated 15.7-metre run-up figure that exceeded the 5.7-metre design basis by nearly a factor of three, TEPCO's management referred the finding to the Japan Society of Civil Engineers sub-committee for continued deliberation rather than treating it as a precautionary trigger for hardening the emergency-power, seawater-pump and switchgear placements that the figure directly implicated. Both the NAIIC and the ICANPS reports characterise this as a choice framed by a "safety myth" — a working assumption that severe accidents did not occur at Japanese plants — rather than by the probabilistic-risk framework the available evidence called for. The correct interpretive framework (precautionary hardening when a credible in-house calculation invalidates the current design basis) was standard in the commercial-nuclear peer group and was accessible within TEPCO itself. The reasoning failure was therefore an Easy-Wrong Think: the framework existed and was accessible; it was not applied. The reasoning failure was the root cause of the hardening-gap that the March 2011 tsunami then exploited.

Act. Execution, in the sense of plant hardening against the re-evaluated tsunami, was never instructed — so there is no competent-vs-incompetent execution question for that workstream before the accident. The routine hardening moves the 2008 figure implied (relocating or watertight-enclosing the emergency diesel generators and essential switchgear; raising or reinforcing the seawall; installing alternate AC sources on higher ground) were standard for the peer group and not attempted at the scale the re-evaluation warranted. On 11 March 2011, execution during the accident itself — operator venting sequences under loss of AC power, site-wide response coordination, and the later containment of releases — occurred under already-lost conditions produced upstream. Act was not the decisive root cause of the outcome; execution during the event tried its best under external constraints that the pre-event reasoning failure had already set. Where Act carries residual weight, it is as a transmission step that propagated the upstream Think failure into the physical outcome, not as an independent locus of failure.

4. Modality evidence

Direction. The strategic posture governing severe-accident risk at TEPCO during 2002–2011 was the "safety myth" disposition documented by NAIIC and ICANPS: a working assumption that Japanese commercial reactors did not require the probabilistic severe-accident framing that US and European operators had adopted over the preceding two decades. The posture is observable as an absence of specific, attributable decisions to re-baseline design-basis external hazards against updated seismic-source science, rather than as a discrete strategic choice made at a datable moment. Senior management's 2008 handling of the 15.7-metre internal figure — referral to the Japan Society of Civil Engineers sub-committee for continued deliberation rather than adoption as a planning basis — is the closest thing the record contains to a directional signal on severe-accident hazard, and NAIIC characterises it as continuity with the prevailing disposition rather than an affirmative strategic choice.

Scoring note (zero-modality rationale): the directional layer described in this subsection is acknowledged in the §4 evidence as present and specific but is not load-bearing for the strategic failure causation of the episode — the operative failure causation mechanism was located in Structure, Processes, Culture rather than in the directional choice itself. Direction is therefore recorded at zero per cent on the rationale of modality acknowledged in narrative but not load-bearing for the strategic value created in the episode. Categorisation under METHODOLOGY-ota-scoring-v4.md §5: modality acknowledged in narrative but not load-bearing.

Structure. The governance architecture placed the principal regulator, the Nuclear and Industrial Safety Agency (NISA), within the Ministry of Economy, Trade and Industry (METI) — the ministry whose remit included promotion of nuclear power. NAIIC documents the consequence as "regulatory capture" and describes the relationship among operators, regulators, and the Federation of Electric Power Companies as one in which oversight effectively ceased. Inside TEPCO, civil-engineering analyses of tsunami hazard reached senior management but did not route to a board-level risk committee with independent authority to order plant-hardening action; ICANPS records no structural mechanism by which the 2008 trial-calculation result could escalate past the sub-committee-referral pathway the same operating line chose.

Processes. The procedural response to a credible in-house calculation invalidating a current design basis was to refer the calculation to an external civil-engineering deliberative body (JSCE) for continued study. NAIIC and ICANPS both record the absence of a standing precautionary-hardening protocol — a routine by which an internally generated tsunami figure exceeding the licensed design basis would trigger an interim hardening response pending external confirmation — of the kind present at operators in comparable tectonic settings. Safety-case updating at Daiichi ran on a periodic-review cadence keyed to regulatory filing cycles rather than to the arrival of new hazard evidence; the 2002 HERP long-term evaluation and the 2008 trial calculation did not activate a non-periodic review track, because no such track was defined. Earlier TEPCO conduct — falsified inspection records for 1988–1998 disclosed in 2002 — is recorded by NAIIC as evidence of prior process-integrity gaps the episode did not remediate.

Capability. Technical capability inside TEPCO to compute tsunami run-up from updated source models was present and was in fact exercised; the 2008 15.7-metre figure was produced by the operator's own civil-engineering group using the HERP source model. The capability to design and install the hardening moves the figure implied — diesel-generator relocation, seawatertight enclosures, seawall elevation, high-ground alternate AC — was likewise available within the Japanese commercial-nuclear supply chain, and comparable moves had been executed at peer sites internationally. The capability gap the episode reveals is narrower: the analytical capability to translate a provisional external-hazard recalculation into a time-bounded hardening programme under conditions of regulatory and scientific uncertainty. Accident-response capability during 11 March 2011 itself — operator training on extended station blackout, alternate-AC improvisation under loss of DC control power — was a further documented gap, though it operated downstream of the upstream conditions.

Scoring note (zero-modality rationale): the capability described in this subsection is recorded at zero per cent in the modality weights on the rationale of insufficient causal weight — the §4 evidence establishes that TEPCO / Fukushima possessed the technical and operational capability the situation required; the failure mechanism was located in Structure, Processes, Culture rather than in a capability gap. The capability is acknowledged as present in the narrative but does not carry standalone weight in the failure attribution. Categorisation under METHODOLOGY-ota-scoring-v4.md §5 "Zero-modality rationale rule": insufficient causal weight.

Culture. NAIIC's summary framing of the episode as "Made in Japan" rests on a cultural reading: reflexive obedience, groupism, and reluctance to question authority were identified by Chairman Kurokawa as mechanisms by which nuclear power became "immune to scrutiny by civil society." Inside TEPCO, the same pattern appears in NAIIC's and ICANPS's accounts of deference to external deliberative bodies as a substitute for internal dissent — the JSCE-referral pathway operated as a cultural protocol for not acting on internally generated evidence that the current design basis was insufficient. The collusive relationship with NISA and academic advisors that NAIIC describes sustained a shared disposition in which raising severe-accident scenarios was, in Kurokawa's phrasing, not a career-advancing move. Prior disclosure failures — the 2002 inspection-falsification admissions — are recorded in the same reports as cultural continuity with, rather than correction of, the deference-and-disclosure pattern the 2008 handling of the 15.7-metre figure then reproduced.