Case file
- What happened: on 11 March 2011, a magnitude-9.0 earthquake and a tsunami estimated at 13–15 metres struck Fukushima Daiichi — far beyond the station's 5.7-metre design-basis flood height. Emergency power was lost, three reactor cores melted, hydrogen explosions tore open reactor buildings, and more than 150,000 people were evacuated.
- Scale: level 7 on the International Nuclear Event Scale, at the time shared only with Chernobyl; decommissioning and compensation measured in decades and hundreds of billions of dollars.
- Root cause: Japan's official Diet investigation called the accident profoundly man-made — operator and regulator failed to adopt known countermeasures despite warnings, including the operator's own internal studies.
- The bill: the plant, a region's economy and public trust, and — in official accounting — more documented deaths from the stress of evacuation than from radiation exposure.
Here is an uncomfortable observation from two decades of PFMEA reviews: the most expensive sentence in industry is it was designed for that. Fukushima Daiichi was designed for a 5.7-metre tsunami and received about fourteen. Nobody lied on the paperwork. The design basis simply stopped describing the planet, and no one was empowered to re-rate it when the science moved.
The situation
Fukushima Daiichi was a six-unit coastal station, commissioned in 1971, with flood protection sized from historical tsunami records — a method that assumes the past bounds the future. The basis was revised to 5.7 metres in 2002. Then it never moved again. By 2008 the operator's own trial calculations put conceivable waves above ten metres; higher sea walls, relocated generators and watertight doors were discussed and deferred. The regulator sat inside the ministry charged with promoting nuclear power, and the industry's safety myth did the rest. A hazard nobody imagines never gets a budget line.
How it unfolded
The earthquake struck at 14:46. Units 1–3 shut down as designed, offsite power dropped, the emergency diesels picked up the load. Textbook, so far. Roughly forty minutes later the tsunami overtopped the defences and filled the turbine-hall basements where the generators and switchgear lived. Within minutes the station had lost nearly all AC power; unit 1 lost its DC batteries almost immediately.
From there the physics was patient. Without cooling, unit 1's core began uncovering within hours, and hydrogen explosions followed in units 1, 3 and 4 over the next three days. Operators improvised with car batteries, fire engines and seawater injection — competent, brave people executing a recovery the design had never provided for. The system meant to make heroism unnecessary had quietly come to depend on it.
Root-cause anatomy
Technically, a common-cause failure of the cleanest kind. The station had redundancy in quantity — grid lines, diesels, batteries — and almost none in kind: everything shared low elevations, basements and one electrical backbone. Defence in depth collapsed to its final barrier, the improvising operators.
Redundancy without diversity is one promise made twice — and the flood only has to collect once.
Organisationally, the failure was the assumption lifecycle. A design basis hardened from hypothesis into dogma; new hazard data arrived and was processed as academic opinion rather than as a change input demanding re-validation. The Diet's verdict — could and should have been foreseen and prevented — lands not on the tsunami but on the management system that received the data and declined to let it change anything.
Where the quality system failed
Name the disciplines and the case files itself. Total loss of AC power from flooding was a known, documented failure mode, so the debate moved to the ratings: occurrence uncertain, severity hypothetical. I have sat in that meeting — car plants, other failure modes, smaller stakes. Arguing the rating instead of the failure mode is not analysis. It is budget protection with a spreadsheet open.
Change control ran backwards. It exists to re-validate when inputs move, yet the hazard inputs moved materially for a decade with no mechanism to trigger a design review. Audits verified the plant against its design basis; nobody audited the design basis against the coastline. Compliance was excellent right up until it stopped mattering. And the warning shot had already been fired: in 2007 the Chūetsu earthquake shook the Kashiwazaki-Kariwa plant beyond its design assumptions, the fleet absorbed the learning, and nobody re-baselined.
What would have caught it
None of the fixes are exotic. Put an expiry date on the design basis itself — re-rate hazard assumptions on a fixed cadence against current science, with the burden of proof on whoever wants to keep the old number. Give the common-cause rule teeth: safety-critical utilities must differ in kind, not just count — different elevation, different power source, different failure mode. A walkdown that asks where the diesels physically sit finds the basement problem in an afternoon.
Then buy mitigation that does not depend on being right about probability. After 9/11, US plants adopted portable pumps and generators for station blackout regardless of how unlikely the trigger; cheap against the consequence, and not required in Japan. Last, fund a regulator whose job is to disagree. Independence is the only structural guarantee that someone can force the re-rating everyone hopes waits another budget cycle.
My take
I have never worked in nuclear power; this is pattern recognition from cheaper industries. In automotive FMEA reviews I have watched a room spend forty minutes debating a severity rating because an honest score would have forced a design change nobody wanted to fund. The ocean, for the record, does not attend FMEA reviews and does not negotiate ratings. I have run audits that certified flawless compliance to specifications nobody had reopened since launch. I have de-escalated critical customer crises where the gap between a contained event and a defining one closed inside the first hour — station blackout is that test with the stakes raised past everything. When I built a greenfield quality organisation for a 900-plus-employee plant, my one non-negotiable was that every assumption gets an owner, a date and a review trigger. Otherwise it is not an assumption; it is a liability with a delay timer.
What this means on your floor
- Give every design assumption an owner, a review date and a trigger — new external data is a change input; treat it as one.
- Audit the specification, not just compliance to it. Ask what evidence would falsify the basis, and who is allowed to raise it.
- Test redundancy for diversity: if one common cause — water, heat, one supplier, one software version — can take every layer at once, you have one barrier with extra labels.
- Buy mitigation that does not depend on being right about probability. The kit and drilled procedure for the failure you were sure would not happen is the cheapest insurance you will ever own.
The tsunami did not defeat Fukushima; an expired assumption did. Somewhere on your floor there is a number that was true when it was written and that nobody has re-read since — a wall height, a torque, a safety stock, a supplier capacity. Quality is not meeting the spec. It is noticing when the spec has stopped describing reality. The Diet called the accident profoundly man-made. That cuts both ways: made by human decisions, therefore preventable by them. The re-rating you force through this quarter is the meltdown that never gets its own case file.
