 Okay, this is the second presentation about disasters. This time is external hazards. What I'm going to explain in this presentation first, general things about external hazards, what they are, which kind of external hazards, what are the important aspects. There are many hazards. I cannot talk about all of them, and I also am not an expert in external hazards. And I don't think there is a person who can claim it's an expert in all external hazards. This is not practically possible, and there is knowledge of many disciplines. So I'm going to be saying something, considering on examples, not in details about the most important topics. One is earthquake, associated to earthquake tsunami. It has been also important in the recent history in nuclear power plants. Of course I will relate this to the standards that we have at the IEA. I will say something in general about seismic evaluation methods. And then at the end of the presentation I'm going to be more, I don't know, deductive, or I don't know how to call it. To talk about a bit of recent experience from the earthquakes from external hazards in nuclear power plants, and less of that can be learned and what the agency has been doing. That's the idea. I will try to occupy the time of the presentation. So first, recapitulating, also linking with the previous presentation, the external hazards originate from sources that are outside of the plant. It can be near the plant, mostly near the plant, we are talking heavy weather conditions and so on. But even remote, like a tsunami, can be originated by an earthquake very far from the plant. But anyway, it's something that is coming from outside the plant. And they have the capacity, of course, to fail or equipment of the plant, equipment important to safety in the US PIS, and so on. So I put here a list of some common external hazards, but there are many, many, many. The question is, not all the external hazards affect all the plants. Some of them are weather related, like, I don't know, heavy snow, or sandstorms, or so on. So not all of them apply to all nuclear power plant sites. So the first thing when considering external hazards is screening from maybe a very long list of hazards that have been identified, saying what is important, what is not important, what can happen, what can not. And we're going to be talking also about this screening process at the high level. Because for the internal hazards, we know what they are that can happen at the plant. For the external, they happen outside. Sometimes you can exclude them, sometimes not, like earthquakes. But those that you need to retain, you need to know about the frequency, about the magnitude, and you have to be able to decide whether you can put the plant in this site. So the analysis of external hazards goes, at the first, in the suitability of the site. The site is suitable. Then for the definition of the magnitude of the hazard that can be expected, this is an input for the design. This is an input for establishing the layout, and this is an input for establishing the design of the equipment against the hazard. So this is the list of some list, examples of common hazards in nuclear power plants. Sometimes people think, this cannot happen in my plant, like a tornado. This is something happening in the U.S. Things like that. It's not always true. Even tornadoes have been seen recently in Europe, in Spain, and from Spain. External hazards are important among other reasons because they can be a dominant contribution to the risk of the plant, to core damage, to a significant radiological release. So they cannot be excluded. Sometimes the estimation of these risks are very often associated with high uncertainties, but they are very often important contributions. Sometimes what happens is that we are very uncertain about the probability or the frequency of such a hazard, and the less or the stronger is the hazard, the stronger is the earthquake, for instance. Of course, the lower is the frequency, and when the frequency is low, the uncertainty associated with this estimation of the frequency is high. But imagine, for instance, that you want to have to consider strong earthquakes, which is in the order of magnitude that it can happen here, one in ten million years. Well, we don't have this seismic history. The question is how you make such an estimate based on the records that you have from maybe the last fifteen or hundred years when there was reliable seismological equipment and registers and so on, the analysis of the ground, how you do that. But also a point that I think is interesting to make is that when we talk about earthquakes and things like that, we are treating as random events that are not random. This happens also in the PSA. For instance, if I say that the water boils at 100 degrees, everybody will agree. So that's not random. Sometimes, if I say, probably that the component fails, or these lights fails in the next 24 hours. Maybe it's not random, but I cannot analyze what are the reasons that may make this fail right now, what is the condition of the lamp? So sometimes we take as random things that are not random. Maybe something purely random is the disintegration of an atom when the radioactive atom is going to split. And this happens with earthquakes. We take things as random that are maybe not random. So if you have an accident like the one in Fukushima four years ago where these plates collide together, one way or another, now it will take many, many years until this tension will build up again and another earthquake of the same characteristic will happen there. So we cannot say that this is really random and we are taking frequencies that are not, you know, based on occurrence on a period of years, but the events are not really random. But this is a difficult topic. I'm going to note these details of the frequency. The point is always the same. The external hazards have a potential to affect many components of the plan or even the entire plan, create a load at least, shake the whole plan as the earthquake and the uncertainty regarding the occurrence is high. Now the phenomenon, losing my voice, is very diverse, it's very broad and it needs really a whole team of experts on many disciplines. You just look at the list. So you need people that know from science of the earth, I don't know how to call it seismology, you need person that know about aircraft, and so on. So there are many topics and I'm not an expert in any of those areas. My expertise in the area of hazard is limited to internal fires and into flooding, and I know some limited knowledge, I have some limited knowledge about those areas, but that's it. So I'm telling you from my general knowledge in this presentation, but not from my personal experience in many of them. One interesting thing to consider about this external phenomenon is that even if they don't cause additional damage to the plant because the magnitude is not very big, one thing they do is they very often contribute to the frequency of PAE, of the loss of offset power. So imagine these heavy storms or rains and so on, very often they fail the grid and nothing more happens to the plant. But at the end, this PAE becomes of high frequency. This depends also on the country, how strong is the net, the interconnection and so on, but there are countries in which there may be experienced a loss of offset power several times per year. And then the emergency power supply has to react, so it's a challenge to a safety system. So that's a point to take into account, that even if no damage is caused, also some hazards contribute to increase this frequency of PAE. That's a picture of Castigasabu Cariba Nukapa plant, the largest plant in the world, where there was a very strong earthquake that caused some secondary effects like fires. This is a fire of a transformer. We'll talk a bit about earthquakes today. The other one, tsunami. And this is a picture of a plant that you know very well. Using this picture, there are many pictures when the wave hits the plant. And it's interesting to know that it's not only the height of the way that it is coming, the sea is going up, it's also the run-up. When the wave hits the plant, it hits with force. Sometimes it carries things with it, vehicles, cars and everything. And it's the run-up, and so this top of the wave goes up into the hill. So you think that what is going to come only this high, in reality it goes much higher because it flashes up. Now, what we have at the IAEA for standards, we have two kinds of standards. We have requirements for sighting and requirements associated to the sighting to the sight evaluation for external hazards. So when you do the sighting, sight selection and sight evaluation, you have to take into account many factors for the sight. Some of them are safety-related, some of them are not safety-related. For instance, you need to have a grid. Some of them are economic aspects. Seismic analysis is, of course, among the safety-related aspects. And it's very clearly indicated in the seismic requirements. And we have the conditions to look for make a seismological, geological, geotechnical evaluation. You have to collect information, not only historical, but pre-historical. If you look at the value of seismology, try to see what experience you can gain about seismic phenomena in the sight, or near the sight. You need to develop a seismotonic model. There is a need for a seismic hazard assessment of the sight, taking into account this seismotonic model. You have to take into account uncertainties and so on. And you also have to be looking for capable faults near the plant and the plants around it. And there are some criteria there. Some criteria can be exclusive. So you cannot put a plant on top of an active fault or near a very active fault. So at the end of the decision is you may install the plant or not. So the seismic aspect can be exclusive. It can be simply, you can. When you can, then the thing is, it is easier or it is difficult. You may have to engineer a lot and to develop a lot of protections and to develop a lot to have a stronger seismic design. In other words, plain words to put more concrete. So this make, because this is important, this make change the decision from putting a plant in this area to putting the plant in some other area. What happens is that in several countries you have no choice because no choice in the sense that there is not something like a low seismic area here and a high seismic area there. All of them are relatively high seismic areas as is the case in Japan. But seismic analysis is a must and is an exclusive criterion. For this site evaluation or site thing we have two associated safety guides. One is new, the one on the left, SSG-9, seismic site evaluation of nuclear power plants. And just to give you an idea the recommendations to meet the requirements that are there are about those aspects that we mentioned before and it starts by a collection of information that is necessary for analysis from any point of view. Seismological, geotechnical and so on. Then you have to develop these seismotic models defining and characterizing the seismic sources how to analyze the ground motion and how this affects and propagates depending on the nature of the soil between the capable faults in the planet and so on. And there is a probabilistic assessment and a deterministic hazard assessment. Analyze also potential for displacement and so on. And at the end of this thing you get two inputs. One, the planet is suitable. Second, I mean if it's not suitable then you can take this site. Second, it gives you the design ground motion. In other words, as a main topic, top result without details. It gives you the input for the design. It's going to give you what is the peak ground acceleration and other aspects that you need to take into account to design your plan. Then when you design your plan then you will define, you will establish the seismic categorization and you will have to design for which level of earthquake you design this or what equipment of the plan and what you will not be seismically qualified and there are rules for that. But the site evaluation keeps you the input for the design so that's really important. So now we come to the design and we go to SSR 2 slash 1 that you have heard several times and related to seismic we have also there 2 safety 1. One is for the seismic design and qualification of an MPP and then we have another one which is not for the design but equally associated to design because what you do when you have a plan that is already designed but for whatever reason you know this has changed about the seismic condition in the plan and so on. This happens. The site needs to be re-evaluated constantly and we have learned also that the plans have been designed according to previous standards so we have a safety guide for evaluation of the seismic design of an existing nuclear power plant. It can be used for instance also for periodic safety review for refurbishing the plant. And in these guides you will find recommendations about seismic analysis I'm going to bring up here the details, two kinds of seismic analysis, seismic evaluation the deterministic approaches and here we have two or no methodologies one is by EPRI it's called the seismic margin assessment. IEA apart from the recommendations in this safety guide has also developed a safety report I forgot now the number related to this methodology this is a conservative deterministic analysis of margins to failure to evaluate what is the capacity of the different components and structures of the plant and it is based on defining what is called a success path for safety systems saying if I have the earthquake I know that if this system and this system and this and this doesn't fail I will be able to safe shut down the plant so I establish what are success paths and then in these success paths there are some equipment that are more stronger than others and what is less strong is what is called a weight link and so in this manner you make an evaluation of the capacity of the plant there is something another methodology for margin assessment a bit different from the NRC there is a fragility analysis approach for this capacity assessment and the use of a simplified fold tree approach for dealing with the system analysis and then of course you have full scope analysis focus scope, reduce scope there are some variations depending on the case because also depends on the location of the plant and everything has associated of course and therefore that's the idea of the methodology here there are some principle elements of seismic margin assessment so first you have to identify because it's very important this concept I mentioned success path how are you going to shut down the plant so you define sometimes primary and alternate success path and then you define with them establish what is the seismic equipment list from this success path and here is the equipment that you need to protect against the earthquake this is also done taking into account plank down, plank wall downs where you look at aspects like the anchoring of the equipment and potential for impact of shaking or breaking some structure and so on and at the end the point is that you have to define this success path and see there what is the called this min-max minimum component capacity in the strongest success but in other words the thing which is the weekends in a success path it is the limit of the design because this is the equipment that is supposed to be failed first so the result of this analysis brings you to a screen component that may be not necessary to seismically qualify from separate from those that are necessary to seismically qualify and provides you a value taking into account the margins for the equipment of what is called Hickley this high confidence low probability of failure so this is a level of earthquake for which you can say with a high confidence that very likely is not going to fail and this you get for one component and you also try to get what is the this value for the whole plan and this is like an estimate of the margin that you have about the design input now there are also some probabilistic approach that I don't know if someone is going to explain also because I'm not sure about the program but also in the seismic domain and excuse me the probabilistic domain of safety analysis there it involves some analysis of the event and fault trees but there is also some simplifications because doing a full seismic PSA is something very expensive and it's only in a few occasions but the goal of the probabilistic seismic evaluation is at the end to obtain an estimate of the core damage frequency due to or induced by seismic failures induced by earthquakes and we go to the level 2 PSA to get an estimate of the frequency of a large or early release normally these results are associated with quite noticeable uncertainties now I'm going to go to more practical things to learn and so on because this is not really my territory and I also don't know your major interest and I don't think that maybe we can engage into the details of the seismic margin assessment and so on the step as maybe before going into this is similar to the internal hazard the first will be to estimate what is called the seismic hazard curve if you don't want to seismic it could be tsunami hazard curve or whatsoever to have a relation between frequency of a hazard and magnitude normally the stronger the hazard the lower the magnitude but this gives you a curve frequency versus magnitude now that you have this magnitude then you have design for a given level of hazard earthquake now you have the fragility assessment that will be for the different magnitudes which damage you can cause on the plant this is on this fragility assessment and then will be the analysis the safe shutdown of the plant taking into account what has failed and what has not failed for the design you have to make sure that you are not going to be failing the equipment necessary the probabilistic domain you take into account the things can indeed fail or the equipment even not affected by the hazard can still fail through random failures or the failures and you come out to the probability this works in general let's say the three steps that maybe go in line with internal hazards I'm going to talk about some earthquakes or tsunamis that has happened in the recent less decayed time mostly in Japan we may have learned from them and also it's nice to understand also that that these events it did happen and that they are important and also sometimes they show us what happened, what doesn't happen that we really sometimes the seismic design provide margins but they are the tip-topics that are maybe relevant let me start this is the dog of a friend of a colleague in the division he's called Michelangelo okay, he's smart dog and he gave me some of the slides so I put his dog I didn't put his picture, I put the picture of his dog look up our plans that have been affected by a strong earthquake I don't remember very well all this Japanese name but this is an earthquake in 2005 10 years ago Miyagi okipa it is on the east coast of Japan not this is the mouse, not the pointer not very far away from where we have Fukushima is here here we have Sengai Peninsula here is Onagawa so it's close to Onagawa the earthquake of Fukushima was in this area the closest place was Onagawa so if you see this is by the way a system called shake cast that we have at the IEA that gives us an idea or depending on the force of the earthquake, the magnitude what is the potential impact on nuclear installations and so on so we have an idea it is not the most important not the nuclear power plants themselves because they have a strong design and we also have research reactors their sources and so on and their equipment that you know are not built in this such a strong concrete structure and it can be relevant from the point of view of emergency coordination for IEA so we have this system called shake cast and we have this information be provided there is an on-call shift they put me on that shift make a previous screen and then to notify those who know this earthquake here you have a magnitude or an indication on when it happened and so on and what was the situation of the plant the plants Onagawa the three units were in operation and they were shut down automatically by the seismic instrumentation and this shows you the shutdown period so some of them went over one year and this tells you that even if safety let's say is not compromise this leads to important loss of production and normally in seismic design you have two levels of earthquake sometimes they call level one, level two but maybe other people put design versus earthquake and operation based earthquake and so on so the ultimate safety systems and so on are designed for the to withstand design basis earthquake but if you have an earthquake that exists at level one the operation based earthquake then before you restart the plant you need to do an evaluation and an inspection of the plant and all the equipment to see what has been impact and this leads you to sometimes two important shutdown periods so this one earthquake another one on the other side of Japan we have a lot of history from Japan and information and there are a lot of nuclear power plants along the coast so we have another one here that affect this Kashiwa-Saki-Kariba number of plants again you have here the same evaluation here those plants were already shut down for a periodical outage more earthquakes also close to the shore there and distance to the because you have of course the impact there is closer but also the earthquake can propagate and can be not even at the west coast it's not something to be neglected that is why Fukushima is also mentioned in this picture so here you have again the same type of of information what was the status of the different different plants and you also see that in some cases it has led to substantial loss of production and shutdown periods to analyze the impact on the on the plant here we have Hamaoka Hamaoka by the way is a place also close to important tectonic faults in the sea which they are now thinking because there is always a recurrence of earthquakes and so on they are now around Hamaoka Hamaoka shutdown developing a tsunami wall of initially was 20 meters high they even increase it even more a massive structure concrete thick solid structure in case a tsunami will hit the plant will not go over the wall and then if it goes because there was thin it can go now also the buildings have tsunami walls not only a wall that it is watertight but the second wall outside that is going to take the heat and it is impressive I've been there on the visit now here we have the same kind of information here by the way in Hamaoka this is one place where they are constructing one of the new generations of advanced boiling water reactors it's in construction there and now I go to one important earthquake that happened also like 10 years ago not 10 years ago I don't know what was in 2007 I would say this is one on Kashiwasaki Kariba Nuka power plant it happened almost 2007 exactly so this was an earthquake of a very very high magnitude this is the Japanese scale but this is the highest category category range and it hit during a holiday at the plant also happened that the plant was under staff because of the national holiday in the morning and it was very close to the plant and it was very strong and this is the biggest Nuka power plant in the world it was a very strong earthquake that of course triggered the shutdown of the plant automatically and it caused a number of failures and it caused also fires and fires is something that you have to take care of them immediately because if you don't just concentrate on shutting down the plant the fire goes on and continues and it can cause more failures and you don't even know if the fire suppression systems will work properly after the earthquake so there was this transformer failures fires big transformers sometimes transformers of this size have something like 20 cubic meters of oil around this magnitude and so on so they can create a very heavy fire that can take really to time to stop actually it didn't take that long this picture is interesting this is the spain fuel pool and there is home surveillance cameras in this area also because of safety and you see on the left side the pool in normal operation what is called now the sloshing of the pool the earthquake start shaking and the water moves and also the fuel well everything moves, the whole building moves but the structure of the rackings of the fuel has to be able to withstand the seismic force the point here is this sloshing we come to the flooding where there was something like this before we have here a schematic picture of the spain fuel pool building this is radiological constructed area because of course we have the fuel there and the building next to our areas next to this is not controlled radiological area the water jump up from the pool because of this sloshing spread and went into some pit something there related to the machine so power boss and here there is a penetration this penetration is not designed for water tightness it's a cable penetration it's designed without the characteristics and maybe we have retained also the water you don't know, never know but the point always is after the plan shakes you get cracks and penetrations can be also influenced and you cannot always ensure and you don't know actually if you look about Fukushima and where the people were putting water in the reactor and it was got in in the turbine building this was a feed and leak you still don't know how it went of course the reactor was broken and the containment was broken but how the water goes into the turbine building but the point is the water finds the way, you put water in the soil the water will find the gaps if you are not sure there is a gap I don't know if it can be or not you put water, you find out so the water found the path through this penetration and exit the control radiological control area and then found the way and there was a spill there in this floor and the other floor eventually goes into the sump and into the sump you have some places to collect water for whatever it is leaks or cleaning or something like this this is not radiological control area and you don't expect to have dirty or radiological contaminated fluids there so then you have a pump and it was up probably have a level meter or something goes up it was pumped out to the sea so you see something can happen it's interesting to know but this also is you know remind that the earthquake can always trigger some other side effects and I think this is a good picture to see also that flooding takes opportunity of every propagation path well, if you take into account the overall performance of the plan you can see that in spite of this very strong earthquake and movement that exceed the design basis of the plan there was this satisfactory plan behavior during and after the earthquake mental safety functions were preserved and there were only very small and significant releases I mean that thing is not a large release nothing to do with something associated to core damage that's the basis here the design basis S2 we have these two levels of earthquake this is the safe shutdown earthquake the design basis earthquake it was largely exceeded and this is where it tells you that you have with seismic you have margins with the flooding it may be easier to say okay I have this equipment here and the connections are there and yes I have to design for this level of water and I put a centimeter more and I wet it and that's it and this equipment fail with the earthquake it's not like that with the earthquake if you design for 0.3G doesn't mean that if you have 0.31 ETH or even 0.4 ETH it doesn't because at the end do you take your input for the use of the design codes and the design codes include margins and you don't know what is the margin for the overall plan without estimation and so on but the margins are there and of course when you when you have an earthquake you see where there was a margin and where there was not an damage occur of course we can say after the evidence of the earthquake the seismic design basis earthquake was underestimated and it was underestimated because the seismic hazard curve was underestimated but then this was compensated for what I mentioned the conservative that you introduce in the seismic design so at the end there was not a safety problem for the plan now there was not a loss of offside power because still maintained two lines fully available something that didn't happen in Fukushima for instance and then what other effects there were on the soil there have been roads like this crack and something but but not in safety significant but the fire protection piping failed and this led to water and soil intrusion in reactor building number one so you see here the side effects you can create a fire you can create a pipe break and you can see yourself in a situation with an earthquake, a fire and maybe not water to put out the fire oil leaks in several transformers in one of them create the fire and then you have to fire fighting but you lost the fire water sources so what they had to do is to call in outside the brigade they had to come with fire tracks from outside so this is a lesson learned we always have in mind we know because this is no we didn't discover anything it was known that the network can trigger a fire and can break pipes particularly those that are not seismically designed maybe the fire water protection system was not seismically designed from my experience in Spain I left Spain now of course 14 years ago but there we only have one plan where the fire protection system is seismically qualified the others not and I don't think this is the only country in the world what is happened so if you have an earthquake and you fire water protection system is not seismically qualified it depends on the margins it depends on the magnitude of the earthquake and what are really the margins of this seismically qualified so people knew about those things but now the reality show them that when you before it happened so they lost they had a break of this they had a fire and they didn't have a fire water protection system now of course they know and they learned the lesson here there are some aspects that happen in the earthquake seismic interactions effects on the control room ceilings of the control room falling I have seen this also in Nagawa and it was seen in Fukushima these are aspects to take into account because you can also impact the operators or the ability of the control room to be available for operation after that there were some break of platforms on top of the spin fuel pool and also something that can happen there are these flexible connections between the condenser and the circulation water system sometimes the rubber connections can fail and also actually by the way if a fire would go in this area it's also an area where a fire can induce a flood it happens in Spain in Bandaios one there was a turbine, missile, hydrogen fire and so on and eventually the oil burned and the burning of the oil pouring down in the turbine hole affect this connection and induce a very important flooding they almost flooded everything so this is another example of interaction between one hazard and another so there were also all the findings of what happened the reactors could be controlled and radiative which is where minimal were some lessons learned from the earthquake and the first thing is that the Japanese they developed a so-called basic integrity assessment policy to assess the integrity of MPP structures, system components they were developed and they were used based on the combination of inspection analysis there's something they did without international standards of guidance to how to do this assessment policy when the stream event exceeded significantly the design basis there's something that they have shared with the rest of the people so learn of course, I mentioned before if not learn, really realize that the earthquake can induce fires in the events so in this now, of course it tells us seismically induced fires need to be taken into account in the design of the fire protection system fire water protection system you can also have to take into account not only for the design of the fire protection system but for the fire protection program to take into account in the situation what you can do and as a result now the plan has a fire brigade permanently at the site I know some countries they do have, they don't but now in Japan there is a permanent fire brigade at the site don't need to call from a fire brigade from outside so now I'm going to come into the other big earthquake to the one that you know of 2011 2011 of March so the time there around 2pm early in the morning here magnitude around 9 this is internal value and it was the last earthquake recorded in Japan and actually said the earthquake but it was not a single earthquake there was a series of earthquakes that also took place over different days something not to forget and it covered the last region you will see we have a picture now following but to give you an idea the island of Japan moved in average 50 meters east after all these earthquakes and it was deepened on the on the east part one meter so I've been there in some places and there are some piers like the one you see here outside and you go to the sea and you know they are covered by water when people before have a boat they still have the boat but sometimes the water goes over the pier something difficult to imagine but the country has moved 50 meters and so it's deepened but it is true so I do not have to control my time when do we have to finish one or two two or three okay so I maybe don't need to go into the very many details but the important thing to say from this picture is that there was not one earthquake there were several earthquakes in several regions but of course related to the to the same tectonic plates and they were not breaking at the same time but there were very important earthquakes in which one plate was subdued inside the other and this is actually what it gives rise to the this displacement what it gives rise to to the tsunami and there were several breaks I have another maybe picture less technical and so on but that's of course a model and create different sources of tsunami and different tsunami waves of different magnitude and the impact on the plant resulted differently this is Onagawa there and Fukushima Daichi, Daini are there and so on it affected very many almost 400 kilometers along the coast of Japan and was a matter of not only distance but also sometimes the super super position of the waves because it depends on the phases sometimes one wave as to the other and build up more so this is for instance the reason that Fukushima Daini the flooding was limited and they were able to keep one power supply that the one was used for the units and so on in Daichi they were not so lucky they were lucky if you so wish called lucky with the units 5 and 6 but it was a series of earthquakes and a series of tsunamis and the overall impact is driven by time and coincidence of the tsunami waves and so on that's a picture around this is the Fukushima Daichi site units 1, 3 and 4 units 6 and 5 are here a bit higher and this is a picture of an estimate of the altitude of the different waves and so on and whether they went of the small tsunami protection and so on and here maybe it's another one taking into account from the level of the sea the tide above and here they have the service water or the intake water and then the grade of the plan the excavation level of the plan was 13 meters above for units 1 to 4 but not sufficient, this is service building, turbine building, reactor building probably has seen many pictures of them these are plan levels about the sea in different plans you have here Fukushima Daichi 13 meters units 4, 10 meters 13 and Daini 12 and Onagawa 14.8 so they are not very different, Onagawa is much higher, you must realize but sometimes when it comes here it was also a matter of lack or coincidence of wave or something there are many factors, it's not something that you know, it's the way it also depends the ways inside the plan the circumstances but these are pictures from a mission we conducted to Onagawa when you Fukushima see what happened and even if you go there you will not now be able you cannot go there, of course, of the terrible conditions that you will be exposed but it's not easy to make a forensic analysis and now say this was caused by the earthquake this was caused by the tsunami and this was caused by the hydrogen explosion you only see destruction, you cannot see but Onagawa survived and Onagawa shut down it is very good to see what the impact of the earthquake and the tsunami was there to the stand it was hit but it was hit by the and this was by the way the plan that it was closest to the earthquake and we had a mission we were participating in this mission as part of the system analysis team so we were looking at several aspects on structures and systems so the plan was operating at the time of the earthquake and tsunami there was one unit that was starting up they were not the same, the status was the same but the plan was in operation and the power cabinets and the power buses and so on was energized so the basis for assuming the operability of the plan after the earthquake is that all these were reported to be undamaged and operable but of course we made our visit, our analysis our discussions after that they have there were the protections of some equipment has been triggered and some equipment is the energized or this energized we cannot energize the equipment to see if there has been damage or not so part of the conclusions are made by analysis by inspection and so on they have been, they were doing they share some results with that we went to for some walk downs of course they are not waiting we were not waiting for the IA they have been also doing repairs but it is impressive to see little impact sometimes in spite of the magnitude of the quaking in structures in walls even in things like the turbine they have been impact on on anchoring of the turbine on the turbine blades by the way by the way I think I am not very photogenic I am the guy there and the guy there so we were visiting some of the systems at the plant this is the instrumentation of the vessel from underneath this RC RCIC equipment that it is what you used to call the isolated core, it is a steam driven system it is equivalent to a cylinder feed water pressure water reactor and this is what was running for most of the time in the Fukushima daichi one because it doesn't need power supply it only needs DC power until eventually disappear even in some units in Fukushima daichi when going without DC power for a while the unit one is the one that doesn't have RCIC have isolation condenser anyway we have a very interesting findings there and discussions and as I said this is like a good lab for seeing what has happened in the whole area and it is interesting to know that this plant because strong positions there of the some engineers was designed to a higher level of tsunami this certainly saved the plant and now of course they are even taking into account further steps to enlarge the protections they are constructing three meters above and reinforcing also some of the buildings the motions that were observed there on the basement were close to the response of the beyond design basis ground mode acceleration however let me show you there were some motions there that were about the design basis I'm going to show you something about the tsunami this was 13 meters it was not reached by the planet and I have some pictures here the tsunami hazard on all these several sites in the course of Japan was underestimated for a number of reasons they were not also taking into account in several opportunities that they have for for the revision of the seismic design and also the design against tsunamis probably all of you have seen this picture where they had some road in some village marking the water came up here 100 years ago if some of you have had the opportunity of seeing the report of the IEA on the Fukushima accident if it has not been changed I was reviewing this report last year ago it's interesting to know when you see the the sighting analysis in the design of Fukushima, the Ichinuka power plant you look there for the external hazards and there is not in the original report tsunami was not there explicitly tsunami was there but was inside the analysis of tidal waves that may happen and the tsunami that was considered for the design was a tsunami from a large earthquake that took place in Chile and propagate across the Pacific a altitude of 3.12 meters in the coast of Japan a nice wave for surfing so this is what it was considered for the surprisingly for the design at Fukushima and if you have seen the picture of Fukushima the Ichi you will also see that the elevation of the soil near the coast is higher so they excavate down the plant to save probably in pumping costs and so on so they lower the soil to be closer to the sea and they went too far down and there were several opportunities to make some improvements put some tsunami world protections to reconsider the situation but these opportunities were not taking one thing here interesting is to mention is when this accident that took place in Kashiwazawa-ki, Kariba before they understood in Japan the importance of having emergency response centers on site and this was installed at several plants in Japan included Fukushima so in Fukushima up in the hill there was an emergency response center now it's required in our requirements of the IE and this is the place where people was able to I will not say to rest because people didn't sleep for days after the accident but it was the only place where people could stay safely at the plant and be able to be there because if they would have not had this facility at the plant simply the whole plant site would have been destroyed and people couldn't have no place to rest no place to hide, no place to have nothing at the plant for responding so this was a lesson that was that was learned from a previous case and it was in place at Fukushima and this is the place from now of course when there is some severe accident condition it is the place where you have all the technical logistics support for the operating crew the place can be activated before that you don't need to be waiting to be waiting for a severe accident but it is there for the case of it so lessons about hydrogen risk of course and emergency arrangement this is the conclusion so maybe to say again that even this earthquake exceed the design basis of many of the plants there in this course that the earthquake itself was not a big problem the failures or the damages that were experienced at all these units we cannot speak for Fukushima because we cannot go there but it was very limited the seismic design was robust and the margins were sufficient the earthquake was underestimated but the margins provided for ensuring the safety functions the problem was the tsunami when the tsunami submerged the plant then the safety functions could not be ensured this is what basically I just said ok so now of course it is very difficult you cannot say in Fukushima anything about what happens there are some people, scientists or different people that claim that the evolution in Fukushima 1 the fast cooling and so on was the result of a potential loco all they say that this was the isolation condenser was not being verified now it is not possible to see if the damage there are from the earthquake, the tsunami the hydrogen explosions the helicopter drop of water and so on so maybe the earthquake indeed has some impact in Fukushima but it is not possible to know what is the impact on that plant in Onagawa we had a very long report from this from this mission and it was impressive the design of the plant regarding the earthquake seeing the damage was really impressive now of course what is important to learn is the seismic hazard evaluation ones have to be very careful not to underestimate and rely simply on historical data on data that it is seismologically recorded there has to be further analysis of the soil in the neighboring areas to be able to understand that the hazard is properly characterized and the magnitude is properly established for the design something about the tsunami that of course was as I said for several reasons underestimated the tsunami warning now it has been clear how important is tsunami warning of course tsunami warning saves people but not really saves the plant can save it partially so when the tsunami warning is given and it is a real warning the tsunami will arrive and if the plant is going to be flooded it will be flooded but depending from where is the tsunami coming and the magnitude you may buy some time so this may allow to initiate the fast shutdown of the plant try to do some actions I mean in case the plant is not properly designed to facilitate the later management of the accident and you know this will of course have some impact in Fukushima but in Fukushima surprisingly even after this tsunami that happens in Thailand in that region there was no warning of tsunami at the plant and it the people that was in this technical support center in the maintenance center I had one colleague of the IEA that was working there he was the head of maintenance of the plant and with the first movements of the earthquake very strong earthquake came they went out of the building they realized nobody had been hurt and so on and later on they found through the TV that tsunami was coming later on but the operators didn't know so there was no alert in two operators in fact this is one of the reasons because some people were sent next to the seat to inspect the intake structure and so on some people died so now there's going to be an alert for the operator but as I said the alert does not protect the plant it gives you some time it gives you some opportunity to influence the outcome or the impact but not really to prevent many failures also important is to take into account not only the tsunami but what we said at the beginning the run up because it's not only the level of the tsunami it's also the possibility the dynamic force and how it can go and what is the the destruction on the plant there's a need to use a systematic approach for dealing with the design of the Nuka power plant for prevention against tsunami so now many as you know the plants in Japan most of them are shut down some of them are now reconsidering going in the process of being authorized to restart but when you see there in the buildings I have seen this in Hamaoka I have seen this in Onagawa now they have buildings have watertight doors and before the watertight door there is a massive star the big unbelievable I don't know how to describe door to take the heat of the potential tsunami so in addition to tsunami walls or increase of the level of the existing protections and so on to make sure that that the plant remains remains dry I'm putting here something we saw that happened in Onagawa is interesting this is the tsunami effect so this is the sea the estimated tsunami could go up to 9.1 meters tsunami went higher but the tsunami wall in this plant was designed with more margins than others as I mentioned before tsunami was not able to go over the wall so the tsunami was not able to flood the plant what happened is that the tsunami went into a structure for the intake of water and there there were the sea water pumps and there were some ultrasonic level transmitters and the water came here with a lot of force and pulled this up these were the original transmitters now this is the way now it's sealed but now where they have the transmitter they have something like this so to make sure that the tsunami will never lift this up the result was that the water entered in this space there was train A, train B there were doors as started as this I don't need to put the detail of the doors there but these are kind of submarine doors you close and there is a wheel and the door is as thick as this and they have rubber joints and so on these are supposed to be able to hold the water not to let it propagate between one division or the other so the water came here went into this tunnel there's some cable penetration there they can bring the power to these pumps and so on and there at the door at the wall they found the way the water I tell you finds every path and it went into some gallery there and it flood the building and they took us to this building for pictures with the press and everything and so on the way they have cell and in this building they have three redundancies marking colors and the water came up from from this side somewhere it's not easy to see here now because let me see yeah the water came here from this gallery from this way so here and the water entered there and these doors that you see here out of this size this is with the big one for moving the equipment this is the small one that you open to gross this is me by the way again and they make us the point because there was a very fast transfer of water from one to another side and they flood this redundancy and they flood this redundancy and this one was not able to flood that there was just one meter and they stole some pumping system water and they pump out the water before the loss one redundancy unfortunately for them the residual heat was low because the plan was starting after a shutdown but I don't see here from the report the times but the times for the flooding here don't match it is unbelievable that the water will penetrate those doors just through the door gaps so quickly and one door and another door and what happened at the end is that those places were connected by the samps the samps were connected so there was a path there was a pipe penetrating there so this door didn't help because the pipe was penetrating the wall now is sealed there was another penetration there in the wall there was a cable penetration there they went from there to there and so on so the water found out all the paths and they believe that they have three redundancies separated and protected against flooding and they didn't and this tsunami didn't exceed the wall there but in this unit found this path through this and they were lucky because something more serious could have happened so you have to understand what is also the importance to learn from this it's not only the earthquake, it's not only the tsunami you have to understand all these things all these propagation flood protection looks like easy but very careful all the communication path has to be taken into account well this is about tsunami warning of course depending what is the origin of the tsunami what is the seismic the origin of the earthquake you have more or less time tsunami warning is is relevant for preparing for the tsunami event so maybe to recapitulate lessons learned from the lessons learned so this lesson from Kasiwa Saki Kariba experience was very important for Fukushima because they came up with the importance of this seismically isolated building with ventilation also filter ventilation at the high elevation and located at the plant and this was the point that the people could stay there at Fukushima and could be there actually this building was contaminated partially by the visit of some politician that didn't care into taking the necessary the contamination measures to visit the plant it was the place where people could reside and stay there for weeks mitigating the accident and also the the side brigade was also very important although there were not fires in the at the plant the fire was not an issue in Fukushima there was some small fires in Onagawa in a power cabinet this mid voltage here it was not but the fact that they have established fire water brigade at the plant as a result of Kasiwa Saki Kariba this gave them the opportunity to have some water tanks and more than water tanks fire trucks and something that will facilitate them to provide cooling to several structures they didn't save the plant unfortunately but they have there because if you have an accident like the one in Fukushima the roads were destroyed the roads were flooded by the tsunami transportation had to be many things by helicopter so having a fire brigade there was a positive thing and I think I finished before the time now I'm ready for anyway some questions thank you