The 11 March 2011 tsunami was probably the fourth largest in the past 100 years and killed over 15 000 people. The magnitude of the design tsunami triggering earthquake affecting this region of Japan had been grossly underestimated, and the tsunami hit the Fukushima Dai-ichi nuclear power plant (NPP), causing the third most severe accident in an NPP ever. Interestingly, while the Onagawa NPP was also hit by a tsunami of approximately the same height as Dai-ichi, it survived the event ‘remarkably undamaged’. We explain what has been referred to as the cascade of engineering and regulatory failures that led to the Fukushima disaster. One, insufficient attention had been given to evidence of large tsunamis inundating the region earlier, to Japanese research suggestive that large earthquakes could occur anywhere along a subduction zone, and to new research on mega-thrusts since Boxing Day 2004. Two, there were unexplainably different design conditions for NPPs at close distances from each other. Three, the hazard analysis to calculate the maximum probable tsunami at Dai-ichi appeared to have had methodological mistakes, which almost nobody experienced in tsunami engineering would have made. Four, there were substantial inadequacies in the Japan nuclear regulatory structure. The Fukushima accident was preventable, if international best practices and standards had been followed, if there had been international reviews, and had common sense prevailed in the interpretation of pre-existing geological and hydrodynamic findings. Formal standards are needed for evaluating the tsunami vulnerability of NPPs, for specific training of engineers and scientists who perform tsunami computations for emergency preparedness or critical facilities, as well as for regulators who review safety studies.

1. Introduction

The 2004 Boxing Day tsunami killed over 220 000 people and ushered a new era in tsunami hazard mitigation and planning, worldwide. There are now several tsunami-specific warning centres monitoring events in the Pacific, Atlantic and Indian Oceans, as well as the Mediterranean Sea [1]. Computational methods have evolved and their predictions of tsunami evolution in the deep ocean are consistently robust, and rely on tsunamograph (DART—deep-ocean assessment and reporting of tsunamis) recordings for updating what are, now and in most cases, fairly accurate initial predictions. Hundreds of scientists and emergency managers in the Pacific and Indian Oceans have been trained in pre-event assessment of hazards through different UNESCO initiatives [2]. Flooding maps for tsunami inundation now exist for most of the western states of the United States, and in several high-risk locales worldwide. Tsunami resilience is evolving into mainstream science. Just before 11 March 2011, the world appeared to have been safer than a decade earlier, at least in terms of warning and preparedness for tsunamis.

Comparatively less attention was paid to the safety of nuclear power plants (NPPs) post-2004, despite the lesser known fact, or perhaps because of it, that an Indian Ocean NPP affected from the Boxing Day tsunami survived fairly unscathed. India has three coastal NPPs, at Kalpakkam, Kudankulam and Tarapur [3]. The tsunami hit the Madras Atomic Power Station at Kalpakkam, whose Unit 2 was operational. The seawater level, normally 3 m below the operating floor of the pump house, rose to approximately 1.9 m above it, flooding the pumping assembly. The reactor was brought to safe shutdown successfully. Yet, there had been no warning for the imminent tsunami [4].

Since the Atomic Energy Act of 1954 in the United States which ‘encouraged private corporations to build nuclear reactors’ [5], the construction of NPPs has faced controversy by alliances of mainstream environmental and mainstream anti-nuclear weapon groups. The nuclear industry worldwide has thus had an increased sensitivity to criticism, and their assessments have often been shrouded in unwelcome and, more often than not, unnecessary secrecy. The entire field of probabilistic earthquake hazards assessment grew in the 1970s out of concerns for the seismic safety of NPPs planned for in California.

Fierce litigation and public relations battles were fought by utilities and environmental organizations in the 1970s for licensing plants that had been planned for in the 1960s. With the exception of the proposed Bodega Bay, California plant, never built because of its proximity with the San Andreas fault, the environmental movement did not succeed in blocking the eventual construction of any single NPP in the United States. However, it did succeed in making permitting so costly and unpredictable in terms of length of litigation, that no plants in the United States were planned for almost three decades, even following the 1978 oil crisis. As the climatic consequences of burning fossil fuels became clearer, and as the United States and the Soviet Union entered into various agreements to reduce their nuclear weapons arsenals, resistance to nuclear power gradually softened. With the lessons of Three Mile Island and Chernobyl seemingly absorbed, plans started being made for new plants in the first decade of the twenty-first century.

Following Boxing Day 2004, the United States Nuclear Regulatory Commission (US NRC) considered re-evaluating their design requirements for tsunamis [6,7], and standard and benchmarks were developed for assessing the veracity of numerical codes used for tsunami assessments [8]. Studies to identify tsunami hazard worldwide started being published, even for locations earlier believed as ‘safe’. In the earlier theme issue of these Philosophical Transactions which discussed extreme natural hazards in the context of the 2004 event [9], it was argued that there should never again be another surprise from an unrecognized mega-thrust system.

Yet there was, and in Japan, the least likely place anyone would have ever expected to have underestimated tsunami threats. The 11 March 2011 earthquake and the tsunami it triggered caused a reactor meltdown in Fukushima Dai-ichi and release of radioactive nuclei in the surrounding area. The accident is the worst since the 1986 Chernobyl event. The impact to the nuclear industry worldwide was severe, and not just in terms of safety re-assessment. The consequences of this substantial setback in alternatives to fossil fuels have yet to be fully assessed. As an example, Germany announced the permanent shutdown of its NPPs. Seven reactors were taken off operations shortly after the accident, and the plan is for all its 17 reactors to be closed by 2022 [10].

Here, we will examine the run-up to the accident in terms of tsunami engineering, and we will argue that neither the impact of the 2004 tsunami on the Indian NPP, nor the knowledge acquired since then about maximum earthquake size in subduction zones [11] did anything to change the nuclear culture in Japan, but did just a bit more so in the United States. We submit that the Fukushima Dai-ichi plant owner Tokyo Electric Power Company (TEPCO) and its principal regulator Nuclear and Industrial Safety Agency (NISA) failed to take simple steps to give its plants a sporting chance to safely shut down, even though there has been mounting evidence that their design against tsunami flooding was inadequate [12].

Our emphasis will be the tsunami aspects of the Fukushima accident. We will briefly describe what happened on 11 March 2011, and will explain what has been referred to as ‘a cascade of stupid errors’ [13], which nobody in the field could have possibly ignored. We will also briefly discuss the industry's and regulators's response which, in some instances, does not necessarily follow an entirely different path from the one which led to the accident.

2. Tsunami setting

Tsunamis have been known and described by chroniclers in Japan for centuries. In fact, the term has largely replaced the English term ‘tidal wave’ to eliminate any confusion with tides, much as the latter is not entirely inappropriate, given that most tsunamis along open coastlines resemble fast receding or ebbing tides. The geological setting of Japan is well known. Here, we will discuss a few large tsunamis that have hit North East Japan (figure 1 and table 1), in chronological order, events which were known in the literature and ought to have been known to regulators, scientists and engineers involved in the safety assessments of Japanese NPPs. Figure 1. Locations of NPPs (triangles) affected by the 11 March 2011 earthquake (star) and tsunami, and relevant historical earthquakes in North East Japan listed in the 1974 catalogue of Soloviev & Go [14]. Events are shown with red dots, whose radius is adjusted to the Soloviev tsunami intensity scale; 150 and 300 km radius circles from Fukushima Dai-ichi are shown with dotted and dashed lines, respectively, depicting the region over which international standards require consideration of hazard sources.

Table 1.Relevant earthquakes in North East Japan as in Soloviev & Go [14]. M, A and I represent the inferred earthquake magnitude, the authenticity and the tsunami intensity scale, respectively. Authenticity: D refers to a tsunami which was registered on at least one tide gauge or there were many reliable visual observations; L refers to a likely event for which a few comparatively reliable observations exist. Tsunami intensity scale I refers to Soloviev scale [15]. Collapse date lat. (°N) lon. (°E) M A I 13 July 869, Jōgan 38.5 143.8 8.6 D 4 31 January 1605, Keichō Nankaido 34.3 140.4 7.9 D 4 2 December 1611, Keichō Sanriku 38.2 143.9 8.1 D 4 13 April 1677, Empo Sanriku 38.7 144.0 8.1 L 2 4 November 1677, Empo Boso-oki 34.7 141.2 7.4a L 2.5 17 February 1793, Kansei Sanriku 38.3 142.4 7.1 D 2 15 June 1896, Meiji Sanriku 39.6 144.2 7.6 D 3.75 3 March 1933, Showa Sanriku 39.1 144.7 8.5 D 3.5 16 May 1968, Tokachi-oki 40.7 143.6 8.0 D 2

Soloviev & Go [14] in their 1974 monumental work on tsunamis in the Western Pacific Ocean refer to the 13 July AD 869 (known as the Jōgan earthquake) event as especially strong in the vicinity of Sendai and surmised that its triggering earthquake was an M∼8.6 with an epicentral location approximately 120 km west of the 11 March 2011 event (figure 1). They refer to 19 studies for this event in the period 1868–1969. Presumably on the basis of these studies, they assigned it a tsunami intensity I=4, which is one of their highest values for Japan tsunamis. Yet, in the aftermath of the Fukushima accident, it has been argued repeatedly that the Jōgan tsunami had not been documented until 2001 [17], well after the design of the NPP.

The intensity scale in table 1 refers to the Soloviev scale , where H is the average of the run-up height, or the overland flooding depth, or the height of the tsunami on the nearby tide gauge [15]. Post-1992, it was recognized that, even for the same tsunami, these values can differ substantially, and for most historical cases reference to an average is meaningless, because often there are only a handful of ‘data’ points, inferred from chroniclers who may have not even visited the affected sites. Nonetheless, intensities are indicative of the size of the tsunami, and the existence of any historical reference to a flooding depth or tide gauge reading provides some confidence about the legitimacy of the tsunami occurrence. A low value may not necessarily imply a minor tsunami, but a high value does suggest a major one. The above notwithstanding, tsunami intensities are only valuable for comparisons of events within the same catalogue, as assessed by the same specific cataloguer [18].

Another two I=4 events are listed by Soloviev & Go's [14] catalogue, in the same general vicinity and are identified as definite tsunamis. They assigned an I=2.5 to the tsunami from the 4 November 1677 earthquake, which they interpreted as an M∼7.4. It is now known as the Empo Boso-oki earthquake and is believed to have been a tsunami earthquake with a magnitude M w =8.4 and estimated 3.5–7 m tsunami heights at the southern Fukushima prefecture coast [16]. A tsunami earthquake is an event that triggers higher tsunamis than otherwise expected based on earthquake scaling laws [19,20]. The iconic M∼7.6, 15 June 1896 Meiji Sanriku earthquake generated a tsunami with maximum height reaching 38 m and killing 22 000 people. The 3 March 1933 Showa Sanriku earthquake M∼8.5 generated a tsunami with maximum height up to 29 m and death toll 3000 [21,22]. The 22 May 1960 Great Chilean earthquake is the largest ever recorded event instrumentally. Its tsunami reached Japan coast 23 h later with wave height up to 6 m, killing 138 people [23]. Probably on this basis, seawalls with normalized heights of 6 m were constructed along the Sanriku coast.

In 2006, national seismic hazard maps were accepted by the Japanese government showing future probabilities of earthquake occurrence and a relevant report was published in 2009 [16]. The latter estimated a 99% probability of an M∼7.5 earthquake occurring in the period 2010–2040 off the Miyagi prefecture—off the Sendai and Onagawa—(west of the 2011 event), and 80–90% for an M∼7.7 event, close to where the 2011 earthquake occurred. The 1933 M∼8.5 (M∼8.1 [16,22]) Sanriku earthquake was the only known normal faulting earthquake pre-2011 generating a tsunami in Japan [22] in the literature, and its 30 year repetition probability was estimated as 4–7%.

For perspective in the subsequent discussion, it is useful to recall the 17 July 1993 Hokkaidō Nansei-oki tsunami that devastated the island of Okushiri in the Sea of Japan. It was triggered by an M∼7.7 earthquake, with estimated 10–18 m s−1 overland flow velocities and extreme 30 m run-up in one location [24]. Towns in Okushiri had been protected by a 4.5 m high seawall, constructed in the aftermath of the 26 May 1983 tsunami. They were overtopped at places by an 11 m tsunami flood [25]. Shuto & Fujima [25] stated that ‘This fact called for serious reflection to the conventional method after 1960 that relied mainly on structures’. The event generated a high-quality inundation dataset in a geographical setting where a fairly accurate determination of the seafloor motion could be made post facto. The latter is important because tsunami predictions can only be as good as the estimates of the source characteristics that produced them, i.e. the estimates of the initial condition for the hydrodynamic simulations. This Okushiri tsunami became the most useful benchmark for numerical codes that purport to predict tsunami inundation. In its aftermath, Japan spent over US$600M (in 1998) to build an 11 m high seawall, to rebuild the main town of Aonae, and to protect about 20 km of coastlines. Even so, its population dwindled from 4679 in 1993 to 3160 in 2012 [26].

The fact that Japan spent an average of approximately US$130K per Okushiri resident expressed a commitment to tsunami hazard mitigation, which unfortunately the 11 March 2011 underscored as not having been uniformly applied elsewhere. To wit, we are reminded of the Kamaishi breakwater, a pharaonic structure protecting Kamaishi, where no NPPs are located. Built at a cost of nearly US$1.5B, after more than three decades in construction, it was the largest and deepest breakwater in the world, and was located 215 km from Fukushima Dai-ichi (figure 1) and largely crumpled under the tsunami [27].

3. A brief history of two nuclear power plants

Four NPPs were affected by the 11 March 2011 tsunami, the Onagawa, Fukushima Dai-ichi, Fukushima Dai-ni and Tokai Dai-ni NPPs [28,29], all within approximately 230 km stretch of coastline (figure 1). The Higashidōri NPP was also affected, but primarily because of loss of off-site AC power [12]. Here, we will briefly compare the tsunami-relevant design history of the Onagawa and Fukushima Dai-ichi NPPs, both of which experienced approximately 13 m maximum wave heights, but had entirely different fates.

As a preamble, NPPs rely on cooling from nearby water bodies, for months even after routine shut downs, irrespective of whether they operate with pressurized-water or boiling-water reactors. For emergencies, they have two alternative sources of emergency power, batteries and emergency diesel generators (EDGs). Sometimes, NPPs have an emergency source of cooling water that can flow to the plant under gravity, even when there is complete loss of external power. The Fukushima Dai-ichi NPP did not have the latter, and relied almost exclusively on auxiliary power for cooling during emergencies.

In terms of planning for tsunami flooding, the most appropriate design measure is the overland flow depth at the plant elevation. This is different from the tsunami run-up, which is the highest inland elevation the tip of the tsunami flood reaches to, with respect to mean water level, and can be quite different from height predictions at nearby tidal gauges. Before the advent of modern numerical codes which predict flooding and inundation, the so-called maximum tsunami height (sometimes erroneously referred to as the maximum run-up) referred to an estimate of the maximum water level the tsunami reached at the initial shoreline. Calculating overland flow depths remains a difficult undertaking, and only with substantial experience from modelling earlier events can it be reliably estimated, for it can be affected by features of scales smaller than the resolution of numerical grids [30]. The prediction of the distribution of overland flow depths is, of course, dependent on the estimation of the maximum probable tsunami.

The Onagawa NPP is operated by the Tohoku Electric Power Company (Tohoku EPCo) and was the closest plant to the epicentral source of the 2011 tsunami (figure 1). It has three reactors (units), which were sequentially taken into operations in 1984, 1995 and 2002 [29]. In 1968, in preparation for licensing, an in-house committee from civil engineers [31] interviewed local people, and concluded that a likely maximum tsunami height around the plant was approximately 3 m based on the 1896 Meiji Sanriku and 1933 Showa Sanriku events. However, they also considered the 869 Jōgan and 1611 Keichō Sanriku tsunamis and decided to set the site-grade level to 14.8 m (table 2), not knowing what the actual local flooding levels from these tsunamis were [35]. The plant was also fronted by a 14.8 m embankment above the reference sea level (table 2).

Table 2.Summary of NPPs design conditions and damage to power supplies. Collapse NPPs pre-2011 estimated tsunami heights (m) [16,32] 2011 tsunami heights/NPP elevations (m) [32] off-site power lines damaged/total [33] EDGs damaged/total [33] Onagawaa 13.6c 13/14.8f 4/5 2/8 Fukushima Dai-ichia 6.1d 13/10-13 6/6 12/13 Fukushima Dai-nia 5.0e 9/12 3/4 9/12 Tokai Dai-nib 5.7e 5/8 3/3 1/3

In 1987, before the license application for Unit 2, Tohoku EPCo conducted a palaeo-tsunami study for the Jōgan tsunami at the Sendai plain, and did numerical modelling for the 1611 Keichō Sanriku tsunami [35], the latter indicating a 9.1 m tsunami height at the site. In 2002, Tohoku EPCo volunteered to conduct an additional study considering the Japan Society of Civil Engineers (JSCE) method [36]. The study used initial conditions for the computations resulting from a parameter variation of the inferred source characteristics of M∼8.3 and M∼8.6 earthquakes, and they estimated a 13.6 m design tsunami height [35]. This analysis is consistent with what has been described as a superior culture of safety at the Tohoku EPCo [37,38].

Units 1 and 3 were in operation during the earthquake, Unit 2 was starting up [12]. Strong ground shaking triggered automatic shutdown procedures. The earthquake damaged four of the five off-site power lines, but two of its eight EDGs survived the tsunami—which arrived 43 min after the earthquake—and they continued to cool down the reactors [12]. Even though the site co-seismically subsided by 1 m, the main tsunami did not reach the facilities, but inundated the basement of the reactor building through a seawater pump conduit [16]. The intake seawater pump was exposed dry for several minutes, as the tsunami receded, but water left in the piping system continued to cool down the reactors. Given the magnitude, distance, duration of ground shaking and ‘the strongest shaking that any NPP has ever experienced from an earthquake’, the Onagawa NPP survived the event relatively unscathed [29,38].

The six-unit Fukushima Dai-ichi was commissioned in 1966 and is operated by TEPCO. Its initial application was based on the 3.122 m measurement local tsunami height (above Onahama Peil (O.P.) reference sea level), observed during the 1960 Great Chilean tsunami at or close to Fukushima [32]. The flooding estimate was provided to the nearest millimetre, underscoring a false sense of accuracy in the safety assessment that is impossible even today. With hindsight, it also underscores the ‘quality’ of the engineering work and of its review.

The first elevation wave of the 2011 tsunami arrived at Fukushima Dai-ichi about 40 min after the earthquake (figure 2), while the second elevation-wave arrived about 10 min later [12]. All three operational reactors (1, 2 and 3) started being scrammed, and apparently the control rods were inserted [39]. The tsunami damaged all off-site electric transmission facilities. According to the National Diet of Japan [40], a back-up transmission line from Tohoku EPCo failed due to mismatched sockets. The EDGs started operating, but then the tsunami swept 12 of its 13 EDGs, resulting in complete loss of electrical power at Units 1–5, a condition known as station blackout. Other than Units 5 and 6 that were jerry-rigged to the one surviving EDG, the other units were left on battery power, which only lasted for approximately another 8 h. The cooling was lost in Unit 1 after several hours, in Unit 2 after about 71 h and in Unit 3 in about 36 h, the three units in operation [39]. The stage was set for the most costly NPP accident in history, this far, and the largest loss of life and civil disruption in Japan since World War II [12]. Figure 2. Tsunami attacking Fukushima Dai-ichi NPP (http://photo.tepco.co.jp/en/index-e.html).

It is estimated that core damage in Unit 1 started 4–7 h after the loss of power, 75–85 h later in Unit 2 and 36–50 h later in Unit 3 [12]. It took 8–14 h for the first release of radioactive materials, and the first hydrogen explosion occurred in Unit 1 about 24 h after the initiation of the event. In total, 23 of the 24 radiation monitoring stations stopped functioning after the tsunami [12]. Off-site power was restored on 20 March 2011 for Units 1 and 2, and on 22 March 2011 for Unit 3 [12].

What was unprecedented was the almost simultaneous loss of both onsite AC power (EDGs) and DC power, an event that simply had not been imagined. Yet, what doomed the Fukushima Dai-ichi was the elevation of the EDGs. The plant personnel were in such dire need of emergency power that they even connected car batteries just to get instrument readings. The narratives in different government and international reports are not helpful in this regard, for they do not discuss in detail the elevation of the generators. Examining [32], p. 38, it is apparent that one set of EDGs (subsystem-A) were located at the first basement floor for Units 1–6, interestingly, at a lower elevation than other critical facilities, see figure on p. 14 in [40]. The plant elevation heights for Units 1–4 were 10 m and 13 m for Units 5–6, with respect to the reference sea level (O.P.). In addition, another set of EDGs (subsystem-B) were located again at the first basement floor for Units 1, 3 and 5 and at the first floor for Units 2, 4 and 6. Even though EDGs were in the basement floor at Units 5 and 6, at least one reportedly survived the flooding, possibly because this subsystem was at a 3 m higher elevation compared to those in Units 1–4. Such siting of the EDGs is incomprehensible, and suggestive of the secondary importance that have been placed on the risk of tsunami flooding in the safety assessments for the plant.

For reference, the Tokai Dai-ni NPP is located 100 km south of the Fukushima Dai-ichi. Owing to strong ground shaking reactors were shut down and all off-site power lost. The maximum wave height reportedly reached 5.4 m above the local reference sea level at Hitachi Point (H.P.) [29] at the pumping area, but did not reach the critical facilities which are located at 8.9 m H.P. [32]. Two of the three EDGs survived the flooding and were used to provide power to continue to cool down the reactors [12]. In this NPP, a tsunami earthquake, similar to the 1677 Boso-oki earthquake was claimed to have been used for the parameter study to determine the maximum probable tsunami, and the design tsunami height, while initially set at 4.9 m was revised to 5.7 m, based on [16,41]. A new 6.1 m side wall protecting the sea water pump area was completed on 9 March 2011 [16]. One can only speculate whether this NPP would have been also severely affected, had the epicentre of the 2011 event been a few tens of kilometres to the south or a delay incurred on the completion of the wall.

4. A cascade of industrial, regulatory and engineering failures

The seeds of the Fukushima Dai-ichi accident were laid during the construction of the NPP. The plant site was at approximately 30 m O.P. [32] (at 35 m O.P. in [42,43]), on a natural berm that ran alongshore (figure 3, see also photographs in [42,43]). According to documents filed in 1967 with Japanese authorities, TEPCO graded the 30 m O.P. berm to 10 m to make it easier to ferry equipment to the site, and to make it easier to pump seawater to the reactors, with the added advantage of the base being closer to bedrock, helpful in reducing local ground amplification during tremors. While the latter may well be true, it is clear that the company did not adequately consider, even qualitatively, the tsunami history of Japan. Figure 3. TEPCO photographs showing the coastal cliffs next to the Fukushima Dai-ichi NPP shortly after the tsunami (http://photo.tepco.co.jp/en/index-e.html). According to [32,42,43] the original ground surface at the seaside where Fukushima Dai-ichi was cited was at +30 m O.P. elevation. This can also be inferred by comparing the size of the persons to the height of the coastal berm. It was excavated to −4 m O.P. to obtain a more stable foundation, and the site ground level ‘was determined by comprehensively considering various issues such as tsunami height, work space, entrances, excavation costs, etc.’ [32].

In 2002, the chief executive officer of TEPCO and four other top executives resigned [44]. It was then revealed that 29 NPP maintenance documents had been falsified. A series of cases of misconduct began to unravel the inappropriate handling of inspection records and report on cracks found in Unit 1 of Fukushima Dai-ichi NPP. As a result, TEPCO was forced to take 17 nuclear reactors temporarily offline. The new management promised to ‘turn a misfortune into a blessing’ [45].

Serendipitously also in 2002, the JSCE produced its tsunami assessment methods for NPPs in Japan [36], later published in a journal paper [46]. When discussing the ‘setting source of historical tsunamis’, the report states that the largest tsunami is to be selected ‘based on the literature survey, etc., the historical tsunami that is assumed to have exerted the greatest influence on the target site is selected as the evaluation target’. There is no discussion how to design when there are no known near-field sources. The JSCE report divides the eastern offshore region of Japan into eight segments, and each is assigned a maximum earthquake moment, based on a given historic event. This was the basis for TEPCO's [32] design earthquake for Fukushima Dai-ichi. Interestingly, while [36] suggested using tsunami catalogues for consultation for design, it does not list Soloviev and Go's [14] catalogue, but has a vague reference to ‘investigation report by research institutes such as universities, etc.’.

A post-2002 TEPCO study used a parameter variation of M∼7.5 earthquakes [34] to develop scenario tsunamis for the plant. It concluded that the design tsunami height was 5.7 m at Dai-ichi and 5.2 m at Dai-ini [12,32] over the O.P. reference water level. The 2007 Fukushima prefecture disaster prevention plan considered a 5 m tsunami height for evacuation purposes [32]. In 2008, TEPCO did two sets of calculations, one based on the Headquarters for Earthquake Research Promotion (HERP) fault models which suggested tsunami height estimates of 8.4–10.2 m relative to the reference sea level. Another one based on Satake et al. [47] produced 8.7–9.2 m tsunami height estimates which were also apparently dismissed [32]. TEPCO ignored them, claiming there was ‘no wave source model’ for the former, and it required a tsunami deposit investigation for the latter [32]. In 2009, new estimates using updated bathymetry and tidal data yielded a 6.1 m tsunami height [12,32]. This was not followed-up and was only reported to Japan's Nuclear and Industrial Safety Agency (NISA) on 7 March 2011 [48]. A post-event study [48] asserts that ‘a senior NISA official has confirmed to us that NISA neither ‘commissioned nor reviewed’ numerical studies of tsunami run-up at Fukushima Daiichi’.

Further, with the objective of obtaining ‘accurate information’ TEPCO undertook to search for tsunami deposits in the area, which, perhaps not unexpectedly with hindsight, yielded ‘no evidence of tsunami deposits’ [49]. In another version of what transpired, tsunami deposits were found at the north of the plant, at 0.5 m and 4 m elevations [32], but were just dismissed as inconsequential. The Wall Street Journal [50] quoted a Japanese seismologist on the investigation committee as saying that ‘Of course there is no record of big tsunami damage there because there was a high cliff at the very same spot’.

Here, it is important to note that standards specify a factor of safety of 1.5 for the ground motion from the design base earthquake, and a factor of 2 for minimal separation distances between adjacent systems, structures and components in NPPs, calculated for elastic displacements. While we do not know if this was also implemented in Japan, as standards require in the United States, the seismic performance of the Onagawa NPP suggests that a substantial margin of safety was built in. One wonders why a similar or even larger margin of safety had not been built in the maximal flooding computations, particularly given the much higher uncertainties in tsunami floods. Even a small earthquake that affects a site instrumented with an accelerograph can be sufficient to check several (but not all) assumptions made for the site's local seismic response. Small tsunamis affecting a site do not allow for checking extreme flooding predictions, such as overtopping and flooding volumes.

A major regulatory failure was in the specification of the design earthquake. Any tsunami hazard study begins with extensive analysis of the geological setting and discusses parameter variations of the source characteristic appropriate for initializing tsunami computations. When examining the seismic hazard for time scales of thousand of years, as is standard practice for NPPs, and when there are large events on the historic record, the best practice remains to assume that the largest inferred event can occur anywhere along the coast of interest, as anyway argued by Ando [51]. To any experienced scientist or civil engineer, it is inconceivable that there have been different design earthquakes for NPPs at such close distance from each other (figure 1). Besides, in 2002, the International Atomic Energy Agency (IAEA) [52] recommended a 150 km radius as the range over which geophysical events would be of interest in a hazard analysis. In 2010, IAEA extended it to 300 km [53]. Figure 1 shows the regions covered by 150- and 300 km circles around Dai-ichi.

The above notwithstanding, one would have expected a Japanese regulatory agency to have known better. Ando [51] studying the Nankai trough suggested that large events along subduction zones are not necessarily repeats of each other, they vary in size, and, of course, the last large earthquake on record may not represent the potential maximum event along the boundary. This concept was explored by Okal & Synolakis [54] in the context of determining the maximum possible earthquake in Makran, by Okal et al. [55] in the case of earthquakes in the South China Sea, Okal et al. [56,57] for Peru, Nanayam et al. [58] for the southern Kuril trench and Nelson et al. for Cascadia [59].

Ando's [51] publication features 483 (369 before 31 December 2010) citations by other papers in ISI as of 26 February 2015, which by themselves have been cited 17 185 times, 11 952 of which occurred before 31 December 2010. Clearly, it is a high-impact journal paper. Even if one disagrees with its basic premise, it seems unlikely that it was not known to TEPCO scientists or those who reviewed the scenario earthquakes impacting the NPP. In this sense, it is incomprehensible that the design earthquake for the Fukushima Dai-ichi plant was 7.5 instead of at least 8.2, as it should have been, had Ando's [51] hypothesis been used in his own home country, as it was worldwide.

For perspective of the difference between perception and reality regarding Japanese capabilities, the US NRC's 2008 tsunami hazard assessment at NPP sites [6] asserts that ‘Japanese tsunami-hazard-assessment approaches are some of the most advanced in the world’.

5. A last chance to avoid the accident was lost

The 28 February 2010 Chilean earthquake had substantial impact at near-field [60] and triggered a transpacific tsunami which reached Japan. TEPCO did what appears to have been a new and entirely internal study to analyse the safety of the Fukushima Dai-ichi from near- and far-field tsunamis. It is possible, that on this basis, in February 2011, NISA granted a 10-year extension in the operating permit for Unit 1.

The study [61] was presented on 26 November 2010 in an international symposium sponsored by the Japan Nuclear Energy Safety Organization (JNES), now merged to the Nuclear Regulation Authority (NRA) of Japan. The symposium was motivated by recorded seismic ground motions at the Kashiwazaki-Kariwasi NPP during the 2007 Niigata-ken Chūetsu-oki earthquake which were higher that its design basis. Other than the study of Okal [62], we know of no other publication that refers to this last pre-event TEPCO analysis, and this by itself is strange, given the voluminosity of published works on this accident. The ultimate conclusion of the report [61] was that the maximum expected water level is 5.7 m, over O.P., the reference water level. This value was calculated as the addition of the 4.4 m design tsunami plus a 1.3 m tidal elevation.

As a preamble to critiquing the last pre-event TEPCO analysis [61], a fundamental issue in any tsunami hazard analysis is the specification of the initial condition, i.e. the parent design earthquake that produces the tsunami to be analysed. This is particularly important in deterministic studies, where a single, but realistic, worst-case scenario is identified, then, usually, the strike and slip angles, and epicentre location varied. In such analyses, the risk is not aggregated, i.e. the run-up at any particular site is not calculated in terms of summing probabilities of occurrence of different tsunamis that may be triggered in different locales. In some studies, non-uniform slip is used. The TEPCO analysis appears to have relied exclusively on a variation of source characteristics for an M∼7.5 event, without an even glancing reference at the impact of recent events at near-field, much as the trigger of their 2010 work was the 2010 Chilean tsunami. Given TEPCO's history and the lack of regulatory interest in determining appropriate design earthquakes, as discussed earlier, this is hardly surprising, fatal as it may have been.

There is another surprising factor in the choice of initial condition, the work of Ando [51] notwithstanding. The opening statement of the 2007 journal paper by Yanagisawa et al. [46], summarizing the 2002 JSCE method, is ‘earthquakes of magnitude 8 would periodically occur in and around Japan resulting in large tsunamis hitting the coast’. Further down, they wrote that ‘to ensure the safety of the coastal power facilities, the design tsunami should be the highest one at the site among all historical and possible future tsunamis that can be estimated with the seismo-tectonics’, and, a few pages further, ‘for tsunamis induced by active submarine faults, the relevant area is estimated from a survey of the active faults and the literature’. The senior author of [46] was then a TEPCO scientist, while another two co-authors are two of the most senior tsunami engineers in Japan. We wonder how disappointed they must have been on 26 November 2010, when, in the symposium organized by JNES, they found out that TEPCO did not appear to have heeded their recommendations [46] in its re-assessment of Fukushima Dai-ichi, particularly as one of the authors of [46] chaired the session of the symposium where the last pre-event TEPCO findings [61] were presented.

In terms of hydrodynamics, the latter presentation [61] implies use of a sophisticated numerical model for the nonlinear shallow-water wave equations (NSWEs) with seven levels of nested grids, from 4320 m to 20 m. The model is not referred to by name. It is not known if it was benchmarked or tested according to world standards [8]. The fact that the United States National Oceanic and Atmospheric Administration's (NOAA) Pacific Marine Environmental Laboratory (PMEL) routinely runs analyses with the NSWE code Method of Splitting Tsunami (MOST) [63]—when developing reference inundation models for at-risk locations at 10 m resolution notwithstanding—the complexity of the small port geometry fronting the NPP and the local bathymetry should had suggested a much finer near-shore grid. A 20 m resolution, as apparently used by TEPCO, can hardly resolve the details of the breakwater in front of the plant, and additional analyses ought to have been considered, at least in terms of maximum run-up. To wit what was possible then, the resolution of the fine grid in the simulations [64] performed in 2010 for the old port of Chania, Greece was 2 m. The approximately 325×630 m2 old Port of Chania is about the same size as the approximately 535×685 m2 port, whose seawall was presumably built to protect Fukushima Dai-ichi.

Even accepting the 20 m resolution of the TEPCO-last-chance computations [61] as adequate to assess overall impact, there are several fundamental flaws in the study's evaluation of tsunami hazards at Fukushima Dai-ichi. Any of them would have raised serious questions to any knowledgeable geophysicist or tsunami-trained coastal engineer.

One puzzle remains the practically identical estimates [61] for the maximum elevation at the site for a far-field tsunami originating from an M∼9.5 earthquake off the coast of Chile and from a near-field tsunami from an M∼7.5 earthquake just offshore. On this basis, the maximum probable water elevation was determined to be 4.4 m [61]. While this might be somewhat counterintuitive to anyone experienced with tsunami modelling of real events, what is entirely counterintuitive is that the analysis appears not to have included any run-up and flooding estimates for the NPP at its base elevation. Ever since the analytical work and laboratory experiments of Kânoğlu & Synolakis [65], it has been clear that long wave run-up up a vertical seawall can exceed twice the value of the incident wave height, and even more for long-wave groups propagating towards a vertical wall [66]. The inference from the TEPCO study [61] is that tsunamis floods resemble the rising water level in a bathtub, and thus the maximum elevation close to shore is also the maximum flooding elevation, so no further flooding analyses was necessary. The tsunami hydrodynamics community has worked for almost two decades now to debunk this myth [63,67].

Second, from 1992 to 2010, 20 tsunamis triggered by parent earthquakes with magnitudes ranging from 7.1 to 8.8 have produced maximum overland water excursions ranging from 3 m to 30 m, with substantial longshore variation, a fraction of which can be explained from scaling laws alone [68]. Any modeller performing a safety study, not to mention a competent reviewer, needs to make a reality check through comparisons with earlier events worldwide, at least in terms of worst case outcomes. The 1946 M∼7.4 Aleutian earthquake produced locally 42 m run-up [69], and destroyed the Scotch Cap lighthouse. Although this extreme value has been hypothesized as because of a co-seismic offshore landslide, its mere occurrence in a well-documented twentieth-century event does underscore the possibility of special effects, locally, even during an M∼7.5 event. This is important to consider when assessing the safety of an NPP, with a seismic-scenario horizon of thousand of years. Furthermore, the M∼7 parent earthquake of the Papua New Guinea 1998 tsunami is now known to have triggered a co-seismic submarine landslide [70], causing greater than 12 m overland flows. Also, consider that the 2010 Chilean earthquake was not the largest that could occur in the Chile–Peru subduction zone. Wave heights offshore Fukushima from other sources around the Pacific Rim were up to three times higher than those from the 2010 Maule earthquake (see figure 4). As TEPCO [61] did a variation of parameters study after the 2010 Maule earthquake, shouldn't it have, in the very least, also considered different subduction zones around the Pacific? Figure 4. Wave heights off Fukushima Dai-ichi for tsunami generated by unit sources from the NOAA database. The chart at the center of the figure shows the wave height relative to a unit source closest to the epicenter of the 2010 Maule earthquake, which has, apparently, triggered additional modeling by TEPCO. The differences are indicative, but suggest waves up to 300% higher. The chart suggests that even a cursory analysis of far-field sources might have revealed substantial amplification off Dai-ichi, and perhaps the renewal of the operating license (done only one month before the 2011 event) might have required modifications or relocation of the EDGs. (Courtesy of Nikos Kalligeris, University of Southern California.)

As an example of what has been the world standard, at least since 2006, consider the wave amplification at a specific site from M w 9.0 earthquake sources around the Pacific Rim as presented by [71,72]. Other than the comprehensive analysis of the hazards from near-field sources, such as the one shown in fig. 3 in [71], allows for a rapid determination of which subduction zones pose the greatest hazard to a specific site. Such analyses, routine in the production of inundation maps in California were apparently not employed by TEPCO, which focused on one far-field source and one local site. Another example of what was possible more than a decade ago, refer to [56], where in the context of determining the tsunami hazard of a liquefied natural gas terminal, a comprehensive analysis of regional earthquakes was considered.

Third, in the context of their analysis of deposits from the AD 869 Jōgan earthquake, Minoura et al. [17] wrote that ‘historical documents record that the Jōgan tsunami invasion turned the flood plain into a broad expanse of water’ quoting earlier Japanese sources. This is in essence what happened on 11 March 2011. It is unlikely that a 4.4 m height-at-the-shoreline tsunami would have produced such flooding. It is equally unlikely that any engineer without experience from surveying tsunami impacts from recent events would have been able to recognize the disparity between the 4.4 m prediction and the historical reports.

Given these observations, the conclusion that TEPCO [61] presented in 2010 ‘We assessed and confirmed the safety of the nuclear plants based on the JSCE method which was published in 2002’, was rather premature.

6. The post-mortem analyses of national and international agencies

In the aftermath of the Fukushima disaster, several national and international agencies have produced reports about the accident trying to identify its causes. Conspicuously missing in all of them are analyses of the pre-event tsunami simulations or any analyses of what an appropriate tsunami hazards study should asymptote to, e.g. the multi-agency/university report for Seaside, Oregon [73,74].

TEPCO's post-disaster report [32,49] claims that the company has consistently followed the JSCE methodologies, but that also they voluntarily conducted reviews and investigations ‘whenever knowledge or theories on tsunamis are newly proposed’. The report then refers to their own internal study in 2008 to assess the 2002 HERP analysis (referred to earlier) that an 8.2 earthquake could occur anywhere off the Sanriku coast, but claims ‘there was no wave source model’ to assess the impact, and that the ‘effect on tsunami height is not necessarily instantly determined’. The report acknowledges ‘the receipt of a manuscript of thesis in progress on the Jōgan tsunami sent by Professor Kenji Satake’, and that with the objective of obtaining ‘accurate information’ they undertook to search for tsunami deposits in the area which yielded ‘no evidence of tsunami deposits’. Furthermore, the report states that the 11 March 2011 event was ‘neither the earthquake proposed in accordance with the HERP Opinion nor the Jogan Earthquake proposed by Satake et al., but rather, it was found to have been a massive earthquake covering a wider seismic source region’. Nonetheless, the report also states that their pre-event analysis was ‘conservative’. Such statements suggest the suspicion of criminal negligence, at least if compared with what happened in L'Aquila, Italy in 2009 [75,76].

The Carnegie Endowment for International Peace [48] produced an otherwise excellent report on the sequence of events leading to the accident. In terms of tsunami engineering, however, it contains incredulous statements about hydrodynamics. It is claimed that ‘as it [referring to the tsunami] approached the shoreline, earlier waves reflected from the land and ‘reinforced’ it (an effect properly known as ‘constructive interference’), ultimately producing a tsunami of over 13 m’. To bolster this improper analysis they contrast the impact at Dai-ichi, with that at Dai-ini, 12 km south where the tsunami height was ‘9 m’, while 40 km south it was ‘only 1 m’.

Such reinforcement as envisioned in the Carnegie report could have occurred only when fairly periodic waves strike vertical seawalls. Differences in run-up of 8 m within 40 km violate scaling laws [68] which suggest how quickly the maximum from any particular event decays in the alongshore direction. Such large differences, within a 40 km stretch of coastline for an M∼9 event [77–79], if indeed true, would probably have been because of near-shore bathymetric or onshore topographic features. The gratuitous inclusions of such uninformed statements is evidence of the lack of familiarity with tsunami run-up phenomenology. Nonetheless, the Carnegie report [48] concludes, correctly, that the tsunami was underestimated because a much smaller earthquake was anticipated. A very interesting part of the report is its analysis of Japan's nuclear safety culture, where it is described how only in 2006, for the first time, did Japan's Nuclear Safety Commission include tsunami risk in its guidelines for NPPs.

A few months after the accident, a task force of the US NRC issued recommendations for enhancing the safety of reactors in the twenty-first century [39]. The report is an excellent introduction to the current state of the knowledge, and contains many suggestions for improvements. We note that while the US NRC currently has an Emergency Response Data System (ERDS) that transmits operational data to the US NRC during declared emergencies, the task force recommended the archiving of data to aid post-event reconstruction, and ensuring that sufficient emergency power exists to transmit such data, i.e. a black-box for NPPs. Despite the overall quality of the report, in its executive summary one reads that ‘the current regulatory approach and the resultant plant capabilities allow it (the task force) to conclude that a sequence of event like the Fukushima accident is unlikely to occur in the United States, and some appropriate mitigation measures have been implemented reducing the likelihood of core damage and radiological releases’. While the latter may be true, one wonders whether the former statement is gratuitous, particularly as the US NRC is commenting on itself. One is reminded that before 2011, the possibility of a reactor core-damaging event in Japan was considered implausible [12].

Further in the report, one finds out that it is recommended that coping systems to enable restoration for AC power need to last for 8 hours minimum, to allow for power to be re-established within a minimum 72 h time window. Power was not restored in Unit 3 for 72 h, and it took almost 9 days to restore off-site power to the plant [12]. Again, one wonders whether an additional margin of safety would have been advisable, given the recent experience, at least as a recommendation.

The United States National Research Council of the National Academies produced a report [12] on lessons from the Fukushima accident to improve US NPPs. The report analyses in depth the chain of events and includes findings and recommendations about safety and the nuclear safety culture. We note as a preamble, that not a single one of the twenty one members of the panel was a tsunami expert, in the sense that it is usually understood, i.e. with a record of earlier research and journal publications on tsunamis. This was probably because of the fact that the emphasis of the US National Research Council panel was on mechanical issues and the nuclear safety culture. The report is overall excellent with a meticulous discussion of the background of US and Japanese NPPs and a detailed analysis of the timetable of the accident. A very useful recommendation is that a high priority should be given to protecting DC batteries and power distribution systems. There is an excellent discussion on the system for prediction of environmental emergency dose information. There is almost no discussion of the methodology of the studies that led to the guess of the maximum probable tsunami. There was no single person related to tsunami engineering, geophysics or coastal engineering among those whom the panel interviewed in 10 meetings over about 18 months. One and a half pages of the 366 page report is devoted to tsunami hazards, and only for the east coast of the United States.

The report states that additional countermeasures to protect from a 10 m tsunami as estimated in 2008 might have required extensive modifications to the harbour fronting the plant. It further argues that other countermeasures such as raising the elevations of EDGs, batteries and switching equipment might have been less disruptive, but that they might not have been sufficient to protect the plant against flooding.

Such politically correct, gratuitous and probably wrong statements allow the false sense of security for regulators and engineers that this type of unwarranted benefit of the doubt provides. One can only imagine the reaction in a courtroom, if a defendant argued that even if he had kept the proper distance, his brakes may not had worked properly, and he might had hit the vehicle ahead of him anyway.

Possibly the most realistic and thus useful assessment of the accident is that of the National Diet of Japan [40]. It was produced after 900 h of hearings and 1167 interviews. It dares to be critical and does not resort to convoluted arguments to give unwarranted benefit of the doubt to those responsible. The report comments that the mindset that contributed in the disaster can be found across Japan, in essence blaming Japan's insularity. The report states that nuclear power in Japan had become ‘immune to the scrutiny of civil society’, and that ‘its regulation was entrusted to the same government bureaucracy responsible for its promotion’. Further, it blames the disaster to ‘bureaucrats to put organizational interests ahead of their paramount duty to protect public safety’. Interestingly, the report concludes that TEPCO was too quick to site the tsunami as the cause of damage, and suggests that the earthquake itself damaged equipment, with the possibility of a loss of cooling accident, before the arrival of the tsunami. We were not able to confirm this in subsequent reports, and in our view, even if so, it was of secondary importance anyway. A major finding is that the prime minister's office and the government (Kantei) did not function correctly, because boundaries between responsible parties and agencies ‘were problematic, due to their ambiguity’.

Returning to what triggered the accident, versus what went on afterwards, it was the destruction of the EDGs that doomed the operational Units 1–3. Had the generators been located at ∼30 m elevation (figure 3), which inferred as the grade level around the plant, even if electrical cables had been torn during the tsunami attack, it would had been possible to restore power within hours. Even if the generators were at 6 m above the base elevation of the plant, they would have probably survived. The cost for such a modification is estimated in hundreds of thousands of US dollars, not millions.

The argument has been made that even if TEPCO have decided to act in 2010, it would had taken it too long to have installed EDGs at higher elevation, as anyway its post-disaster report recommends [32]. Consider that during a massive power failure in the mid-summer in 2013 in the Mediterranean island Thera, it took less than 24 h to move EDGs with ferry boats from another island, and partial power was restored within a few hours thereafter. This gratuitous argument by the US National Research Council begs the question, when would had been appropriate for TEPCO to presume they have enough evidence of large tsunamis to provide for more secure emergency power for a total station blackout? What is the threshold of evidence which forces a regulator or utility to take action? Who decides?

7. Bagatellomania in tsunami modelling

Following the 2011 accident, the US NRC commissioned a re-evaluation of the tsunami safety of all NPPs in the United States, and studies are underway, by both the US NRC consultants and plant operators. Tsunami hazards have been included in studies for license applications in new NPPs. The methodologies used to determine the maximum probable tsunami, at least as they trickle through published reports raise concerns, that, once again, when it comes to determining flooding levels, the forest is being lost for the leaves.

Salt [80] introduced the notion of trifle worship (which he referred to as bagatellomania) in his analysis of highly defective simulation projects. He describes how software developers, in their efforts to show off and sell their products, point out a long list of features, in hopes suggestible clients would ‘mentally elide them with benefits’.

A similar process is now underway, as developers of numerical codes used for computations to determine the maximum probable tsunami add complexities to their models without an even glancing reference at the uncertainties introduced by the approximately inferred initial conditions for future events, often referred to as the aleatory uncertainty.

As an example, consider an agency report [81] for the US NRC which comments in great detail for various geological and hydrodynamic aspects of the licensure applicant's assessments and writes ‘The shallow-water equation models lack the capability of simulating dispersive waves, which could be the dominating features in landslide-generated tsunamis and for tsunamis travelling a long distance’. While the operative word is ‘could’, the report did send a strong message to the industry to use dispersive models, also known as Boussinesq-type (BT) models. These models differ from shallow-water wave models, as they include extra terms purporting to model real dispersion better. There are tens of BT models with different approximations to dispersion, and their derivations are not as standard as those of the NSWE. Certain BT models are mathematically elegant and intellectually stimulating, and research in their methods of solutions do advance numerical mathematics and knowledge on nonlinear wave phenomena [82].

Hazard studies are by definition applied, in the sense that tried and tested methodologies need to be used to ensure quality control. We can state that there is no controversy that NSWE models are more robust, less computationally costly, and their convergence is better understood than BT models. The statement above in the report [81] implies to the gullible reader or unfamiliar regulator the possibility of dispersive effects affecting to first order the flooding predictions from the main body of the tsunami, much as we suspect this was not intentional. In all cases we know of tsunamis of geophysical relevance, the NSWE are more conservative, as dispersion invariably reduces the wave height and spreads out the wave train, or changes the sequencing of the leading waves, but even the latter is modeled well with NSWE codes, given their inherent numerical dispersion [83].

NOAA's operational NSWE model as used for real-time flooding predictions has been tested with every significant tsunami since 2003 [1]. Predictions for the time histories of surface elevation done in real time have been shown in excellent agreement with the measurements from DART buoys, except for unexplained time shifts of a few minutes in the arrival of the waves. No BT models have been tested for far-field propagation in as many events, and all comparisons of BT models we know of, also do require almost identical time shifts as NSWE models to match predictions with the DART measurements. Further, no BT models have been shown to model flooding from real tsunamis any better or as consistently as NSWE models, not to mention that many BT models de-facto become NWSE near or post breaking [82]. Despite this inconvenient truth, BT models have been peddled as panacea, not by mathematicians who are the most likely to understand their convergence and appreciate their advantages, but by engineers with no prior experience in tsunamis. The fact that the imagined benefits of BT simulations compared to the NSWEs are lost when done at inappropriate resolution somehow escapes many modelers, who don't even check the convergence of their schemes for their specific application.

BT codes may have substantial benefits when simulating near-shore storm waves or swell entering ports [64], but their benefits for studying tsunamis in ports remain unproved. One basic issue here is the duration of the event. Storm waves can last for several hours, allowing for time for nonlinear coupling of shorter frequencies, while near-shore tsunamis last for tens of minutes. BT models can probably predict detailed time histories of landslide tsunamis, but in the single historical case for which field observations exist, BT models predict maximum run-up to the same level of accuracy as NSWE models [84].

If a regulator's objective is to use the highest-end model available at the particular time a given study is performed, why not use a Large Eddie Simulation (LES) [85] of the Navier–Stokes equations to model all critical tsunami impacts? If one argues that the more higher order terms a code includes to approximate the parent equations the more accurate the results are, this necessarily begs the question, what grid resolution is appropriate for such simulations? Also, why not model the ocean density stratification and also the compressibility of the ocean floor, effects known to possibly affect to third order tsunami arrival times in the far-field?

Last, it seems incomprehensible that there is no concern that BT models for tsunami propagation which purportedly are used to model shorter waves of wavelengths of the order of tens of metres, nonetheless use kilometre-sized grids far offshore. For near-field events, BT-type models may need resolutions as small as 25 points per wavelength [86] to converge, a word unknown in most government reports, at least in the United States and Japan.

Such trifle-worship as worrying about dispersion in mainstream tsunami computations for NPPs without specific guidance about choosing initial conditions, or specifying guidelines for the convergence of computations, or whether tsunami earthquakes need to be considered, all this is reminiscent of the 3.122 m value from the 1960 Great Chilean tsunami, on which basis the protection works of Fukushima Dai-ichi were designed. One thus wonders whether TEPCO's pre-event predictions would had been any more realistic had they used a LES simulation, or had they considered the ocean stratification.

8. Conclusion

Reading the thousands of pages of the US National Research Council [12], the US NRC [39], the National Diet of Japan [40] and TEPCO [32,49] reports we are struck that the lead message of the disaster was lost. While the reports, appropriately, analyse the timetable of events that led to the meltdown and make recommendations for improving emergency procedures for plant operations, they ignore entirely the issue of the determination of the maximum probable tsunami, in the same manner as the JSCE did in 2002, and do not refer to the training or certification needed for performing or reviewing NPP tsunami hazard studies.

As an example, the US National Research Council report [12] is puzzled that, while ‘TEPCO actively implemented countermeasures to protect critical equipment and infrastructure’, it appeared to lack the sense of urgency after its 2008 trial computations yielded estimates which were substantially higher. The report neither mentions nor comments on TEPCO's 2010 presentation [61] that it ‘have assessed and confirmed the safety’ of the NPP. In this context, the National Diet of Japan concludes that its investigative commission ‘found ignorance and arrogance unforgivable for anyone or any organization that deals with nuclear power’. While the findings [12] include a general recommendation that the industry should seek out and act on new information about hazards, and comments extensively on improving the training of plant operators, it does not address the issue of the training of those who will interpret this new information on hazards, or those who will determine the detailed inundation from the maximum probable tsunami, or the training of regulators who review safety studies. Shouldn't the US National Research Council panel [12] at least had considered if certification in tsunami hazard studies and their evaluation is needed, given the spectacular failure (even in Japan) of the entire hazard evaluation process? In essence, a very basic, although implicit, conclusion of the National Diet of Japan was ignored, most likely because of the lack of direct experience of the US National Research Council panelists with tsunamis.

The same report [12] discusses probabilistic risk assessment (PRA), which it frames into three questions, what can go wrong, how likely is it to happen, and what are the consequences if it does happen. The report states that there were no PRAs for tsunamis in Japan in 2011, and were still under development in November 2012. PRAs exist for US NPPs, even though they are not required. One wonders here how external events such as tsunami-earthquakes, known to produce larger tsunamis than expected for their seismic moment magnitudes, or co-seismic landslides are handled in such studies. There is no theory or hypotheses at the time of this writing which informs on how often such events occur in a ‘normal’ population of earthquakes. Given the Dai-ichi experience, as well as the indefensible assumptions in many PRAs, one wonders whether it is just more logical for now to simply consider the maximum possible M∼9.6 earthquake of Kagan & Jackson [11] as a trigger for a tsunami for all subduction zones threatening a given NPP.

For perspective, consider a 2010 safety study for the tsunami hazard for a liquefied natural gas facility along the eastern Mediterranean coast of North Africa. The study was commissioned by an energy company and the tsunami consultant was a major European laboratory, very experienced in coastal engineering studies. One wonders whether this was their first design study with tsunamis, given that their estimate for the inland flooding level was 1 m, yet they have used as an initial condition the AD 365 event, whose tsunami is known to have destroyed most of Alexandria. In fact, Alexandria disappeared as one of the centres of the meta-ancient world following this event. The well known laboratory signed off on what was a Fukushima-size underestimation of the hazard. The energy company was itself surprised at the finding and solicited an external review. Follow-up studies revealed an almost order of magnitude higher local overland flows, consistent with historic reports. On this basis, the energy company moved its planned site, at no additional cost, given that it was at its initial stages of planning.

It is clear to us that what is missing in contemporary hazard assessments are regulatory guidelines for the training of the scientists and engineers who work on estimating the maximum probable tsunami. The online free availability of computational tools has made it easy for anyone to model many physical phenomena, sometimes with unwelcome consequences. As an example, there are several excellent ‘free’ BT and NSWE models. Their outputs may differ slightly, for the same initial conditions, but these differences dwarf the uncertainties in source characterization, or differences in results when convergence is not checked, or when inexperienced people use them. Amateurs, even when using a high-end camera, may need to take tens of thousands of photos of different subjects to occasionally approximate the quality of a really professional portrait photograph. Recreational pilots are certified to fly small planes after thirty hours of flight time, but are not allowed to fly commercial airliners unless they have 1500 h experience with flying planes. The consequences of pilot error have proved far less severe than the consequences of substandard tsunami engineering, not least because pilot error affects the pilot directly.

As was argued in the theme issue of these Philosophical Transactions in the aftermath of the 2004 Boxing Day tsunami [9], ‘As elsewhere in science, just because a numerical model produces results, it does not imply they are meaningful or always physically realistic’. Had the TEPCO modellers had any experience with tsunamis, they would have had immediately recognized that their ‘high’ resolution predictions were underestimating the hazard, even for their choice of an M∼7.5 earthquake. The modellers who suggested a 1 m maximum overland tsunami height in North Africa from an M∼8.5 event were not able to see themselves the ridiculousness of their prediction. We hope that studies for new NPP now planned in the Eastern Mediterranean will be more professional, and their reviews will not be as insular, and involve hazards identified in this volume [87].

It is here that we are reminded of Umberto Eco's echoes of intertextuality. Hazard studies need to be considered in fairly broad context, and include the author's personal experiences in the interpretation of the results. How can someone who has not walked on flooded lands, compared the inundation between adjacent beaches, wondered why a single structure was left standing while all others were flattened, debated whether a debris mark on a surviving tree was from the tsunami or carried by the wind, and listened to sometimes widely different eyewitness accounts for the same location, how can he interpret a historic report, or understand what real difference a change in grid resolution can make, or ultimately put his flooding prediction in the proper context.

In our view, all energy and engineering companies prefer realistic answers and realize that public safety is to the organizations' best interest. Most are cognizant of the fact that an ounce of prevention is worth a pound of cure. Yet, sometimes, industry consultants, because of lack of experience, imagine that their clients prefer the ‘good’ news of lower estimates, and do not check and re-check and check again their analyses. Regulators are sometimes more comfortable with people they know than people they don't, ignoring the additional perspective that people thinking outside their insular boxes can introduce. To wit, even post Fukushima, the current US practice appears to reflect diminishing regard for anything not invented by consultants of utilities and of regulators, to paraphrase the National Diet of Japan's [40] finding.

What regulators and the industry need are guidelines for assessing the experience and training of their engineers, their consultants and of the reviewers of their reports, just as they have long realized they need guidelines for the training of plant operators.

Finally, consider the contradictions in the implementation of tsunami defences in Japan, where it has been argued [25] that tsunami science and engineering began, such as the US$600 million spent to protect Okushiri, the US$1.5 billion Kamaishi breakwater, but the ineffective protection works in the Sendai plain, or the siting of EDGs in basements at Fukushima Dai-ichi. The entire experience with TEPCO's pre-event internal studies not to mention the entire methodology that has been used in Japan to assess tsunami hazards [36] points to the perils of insularity. When it comes to studying hazards or designing structures whose catastrophic failure will transcend national boundaries, even countries with sophisticated technologies need to take note of Godel's incompleteness theorem.

Competing interests

We declare we have no competing interests.

Funding

This contribution was partially supported by the project ASTARTE—Assessment, STrategy And Risk Reduction for Tsunamis in Europe. Grant 603839, 7th FP (ENV.2013.6.4-3 ENV.2013.6.4-3) to the Technical University of Crete and the Middle East Technical University and by the US National Science Foundation award CMMI 1313839.

Footnotes

One contribution of 14 to a theme issue ‘Tsunamis: bridging science, engineering and society’.