The “Ultimate Heatsink” vs the Condensers in Each Reactor Building. And the Torus as a heat sink

World Nuclear Association, Fukushima Accident 2011

Quote: ” Then 41 minutes later the first tsunami wave hit, followed by a second 8 minutes later. These submerged and damaged the seawater pumps for both the main condenser circuits and the auxiliary cooling circuits, notably the Residual Heat Removal (RHR) cooling system. They also drowned the diesel generators and inundated the electrical switchgear and batteries, all located in the basements of the turbine buildings (the one surviving air-cooled generator was serving units 5 & 6). So there was a station blackout, and the reactors were isolated from their ultimate heat sink. The tsunamis also damaged and obstructed roads, making outside access difficult. ” end quote

In the language of the industry perhaps all of the above fair and reasonable. In the visual images of the Fukushima Diiachi post disaster site, when reading the above the focus is drawn to those things by the sea, the cooling system parts and the back up power system parts which all seem to be totally and absolutely needed in order to prevent disaster.

But what does “ultimate heatsink” mean? The only one that mattered?

The reactors have “heatsinks” – radiators, condensers, heat exchangers in each reactor building and the Torus itself has a cooling role.

Here is a schematic of the Isolation Condensor System which each reactor at Fukushima Diiacha has:


The source for this schematic is “APPENDIX F Safety System Descriptions for Station Blackout Mitigation: Isolation Condenser, Reactor Core Isolation Cooling, and High-Pressure Coolant Injection” of the American Nuclear Society Fukushima Diiachi ANS Committee Report.

From its title one can see that there are more than one cooling system involved in each reactor. And though the names of the equipment described earlier as being the “ultimate heatsink” seem indispensible, in an emergency dealing with decay heat, even the loss of Residual Heat Removal (RHR) cooling system or the main condenser circuits and the auxiliary cooling circuits, could be lived without if the Emergency Core Cooling System components and other systems could be brought into play.

As we have seen from the preceding descriptions of each reactor disaster, at various times, various parts of each reactors emergency systems worked, while other parts did not.

The schematic diagram shows that condensors existed high up in the reactor buildings. And the manuals and the Appendix cited here show the ECCS is supposed to be a self powered system, and it is described as such. The Emergency system units failed, ultimately. Was this failure in fact due to the loss of the “ultimate heatsink”?

No. The ECCS and other systems used in the emergency failed because they could not effectively use their own heatsinks located in the reactor building.

When the primary systems fail, electrically driven valves can isolate the core and core water from the broken system. Even if the main system is badly destroyed and ruptured, the core and its water can isolated and sealed off from the broken part by these valves. And the heat sinks then become the condensors in the reactors, and the torus itself.

So instead of looking at the damage by the sea, to find out what went wrong we have to look at the reactors and the reactor buildings. Here is what the American Nuclear Society says :


The primary purpose of the isolation condenser system (Fig. 1) is to remove decay heat and conserve
reactor water inventory when the reactor becomes isolated from the turbine condenser. The isolation
condenser system consists of two trains of equipment. Each train consists of a large heat exchanger
located in the reactor building, outside of containment and above the RPV in elevation, which
condenses steam produced by decay heat and returns it to the reactor by natural circulation.

The primary side of the heat exchanger is fed by a steam line from the RPV, and a condensate return
line that returns the condensed steam back to the RPV through one of the recirculation pump lines,
together with appropriate isolation valves. In the ready state, the steam line is open and the condensate
return line is closed, which allows the condensate line to be kept filled and eliminates the potential for
water hammer during start-up. When the appropriate signal (high reactor pressure) is given, the
condensate return valve is opened and a natural-circulation circuit is completed. The secondary (shell)
side of the isolation condenser consists of a large tank of water with sufficient capacity for several hours
of decay heat removal by boiling and venting to the atmosphere. From this point the system can
operate without any electrical power or operator action for several hours. Longer term, the shell side
can be replenished by the nuclear power plant (NPP) operators using the NPP makeup water system,
the fire protection system, or fire trucks.”

And so the Appendix goes on, describing each system as deployed for station blackout.

AS we have read in the earlier posts, each reactor failure, explosion, containment breach and meltdown was preceded by failures of solenoids that open or shut valves in the various coolant pipes. Some critical system however, have their own steam turbine. Sadly these steam turbines, located right next to each reactor, could power more than the water pumps for each system. It could power the solenoids which operate the valves, but it does not. The solenoids rely not on the emergency turbines, but on external power.

So, even with the loss of the equipment described as “ultimate heatsink”, the reactors could have been cooled if the valves had allowed the water to flow to the condensers in the reactor buildings.

The valves which isolate the reactors from damaged systems and which allowed water flow in the undamaged systems didnt all work. So the reactors overheated. Because the water could not be 1. sealed from the damaged parts nor redirected to the undamaged condensers.

There was more than one heatsink. Each reactor had 3 heatsinks, plus the damaged parts by the sea.

There were intact heatsinks with each reactor. The loss of the ones by the sea was not “ultimate”.

And the sad thing is the valves in some systems are normally battery powered. And those normal batteries went flat. And then the reactors overheated and breached containment.

To continue the ANS description:


The primary purpose of the RCIC system (Fig. 2) is to provide makeup water to the RPV when the
RPV is isolated from the turbine-condenser. The RCIC system uses a steam-driven turbine-pump unit
and operates automatically in time and with sufficient coolant flow to maintain adequate water level in
the RPV for the following events:

• RPV isolated and maintained at hot standby
• complete NPP shutdown with loss of normal feedwater before the reactor is depressurized to a
level where the shutdown cooling system can be placed in operation
• loss of AC power.

The RCIC system is sized to keep up with decay heat inventory losses from the RPV [90 to 180
m3/hour (400 to 800 gal/minute), depending on reactor design power level]. Since the reactor decay
heat reduces rapidly after an NPP scram, the RCIC system quickly has more than enough capacity to
keep up with decay heat steam production losses through the safety and relief valves (SRVs)—the
RCIC system does not control reactor pressure, so the generated steam from decay heat lifts the SRVs,
and the steam is routed to the suppression pool.

The RCIC system is contained within one electrical division and consists of a steam-driven turbine that
drives a pump assembly and the turbine and pump accessories. The RCIC system also includes piping,
valves, and instrumentation necessary to implement several flow paths. The RCIC system steam supply line branches off one of the main steam lines (leaving the RPV) and goes to the RCIC turbine with
drainage provision to the main condenser. The turbine exhausts to the suppression pool with vacuum
breaking protection. Makeup water is supplied from the condensate storage tank (CST) or the
suppression pool with the preferred source being the CST. RCIC system flow is discharged to the
feedwater injection line.

Following a reactor scram, steam generation in the reactor core continues, although at a reduced rate
because of the core fission product decay heat. The turbine condenser and the feedwater system supply
the makeup water required to maintain RPV inventory. In the event the RPV is isolated and the
feedwater supply is unavailable, SRVs automatically maintain the RPV pressure within desirable limits.
The water level in the RPV drops because of continued steam generation by decay heat. Upon reaching
a predetermined low level, the RCIC system is initiated automatically. The turbine-driven pump supplies
water from the CST (preferred) or from the suppression pool to the RPV. The turbine is driven with a
portion of the decay heat steam from the RPV and exhausts to the suppression pool.

The RCIC system is designed to pump water into the RPV from full operating pressure down to ~1
MPa (150 psia). During RCIC operation, the wetwell suppression pool acts as the heat sink for
steam generated by reactor decay heat. This results in a rise in the suppression pool water
temperature. When AC power is available, heat exchangers in the RHR system are used to maintain
the suppression pool water temperature within acceptable limits by cooling the suppression pool
water directly.
A design flow functional test of the RCIC system may be performed during normal NPP operation
by drawing suction from the CST and discharging through a full flow test return line to the CST
(not shown in Fig. 1).2 The discharge valve to the reactor feedwater line remains closed during the
test, and reactor operation remains undisturbed. lf the system requires initiation while in the test
mode, the control system automatically returns to the operating mode.

Cooling water for pump and turbine operations and for the lube oil cooler and the gland seal
condenser is supplied from the discharge of the pump.

Two turbine control systems include a speed governor limiting the speed to its maximum operating
level and a control governor with automatic set-point adjustment that is positioned by a demand
signal from a flow controller. Manual operation of the control governor is possible when in the test
mode but is automatically repositioned (the governor valve goes back to its normal operating
position) by the demand signal from the controller if system initiation is required. The operator has
the capability to select manual control of the governor and adjust the power and flow to match
decay heat steam generation. Several U.S. NPPs have developed procedures to override RCIC
system valves and controls and manually run the RCIC system in case of an SBO.

The turbine and pump automatically shut down upon

• turbine overspeed
• high water level in the RPV
• low pump suction pressure
• high turbine exhaust pressure
• automatic isolation signal.

The steam supply system to the turbine is automatically isolated upon

• high pressure drop across two pipe elbows in the steam supply line
• high area temperature
• low reactor pressure
• high pressure between the turbine exhaust rupture diaphragms.

The RCIC system operates independently of auxiliary AC power, NPP service air, or external
cooling water systems. System valves and auxiliary pumps are designed to operate by direct-current
(DC) power from the nuclear power station batteries, except for the inboard containment isolation
valve, which is powered by AC power (fail as-is), and the hydraulically operated valves, which are
operated by the turbine control system through mechanical linkages.

In the case of an extended SBO, the RCIC system may stop operation for one of a number of

• The DC power for valves is available, but the DC power for instrumentation has failed,
causing the DC-controlled valves to close.

• The suppression pool temperature is too high, leading to inadequate pump net positive
suction head or inadequate lube oil cooling.
• The containment pressure is too high, causing the RCIC system turbine to trip.


Philosophically, the HPCI system is similar to the RCIC system, except that the HPCI system has
about seven times the flow (680 to 1270 m3/hour) and is part of the ECCS network (see Fig. 3). In
ECCS use, small breaks in which the reactor does not depressurize through the break are helpful.
However, the ECCS can also act as a backup to the RCIC system for isolation transients. Because of
the larger steam consumption, the HPCI system can be manually controlled to use the full flow test
line to limit the water being pumped to the reactor while depressurizing the reactor through the
HPCI turbine.

The same types of signals initiate and terminate the HPCI system as do the RCIC system, and DC
power is needed to operate some of the HPCI system valves.

end quote.

Due to the design of the power source for the electric solenoid operated valves, the coolant could not cool the core because, by the result of design, no coolant could flow to the undamaged ‘heatsinks’. (the isolation condensors in the reactor buildings. And that includes the HPCI flow to the Torus and back.

When coolant levels fell in reactor number 2, no isolation from the breach was achieved for the same reason. No operating valves.

Why call the destroyed condensors “ultimate heatshinks” when the reactor buildings’ condensers and the torus were Japan’s last hope?

It makes it harder to find the cause if one is looking at the wrong components. So it is confusing.

Especially when it is probable that with the destruction of the tsunami, the destroyed condensers by the sea, had the valves been working, Reactor 2 would have been sealed off and isolated from those broken pipes. In that case.

Cause of disaster: valves that would not respond to the emergency because of design. And there are two modes to these systems. Automatic and manual control. But manual is apparently only possible by electrical switches.

What did the politicians and regulators say at the time of approval for export to Japan and shortly thereafter?

“At the prodding of the ACRS, which first sounded the alarm about the China syndrome, the AEC established a special task force to look into the problem of core melting in 1966. The committee, chaired by William K. Ergen, a reactor safety expert and former ACRS member from Oak Ridge National Laboratory, submitted its findings to the AEC in October 1967. The report offered assurances about the improbability of a core meltdown and the reliability of emergency core cooling designs, but it also acknowledged that a loss-of-coolant accident could cause a breach of containment if ECCS failed to perform. Therefore, containment could no longer be regarded as an inviolable barrier to the escape of radioactivity. This represented a milestone in the evolution of reactor regulation. In effect, it imposed a modified approach to reactor safety. Previously, the AEC had viewed the containment building as the final independent line of defense against the release of radiation; even if a serious accident took place the damage it caused would be restricted to the plant. Once it became apparent that under some circumstances the containment building might not hold, however, the key to protecting the public from a large release of radiation was to prevent accidents severe enough to threaten containment. And this depended heavily on a properly designed and functioning ECCS.” Source: The US Nuclear Regulatory Commission,


“For those reasons, the AEC sought to resolve the ECCS issue as promptly and quietly as possible. It wanted to settle the uncertainties about safety without arousing a public debate that could place hurdles in the way of the bandwagon market. Even before the task force that Price established completed its study of the ECCS problem, the Commission decided to publish “interim acceptance criteria” for emergency cooling systems that licensees would have to meet. It imposed a series of requirements that it believed would ensure that the ECCS in a plant would prevent a core melt after a loss-of-coolant accident. The AEC did not prescribe methods of meeting the interim criteria, but in effect, it mandated that manufacturers and utilities set an upper limit on the amount of heat generated by reactors. In some cases, this would force utilities to reduce the peak operating temperatures (and hence, the power) of their plants. Price told a press conference on June 19, 1971 that although the AEC thought it impossible “to guarantee absolute safety,” he was “confident that these criteria will assure that the emergency core cooling systems will perform adequately to protect the temperature of the core from getting out of hand.”” Source: US Nuclear Regulatory Commission, link as above.

It is more than merely interesting. The regulators have had since 1967 to come up with a solution.

In 2012, as a result of the “full scale” results at Fukushima Diiachi, the NRC ordered the stationing of moblie emergency diesel generators at similar US nuke plants.

The ECCS has a battery life less than that of the longest lived radionuclide capable of emitting decay heat into the core.

And where both LOCA and loss of grid connection occurs, because reactor plants cannot adequately power themselves, they may explode, breach containment and melt down.

I do not think a jargon term like “ultimate heatsink” is in the public interest.

If the same combination of LOCA and blackout happens in America, the whole world knows now that
the workers have between 20 and 70 hours to operate those ECCS valves.

This is not the high point of energy science:

Throughout the entire disaster sequence, the emergency turbines were being by decay heat steam. The American Nuclear Society states that in elements of the emergency core cooling system were lost as were elements of the station blackout mitigation system. What was lost was DC. The HPCI and the RCIC of reactor 2 cooling systems were lost in this way. Yet, in both cases, the systems are powered by emergency turbine power. Except for the solenoid valves of those systems. The ANS says “RCIC system operated for ~70 hours. In general, one should not expect the RCIC system to run much beyond 8 hours in a station blackout (SBO).”

In fact I would expect that, contrary to the opinion of the ANS, that in the situation were the RCIC is used as part of an emergency recovery system, its power run for as long as it takes, 8 hours, 70 hours, a million hours. And where the components of the formal Emergency Core Cooling System are needed to avert disaster, that the power for the total system comply with NRC regulations. To run for as long as decay heat is being generated in the core.

The means by which the disaster occurred was by self powered emergency systems the valves for which were in fact not powered from the system, but but from time limited supply.

Why time limit the coolant pipe valves of an atomic power plant.

Does any one think is a good idea?

Does anyone, apart from a few fanatics, think that this is nuclear science? It is not, it is basic electrical engineering applied to emergency critical systems. If such an arrangement of power off = dead solenoids were wired into an aircraft critical system, it would not be approved. Aircraft have to fly, ECCS have to work. full stop. No matter what. flat battery, flooding, fire, missile strike and this is stated by Ergen in 1967.

No excuses, 70 hours is not sufficient, no matter what comparison the American Nuclear Society apply to that design imposed time limit. Sure its longer than 8 hours. But the longest lived radio isotope created by the core emits decay heat for longer than 70 hours.

No amount of US engineering Group Think is going to induce me to look at what is claimed to be the ultimate heatsink when I can see the circuit design concept that rendered the emergency core cooling systems useless.

The solenoid valve can be but were not powered by the ECCS steam turbines. And these steam turbines are powered by decay heat. So long as there is decay heat, there is steam for the turbines. Why exclude the valves from this power source ?

While there were many “heat sinks”, each reactor had an “ultimate power source”. The emergency steam turbines. If the engineers cannot imagine those turbines being used to generate low voltage DC for the ECCS solenoids, they need to go back to school.

11 Responses to “The “Ultimate Heatsink” vs the Condensers in Each Reactor Building. And the Torus as a heat sink”

  1. CaptD Says:

    Great Analysis!

    RE: It is more than merely interesting. The regulators have had since 1967 to come up with a solution.

    The Japanese are now paying for that lack of nuclear honesty!

    Just think what they could have done with a Trillion Dollars (US) if they could have build Solar (of all flavors) instead of having to pay for their Trillion Dollar Eco-Disaster…

    My advice to the nuclear industry: History Repeats Itself!

  2. TechDud Says:

    Were the “heat-sinks” already heat-loading due to the receding water inside the breakwater, before the tsunami?

    • nuclearhistory Says:

      Wise thought. As the reactors shutdown immediately at quake, and as in some of the reactors at least, Station Blackout Mitigation (ECCS without coolant loss roughly) had been invoked. So even if the primary coolant loop was stressed, reactor power was at shutdown level. However, that is merely my thoughts on it from the ANS report. I don’t know.

    • nuclearhistory Says:

      My focus was on the ECCS. I have been reading about the history of 70s controversy. In March 2011. Coincidence. I have been focussed on the ECCS systems ever since. The American Nuclear Society conclusions therefore make sense to me. The solenoids are the components which are most vulnerable. The pumps and steam turbines are not vulnerable to station blackout at all. Where this decay heat steam, there will pumps working in the reactor buildings. But where the solenoids have no DC, the pipe valves will be closed. That is all I am convinced of. One system, one set of vulnerable components. Where ever else was going on, I don’t know. Obviously lots of other stuff. Stuff I am ignorant of. I have one point about the accident. The solenoids.

      • TechDud Says:

        I note that modern low-voltage solenoid valves employ a reverse-bias power diode to shunt any high-voltage discharge when, upon cut-off, the electromagnetic field collapses. I wonder; did they employ them? Surely, this equipment was swapped out sometime this millennium if not upgraded? How critical is it to “stick-to” only “approved-designs” for such facility?

        I remember that this was a Mark I (built upon a historic dump-site); somewhat incrementally above “prototype”, perhaps?
        Time to stop thinking of it as a “reactor”, rather, an “incinerator”, maybe? The term “China-Syndrome” could be updated as the “24°36′37.3″S 39°00′1.5″W – 500k off the coast of Rio de Jeneiro Syndrome”, too; perhaps. 😦

        What of the possibility of tunneling in “corium-catchers”? 🙂
        Pipe-dream, or no?

        By the 70s controversy, are you referring to the GE-Three? There were so many 70s controversy.
        Wasn’t there one or more involving TEPCO?

        PS: Thank you for your generosity with your time, disseminating the truth of this stealthy ongoing disaster. You, and others i hold in high-esteem for lending your well-thought analysis & data.

      • nuclearhistory Says:

        Hi,TechDud, thanks for contributing your thoughts. At the moment I am not commenting on the corium. I have thought about it, and looked at some of the aspects of it, but am not at the point where I can contribute anything solid yet.

        The controversy I am aware of is the one discussed in the NRC short history at the NRC site. Nader and Abbott in their 1975 discuss the specifics in their 1975 book. I find it significant that after all the discussion in the 1970s and the reassuarnces, the ECCS failed to protect the Fukushima reactors. Now, the view is, I guess, that Fukushima Diiachi was a Station Black Out situation. Whereas the 1970s debates centred around Loss of Coolant.
        Well my view is that as the American Nuclear Society in its analysis explains the details, it is clear that significant parts of the parts of the ECCS in fact comprise part of the Station Blackout Regime. Now, the question is, in a LOCA lasting more than 20 – 70 hours would the same situation have existed with the low voltage supply? I think yes. I might be wrong. However, perhaps in the situation where SBO was not occurring maybe the batteries could have been easily changed. In the sitation at Fukushima Diiachi, the SBO regime did not stop core overheat, and it was a failure of battery power which clearly, according to the ANS, which was the cause. I have no trouble with the “50 cent parts” being the cause of a major accident. Of course, in looking at this one sub system and its components, it does not argue away the existence of other, undisclosed causes. The thought that siting and earthquake itself did not cause the disaster outrages some people who consider the obvious stressors these things present (and they are triggers for the various responses at the plant) are not, in my view, the actual things which, in the course of the accident process, caused the ultimate failure of the plants. The social, political and ideological need to shut the plants down is one thing. The investigation as to the actual process of technical failure is another. It is only now, after reading whatever technical information I could find, that the role of the Torus for example, becomes clear in its multiple role, which includes that of heat sink. Some of the plant at least at Fukushima Diiachi did have core isolation cooling systems whith condensors in their reactor buildings. It is also clear that as forwarned by sources cited by Nader and Abbott in 1975, reactor pressure did prevent coolant top up, the suppression regime did not prevent over pressure in the reactors and so one. And in this one of the features which reduced operator control and options available was the failure and vulnerability of the pipe valve solenoids.

        There is a simplistic view that the reactors had only 1 coolant system, one set of heat exchangers and no options. And from what I have seen and read that simplistic view is wrong, and it is not one held by the interested US public in the 1970s. Everyone understood at that time, that the ECCS was a separate cooling loop. EVen though the ANS and other accident reports are available, which do explain the multiple cooling systems, the general public is not encouraged to think in terms of this. The terminology of the NRC does not help.

        I have a working knowledge of solenoids, but the exact circuit facilities and specification of the solenoids in question are unknown to me. It is sufficient for me to know the 1.failure of operating current resulted in failure (ANS)(flat batteries in some instances and destroyed control panels in others) and 2. loss of current returned the valve settings to default. The ECCS pipe valves returned to the closed position. ECCS normally off. This is my understanding.

        It is technical. It is open to discussion. I have my present view. Based primarily on the ANS report, the critical solenoids are vulnerable and have a time limit based on an assumption which was insufficient for the situation. In hindsight this is easy to see and the assumption is faulty. DEspite the assurances given in the 1970s. The public after all that transpired, has a justifiable expectation that the emergency system comply with the actual requirement for an emergency core cooling system, not matter what trigger invokes it, whether that be LOCA or SBO or both. So I remain quite depressed at some explanations which blame the reactor failures on a scenario which ignores the existence of the emergency cooling systems. I am quite depressed about the fact that a social and political narrative is actually being used as a technical analysis. In this narrative, the claim is sattelite photos show the entire cooling system. No they don’t the eye in the sky cannot see the cooling systems resident in the reactor buildings. It depresses me that such assertions are made. For they have no credilibity. Though, of course, if there had been earthquake, and no tsunami, the failure sequence would not have occurred. But that is not an accident analysis. I’ll have a look at the Rio thing after I have finished with Karl Morgan’s excellent book. Anyway, bottom line, we need to discern the truth. And our ideology cannot be a blinker nor blinder.

        There is another important point. If, as promised by nuclear regulators in the late 1960s and 1970s in the course of the ECCS controversy, the ECCS systems had been in fact properly considered, the Fukushima Diiachi reactor accidents would not have happened. That they did is reflective of nuclear group think, not just in Japan, but trans nationally. At the time they were built, they were built with an ECCS in them, the batteries. And the view was no trigger could possibly invoke the timer. Wrong assumption. The triggers in March 2011 were multiple. Various things may be said about human design and natural forces. Humans are poor judges. That in itself though is not an accident analysis, merely a self fulfilling prophecy.

  3. nuclearvox Says:

    Reblogged this on NuclearVox.

    • nuclearhistory Says:

      well I am just learning about this. I hope everyone is thinking for themselves. I could be wrong.

      • nuclearhistory Says:

        Hi CaptD, yea, it was deliberate. I am sorry to point out mistakes of others, but I think it is crucial that the public understand the accident and the vulnerablities of the backup system solenoids. Noone seems to be mentioning the Backups or properly explaining the lack of integral long term power for the critical low voltage DC solenoids. Yea, ultimate imperative to heatsink the core doesnt mean heatsinks are all in one place. Many gods. All of them turned out to be idols.

  4. Nuclear Engineer Says:

    The RCIC system was only DESIGNED to operate at 8 hours. I agree it should run indefinitely, but 8 hours is well beyond what the system is designed to do in a single run, especially with no suppression pool cooling.

    RCIC cools itself using a little bit of the water that it is pumping. RCIC operates in 2 modes, 1 which draws from an outside tank, and 2 which draws from the suppression pool inside the containment. When water is no longer available from the tank, RCIC runs in pool mode, which means it uses the pool water to cool itself. With no power to run the pool heat removal systems, the water temperature heats up, and eventually either through a loss of NPSH or through the increase in temperature in the cooling water to the turbine, RCIC fails mechanically.

    • nuclearhistory Says:

      Thanks for that information.

      It is the requirement of ECCS to continue to cool the core for as long as required, as mandated in the NRC acceptance criteria for Emergency Core Cooling Systems which compels me to think that the total ECCS can cool the core, or should have cooled the core even when the primary coolant loop was destroyed.

Comments are closed.

%d bloggers like this: