Defense in Depth

The real lesson of Fukushima wasn't "add more backup generators"; it was that any safety system requiring electricity can fail.

Defense in depth is the nuclear safety principle that five independent physical barriers stand between radioactive fuel and the public, so that no single failure can cause a release. The barriers are: the fuel pellet matrix itself, the zirconium cladding around each fuel rod, the reactor pressure vessel, the primary containment structure, and the outer reactor building. In older designs, keeping those barriers intact under accident conditions required active cooling: pumps, valves, electricity. Post-Fukushima passive designs like the AP1000 replace that dependency with physics. Gravity, natural convection, and compressed gas move coolant without any pumps or external power.

In the AP1000, a large water tank sits above the reactor. If sensors detect an accident, the system does not wait for an operator command or a diesel generator to start. Gravity drains the water down into the core. Natural convection circulates it. Air flows passively around the outside of the containment dome, removing heat without fans.

So what happens if the passive system itself fails?

That's where the layered barriers matter. Even if cooling is imperfect and fuel is damaged, the zirconium cladding contains most fission products. If cladding fails, the pressure vessel contains them. If the vessel leaks, the containment dome holds them. Each layer is independent. At Fukushima, hydrogen accumulated and exploded inside reactor buildings because those outer buildings were not designed as sealed containment. AP1000's steel containment vessel is designed to withstand that scenario.

Passive safety changes the political and economic calculus for nuclear power: a reactor that cannot melt down without active intervention is easier to site, insure, and license than one that can.