Simulation, Epistemic Opacity, and ‘Envirotechnical Ignorance’ in Nuclear Crisis

The latest severe nuclear accident at Fukushima-Daiichi provided an occasion for the public display of radiation maps (or dose projections) in official communiqués, ex-post reports on the accident, and the mass media. Vividly colored visualizations of radiological risk, spreading from the damaged reactors at Fukushima into the world, became public elements of fascination and fear. The scale and uniqueness of this ‘envirotechnical disaster’ (Pritchard 2012) put the operators of the simulation-based Japanese System for Prediction of Environment Emergency Dose Information (SPEEDI) and the Emergency Response Support System (ERSS) under tremendous pressure. Not only were the available radiation measurement data sparse, but could the dose projections produced by these systems be trusted in such a critical situation? Minimizing the severity of the radiological situation might have endangered the population in the radiologically affected areas; whereas an overly conservative recommendation to evacuate a large area might have paralyzed the capacities of emergency task forces.

The Japanese SPEEDI and ERSS systems fall into the category of decision-support systems for nuclear emergency management (henceforth referred to as DSNE systems). They rely on computer models for simulating the atmospheric dispersion of radioactive trace species and estimating (or projecting) potential doses in the event of a radioactive release from a nuclear site. In Germany (Wilbois et al. 2013), as in Japan (Chino et al. 1993), such systems are part of the national emergency response apparatus, supporting experts and other members of emergency task forces in managing the radiological effects of nuclear accidents. In the wake of the accident, different official reports provided sometimes contrasting assessments of the way in which the SPEEDI and ERSS systems have been used during the Fukushima-Daiichi crisis. For example, the extensive report by an Independent Commission appointed by the National Diet of Japan criticized the way in which the Japanese authorities conducted their regular drills and exercises as well as the fact that the results of the SPEEDI system were not drawn upon in the decision making process early enough (The National Diet of Japan 2012). In contrast to this assessment, the International Atomic Energy Agency’s (IAEA) report on the accident (IAEA 2015) pointed out that, according to its own standards, dose projections should not be used as the basis for determining the most appropriate protective countermeasures in a real emergency because of the inherent uncertainty of such simulations. The lack of consensus regarding the role of computer-generated radiation dose projections during the Fukushima nuclear crisis prompts us to address some issues concerning the epistemology of dose projections.

Against this background, this paper critically addresses some of the sources of epistemic opacity (Humphreys 2009), non-knowledge or ignorance (Gross 2007; Böschen et al. 2010; Friedrich et al. 2017), and ‘the limits of representation’ (Kinsella 2012) affecting DSNE systems by looking into the simulation technologies and practices used by the members of the epistemic community of radioprotection experts supporting German nuclear regulators and emergency task forces. In this country, regular drills and exercises aimed at preparing for real accidents are conceived with DSNE systems in mind. In a real event, they are expected to provide first dose projections within two hours from the onset of a serious incident or accident. In this context, latent software faults (i.e., software defects which may remain undetected for a long time) lingering in simulation code are one source of epistemic opacity affecting DSNE systems, which has received relatively little attention by the atmospheric dispersion modeling community. The discovery of such faults often surprises experts, who usually focus their efforts on the science of dispersion modeling rather than on the reliability of the computer code implementing them. The lessons from Fukushima prompted the German epistemic community of radioprotection experts to engage in a model inter-comparison exercise with the different dose projection models used by the state and federal authorities in that country. The result of this exercise showed that these models can yield widely differing results, both quantitatively and qualitatively, which may contribute to wrong decisions concerning the most appropriate countermeasures in emergencies. The paper then turns to an account of and commentary on the impromptu adaptations brought to a German DSNE system used in Baden-Württemberg during the Japanese nuclear crisis from 2011 in order to allow for a dose projection with several emission phases and sources for the Fukushima accident site. This experience showed that the effective use of this system was impeded by what we shall regard as envirotechnical ignorance. Finally, we provide commentary on a series of questions that emerged in the wake of the Fukushima crisis concerning the role of DSNE systems in emergency response planning, on the basis of two official reports on the accident.

The analysis draws mainly on four empirical sources: Scientific papers, regulatory guidelines, and official reports on the Fukushima accident; the author’s retrospective ethnographic account as a member of the scientific staff at the Institute of Nuclear Technology and Energy Systems (IKE) in Stuttgart between 2007 and 2012; participant observation of IKE’s public activities during the Fukushima accident; and interviews with IKE experts (both formal and informal). Founded in 1963, the IKE is one of the oldest and was at its peak in the 1980s the largest German nuclear science and engineering institute, employing over 200 people. Following the Chernobyl accident, the institute was tasked with the development and maintenance of an atmospheric dispersion forecasting and dose projection system, called ABR-KFUE,¹ used by the state government of Baden-Württemberg for decision support in nuclear emergency management. On the theoretical side, the paper contributes to a more nuanced, situated understanding of three sensitizing concepts—epistemic opacity, non-knowledge (or ignorance), and the limits of representation—on the basis of a concrete case study focused on German radioprotection policies, experts, practices, and simulation software. On the practical side, the case study arguably contributes to a better understanding of how radioprotection regimes or—in a Foucauldian–Deleuzian sense—assemblages, are socially constructed within specific political traditions and technological cultures. Bringing the theoretical question of knowledge production together with the practical and political question of how radioprotection is constructed ultimately helps to trace a series of sociotechnical issues related to protecting people and ecosystems against radioactivity back to the epistemology of dose projections.

As a consequence of the radiological effects of the Chernobyl accident in Germany, a federal law for radiological protection, known as the German Precautionary Radiation Protection (PRP) Act,² was passed in November 1986 by the then governing conservative-liberal coalition with the aim of facilitating an effective, coordinated emergency response to nuclear accidents. While being criticized for aligning the allowable radiation levels with the more permissive international standards of that time (Günther and Dietz 1987), the law also laid the legal groundwork for the establishment of the German Integrated Radioactivity Information and Decision Support System (IMIS). IMIS is composed of a dense network of radioactivity measurement stations and represents an essential component of the national nuclear emergency response and radioprotection system (Weiss and Leeb 1993). An important extension to this system consisted of computer-based atmospheric dispersion simulation and dose projection models for immediate decision support in nuclear emergencies. These models employ emission data from the IMIS network and meteorological data from the German Weather Service in order to produce comprehensive small-to-mid range atmospheric dispersion forecasts and dose projections.

As stipulated by the PRP Act from 1986, in the event of an emergency, the individual state governments are in charge of taking immediate countermeasures for a limited area (currently 100 km in radius) around the accident site. Outside that area, the federal government takes over responsibility. In Baden-Württemberg, for example, a nuclear emergency task force composed of employees of the environment ministry supported by expert advisors assembles within an hour after the onset of an accident to decide upon the most appropriate radioprotection countermeasures. Task force members communicate with nuclear power plant (NPP) operators and make recommendations to the branch of the government in charge of managing the crisis. By the end of the 1980s, DSNE systems were introduced to automate atmospheric dispersion forecasts and dose projections and to support experts and decision makers during emergencies. In such an event, dose projections are either triggered automatically when measured emission values exceed a certain threshold or when an NPP operator signals a dangerous technical incident. Within 1–2 hours from the alarm trigger, the first dose projections are delivered to the members of the emergency task force, who can use them in the decision making process. In principle, there are four possible recommendations: Take shelter or stay in house; take iodine tablets; and temporary/permanent evacuation in a specified area. A 2–5 km zone around the emission point is evacuated regardless of the amount of released substances if an event qualifies as an accident. In addition, for an area of up to 100 km from the emission source, divided into 12 equal sectors, dose projections are used to decide if, when, and which sectors to evacuate.

The PRP Act also stimulated the formation of an epistemic community of experts supporting authorities and policy makers in their efforts to facilitate an effective response to nuclear accidents. Haas (1992) defines an epistemic community as “a network of professionals with recognized expertise and competence in a particular domain and an authoritative claim to policy relevant knowledge within that domain or issue-area” (p. 3). The members of such a community share beliefs, norms, practices, values, and notions of validity as well as a set of common practices and problem domains they jointly address. The German epistemic community of radiological protection professionals is composed of several research groups working closely with the state and federal environment ministries, and other relevant government agencies. Until 2017, the IKE in Stuttgart hosted one of these research groups in charge of the development of the simulation components of the ABR-KFUE system.

In the wake of the Chernobyl accident, the promise and expectation that dose projections, a vast network of monitoring stations, and an epistemic community of radioprotection experts would be able to effectively protect the population and the environment in the event of another nuclear “mishap” facilitated a compromise between the nuclear industry, regulators, and society. This compromise allowed for the continued operation of NPPs despite the risks entailed by nuclear power production, proven real by the Chernobyl accident. The accident in Ukraine, however, did not provide an objective basis for challenging the safety of German reactors for the simple reason that it occurred elsewhere. Within the discourse of compromise, nuclear power was considered a bridging technology until nuclear fusion or some other new technology would be able to replace it. An important argument in favor of extending the regulatory focus from accident prevention to radioprotection was the fact that, although Chernobyl occurred in another country, its radiological effects were also felt in Germany. This meant that something needed to be done regardless of the perceived safety of German reactors, in order to protect the population.

By stalemating the nuclear issue, the compromise from 1986, focusing on risk mitigation rather than prevention, ensured the continued operation of German reactors until 2011, when the Fukushima accident prompted a nuclear phase-out decision by the governing conservative-liberal coalition of the time.³ The critics of this decision considered that the federal government ignored the results of the reactor safety review (BfS 2011) commissioned by the Bundestag shortly after the onset of the accident, endorsing the safety of German nuclear plants. The government chose instead to follow the recommendation of an ‘Ethics Commission’ appointed by the German chancellor to phase out nuclear power by 2022 on the basis that the severity and uncontrollability of an eventual accident on German soil must be taken into account in the assessment of residual risks (Jahn and Korolczuk 2012).

Setting the stage for a case study focused on Germany, the next three subsections will introduce the theoretical framework used to analyze the epistemology of dose projections. In doing so, we leave the discussion of the broader political implications of such systems aside for now, as it would exceed the aims and scope of this paper.

While the members of the epistemic community of radioprotection experts are generally committed to supporting regulators and emergency managers, the degree of their commitment to a predefined set of beliefs, norms, values, and practices may vary from one country or group to another. These variations reflect the social construction of different radioprotection regimes and modeling cultures. As Haas (1992) notes, the members of an epistemic community have “intersubjective, internally defined criteria for weighting and validating knowledge in the domain of their expertise” (p. 3). For example, the Initiative on” Harmonisation within Atmospheric Dispersion Modelling for Regulatory Purposes” (short, Harmo)⁷ endorses two model validation kits, following seemingly contradictory methodologies. Referring to the main validation kit, the description of the alternative validation kit states that “[t]he results from the Model Validation Kit should be interpreted with care, because it does not explicitly address the question of stochastic nature of observed concentrations” (Harmo.org 2018). A few sentences later, however, it acknowledges that “[t]here are some issues with the [alternative] ASTM procedure that are not fully resolved and deserve further attention.” The problems and practices associated with the verification, validation, and testing of simulation models and codes seem dialectical within the dispersion modeling community. Furthermore, the absence of a clear distinction between simulation codes as software; and models as representations of reality within this community can be traced back to the question of whether validation and verification should be viewed as qualitatively different activities. Winsberg (2010), for example, argues that the conceptual division between validation and verification can be misleading if the focus is put on the methods used to achieve either of the two. Oreskes et al. (1994) note that, as opposed to verification, validation does not necessarily denote an establishment of truth but of legitimacy, whereas the verification of numerical solutions is usually performed by comparison with analytical solutions considered to reflect a theoretical truth. As these authors further note, the two terms are used erroneously, either as synonyms or with “validation” entailing the assertion that the model accurately represents some physical reality. However, as other authors observe (Hook and Kelly 2009; Merali 2010), such debates do not consider the social dimension of coding as an error-prone human activity. In this sense, Neumann (1994) provides dozens of examples of disasters caused by pure coding faults in computer models. The distinction between simulation codes as software and simulation models as constructs of reality requires the existence of a distinction between testing software and a philosophical argument around the notions of validation and verification in the mindset of modelers.

One of the paradoxes entailed by the principle that verification and validation must always imply comparisons with measured data is that testing is reduced to a limited number of input cases reflecting only instances in an entire history of realizations of the phenomena being modelled. As Oreskes et al. (1994, p. 642) put it, “[w]hat we call data are inference-laden signifiers of natural phenomena to which we have incomplete access.” While measurement data from experiments and accidents, such as the ones from Chernobyl and Fukushima, represent invaluable epistemic resources for modelers, these datasets are limited in number and will hopefully remain so. As Vehlken (2016) notes, some aspects of nuclear technology cannot be tested at all by means of experiments because of insurmountable physical and social difficulties. In this context, the practice of relating the outputs of one’s model to a limited set of measured data contrasts with the principles of code and input space coverage by test cases. Test coverage criteria aim at stressing the limits of the software being tested to the end of finding more faults rather than making the software behave as expected for a limited set of input cases. In this sens, latent software faults in simulation codes pose a particular challenge, the tackling of which may require an additional toolbox of methods from the software reliability domain. Testing can be a costly, repetitive, and unattractive task especially for scientists (Merali, 2010), for whom it becomes more attractive and “publishable” if real data are used. At the same time, scientists often seem reluctant to publish their code (Barnes, 2010), thus preventing interested peers and members of the public from participating to the search for software faults in simulation codes. Currently, more effective testing methods exist, such as random testing, which, however, are not easy to use even by software engineers. Testing requires an intense preoccupation with the problem of revealing the maximum number of faults before releasing the software, regardless of the nature of those faults. Observing that there are very few published methods and studies aimed at finding and removing pure coding faults (or mistakes) from scientific software, Hook and Kelly (2009) propose a new testing activity, called code scrutinization, which is to be carried out before verification and validation; and show that random and mutation testing can successfully be used for code scrutinization. In spite of these promising results, there are reasons to believe that code scrutinization will not be picked up by all members of the scientific community because it is likely beyond their research interests. Addressing a new source of uncertainty in dispersion models owing to software faults is met with reluctance by some members of the Harmo community as well, whose strategic purpose is to obtain funding for atmospheric release experiments. Also, code scrutinization does not guarantee the elimination of all existing software faults. This suggests that, with the current testing, validation, and verification methods and practices, the trustworthiness of simulation codes cannot be fully guaranteed.

The validation-verification dialectic as well as the distinction between models and codes (or lack thereof) also reverberates upon the ability of experts to distinguish between inherent model features and flaws, numerical effects, and coding faults. This may lead to situations in which latent faults remain undetected for years in simulation codes. In the course of the development of the ABR-KFUE system, it became evident on a number of occasions that latent faults existed in the codes. Whenever such a fault was discovered, the experts from the ABR-KFUE group analyzed its root causes, removed it, and released a new version of the system. In the remainder of this section we discuss two examples that we consider relevant with respect to the epistemic opacity of simulation codes, as perceived by the members of the ABR-KFUE group.

The first example deals with a scaling error in the gamma submersion code,⁸ which remained undetected for about 5 years. The scaling error was introduced when the developers of the system were required by a new regulatory guideline to extend the radius of the monitored area from 50 to 100 km. In order to avoid increasing the computation time given the new problem size, the developers chose to increase the size of the grid cells used to discretize the three-dimensional space surrounding the monitored sites while keeping the number of cells unchanged. In the old code, the optimization of the gamma submersion dose computation was based on a set of precomputed parameters generated using a legacy program, which was no longer available. Because the developers did not fully understand the role and meaning of those parameters, provided in form of a static file, they ignored them. The resulting bug remained unnoticed for several years, although the new version of the code computed in some cases doses 5 times higher than what would be normally expected. This was partly due to the fact that the maximum concentration is determined by dispersion models as a function of the overall distribution of concentrations within a given area and time frame. The maximum concentration needs to be calibrated using experimental data for any given combination of topography, weather, and emission data. With the maximum concentration being a model variable without meaning in the absence of a reference to measured data, to which—however—all other concentration values in the model area are mathematically linked through the mass conservation law, this example also illustrates how verification and validation of dispersion models are intrinsically coupled.

The opaque dependency on precomputed parameters represents a good example of what Wimsatt (2007) calls generative entrenchment: “A deeply generatively entrenched feature of a structure is one that has many other things depending on it because it has played a role in generating them” (p. 133).⁹ Owing to missing documentation, this dependency appears to be a symptom of practical drift (Snook 2002, p. 194). As Lundestad and Hommels (2007) note with regard to software development, practical drift can be understood as an unwanted yet unavoidable progressive derogation from software engineering processes and best practices rooted in social and organizational factors. Considering that DSNE systems have only come under serious scrutiny in the wake of nuclear accidents, there was sufficient time for practical drift to occur as well as for fluctuations in policies, funding, and personnel to affect the practices of the ABR-KFUE group. To better understand how trust in simulation software can emerge and be upheld in these circumstances, the ABR-KFUE group should be regarded as a multidisciplinary thought collective.¹⁰

Fleck (1979) defined a thought collective as a community of persons mutually exchanging ideas or maintaining intellectual interaction. The members of a thought collective both adopt a certain way of perceiving and thinking; and transform it continuously, whereby this transformation happens both in their minds and in the interpersonal space between them. A thought collective is likely to develop a certain thought style reflecting the members’ way of perceiving and thinking as well as interpersonal relationships. While the members of the ABR-KFUE group had different backgrounds, ranging from meteorology, physics, and engineering to computer science, over the years, the frequent meetings (at least 4 per year) brought them closer together from an epistemic point of view, thus creating the premises for the emergence and cultivation of a specific thought style. Members shared the common purpose of developing and improving the ABR-KFUE system through regular exchanges of ideas, concerns, and joint drills and exercises with representatives of the environment ministry and NPP operators. Being at the core of all these activities, over the years the ABR-KFUE system not only gained a degree of autonomy, as Winsberg (2010) observes about simulation models in general, but also a certain epistemic authority within the group, reaching the status of what might be called a non-human expert. Members trusted the results of the system just as much as they would trust the opinion of another colleague on a certain matter—until a more critical spirit finally questioned the authority of the system while conducting a routine calculation, which led to the discovery of the scaling error. Since there was no a priori sense within the group for what a gamma submersion dose projection would look like for the extended monitored area, most members did not question the epistemic authority of the system—a black box to them, which obscured the practices of its authors. As for the actual developers of the code—a minority within the group—the generative entrenchment caused by the natural churn of scientific personnel at the IKE induced a certain reluctance to grapple with the poorly documented legacy codes, unless really required to do so.

Another example of a long lived latent fault in the ABR-KFUE system is that of an erroneous parameterization of one of the six atmospheric stability classes, depicted in Fig. 1, used by the atmospheric dispersion code. Depending on wind speed and solar radiation intensity, these empirically determined stability classes have a direct influence on the radiation dose because, in more unstable conditions, represented by the classes A-C, the diffusion process caused by turbulence helps to spread the radioactive trace species over a larger area of the atmosphere. The table in Fig. 1 shows that the most commonly encountered stability classes are C and D. Influenced by the scenarios of the drills conducted yearly at one or two NPPs and by the weather conditions during those drills, the users of the system usually carried out their routine simulations using the most commonly encountered atmospheric stability classes. One user of the system eventually observed that for the stability class E, the horizontal spread of the plume was excessive. The fault, caused by an erroneous parameterization of the E class, was discovered in the course of the German model calibration study carried out after the Fukushima accident, discussed in more detail in the next section. A rule of thumb from reliability engineering states that, the less common an input case is, the more likely it is for it to activate a latent fault. Under the influence of their habits and practices, the users and testers of the systems usually limited their scope to the most common input cases. In this context, if one regards the entire ABR-KFUE expert group as a collective cognitive agent, then epistemic opacity is due also to the habits, practices, and thought style cultivated by its individual members. In other words, it is socially constructed.

The most common way of testing DSNE systems is to visually inspect the dose and concentration projections they produce. Experts visually check radiation and concentration maps for plausibility, confronting them with their expert knowledge about the phenomena being simulated. This practice, although less systematic than validating against real data or the verification methods proposed, for example, in the guideline 3945 issued by The Association of German Engineers (VDI 2000), is worth cultivating because, given its popularity, it is probably the one that facilitated the discovery of most anomalies and coding faults so far. However, to avoid confirmation bias, visual inspection should be accompanied by some curiosity and randomness in choosing the input cases. This is how, for example, the systematic scaling error from the ABR-KFUE system was eventually discovered.

Through visual inspection, experienced users are able to judge with a reasonable level of confidence whether the following input parameters have been correctly accounted for in atmospheric dispersion simulations: Wind direction, wind speed, and atmospheric stability class (or diffusion category) by inspecting the orientation of the plume; the length and shape of the plume by correlating them with the wind speed and the atmospheric stability class; and, to some extent, the concentration and dose levels indicated by the color-coding scheme. What even experienced users may not be able to check for plausibility by mere visual inspection include the following characteristics of dose projections less evident to the eye: The maximum dose level, since this is one of the very unknowns the system is called upon to forecast; the extent to which the spatial distribution of dose values in the monitored area obeys a Gaussian distribution, as it is supposed to do in theory (Etling 2008); and the relation of a particular simulation result (which is yet to be verified) to already verified reference results. In addition, one of the pitfalls of common visualizations of concentrations and doses is induced by the default logarithmic scale used by DSNE systems. Logarithmic scales can obscure model flaws and numerical effects, which may contribute to a perceived amplification or attenuation of risks, respectively, in different regions of the monitored area, by making small concentration and dose values appear greater, and vice versa. As shown in Fig. 2, the logarithmic scale used in the plot on the right-hand side obscures the dotting effect of the RIMPUFF model, which becomes more evident when using a linear scale (left hand side plot). The logarithmic scale may also induce a perceived amplification of risk, whereas the inverse effect might be expected when using a linear visualization scale. This pitfall arguably exposes the limits of radiological risk representation through radiation maps.

Staying within the epistemic boundaries of a single model when conducting verification and validation entails a series of disadvantages, some of which could be related to the inability of modelers to escape the thought style of one’s work group. Comparing different models based on their results promises more rewarding outcomes in terms of identifying and elucidating anomalies and faults. Model inter-comparisons require different institutions to provide access to their systems or to decide upon a set of input cases and to share the results produced by their models for those cases. Like in the case of single-version verification and validation, within the epistemic community of radioprotection experts, visual inspection appears to be one of the preferred method for inter-model comparisons. Depending on the results of such exercises, experts may dig into their own code base to elucidate any anomalies revealed by the comparison with the results of other models. Since visual comparisons do not distinguish between inherent model features, biases, and software faults, the purpose of model inter-comparisons is to also facilitate focused discussions between experts from different institutions based on specific input cases. Here another source of socially motivated epistemic opacity arises from secrecy; since, usually, experts and members of the public do not have access to the source code and thought styles of other groups.

While occasional inter-institutional model comparisons have been carried out before 2011 as well, the Fukushima accident provided reasons to conduct more systematic comparative studies of the atmospheric dispersion models used in Germany and Switzerland. One of these reasons was that the various dose projections for the Fukushima Daiichi accident site, published in different official reports on the accident, scientific journals, and the media were so different, both qualitatively and quantitatively, that reasonable doubt arose concerning their usefulness in real emergencies. Consequently, in 2012 the German Federal Office for Radiation Protection (BfS—Bundesamt für Strahlenschutz) commissioned a comparative study of the atmospheric dispersion and dose projection models used in Germany and Switzerland (BfS 2016), which confirmed these concerns.

The study showed that, given the same inputs, different models produced qualitatively different results in many of the tested input cases (Fig. 3 shows an example). The authors of the BfS study (themselves members of the groups developing the systems being compared) concluded that different models using identical input and calibration parameters may lead to different recommendations of countermeasures in a real emergency. Therefore, they called for the harmonization of dose projection models on an international level, especially in cooperation with Germany’s neighboring countries (BfS 2016). The authors of the study also pointed out that existing experimental data are insufficient for validating the models and requested that “dispersion experiments” with non-radioactive tracers and emission phases of several hours should be conducted, especially for emission source distances ranging from 10 to 100 km.

The BfS comparative study provides insights into how an entire epistemic community went about the problem of epistemic opacity in the aftermath of the Fukushima-Daiichi accident. Much like the ABR-KFUE group, the epistemic community of radioprotection experts may be regarded as a collective cognitive agent tasked, among other things, with facilitating the collaboration in an eventual joint emergency response effort at the federal and international levels. In this sense, the BfS report suggests that, to avoid confusion and to facilitate collaboration, members and groups from different countries and federal states should take steps towards “harmonizing” their guidelines and regulations concerning civil protection measures in order to allow for each state and country to use their own DSNE system(s) in a real emergency. This is to say that, given the inherent differences between their models, the different groups participating in the study agreed to disagree concerning their own modeling cultures but promised to make efforts towards improving collaboration in spite of these differences. This interpretation suggests that the chosen way of tackling the epistemic opacity of dose projection models was to defer to responsibility and accountability for the tools and methods used in one’s own backyard. This mindset allows for the coexistence of parallel modeling cultures and simulated realities embedded in the local regulatory cultures of different federal states and countries. Also, considering the large number of back-to-back radiation maps presented in the study, the method of visual inspection seems to be indeed the de facto community standard for learning about models and codes. This is understandable considering that, in a real emergency, decision makers will also use visual dose projections to plan protective countermeasures.

Shortly after the onset of the accident, the ABR-KFUE group received a request from the environment ministry of Baden-Württemberg to perform an atmospheric dispersion forecast using the source term (i.e., the quantity and nature of radioactive materials and the duration of the release) and meteorological data from the Fukushima-Daiichi site. The goal was to test the ABR-KFUE system in a real situation in which data are sparse and the crisis communication is performed under tremendous pressure. This was part of an effort by nuclear experts all around the country to rehearse civil protection protocols in a global crisis situation. In response to the ministry’s request, IKE experts used data provided by the German Society for Facility and Reactor Safety (GRS), which were insufficient to evaluate the possible consequences of the accident without a high level of uncertainty. For this reason, they were given license to make assumptions as necessary based on their experience and expertise. As the accident unfolded, the release of radioactive materials continued over days and weeks, with four main emission phases from different sources, which were clearly visible in the source term compiled by the GRS. However, the ABR-KFUE system only supported single-source releases since an accident with several emission phases and sources had not been explicitly foreseen in the accident scenarios, the regular drills, and guidelines for nuclear emergency response. In these circumstances, the experts decided to adapt the ABR-KFUE system impromptu in order to provide the requested simulation results as rapidly as possible. They prepared a special accident category with several emission phases and four sources of emission, which was added to the existing list of accident categories supported by the system for bootstrapping the emission codes. Although the required adaptations were relatively uncomplicated, they took several days to implement. In addition, the model area had to be increased, the meteorological data had to be prepared manually, and the topography of the Fukushima site, reaching as far as Tokyo, had to be added to the database of the system. Eventually the ABR-KFUE system was able to produce a result (Scheuermann et al. 2011), which looked similar to the ones published by the Japanese authorities.

Prior to the accident, predefined inputs for the source term based on so-called release categories, determined as part of two German risk studies from 1979 and 1990 (Schmid and Schnadt 2004), were used by the ABR-KFUE system. These release categories foresaw a maximum release time of 6 h, whereby the most severe of them was based on a core meltdown scenario with a single emission phase and source. The limitation of the system to one emission phase per simulation may thus be attributed to a kind of envirotechnical ignorance concerning the tightly coupled physical interactions between normal and extreme natural processes, nuclear reactors, and their active safety systems. At Fukushima, the tsunami wave, the plant protection wall, the water affecting the diesel generators, and the rising temperature caused by the ongoing radioactive decay process interacted in unprecedented ways. This abysmal combination of factors ultimately led to a scenario beyond that of the maximum credible accident—the term used by nuclear experts for worst case scenarios on the basis of which the safety systems of nuclear reactors are designed. Since Fukushima had exceeded the maximum credible accident scenario in scale and severity, it also produced knowledge which was not represented in the ABR-KFUE system before. The epistemic accident at Fukushima thus revealed a scenario previously unforeseen by experts. In response, the system was upgraded to allow for several emission phases and sources. The failure to account for an accident with several emission phases of long durations can also be attributed to the “limits of representation” (Kinsella 2012) with respect to the maximum credible accident scenario. This epistemic blind-spot was arguably the product of a collectively held belief that in Germany such an accident would not be possible, reinforced by the risk studies from 1979 to 1990. In this light, the experts’ decision to adapt the ABR-KFUE system impromptu so as to be able to produce a dose projection for the Fukushima site may be interpreted as a reflex reaction aimed at restoring the “closed world” imagination of controllable accidents underpinning the German post-Chernobyl radioprotection assemblage. While experts argued that a similar combination of factors and events that led to the Fukushima disaster would not be possible in Germany, a different scenario leading to an accident of comparable scale (including multiple radioactive emissions from different reactors) cannot be reasonably excluded.

The nuclear emergency response of the Japanese authorities was criticized in the media (Von Hippel 2011; Ionescu 2012; Jones et al. 2013), by members of the public (Plantin 2015; Riedlinger and Rea 2015; Kera et al. 2013), and in different official reports on the Fukushima accident. Some of these reports reflect contradictory expectations of the role of DSNE systems during the Fukushima crisis, notably the one issued by an independent commission appointed by the Japanese Diet (The National Diet of Japan 2012) and that of the International Atomic Energy Agency (IAEA 2015). In the section about nuclear emergency response, the independent commission’s report notes that the “chaotic evacuation orders” were revised several times in one day and that some evacuees were sent to areas which later turned out having high levels of radioactivity (p. 38). The report further criticizes the Japanese practices of preparedness, including the use (or misuse) of the radiation measurement and dose projection systems:

[The] government also failed to assume a severe accident or a complex disaster in its comprehensive nuclear disaster drills. As the scope of the drills expanded, they lost substance, and were performed for cosmetic purposes, rather than to develop preparedness. The irrelevant drills were lacking instruction in the necessity of using tools such as the radiation monitored information from SPEEDI [System for Prediction of Environment Emergency Dose Information]. Though it was applied in the annual drills, participants found the drills useless at the time of the accident” (p. 38).

To sustain this assessment, the authors reiterate some of the regulatory guidelines and expectations concerning the role of DSNE systems in Japan, which seem analogous to the German ones:

The Emergency Response Support System (ERSS) and SPEEDI are in place to protect public safety. The environment monitoring guideline assumption is that ERSS predicts and forecasts the release of radioactive substances and release data, and SPEEDI predicts and forecasts the spread of radioactive materials based on ERSS. Public safety measures, including those for evacuation, should be planned based on the use of these systems. […]

The system failed. The emission data could not be retrieved from ERSS, and the government was unable to use the SPEEDI results in planning protection measures and fixing evacuation zones. (p. 38).

As the report suggests, the Japanese regulatory expectations of preparedness for a nuclear accident assumed a working DSNE system in place at the time of the accident. Without taking into consideration the circumstance of the situation, notably the lack of measurement data and the inherent limitations of the simulation-based SPEEDI system, the report finds that these expectations were not met in practice. This point of view is shared by several commentators of the Fukushima evacuation controversy (Schäfer 2016; Funabashi and Kitazawa 2012; Yamawaki 2017). In contrast to the Three Mile Island and Chernobyl accidents, human error on the part of plant operators played a relatively minor role in the root cause analysis of the “beyond design basis” accident at Fukushima Daiichi. The Independent Commission found, however, evidence of it in the authorities’ response to the accident, thus putting the burden of accountability on emergency managers. This may also be interpreted as a shift from prevention to preparedness in the Japanese regulatory culture, as Schmid (2016) observes.

In contrast to the Independent Commission’s report, the IAEA guideline for nuclear emergency preparedness and response recommends that initial decisions upon countermeasures be taken on the basis of simple criteria that rely on observable data and not on dose projection models, which may entail “great uncertainties” before and during a release (IAEA 2002, p. 286). In this sense, the IAEA report on the Fukushima accident (IAEA 2015) notes that, although

“[t]he [Japanese] emergency response plans envisaged that decisions on protective actions would be based on dose projections [using SPEEDI] performed at the time when a decision was necessary… [t]his approach was not in line with IAEA safety standards, which stipulate that the initial decisions on urgent protective actions for the public need to be based on plant conditions” (IAEA 2015, p. 44).

These contradictory expectations of the role of DSNE systems in real emergencies may have induced a state of indecision with the Japanese nuclear emergency managers. Yamawaki (2017), for example, notes that one of the main reasons for doubting the utility of dose projections was the concern that the wind direction might suddenly change. Therefore, experts were reluctant to release the forecasts of the SPEEDI system in the first place. While both reports acknowledge that dose projection models can facilitate a more comprehensive diagnosis of the radiological situation based on measured meteorological and emission data, there appears to be a lack of consensus concerning the trustworthiness of dose projections based on weather forecasts and inconsistent emission data. This lack of consensus may be explained by the different contexts in which the IAEA and national regulatory agencies operate. Whereas the latter context entails a dimension of political accountability rooted in a mitigation principle which holds that even unreliable dose projections are better than no projections at all, the international and professional perspective advocated by the IAEA seems rooted in a deterministic paradigm of precaution, which considers that a sound national regulatory culture can warrant reactor safety. In the wake of Fukushima, the constructivist, mitigation-oriented view of the Independent Commission and the deterministic, precautionary principles advocated for by the IAEA in its role as an expert advisory body thus appeared to challenge each other, with the latter reflecting the dominant view within the nuclear community.

The apparent disagreement between the dose projections published during the Fukushima accident prompted a series of questions and controversies about the exact role and usefulness of such simulations in planning emergency response measures. As I have argued, the epistemic opacity affecting atmospheric dispersion simulations and dose projections produced by DSNE systems challenges the trustworthiness of such tools when used in real emergencies. The ‘envirotechnical ignorance’ of radioprotection experts—that is, a lack of knowledge and awareness of the tightly coupled processes and potentially hazardous interactions between technology, humans, and nature revealed by the epistemic accident at Fukushima—raised additional concerns regarding the overall usefulness of these systems. In this sense, the German response to the accident showed that DSNE systems were unable to account for the complex envirotechnical failures that caused the Fukushima accident without impromptu adaptations. This experience revealed the limits of representation concerning the maximum credible accident scenario in the context of the German radioprotection assemblage.

One of the lessons learned from Fukushima is that dose projection models and DSNE systems are out there and they will be used, one way or another, regardless of the issues addressed in this paper. In a way, the accident pushed the problems associated with using these systems in real emergencies into public debate, thus drawing upon them the scrutiny of various publics and political actors. In Japan as in Germany, DSNE systems seem to have become an ‘obligatory passage point’ (Callon 1984) in nuclear emergency management and indispensable components of the radioprotection assemblage. In spite of the Fukushima experience, in Germany there still appears to be a general consensus among experts about the positive role of these systems in planning evacuations and countermeasures in nuclear emergencies. This is understandable considering that, over the past three decades, the routines and practices of nuclear emergency task forces were developed and rehearsed with DSNE systems in mind and at hand. Consequently, these systems gained epistemic authority in the interdisciplinary thought collectives that create and operate them. Today, regular drills and exercises with radioprotection experts, emergency managers, and NPP operators would be inconceivable without the use of DSNE systems.

The Fukushima experience thus points to an unresolved tension related to the question of whether or not to use DSNE systems in crisis situations, considering the diverse sources of uncertainty affecting them. In the logic of national regulatory systems, not using such systems can be interpreted as an institutional breakdown caused by the rejection of uncertainty at the expense of ignoring incomplete yet valuable knowledge; whereas, in the deterministic-precautionary logic of the IAEA, using dose projections for emergency response planning is conditioned by their provable reliability and trustworthiness. This tension is further deepened by the social construction of the radioprotection assemblage within which various individual and collective cognitive agents—ranging from experts, thought collectives, and epistemic communities to political actors and publics—are confronted with the epistemology of dose projections in critical situations. A possible way out of this impasse could be to accept dose projections for what they are—a source of incomplete, uncertain, yet potentially valuable knowledge, which needs to be confronted with the tacit knowledge and experience of radioprotection experts as well as with the input of other relevant cognitive agents, including members of the public and lay experts, in order to gain trustworthiness and acceptance in any given situation. And, as Schmid (2012) suggests, at least some room for improvisation should be left in emergency response plans and protocols so as to be able to tolerate uncertainty and mistakes.

Finally, it should be noted that the current paper merely scratches the surface of the issue of radioprotection regimes in Germany, Japan, and worldwide. A more detailed analysis is needed with regard to questions of responsibility and accountability for decisions and countermeasures, such as evacuations, on the basis of the ongoing Fukushima experience. Jobin (2012), for example, opened the way in this regard by arguing that radioprotection regimes are not able to provide all the help needed by the people directly affected by the Fukushima accident. Also, a broader discussion of the German nuclear phase-out decision with reference to the German radioprotection assemblage and its implications for the discourse of nuclear power in that country is still missing in the literature.