Engineering data integrity: what the Hamaoka case teaches about safety decisions

A precise report can still fail to support a decision

On 14 September 2026, Chubu Electric Power published the disclosed version of an independent committee report into inappropriate practices used when formulating the design basis ground motion for Hamaoka. The company also withdrew regulatory applications concerning units 3 and 4 and announced leadership and organisational changes.

This was not a nuclear accident, radioactive release or earthquake damage event. The public issue is the trustworthiness of the evidence-production process. Decimal precision cannot repair a chain whose source, selection rules, assumptions and review cannot be reconstructed.

Direct answer: what is Hamaoka's main engineering lesson?

Engineering data integrity is not merely preventing someone from editing a spreadsheet. It means making origin, selection, transformation, assumptions, criteria, versions, review and conclusion reconstructable, reproducible and open to challenge.

A true data point selected through a biased process can support a misleading conclusion. An unfavourable result is not noise until a documented technical rule explains why it may be treated differently.

What happened and what Chubu decided

Chubu received the report on 11 September and released a redacted version on 14 September. It acknowledged inappropriate seismic-assessment methods and serious doubts about the reliability of application materials and subsequent regulatory responses.

The company withdrew installation-change and related applications for units 3 and 4. At the 15 September revalidation, no later public NRA act had completed the regulator's response, and no official reapplication or restart timetable existed.

The matter became public on 5 January after information entered the regulator's safety-reporting channel. The NRA suspended the review and used strong language about intentional data manipulation. This article attributes that language rather than adopting it as its own headline.

Regulator and committee: terminology needs attribution

January NRA documents used language equivalent to misconduct, fraud and intentional manipulation. International reporting often says falsified data or data scandal.

The independent committee did not find the practices proper. It nevertheless warned that reducing the entire set of acts to words such as falsification, fabrication, underestimation or data fraud would be inappropriate because the assessment involves methodology, randomness, academic coherence and different evaluative axes.

That caution is not an acquittal. It is why this analysis uses inappropriate practices, questioned selection and reliability concerns, while reserving stronger terms for the sources that used them.

What design basis ground motion means

Design basis ground motion is the site-specific shaking reference used to design and assess safety-important structures, systems and components. It is built from scenarios, models, criteria, uncertainty and margins.

It is not simply the largest earthquake that could ever occur. IAEA SSG-67 helps explain the concept but does not retrospectively judge Hamaoka's method or quantify a lost safety margin.

The selection process under scrutiny

Public documents describe that before 2018, multiple sets of 20 simulated seismic motions plus a representative wave were generated, and one set was selected by the company.

From around 2018, Chubu acknowledged a process in which a wave that was not initially closest to the mean was selected as representative, after which other waves were chosen so that it became closest to the set mean.

This does not prove the reactors would fail in an earthquake. It explains why the selection pathway and regulatory evidence need reliable reconstruction.

Legitimate variability is not permission to choose the answer

Simulation variability can be technically legitimate when the method defines how it will be represented. A pre-defined criterion exists before results are examined; sensitivity analysis retains alternatives and shows how assumptions affect the conclusion.

Risk arises when the result is viewed first and the analytical route is then adjusted towards a preferred answer. Running more models does not create trust if the representative-result rule cannot be audited.

Integrity runs through the entire chain

Raw data, processing, model, assumptions, selection criterion, result, interpretation, recommendation, decision and verification are not the same thing. Integrity can fail at any link.

A calibrated sensor cannot correct an improperly selected series. A sophisticated model cannot correct a hidden assumption. Final-document review cannot replace access to raw evidence, versions, filters, exclusions, adverse results and justifications.

Reliable data must survive the journey from measurement to decision.

The desired answer is an organisational hazard

Deadlines, licensing, cost and restart expectations can influence decisions without an instruction to change a number. Pressure may shape what gets tested, reported, repeated, escalated or challenged.

The governance questions are whether the team was testing a hypothesis or proving an answer, whether contrary results had a formal escalation path, and whether professionals could stop a submission when evidence was insufficient.

In critical engineering, evidence must be allowed to change the decision. If only the decision can change the evidence, the control has failed.

Safety culture must become observable

Chubu's presentation attributed organisational, governance and compliance factors to the committee, including a tendency to prioritise internal logic over societal and regional perspectives. The company acknowledged inadequate conditions for correct information sharing and multi-perspective discussion.

Culture is not a vague root cause. It becomes visible through approved criteria, protected reporting, independent review, recorded dissent, evidence access, accountability and stop authority. IAEA GSR Part 2 is an international management reference, not a law this article applies to Japan.

Questioning is a safety barrier

The matter reached the regulator through a safety-reporting system. The identity of the person who raised the concern is neither needed nor appropriate for understanding the value of the channel.

The US NRC safety-culture policy describes an environment where concerns can be raised without fear, supported by a questioning attitude, problem resolution and effective communication. It is a useful benchmark; the NRC does not regulate Hamaoka.

Independent review must reconstruct the path

Independence is not another signature on the final page. Reviewers need raw data, model versions, criteria, exclusions, alternatives and technical disagreements. Otherwise, they review presentation rather than evidence.

The greater the consequence, the clearer the separation should be between producing, verifying and authorising. The record should show what was challenged, what changed and why a conclusion survived or failed review.

The same mechanism exists beyond nuclear engineering

The mechanism appears when an occupational-risk classification is softened because action is expensive, only a favourable exposure period is measured, an adverse thickness reading is dismissed without technical grounds, or a test is repeated until it passes without preserving earlier failures.

It also appears when an incident investigation selects only statements supporting its first hypothesis, a calculation changes assumptions to fit equipment already purchased, or a dashboard changes its denominator after the result to keep a target green.

Precision is not synonymous with reliability.

Technical-information integrity checklist

Educational governance checklist; it does not replace sector regulation, a quality system, audit or procedure.

• Preserve source, metadata and raw data.
• Define selection criteria before the conclusion.
• Justify and trace exclusions.
• Control file, software and model versions.
• State critical assumptions.
• Retain adverse results.
• Use sensitivity analysis where relevant.
• Require technically competent review.
• Match independence to criticality.
• Record and answer technical dissent.
• Link evidence, criterion, decision and action.
• Verify effectiveness after the decision.

What we do not know and must not conclude

The case does not prove that units 3 and 4 would fail in an earthquake, nor that an accident, structural damage or radioactive release occurred. Public data do not permit calculation of a correct design basis or seismic margin, or conclusions about individual criminal liability.

The committee did not exonerate the company; it rejected a one-word simplification. Withdrawal does not permanently bar future regulatory action, but no official reapplication or restart date exists. The NRA's final response and independent verification of corrective-action effectiveness remain open.

Questions before accepting a technical report

Can the report be traced to raw data? Would another team reproduce a compatible result? Were criteria set before or after the result? What was excluded and why? Who reviewed the work, with what independence? Where is dissent recorded? Does the conclusion display uncertainty? What evidence would make the team change its mind? Who can say: do not submit yet?

Conclusion: physical strength and evidence integrity

Hamaoka requires careful reading because the regulator, company and independent committee use different frames. One engineering conclusion is still available: safety depends on the physical strength of an installation and on the integrity of the process producing the evidence used to call it safe.

When evidence can no longer contradict the decision, a report stops being a control and risks becoming a justification. A safe organisation preserves the trail and the professional right to say: these data do not yet support this conclusion.