I watched the HBO documentary “Fukushima: A Nuclear Nightmare” the other day. It's chilling.
The film gives a detailed account of the nine days after the March 2011 earthquake and tsunami, focusing on the workers who risked their lives to prevent a total catastrophe at the Daiichi nuclear plant. The footage and firsthand testimonies are gripping. But what stayed with me wasn't the disaster itself. It was what came at the end.
The trailer:
The documentary reveals that TEPCO — the utility company operating the plant — had received a report warning that a tsunami of 15 meters was possible at the Fukushima site. Instead of acting on it, they sat on the report and only gave it to nuclear authorities on March 7, 2011. Four days before the disaster struck.
As an New York Times reporter puts it:
“Japan is the nation that invented the word tsunami. So the idea that a Japanese plant wouldn't be ready for its tsunami looks ludicrous. And yet they weren't.”
The fix didn't even need to be complicated. As another expert explains, you don't necessarily need a massive wave wall to block a higher tsunami. A waterproof power system — like you'd find on a ship or submarine — would have gone a long way. The backup diesel generators that failed were sitting in low-lying areas vulnerable to flooding. It wouldn't have taken a whole lot.
So why didn't they do it?
The Orthodoxy
The documentary introduces a concept called the “safety myth” — the propaganda campaign that had convinced the Japanese public that nuclear energy was completely safe. This wasn't just marketing. It became an orthodoxy, and questioning it carried real consequences.
The reporter says it plainly:
“If you question the safety of a plant, even something like, hey, let's have a few more backup systems, it could possibly cost you your career. And so people didn't do it. They had to toe the line.”
That's not a technical failure. That's a psychological safety failure operating at an industry-wide scale.
You don't need a conspiracy. You don't need villains twirling mustaches. You just need an environment where raising concerns carries personal risk and staying quiet doesn't. People do the math — consciously or not — and they stay quiet. Multiply that across an entire organization, an entire industry, for years, and you get Fukushima.
“We Did Everything That Was Required”
There's a moment near the end of the documentary where a senior TEPCO manager says something like:
“Of course, safety comes first in nuclear energy. We did everything that was required.”
Required. Yikes. That phrase — “everything that was required” — is compliance language, not safety language. It means “we met the minimum standard someone else set for us.” In a real safety culture, the question isn't “did we do what was required?” It's “what else could go wrong that we haven't thought of yet?”
Those are fundamentally different postures. One is defensive. The other is curious.
The Timeline That Shows a Pattern
The record of warnings TEPCO received and ignored is damning. In 2000, an internal TEPCO report recommended safety measures against seawater flooding. In 2002, a government research body estimated a potential tsunami up to 15.7 meters. TEPCO pushed back, saying further study would “take time and cost money.” The regulator accepted that answer.
By 2008, TEPCO's own subsidiary had run the numbers and confirmed the 15.7-meter estimate. Executives initially approved countermeasures. A construction schedule was drawn up. Then they reversed course. The concern was that taking action would raise public alarm and possibly force a shutdown. Acting on what they knew would be politically and financially inconvenient. So they buried the finding.
When the subsidiary's engineer reported the 15.7-meter figure, someone at TEPCO headquarters asked whether the number could be made smaller by changing the calculation method. The engineer found that it couldn't. His prediction was shelved anyway.
That moment tells everyone in the organization exactly what the real priorities are.
This Isn't Just About TEPCO
Here's where I want to resist the easy framing. It would be simple to make this a story about one bad company. But the failure mode is universal.
Humans are bad at low-probability, high-consequence risk. We discount risks that haven't materialized recently. We anchor to existing assumptions. We treat the absence of a disaster as evidence that our safeguards are adequate, when it might just mean we've been lucky. You see the same pattern at NASA before Challenger and Columbia, at BP before Deepwater Horizon, and in healthcare systems before sentinel events. The cultural flavor changes, but the underlying mechanism is remarkably consistent.
There's also a lazy assumption — common in the West — that “Japanese management” is monolithic. That because Toyota operates a certain way, Japanese industry broadly operates that way. TEPCO is a devastating counterexample. Not all Japanese companies are Toyota. Toyota is a manufacturing company that competes globally and faces existential market pressure every day. TEPCO was a regional monopoly with guaranteed demand and no competitive threat. Those are fundamentally different operating environments, and they produce fundamentally different cultures.
Toyota Way Principle #1 is to base decisions on long-term philosophy, even at the expense of short-term financial goals. TEPCO violated that principle at every turn — it wasn't their principle.
They had the data. They approved the countermeasures. Then they reversed course because the short-term costs — construction expense, potential shutdown, public anxiety — outweighed what felt like a theoretical long-term risk. That's short-term financial thinking dressed up in risk management language. And “safety first” was apparently a slogan at TEPCO, too. The words on the wall were the same. The behaviors behind them were opposite.
It's also tempting to make this an anti-profit argument. It isn't. Toyota is relentlessly profit-conscious, and the whole point of the Toyota Production System is eliminating waste to improve both quality and cost. The discipline of competing for profit can actually drive better risk management, because the cost of catastrophic failure is real and visible. Toyota's long-term thinking isn't anti-profit — it's a different theory of how you sustain profit.
TEPCO wasn't a typical private company. It was a regional monopoly utility with guaranteed demand, regulatory capture, and no real competitive threat. Monopolies don't get the same evolutionary pressure to improve. And the regulator, NISA, failed at every turn — asking TEPCO to act, accepting “no” for an answer, and never escalating. The watchdog had no teeth. Or chose not to use them.
What TEPCO had was the combination of monopoly protection, regulatory capture, and asymmetric consequences for decision-makers. The executives who shelved the countermeasures bore none of the personal downside risk of a tsunami. They bore significant personal risk from acting — cost, alarm, possible shutdown. So the decision that was rational for them individually was catastrophic for everyone else.
That's a governance and accountability structure problem. You can find the same dynamic in government agencies, nonprofits, and public institutions.
The Onagawa Contrast
The sharpest counterpoint is the Onagawa Nuclear Power Plant, which was closer to the epicenter of the earthquake and tsunami. Onagawa had a sea wall 14 meters tall and successfully withstood the disaster. Same earthquake, same coast, different decisions.
The difference came down to one engineer — Yanosuke Hirai — who fought for a higher seawall against internal resistance and won. The margin between catastrophe and safety was whether the organization had the structural capacity to let the right technical voice prevail over short-term convenience.
What I See in Healthcare
I think about this constantly in the context of healthcare. The scale is different, but the dynamics are the same.
The hospital where everyone knows the handoff process is broken but nobody escalates it because the last person who raised a concern got labeled “not a team player.” The unit where near-miss reports have dried up — not because things got safer, but because people stopped reporting. The executive who says “safety is our top priority” at the all-hands meeting and then asks “why is this costing so much?” in the budget review. The compliance mindset of “we met the standard” substituting for the improvement mindset of “what are we missing?”
In healthcare organizations I've worked with, I've seen what happens when leaders start genuinely cultivating psychological safety. Reported incidents go up — not because more things are going wrong, but because people feel safe enough to speak up. And when that's combined with effective problem-solving, actual harm starts going down. Virginia Mason Medical Center modeled their “Patient Safety Alert” system on the Toyota andon cord concept, creating a way for people to call out problems without fear. The result was exactly what you'd hope for: more reports, fewer serious events.
At Toyota, the andon cord isn't just a tool. It works because of the culture behind it — the expectation that problems will be surfaced, the team leader response, the absence of blame. As Jeff Liker and Mike Hoseus wrote in Toyota Culture:
“Without trust in their employers, employees are reluctant to admit to the existence of problems and learn that it is safest to hide them.”
Mike Hoseus tells the story of accidentally scratching a car on the assembly line in Japan. His first instinct was to let it go. Nobody would notice. But he pulled the andon cord anyway, and the team leader came, gave him a tip on how to hold his tool differently, and didn't seem angry. At the afternoon group meeting, the whole team applauded him — not for scratching the car, but for admitting the mistake.
“I felt like a million bucks. And guess what I did the next time I made a mistake?”
Compare that to TEPCO, where raising a concern about tsunami risk could cost you your career.
The Systems That Have to Be Built
The documentary's last line is the one that stuck with me most:
“If you're asking whether the accident was the result of human error, it's more that human behavior played a role. Honestly, I don't think the world has learned this lesson properly even now.”
I think he's right. The principles that could have prevented Fukushima aren't exotic. They're unnatural — they have to be practiced, reinforced, and defended every day. Long-term thinking doesn't come naturally. Stopping production for quality doesn't come naturally. Treating problems as treasures doesn't come naturally. These are all upstream swims against deeply wired human tendencies toward short-termism, optimism bias, and conflict avoidance.
The question for any organization isn't whether you're susceptible to these failure modes. You are. The question is whether you've built the specific counter-systems that resist the natural drift:
Do problems flow upward without being filtered or punished? Does the organization act on weak signals or wait for proof of danger? Do the people with technical knowledge have a real path to influence decisions? Are leaders making decisions where they bear proportional consequences for being wrong? Is “safety first” a slogan on the wall, or is it backed by systems and behaviors that make it real?
Those are design questions. And they apply whether you're running a nuclear plant, a hospital, or a factory.
What's your organization's version of the safety myth — an orthodoxy that cannot be challenged?
