The Worst-case Scenario in Japan's Nuclear Crisis
The nuclear power plants in Japan weathered the earthquake itself without difficulty. The four plants nearest the quake's epicenter shut down automatically, meaning that the control rods were fully inserted into their reactor cores and the plants stopped producing power. This is normal operating procedure for these plants, but it meant that the first source of electricity for the cooling pumps was gone. That isn't a problem because the plant could get power from the power grid to run the pumps.
However, the power grid became unstable and it shut down as well. The second source of electricity for the cooling pumps was gone. That brought the backup diesel generators into play. Diesel generators are a robust and time-tested way to generate electricity, so there were no worries.
But then the tsunami hit. And unfortunately, the tsunami was far larger than anyone had planned for. If the backup diesel generators had been higher off the ground, designed to run while submerged in water or protected from deep water in some way, the crisis could have been averted. Unfortunately, the unexpected water levels from the tsunami caused the generators to fail.
This left the last layer of redundancy -- batteries -- to operate the pumps. The batteries performed as expected, but they were sized to last for only a few hours. The assumption, apparently, was that electricity would become available from another source fairly quickly.
Although operators did truck in new generators, they could not be hooked up in time, and the coolant pumps ran out of electricity. The fatal flaw in the boiling water design -- thought to be impossible to uncover through so many layers of redundancy -- had nonetheless become exposed. With it exposed, the next step in the process led to catastrophe.