Annals of Nuclear Energy 178 (2022) 109353

Contents lists available at ScienceDirect

Annals of Nuclear Energy

journal homepage: www.elsevier.com/locate/anucene

An overall safety concept for nuclear power plants

Juhani Hyvärinen a, Juhani Vihavainen a, Marja Ylönen b, *, Janne Valkonen c
a
Lappeenranta University of Technology, Finland
b
University of Stavanger, Norway and Technical Research Centre of Finland, VTT, Finland
c
Platom Oy, Finland

A R T I C L E I N F O A B S T R A C T

Keywords: A comprehensive understanding of the “safety” of nuclear reactors is essential for effective and efficient safety
Nuclear safety management by licensees and regulation by authorities. Nuclear reactors are designed subject to incomplete
Defence-in-depth knowledge of factors that affect their safety. The idea of defence-in-depth has evolved to combat the threat of the
Overall safety
unknown; it is implemented by means of technical artefacts, leading to a complex set of technical safety re­
Safety system design
Institutional strength-in-depth
quirements to prevent accidental radioactive releases. Nuclear power plants have thus become systems of technical
Sociotechnical systems view systems. Similarly, significant human and organizational aspects are involved in nuclear power plant construction
and operation; a nuclear power plant is an organization of organizations. Earlier studies have identified the need
for holistic understanding of safety and accounting for the technical and organizational aspects simultaneously
(Harvey and Stanton, 2014). This paper seeks to clarify the concept of defence-in-depth using the Overall Safety
Concept (ORSAC) developed at LUT (Hyvärinen et al., 2016), and the sociotechnical systems view in the nuclear
power industry context, extending defence-in-depth thinking to the organizational context in one transparent
framework. We show how organizational and technical aspects affect each other in the operation of nuclear
power plants. This paper paves the way for systematic modelling of how technical and organizational aspects
affect each other.

However, Hollnagel (2017) has referred to the paradox of safety. By that

1. Introduction
Safety is usually approached in the nuclear industry via a variety of
technical safety analyses, such as deterministic safety analyses, analyses
of material integrity, probabilistic safety analyses, or organizational
related analyses such as audits of a safety management system or as­
sessments of safety culture. In nuclear industry, the terms “safe” and
“safety” are understood as relative, not as absolute. Engineers and sci­
entists involved in material world processes well understand that it is
not possible to achieve “absolute” safety in the sense that unwanted
events (accidents) could be rendered complete absent. Therefore, in this
paper, “safe” and “safety” are to be understood as “producing acceptably
low risk” where “risk” is understood as the product of value lost and
likelihood of the event, and “acceptable” is understood as “not explicitly
challenged by the stakeholders”. (For an interesting discussion of
various senses of “safe”, and its potential to be used inconsistently, see
(Hansson, 2012).
The Society for Risk Analysis defines safety as: “safety as antonym of
risk (the safety level is linked to the risk level; a high safety means a low
risk and vice versa)” (The Society for Risk Analysis (SRA), 2018).
he refers that safety is approached from its negation, from the
perspective of risk and what can go wrong, instead of approaching it
from the perspective what goes well. Though, he admits that those two
approaches to safety are complementary.
Furthermore, accident investigations, in particular, have shown that
accidents are results of both technical and organizational factors and
that it is difficult to separate them (Harvey and Stanton, 2014; Leveson,
2004). This interconnectedness of technical and organizational factors
in accident analysis has given rise to a need for a holistic, systemic,
sociotechnicalunderstanding of nuclear safety that this paper represents
(Dekker et al., 2011; Harvey and Stanton, 2014; Leveson, 2012). Simi­
larly, designing, licensing, and constructing a nuclear power plant is a
huge undertaking in which various stakeholders (designers, suppliers,
manufacturers, end-users, regulators, etc.) exchange large amounts of
information on many levels of detail. The vast amount of details
involved seems to obscure the overall goals of achieving safe and eco­
nomic plants in the minds of the many stakeholders involved.
As an example, two well-known nuclear power plant projects; in
Finland (Olkiluoto 3) and in France (Flamanville 3) have been signifi­
cantly delayed due to such issues. Generally speaking, advances in

* Corresponding author.
E-mail address: Marja.k.ylonen@uis.no (M. Ylönen).

https://doi.org/10.1016/j.anucene.2022.109353
Received 14 January 2022; Received in revised form 3 July 2022; Accepted 25 July 2022
Available online 31 July 2022
0306-4549/© 2022 Elsevier Ltd. All rights reserved.
J. Hyvärinen et al. Annals of Nuclear Energy 178 (2022) 109353

Abbreviations NUREG US Nuclear Regulatory Commission Regulation

ORSAC Overall Safety Concept
US EPR system definitions. Some common abbreviations apply to PDS Primary Depressurization System
NuScale as well PRT Pressurizer Relief Tank
AOO-DBA Anticipated Operational Occurrence – Design Basis PSRV Pressurizer Safety Relief Valves
Accident RCB Reactor Containment Building
CCWS Component Cooling Water System RCCA Rod Cluster Control Assembly
CGCS Combustible Gas Control System RCPB Reactor Coolant Pressure Boundary
CHF Critical Heat Flux RHRS Residual Heat Removal System
CIS Containment Isolation System RPV Reactor Pressure Vessel
CMSS Core Melt Stabilization System SAHRS Severe Accident Heat Removal System
CMSS Core Melt Stabilization System SAM Severa Accident Management
CVCS Chemical and Volume Control System SG Steam Generator
CWS Circulating Water System SoS System of Systems thinking
DiD Defense in Depth STS Sociotechnical systems view
EBS Extra Borating System UHS Ultimate Heat Sink
EFWS Emergency Feedwater System U.S NRC United States Nuclear Regulatory Commission
EFQM European Foundation for Quality Management WANO World Association of Nuclear Operators
ESWS Essential Service Water System WENRA Western European Nuclear Regulators Association
IAEA International Atomic Energy Agency
NuScale systems, additional list
INSAG International Nuclear Safety Group
CFDS Containment Flooding and Drain System
IRWST In-containment Refueling Water Storage Tank
CIV Containment Isolation Valves
ISiD Institutional Strength-in-Depth
CNV Containment Vessel
LHSI Low Head Safety Injection
CRA Control Rod Assembly
LWR Light Water Reactor
DHRS Decay Heat Removal System
MFWS Main Feedwater System
ECCS Emergency Core Cooling System
MHSI Medium Head Safety Injection
RCCWS Reactor Component Cooling Water System
MSRT Main Steam Relief Train
RSV Reactor Recirculation Valve
MSSS Main Steam Supply System
SCWS Site Cooling Water System
NGO Non-governmental organisation

technology, more stringent safety requirements, more complex tools for
designers, and the large number of suppliers with their sub-suppliers are
among the reasons cited for the ever increasing complexity of projects. A
huge amount of documentation is produced, from which the “big pic­
ture” of the plants’ safety is difficult to discern. This is one reason for
investigating overall safety and seeking means to tackle the challenge of
complexity and the volume of information.
There is no consensus yet about the definition of an overall safety
concept. Instead, a wealth of safety principles exists in the nuclear field,
such as the principles of defence-in-depth, safety culture, and resilience.
Methods, such as deterministic safety analyses, probabilistic risk (or
safety) analyses, and failure and effect mode analyses are used to verify
that concepts such as safety functions, safety margins, conservatism,
single-failure criterion, and fail-safes are implemented, justifying the
fulfilment of stated safety goals (whether this on the most rudimentary
level refers to acceptance criteria for design parameters, or on the
highest level whether it means protection targets for the general popu­
lation). In passing, we note that regulators often avoid explicit assess­
ment whether a design, plant or activity is “safe”; rather, they prefer to
conclude that the item “complies with applicable regulations”. This is an
implicit endorsement of the relativity of all engineered safety.
All these principles, concepts and methods can be used as a basis for
overall safety thinking. Often there is confusion as to what principles,
concepts and methods are fundamental and which are not. Sometimes
one principle can be expanded to cover other principles, thus becoming
an overarching principle (Leveson, 2012); the best example being the
idea of defence-in-depth, which has recently been expanded to in­
stitutions (synonymous to organizations) (Insag-27., 2017; Ylönen et al.,
2017).
Furthermore, theories on complexity, sociotechnical systems (STS),
as well as system of systems (SoS) have provided theoretical and con­
ceptual incentives to approach safety from a holistic perspective (Emery
et al., 1960; Harvey and Stanton, 2014; Dekker et al., 2011; Ylönen
et al., 2017; Aven and Ylönen, 2018). When we describe a sociotechnical
systems view, we refer to the interconnectedness and complexity of
social and technical systems (Leveson, 2004; Kleiner et al., 2015).
In this paper, we propose to integrate the many aspects of nuclear
safety in a comprehensive but transparent framework of overall safety.
The development starts from the fundamental principle of defence-in-
depth, as used in the functional and structural interpretations of nu­
clear safety design. We propose a framework in which all the relevant
concepts can be organized so that their roles and interrelations are clear.
Then we proceed to consider the nuclear community as an organization
of organizations and discuss the concept of institutional strength-in-
depth. Finally, we discuss overall safety from the perspective of socio­
technical systems.
After introduction, Chapter 2 discusses defence-in-depth, which is a
fundamental concept in nuclear safety. In Appendix 1, we give a brief
history of the evolution of the concept. Chapter 2 describes current in­
terpretations of the defence-in-depth approach as (1) structural and (2)
functional design philosophy. We also seek to clarify the roles of safety
margins, which we consider as a metric for the confidence that a given
(usually structural) barrier will withstand its design loads, and system
design requirements regarding redundancy, diversity and physical sepa­
ration, and fail-safe design, which we consider to be properties that
affect the reliability of safety functions. Chapter 2 concludes with a
proposal for a framework to graphically illustrate the interrelation of the
defence-in-depth levels, safety functions, and their design criteria.
In Chapter 3, we apply the model to actual reactor designs, showing
that the degrees of independence between defence lines can vary a great
deal. This sheds light on where real independence can be meaningfully
gained, and thereby helps to focus design and regulation development
efforts where actual benefits are obtainable. We then proceed to expand
the discussion from technical safety to organizational safety. A nuclear

2
J. Hyvärinen et al.
power plant can be viewed as a technical system of systems; analo­
gously, the organizations involved in its construction and later operation
interact with each other, constituting an organization of organizations.
We also deal with the concept of institutional strength-in-depth, which is
a relatively novel conceptualization of the robustness of national nuclear
communities in terms of safety. Then, in Section 3.4 we deal with the
socio-technical systems view and system of systems thinking and discuss
the requirements that these concepts set on the further development of
overall safety framework.
Finally, Chapter 4 discusses the significance of our main findings,
and Chapter 5 provides a brief summary of the main points of this paper.
2. Defence-in-depth as conceptual framework
This Chapter describes defence-in-depth as defined in the nuclear
safety related international literature, with an emphasis on the latest
IAEA top-level safety guidance, INSAG-12, published in 1999 (INSAG,
1999). This is the first revision of the classic 75-INSAG-3 (1988). By the
time of INSAG-12, the defence-in-depth level definitions in the IAEA
INSAGs had stabilized, indicating that the (technical) concept for
functional levels had matured. The latest IAEA safety system design
guidance, SSR-2/1 Rev. 1 (2016), also follows this definition.
Noteworthy features of the INSAG-12 defence-in-depth definition
(INSAG, 1999);Section 3.2) are the following:
1. Defence-in-depth “underlies the safety technology of nuclear power”
but additionally it is clearly recognized as relevant for organizational
aspects as well (§44).
2. The operative definition for defence-in-depth is in terms of “several
levels of protection” which include “successive barriers” preventing
the release of radioactivity. Protection of barriers and “further
measures to protect the public and environment” are foreseen in case
the barriers are not fully effective (§46).
3. The barriers are primarily physical and “may serve operational and
safety purposes, or may serve safety purposes only” (§48).
4. Functional defence-in-depth is presented as “The strategy for defence
in depth is twofold: first, to prevent accidents and second, if pre­
vention fails, to limit the potential consequences of accidents and to
prevent their evolution to more serious conditions”, which is struc­
tured in five levels, four directly pertaining to plant technology, the
fifth focusing on off-site measures.
5. Treatment of the organizational aspect is rather more sketchy, as
obvious in (§50): “Human aspects of defence in depth are brought
into play to protect the integrity of the barriers, such as quality
assurance, administrative controls, safety reviews, independent
regulation, operating limits, personnel qualification and training,
and safety culture” but nevertheless the independent layers of per­
formers, verifier/reviewers and independent regulators are clearly
recognisable.
6. The design of barriers and safety systems involves three elements
(§50): “…prevent undue challenges to integrity of physical barriers,
… prevent the failure of a barrier if it is jeopardized, … prevent
consequential damage of multiple barriers in series”; this chain
implicitly raises the notion of safety margin as the measure for how
close to failure the challenge brings the barrier.
7. For safety systems “to the extent practicable … the different safety
systems … are functionally independent under accident conditions”
(§50).
In Section 2.1, we discuss in more detail:
• The structural interpretation of defence-in-depth concerning the
barriers.
• The concept of safety margin in relation to the integrity of the
barriers.
3
Annals of Nuclear Energy 178 (2022) 109353
• The functional interpretation of defence-in-depth concerning the
defence levels. Note that a defence-in-depth level is not equal to a
safety function. Safety functions are implemented on multiple (often
all) levels.
• The role of redundancy, diversity, physical separation, and fail-safe
design as means to increase the reliability of the safety function
implementations.
Finally, we propose that the defence-in-depth levels and funda­
mental safety functions are organized as a matrix framework, upon
which any particular plant safety architecture can be overlaid. This
matrix framework was first proposed in the ORSAC study (Hyvärinen
et al., 2016) and is therefore called the ORSAC framework.
2.1. Structural and functional interpretations
The ideal structural interpretation of the defence in depth approach,
with three fundamental barriers, fuel cladding, reactor system and
containment structure, is illustrated in Fig. 1 below. The fuel matrix and
the physical distance between the plant and the population are also
included, although they can be considered less fundamental than the
fuel cladding, the reactor system and the containment structure.
In reality, physical mechanisms that can damage the fuel cladding
also involve damage to the fuel matrix (e.g. pellet cracking and swelling,
causing pellet-cladding mechanical interaction); parts of the reactor
system either penetrate the containment structure (e.g. let-down and
makeup systems in PWRs; reactor water clean-up and standby cooling
systems in BWRs), or form part of the containment pressure boundary
(steam generator tubes in PWRs). Therefore, the physical barriers cannot
be completely independent of each other.
In the structuralist view, barrier integrity is the item of most interest.
In order to design the barriers, the physical loads used in dimensioning,
in addition to the associated acceptance criteria and desired safety
margins, have been specified. This is illustrated in Fig. 2.
In practice, for every barrier many different challenging loads can be
identified (postulated), and also many barrier failure modes. For design
purposes, loads are typically divided according to their likelihood of
occurrence into categories such as normal, transient, and accident loads.
For example, the fuel cladding in normal operation is subject to
corrosive loads on both inside and outside surfaces. The cladding tem­
perature in normal operation is not a limiting factor. In transient con­
ditions, dramatic cladding overheating due to exceeding critical heat
flux must be avoided. In accident situations, the cladding temperature
becomes the variable of main interest, because it controls both the rate
of corrosion in accidental conditions and the mechanical strength of the
ductile cladding material. Therefore, the relative significance of
Fig. 1. The idealistic notion of the structural physical barriers to prevent
radioactive release.
J. Hyvärinen et al. Annals of Nuclear Energy 178 (2022) 109353

Fig. 2. The design of a barrier involves specification of loads and safety margins against relevant acceptance criteria. It also recognizes that even a properly designed
barrier may still fail to contain the load, therefore mitigation against barrier failure must be provided. For example, fuel overheating in an accident could damage a
small fraction of fuel rods, even when the peak cladding temperature remains below statutory limits.

physically different loads varies depending on the initiating event of
interest.
2.1.1. Role of safety margins against barrier failure
As described in the NEA Safety Margins Action Plan (SMAP) report
(NEA, 2007), safety margins were traditionally understood to have been
introduced in recognition of the fact that uncertainty exists concerning
the safety variable value at which damage occurs. By setting the regu­
latory acceptance limit “conservatively” with respect to the point of
damage onset (i.e. the limit being less than the damage threshold), a
sufficient margin should be assured in design basis accidents. It should
be noted that the safety margin concept applies explicitly to either
barrier or system losses. Therefore, in a complex facility, such as a nu­
clear power plant, there will be as many safety margins as there are
barriers or systems whose loss is considered to be a safety problem.
Furthermore, for each barrier or system, a separate safety margin
will exist for each damage mechanism that could lead to the loss of the
barrier or system. Therefore, this definition requires a clear identifica­
tion of the safety variables, and how they relate to barrier or system
function losses.
A traditional safety margin has been illustrated well in IAEA
TECDOC-1791 (IAEA, 2016), p. 39, shown here in Fig. 3. In the topmost
box, “value of parameters that can produce a cliff-edge effect” can be
interpreted as a “barrier failure” meaning a barrier failure representing
falling off the cliff.
In reality, the knowledge of both the barrier capability and the load
are subject to uncertainty. If plenty of data is available on both, then one
can estimate the safety margin as a margin to damage. This is illustrated
in Fig. 4.
As shown in Fig. 4, barrier failure is statistically possible even when
the median load is much lower than the median capability. This is, of
course, well known and is manifested in design criteria such as the 95/
95 criterion for exceeding a critical heat flux (CHF) in the anticipated
operating occurrences (there must be a 95 % degree of confidence that
95 % of the fuel rods do not undergo a CHF).
The notion of “conservatism” refers to either the load being artifi­
cially exaggerated or the capability artificially reduced to cover (sto­
chastic) uncertainty in either, or both. Structural defence-in-depth
concerns the presence of successive barriers, not their strengths relative
to the loads (or each other). Therefore, we suggest that adding or
removing conservatism in the barrier design will not affect the defence
in depth, it only changes the confidence that the barrier can withstand
its design load.
We also note in passing that such statistical (stochastic, aleatory)
uncertainty about the parameter values is by no means the only signif­
icant source of uncertainty. Much more interesting and challenging is
the epistemic uncertainty, that is, sheer lack of knowledge that would
have been relevant—e.g. unidentified failure mechanisms or physical
processes that have escaped attention (Hyvärinen, 1993; Hyvärinen,
1996; Vihavainen, 2014). Defence-in-depth philosophy was developed
specifically to address the lack of thorough knowledge of mechanisms
that could cause some of the physical barriers to fail.
2.1.2. Functional interpretation
Following the Principles of INSAG-12, the IAEA has defined the
functional levels of defence-in-depth in the Specific Safety
Requirements-2/1 Rev 1 (Fig. 5) (IAEA, 2016). There are two main
levels: (1) “Operational states” that consists of “Normal operation” and
“Anticipated operation occurrences”, (2) “Accident conditions” that is
divided into “Design basis accidents” and “Design extension conditions”

Fig. 3. IAEA TECDOC-1791 (IAEA, 2016), p. 39, view of a safety margin.

4
J. Hyvärinen et al. Annals of Nuclear Energy 178 (2022) 109353

Fig. 4. For most physical loads and physical barriers, both the magnitude of the load and the barrier capability are statistical quantities and a finite probability of the
load exceeding the capability is inevitably present, even when the median load (A) is far below the median capability (B).

Fig. 5. IAEA SSR-2/1 Rev 1 (2016) (IAEA, 2016), Functional defence-in-depth. There are five levels affecting the design of the plant, but for historical reasons, the
level numbering runs from 1 to 4, with Design basis accidents and Design extension conditions without significant fuel degradation being labelled levels 3a and 3b,
respectively. The nominally fifth level of DiD refers to emergency preparedness measures, which mainly take place outside the plant.

the latter of which is subdivided into two categories: “Without signifi­
cant fuel degradation” and ”With core melting”.
A key feature of the defence line representation shown in Fig. 5 is the
decreasing likelihood of invoking a level (or probability of entering an
event category), when moving from left to right across the levels. It is
certain that a plant will experience “normal operation”; by convention,
anticipated operational occurrences are postulated to take place once in
the plant lifetime, generally with frequency of > 1e-2/a; design basis
accidents would be expected to be observed only a few times in a large
population of plants; and so on. The two generally accepted interna­
tional frequency limits seem to be the 1e-2/a for anticipated operational
occurrences and 1e-5/a as a PRA target value for design extension
conditions leading to the core melting. As an aside, we note that PRA
values for core damage frequencies generally seem to be somewhat
lower than actual experience (Ha-Duong and Journé, 2014). However,
the exact value of the limiting frequency as such is not crucial; important
is the distinction between accidents without core melt (where massive
damage to fuel integrity is avoided) and with core melt (where fuel
integrity is largely lost). The latter tends to challenge the containment
function more severely than the former.
The above IAEA definition has also served as the foundation of the
more elaborate WENRA defence-in-depth definitions and has become
de-facto state-of-the-art. The exact definitions of the defence-in-depth
levels are provided in Appendix 2.
In their recent discussions of defence-in-depth for future reactors,
WENRA has insisted that the levels of defence required under the
defence-in-depth principle should be as independent of one another as is
reasonably achievable. This sounds reasonable but comes with a very a
demanding built-in assumption that the defence levels are indeed
physically separable from each other. In reality, this is true to a limited
degree only, because the same equipment gets credited in multiple
defence lines. For instance, there is no design, operating or planned,
where there would be five physically independent means to control the
reactor power level. Therefore, we conclude that it would be best to
explicitly recognize this fact of life.
Note also that the functional defence-in-depth presented in Fig. 5
requires that postulated initiating events be allocated in appropriate
defence lines. This is done based on the expected event frequency; one
can envision a decreasing frequency axis running from left to right, so
that normal operation has the highest frequency (~1) and the Design
extension condition With core melt (hopefully) very low frequency. This
defence-in-depth logic allows design requirements to be established to
manage events in each defence line (event category). The design pre­
sumes that event identification and frequencies remain stable; during
plant operation, operational events may challenge these notions. Either
the event frequency may prove to be so much higher (or lower) that the
event needs to be moved to a different category (defence line), or the
event may present previously unidentified but significant safety chal­
lenges. For good examples of the latter, see the discussion on boron
dilution in PWRs in (OECD/NEA, 1996) and thermal insulation behav­
iour interference with emergency cooling during loss-of-coolant acci­
dents discussed in e.g. (OECD/NEA, 2013). Root cause analysis of
operating events generally is desirable to ensure that this foundation of
nuclear safety remains robust.
2.1.3. Safety functions and their design requirements
The IAEA has defined the fundamental safety functions in the Spe­
cific Safety Requirements − 2/1 Rev 1 (IAEA, 2016) as:
“Fulfilment of the following fundamental safety functions for a nu­
clear power plant shall be ensured for all plant states:
(i) control of reactivity;
(ii) removal of heat from the reactor and from the fuel store; and

5
J. Hyvärinen et al.
(iii) confinement of radioactive material, shielding against radiation and
control of planned radioactive releases, as well as limitation of acci­
dental radioactive releases.”
The IAEA has illustrated the relation of individual safety functions to
an individual level of defence in TECDOC-1570 (IAEA, 2007). This
interrelation is shown in Fig. 6. This view invites an expansion to include
the same figure at all levels of defence and for all safety functions, which
we will discuss in Section 2.6.
In order to provide confidence in the engineered safety features
(systems, structures, and components), SSR-2/1 Rev 1 requires them to
be designed with adequate redundancy, diversity, and physical separation
provisions. All these design features are there to increase confidence in
successful execution of the safety function in case it is needed. Often it is
required to design a safety function fail-safe; this can be done if a safe
direction for system failure can be unequivocally identified. The capa­
bility to rapidly shut down an operating reactor is a typical example of
fail-safe design: control rods causing the shutdown are kept out of the
reactor core by an active system, and should the system fail, e.g. due to
lack of motive power, the rods will enter the core by gravity or stored gas
pressure, shutting the reactor down.
Redundancy is a means to combat random equipment failures. It is
therefore a generalization of the “single failure criterion”, the postulate
that in the case of need, any individual component that would need to
function fails to do so. This leads to the so-called N + 1 failure criterion,
with N understood as the minimum number of affected components
required to fulfil the function in question. N + 1 capable system
Fig. 6. Example of how a safety function relates to a level of the defence-in-depth (top) approach according to TECDOC-1570 (IAEA, 2007), p 23. Note that the Line-
Of-Protection (LOP) in this figure relates to prevention or control of mechanisms that are capable of challenging the proper execution of the safety function.
6
Annals of Nuclear Energy 178 (2022) 109353
configurations are typically 2 × 100 % or 3 × 50 %.
Some regulatory systems have expanded the redundancy require­
ment to include the postulate of “concurrent maintenance” on another
component, leading to an N + 2 failure criterion. The N + 2 criterion
increases the pieces of safety equipment (safety trains) in the plant, but
also enables on-line maintenance of safety equipment, thereby
providing an availability advantage. N + 2 capable safety system con­
figurations are typically 3 × 100 % or 4 × 50 %.
Diversity is a means of combating common mode failures due to
reasons which are internal to the safety equipment. Redundant systems
cope well with individual random failures, but are susceptible to com­
mon mode failures, which can knock out all similar pieces of equipment
in one stroke. Diversity is implemented by providing the same func­
tionality using different physical principles and different physical
processes—the most typical example being the diversification of the
control rod scram in light water reactors by carrying out a boron solute
injection into the reactor.
Physical separation is a means of combating common mode failures
triggered by external conditions (materialising hazards) such as fires or
floods. To be useful, physical separation has to pertain to redundant
systems, so that redundant trains (or components) are separated from
each other so that a hazard affecting one cannot propagate to another
during its mission time.
J. Hyvärinen et al.
2.2. Institutional Strength-in-Depth (ISiD) as a form of organizational
DID
After the Fukushima accident and its lessons learned, the IAEA’s top-
level expert group, the International Nuclear Safety Advisory Group
(INSAG), introduced the concept of institutional strength-in-depth
(ISiD) (Leveson, 2012). ISiD is to a large degree analogous with
defence-in-depth and aims at providing tools to construct a robust
overall nuclear safety system at a national level. The concept is based on
the idea that it is not enough that there are good technical tools and
safety standards, but these standards need to be implemented efficiently.
The ISiD refers to a network of organizations, such as governments,
industry, regulatory bodies, media and NGOs, and the interfaces be­
tween them that assure that the tools and safety standards are efficiently
applied. Fig. 7 provides an illustration of how the core actors contribute
to nuclear safety. For instance, strong self-regulation in the context of
industry refers to internal barriers such as experienced staff, strong
safety management systems, a vivid safety culture as well as peer pres­
sures from national and international industry (e.g. WANO re­
quirements). In addition, regulators’ internal barriers consist of
regulator capabilities and competence, organizational structure, inter­
national peer pressure derived e.g. from the IAEA reviews (Leveson,
2012).
ISiD builds on the existing safety principles, such as the safety cul­
ture, and the defence-in-depth principle and is thereby extended from
the technical context to organizational context. The philosophy of
defence-in-depth means in the organizational context each of the key
organizations i.e. industry, regulators, government, and stakeholders in
the nuclear domain form an independent safety layer or barrier which is
further strengthened by multiple internal barriers, such as competent
actors, safety management systems and a vivid safety culture (INSAG,
1999). Openness, transparency, and a questioning attitude should pre­
vail between the organizations. As such, ISiD complements the defence-
in-depth thinking. Furthermore, the INSAG-27 report suggests that the
IAEA should develop formal ISiD guidelines.
ISiD is created for the assessment of the robustness of the national
nuclear community. In this sense, ISiD is a useful concept: it brings into
the same picture the relevant organizations and their roles and re­
sponsibilities that need to be fulfilled in order to maintain and improve
the nuclear safety. ISiD gives a name to a phenomenon which is relevant
to the overall picture of national nuclear safety. Despite its relevance as a
Fig. 7. Interrelation of the nuclear industry, regulators and stakeholders according to INSAG-27 (Leveson, 2012);;Fig. 1.
7
Annals of Nuclear Energy 178 (2022) 109353
concept, ISiD is not much differentiated from the safety culture concept,
and it is not yet a theoretically well-developed concept (NEA, 2007).
Therefore, ISiD needs to draw on the safety culture and organizational
theories if it aims to provide deeper insights into inter-organizational
relations, such as the internal and external barriers of organizations.
Results of country-specific forums can be used to identify the
strengths and weaknesses in the mindset and practices of the national
nuclear community (OECD NEA, 2018; OECD NEA, 2019). These
include the technical rigour with an emphasis on pragmatism, facts, and
science that contributes to thorough problem solving from a technical
point of view, but which can be blind towards human aspects (OECD
NEA, 2019), or overconfidence in a country’s own national approach,
such as was noted after the fact in Japan (Report of the Fukushima
Nuclear Accident Independent Investigation Commission and Diet,
2012). Thus, identification of national cultural features can be used to
improve the robustness of a national nuclear community.
It is good to note that even though it is possible and important to
recognize national cultural features or a mindset which is common to
different organizations in the nuclear field, these organizations have also
their own internal goals and interests which may differ. Even within a
single organization there are different subcultures (Schein, 2004; Schein
and Schein, 2016), which increase the complexity of organizational life.
Therefore, in addition to the need to recognize national cultural fea­
tures, also various organizational aspects are important to identify when
trying to create an overall safety framework and to comprehend safety
from a holistic viewpoint. Therefore, an overall safety framework needs
to recourse also to theories of social science, safety culture, and orga­
nizations which provide thorough approaches to detect human and
organizational factors from different angles, from societal, inter-
organizational, organizational, individual, structural and from ideal
(mindset) viewpoints. It depends on the context, whether general or
more detailed analyses of organizations are needed.
2.3. The overall safety and sociotechnical systems view
In this Chapter we deal with overall safety related concepts, such as
the sociotechnical systems view and system of systems view and review
the related demands for the overall safety framework. We also provide a
tentative definition of overall safety and a visualization of it. These as­
pects contribute to further improvement of the overall safety
framework.
J. Hyvärinen et al.
The Framework Plan of the Finnish Research Programme on Nuclear
Power Plant Safety (SAFIR2022) stresses overall safety and a systemic
approach to safety as relevant research topics. However, there is no
consensus about the definition of the overall safety concept; the term
was first used in the defence community to refer to the wholesome
involvement of society in national defence activities. In the academic
literature, the concept of overall safety is rarely used. Instead, other
terms such as a holistic understanding of safety, a sociotechnical systems
view (STS), or system of systems thinking (SoS) are more commonly
used (Dekker et al., 2011; Harvey and Stanton, 2014; Leveson, 2004;
Kleiner et al., 2015).
By a sociotechnical systems view (STS) we refer to the interconnec­
tedness of social and technical systems (Ylönen et al., 2020; Leveson,
2004; Kleiner et al., 2015; Ylönen et al., 2017; Wahlström, 2018). STS
embraces four dimensions: human, technical, organizational, and
external environment, including for instance national cultural, political,
regulatory, economic, technological, and geo-political environments.
Intrinsic complexity arises from the multidimensional interactions be­
tween the components (Dekker et al., 2011; Harvey and Stanton, 2014).
Close to the sociotechnical systems view is system of systems thinking
(SoS), which refers to a large supersystem that consists of subsystems
which are large and complex, and which function autonomously (Har­
vey and Stanton, 2014). Note here the analogy between nuclear power
plant architecture and systems architectures discussed above in Section
2.1. In social systems, the subsystems can have their own goals, but they
need to collaborate with other subsystems and to achieve the goals of
SoS, just as engineered safety systems need to function together to
implement their safety functions.
We can think of nuclear power plants as systems of engineered sys­
tems and as sociotechnical systems consisting of independent sub­
systems with their own goals. Interoperability is the key to successful
system integration. However, this brings challenges from the safety
perspective, as it inevitably means that there are increased interfaces
and interactions between multiple components (Harvey and Stanton,
2014).
There are some identified challenges regarding the system of systems
view, particularly from the organizational and safety culture perspec­
tive. These include the network structure, complexity and external in­
fluence, the emergent whole (which means that the system is in a state of
constant change due to the unpredictable interconnectedness of
different subsystems, and their outcome (Dekker et al., 2011), infor­
mation transfer across boundaries, continual change, and culture (Har­
vey and Stanton, 2014). For instance, in the network of organizations, it
is difficult to create a coordinated safety culture, i.e. a similar mindset
and practices regarding safety.
Fig. 8. Visualization of overall safety. The overall safety of nuclear power plants is affected by macro-, meso- (organizational-level) and micro-level factors.
8
Annals of Nuclear Energy 178 (2022) 109353
With regard to the development of overall safety frameworks, STS
and SoS provide some aspects to reflect upon. Comprehension of overall
safety should include technical, human, organizational, and the orga­
nization’s external environment including global and national aspects.
In the context of Fig. 8, we provide examples of how organization’s
external environment has implications on organization’s safety.
By overall safety we refer to the outcome of safe functioning of a
nuclear power plant (as a technical and socio-technical entity), and safe,
sustainable, and successful functioning of licensee’s organization, which
external actors and factors also affect.
Overall safety is visualized in Fig. 8 that borrows ideas from the
quality management of an organization’s ecosystem (EFQM), socio­
technical understanding of safety (Harvey and Stanton, 2014; Ylönen
et al., 2017) and studies on organizations (Schein, 2004).
In Fig. 8 overall safety is an outcome of interaction between macro-,
meso- and micro-level phenomena. Macro-level factors are external to
the license holder organization. Macro-level factors include global- and
national-level societal, political, economic factors, such as economic
depression, and geopolitical uncertainties, but also sociotechnical fac­
tors such as technological development, and the availability of raw
materials and spare parts. The list is not exhaustive, but it shows some
factors that may have influence on overall safety over time. License
holder’s organization is affected by external factors and it needs to
respond to them e.g., by creating new policies and strategies, or by
changing the organizational structure, and these actions may have safety
implications. Hence, macro-level factors can have direct or indirect ef­
fects on organizations and safety. Furthermore, new technologies may
have both positive implications on safety, but they also may increase
security risks with safety implications. When a technological paradigm
changes, it is normal that some old failure modes disappear, while new,
previously irrelevant, failure modes emerge. Appendix 3 provides a
recent example of such an event describing an incident that happened in
Forsmark nuclear power plant. Therefore, the external factors related to
the organization are worth considering in terms of overall safety.
The meso level refers to the organizational level that is applicable to
the license-holding organization, regulatory body, and suppliers. This
meso level consists of four dimensions which also are mutually con­
nected: (1) organizational structures such as organization’s goals and
strategies, as well as resources, decision-making structures, and the
management system, which guides actions and practices within the or­
ganization; (2) social aspects which refer to interaction and action
within an organization to which hierarchies, power relationships, and
various expectations regarding individual actions’ influence; (3) cultural
aspects, such as shared norms, beliefs, and values, which also affect the
social action in an organization: (4) technical aspects which mainly
J. Hyvärinen et al.
relate to technologies of nuclear power plants’ systems, structures, and
components which require human competences and human-technology
interactions which organizations’ structures, cultures and hierarchies
also affect.
The meso level of an organization can easily be depicted as a
sequence of layers (defense barriers) surrounding the primary activities
(Harvey and Stanton, 2014):
1. the primary activity, e.g., plant operation;
2. owner oversight to verify that company performance goals (safety
indicators among them) are being met;
3. statutory or regulatory reviews and inspections to verify that safety
regulations continue being met;
4. national administrative oversight of regulator activities; and finally,
5. political and general public attention to the performance of all the
other actors (1 through 4).
The micro level refers to individual actions. The organization (meso
level) enables and constrains the actions and performance of individuals
in terms of safety. For instance, changes in organizational structure may
increase the workload of some individuals, thus affecting their ability to
carry out their tasks in a prudent way. Individuals are carriers of orga­
nization’s structures and culture, but they are not just passive carriers,
but also actors who maintain, question, and change structures and
practices in the organization.
The macro, meso and micro levels are thus in continuous interaction
and cannot be completely isolated from each other. Fig. 8 illustrates the
levels of overall safety, but it does not examine the sociotechnical in­
teractions between them, or between different organizations, which
have different roles, responsibilities, expectations, and strategies. These
aspects create complex interactions between them. In addition, as the
sociotechnical aspect is defined as the interconnectedness and
complexity of social and technical systems (Leveson, 2004; Kleiner et al.,
2015), the overall safety framework needs to be improved so that it can
deal with the interconnectedness of technical and organizational factors
simultaneously. The case in Section 3.4 describes the relationships be­
tween the macro-, meso- and micro-level factors in the context of the
nuclear sector.
Adopting a sociotechnical systems view, i.e. overall safety, also poses
challenges for safety regulation. Below are some reflections on what
sociotechnical safety regulation would entail (Ylönen et al., 2017; Le
Coze et al., 2017):
1. It is necessary to go beyond compliance with regulations since
compliance alone does not guarantee safe performance in complex
emerging situations.
2. Sociotechnical safety regulation would require broad cooperation
between different experts, so that various views and alternatives
would be taken into account.
3. Sociotechnical regulation would require understanding of macro-
level economic and political aspects, as well as meso-level in­
terfaces within an organization and between organizations, not to
mention micro-level individual workloads. Heavy workloads may
have negative effects on safe performance. Obtaining a broad holistic
understanding of the functioning of the organization can be assisted
by visualization of overall safety.
3. Developing an overall (design) safety framework based on
DID
3.1. The ORSAC Framework—A large plant example
The foundation for the framework is to apply a functional defence-in-
depth approach, which posits that there are multiple defence levels in­
dependent of each other. The overall safety concept arises from the
fundamental recognition that each safety function has to be provided on
9
Annals of Nuclear Energy 178 (2022) 109353
each line of defence-in-depth. Therefore, defence-in-depth levels can be
viewed as columns in a matrix where the rows represent the three
fundamental safety functions. The elements of the matrix can then be
filled in, indicating which safety systems perform each safety function
on each defence level. This representation provides an overview at one
glance of the interrelations of systems and components credited with
implementing the safety functions. Therefore, we call this the Overall
Safety Framework.
An example of an overlay of the safety functions across the defence
levels is shown in Fig. 9 for a typical large LWR, using the IAEA defence
lines for clarity.
As is obvious from.
Fig. 9, the same physical components (control rods, process systems,
containment structure) are credited on multiple defence lines. The five
levels of defence are independent of each other only in theory. In
practice, there are at most two or three levels of defence that can be
credibly implemented by physically independent means. If two separate
ways of dropping the control rods (breaking the holding current supply)
are provided, then clear functional separation can be achieved between
the levels AOO-DBA. Another potentially clear separation line can be
implemented between design extension cases without a core melt and
with a core melt, by requiring that all systems dedicated to the latter have
no functions for the former. However, the containment structure inevi­
tably has to be credited in both defence lines; it is not practicable nor
necessary to envision separate DBA and Severe Accident containment
structures. In fact, the very rationale for building a containment in the
first place was to protect against large release of radioactive materials
from a massively damaged reactor core.
3.2. The ORSAC framework–an SMR example
It is possible to construct an ORSAC model based on the NuScale
small modular reactor on the basis of material publicly available on the
U.S. NRC website (Application Documents for the NuScale Design,
2022). This has been done in.
Fig. 10, using the IAEA defence-in-depth levels and fundamental
safety functions:
- Defence lines: normal operation, anticipated operational occur­
rences, design basis accidents, design extension conditions, core melt
accidents
- Fundamental safety functions: criticality control, heat removal,
containment of radioactive materials.
As is obvious, also in the case of an SMR it is not realistic to expect
more than three physically independent levels of defence. In fact, for a
hypothetical core melt accident, the containment structure would be
credited as a core catcher, therefore only two independent structures can
be distinguished (the process systems and the containment structure).
The main advantage of the small size of SMRs is the relative ease of
decay heat removal from the reactor and the containment structure. For
fuels similar to the fuel used in large reactors, the reactor power de­
creases as cube of linear dimensions, but the enveloping surfaces
decrease in the square of linear dimensions–therefore heat fluxes
through the enveloping surface decrease linearly with linear di­
mensions. Therefore, small SMRs may be able to remove decay heat
adequately without separate dedicated engineered safeguard systems by an
inherently natural processes of convection. Thus, the safety function is
fulfilled but dedicated systems with their complex design and imple­
mentation requirements, can be eliminated. However, the physical
structures involved still get credited over a broad range of defence lines!
As can be seen by comparing Figs. 9 and 10, the ORSAC framework
provides a quick overview of the whole safety justification of the con­
cepts, and highlights the difference between very complex active design
(the US EPR) and much simplified passively safe design (NuScale).
J. Hyvärinen et al.
Fig. 9. Three main safety functions overlaid across the defence lines for the US EPR system configuration (Turunen, 2020). Note that almost every system gets
credited on more than one defence line; there is some, though incomplete, separation between Operational and Accident conditions and between the Design
Extension Conditions without and with core melt. (See List of Abbreviations for system identifications.).
3.3. NPP construction and operation – Organization of organizations
The nuclear community consists of several organizations which have
clearly distinct and different roles, while interacting with each other.
Socio-technical systems have been studied e.g. by Rasmussen (Ras­
mussen, 1997) who presented a model for the socio-technical system
involved in risk management, see Fig. 11 below.
While quite illuminating, the system in Fig. 11 ignores the fact that
on the company level, many actors may be present; as one proceeds
down the ladder, the number of organizations, organizational units,
staff, and work to be done increase rapidly. Given the technology uti­
lized and regulated, all people working in the area can find themselves
somewhere in this model, forming a community.
We suggest that the community, as an organization of organizations,
behaves to some extent like one organization. In other words, there are
some uniform beliefs and feelings which are fundamental and shared by
all members of the community. Interestingly, the most important such
fundamental beliefs are subconscious, perhaps even never explicitly
articulated. The presence of subconscious fundamental beliefs was
suggested e.g. by Schein (Schein, 2004), as discussed by Levä in (Levä,
2003). Schein’s three-layer model for an organization’s behaviour and
its drivers is presented in Fig. 12.
As said, the nuclear community forms an organization of organiza­
tions, with complementary responsibilities but also shared values,
norms, and beliefs.
We use here two Finnish nuclear newbuild projects as examples to
10
Annals of Nuclear Energy 178 (2022) 109353
illustrate the concept organization of organizations. The first example is
the construction of the Olkiluoto 3 nuclear power plant that was in the
commissioning phase in May 2022. The second example is the con­
struction of the Hanhikivi 1 nuclear power plant where the licensee
Fennovoima withdrew the Construction License Application in May
2022. Key information of the example projects and involved stake­
holders is presented in Table 1 below.
Fig. 13 below presents an organization of organizations in a form of a
matrix. The level of involvement of the stakeholders gradually changes
from real design and construction type of work to superficial remote
oversight of the project. This matrix structure works both for the CFS-
TVO and RAOS-Fennovoima relation, because both are EPC (Engineer­
ing, Procurement, Construction) contracts where the plant supplier (CFS
or RAOS) assumes responsibility for the plant delivery.
In Fig. 13, exact correspondence to the defence levels of Fig. 5 is not
achieved, but the analogy is useful, nevertheless. The players consist of
the delivery team (CFS, RAOS) doing the actual work, the owner (TVO,
Fennovoima) overseeing the delivery according to the EPC contract, the
technically competent regulator STUK overseeing the activities of the
licensees (TVO, Fennovoima) and reporting to the supreme authority on
nuclear matters, the Ministry (TEM, forming part of the Government).
The Government is accountable to the Parliament, the members of
which are accountable to their constituents (voters). Therefore, each
level can be thought of as backing up the ones before – much in the same
way that the levels of defence back each other up. Note that Fig. 13
presents the state of affairs at the time of construction – once the plant is
J. Hyvärinen et al.
Fig. 10. Small reactor safety: NuScale approach (200 MWth) (Turunen, 2020). In this case, independence of Operational States and Accident Conditions is somewhat
clearer than in a large reactor. There is no comprehensive Severe Accident Management strategy, but NuScale has demonstrated that In-Vessel Retention of core melt
is feasible both in the reactor and in the containment vessel.
commissioned, the roles change, and the owner/operator assumes the
primary role at the first level.
Looking at Fig. 13, one can see that the “independence of levels”
requires all members of the community to stick to their proper roles. For
example, should the technical regulator assume some of the licensees’
obligations regarding interaction with the contractors, it becomes
impossible for the regulator to objectively review the licensees’ sub­
mitted documents. Note also that insisting that the licensee assume
larger responsibility for safety necessitates that the licensee be given
latitude to decide how this responsibility is best discharged; this need for
room to manoeuvre is inherently contradictory to having detailed rules
for the licensee to follow.
As shown in Fig. 13, the ORSAC framework embraces also organi­
zational aspects, and it draws on Schein’s (Schein, 2004) theory on or­
ganizations (Schein, 2004). The robustness of national nuclear
communities in terms of safety is an important topic from the point of
view of overall safety as the IAEA’s institutional strength-in-depth
concept indicates (ISiD) (Leveson, 2012). Fig. 13 is partly in accor­
dance with ISiD in terms of combining different organizations with
different functions into the same framework. However, it does not deal
with organizations’ inner barriers, which are relevant to ISiD. In the next
section we will extend the ORSAC framework to cover also socio­
technical aspects and internal barriers based on ISiD.
3.4. Extension of ORSAC from the sociotechnical and organizational
perspectives
The benefit of the ORSAC framework is that it is able to also include
organizations in the same framework, and in this way visualize these
organizations and their relevant functions in terms of safety. However,
from the sociotechnical and organizational perspective, the ORSAC
model could be further enriched by including factors which are external
to the organization in the framework and mechanisms that affect in­
teractions within and between organizations.
11
Annals of Nuclear Energy 178 (2022) 109353
By an organization’s external factors we refer to macro-level i.e.
global and national-level trends including pandemics, economic
depression, availability of raw materials, or technological de­
velopments, which all create pressures which organizations need to
answer to, e.g. via changing their strategies, organizational structures,
or investing in new technologies, as mentioned in Section 2.3. These
external factors and the way organizations answer to them may have
significant safety implications. Therefore, we argue that an overall
safety framework would need to include a nuclear power plant’s
external factors, and this would mean an extension of the ORSAC
framework.
In addition to macro-level external factors, an overall safety frame­
work would benefit from including meso-level, i.e. organization-level
factors which have effects on interactions within and between
organizations.
Inside each organization it is possible to distinguish between struc­
tural, cultural, and social aspects (see Fig. 8 and Fig. 14). By an orga­
nization’s structural aspects we mean the organization’s goals,
strategies, management structure, main functions, departments, re­
sources, written norms and procedures, roles, and responsibilities that
structure the activities and safety performance in the organization. By
social aspects we refer to action in relation to other people’s or groups’
actions, hierarchies, power relationships, expectations, and social
pressures which affect action. Cultural aspects embrace shared values,
beliefs and understanding in an organization. Cultural aspects provide a
mindset that guides actions. Structural, social, and cultural aspects are
intertwined and have reciprocal relationships. Structures enable or
constrain actions, e.g. written norms may enable safe performance or
constrain it, e.g. in terms of strict rules that cannot be followed. Actions
may also affect structures, when members of an organization deviate
from official norms and create new unofficial norms, which may with
the passage of time become written norms and new structures.
Furthermore, cultural values and beliefs affect the interpretation of
structures and actions, and they guide human action. Cultural values
J. Hyvärinen et al. Annals of Nuclear Energy 178 (2022) 109353

Fig. 11. The socio-technical system involved in risk management according to Rasmussen (Rasmussen, 1997).

Table 1
Key information of the two nuclear newbuild projects in Finland.
Olkiluoto 3 project Hanhikivi 1 project

Project acronym OL3 FH1

Licensee organization TVO (Teollisuuden FV (Fennvoima)
Voima)
Plant supplier CFS (Consortium Rusatom Overseas
Framatome Siemens) (RAOS)
Decision-in-Principle (to 2002 2010
construct nuclear power plant)
granted by the Finnish
government
Project phase in May 2022 Commissioning in Construction license
progress application
withdrawn

Fig. 12. The artefacts, expressed values, and fundamental beliefs in the nuclear
community. As an example, “continuous improvement” is an expressed value,
but it seems to be driven by a subconscious belief that a change is always for the
better. This is debatable.
and beliefs may be manifested in structures, e.g. in an organization’s
policies and strategies. Thus, structures, actions, and cultural beliefs are
closely intertwined.
Furthermore, it is possible to approach any activity or relationship in
an organization from structural, social, and cultural perspectives. For

12
J. Hyvärinen et al. Annals of Nuclear Energy 178 (2022) 109353

Fig. 13. The organization of organizations, with the focus on a new build of a nuclear plant in Finland at design and construction phase. CFS (Consortium Framatome
– Siemens) and RAOS (Rusatom Overseas) represent the consortia responsible for the new build delivery (IO = Inspection Organisations, O&M = Operations and
Management, TEM = Ministry of Economic Affairs and Employment of Finland).

Fig. 14. An organization of organizations, with the focus on a new nuclear plant build in Finland, complemented by macro and meso (organizational) level factors.

instance, safety management can be seen from the structural perspec­
tive, i.e. adopting a management system and resource point of view, or it
can be seen from an action point of view, such as from a power re­
lationships perspective, as well as from a values and beliefs viewpoint.
This way organizational life can be seen as a more dynamic phenomenon
in terms of safety. Fig. 14 visualizes the ORSAC model in the context of a
new nuclear build now complemented with macro- and meso- (i.e.
organizational-) level factors.
We illuminate the relationship between the three levels (macro meso
and micro) with the help of the following case. New technological de­
velopments (macro-level), such as introduction of programmable auto­
mation systems (technical systems) have implications for the project
owners (meso-level) in terms of decisions related to upgrading of their
existing systems. Programmable technology provides self-diagnostics
capabilities far beyond what was available in analog automation sys­
tems (a positive feature), but at the same time introduce new types of
vulnerability to common-mode failures (a negative feature) and there­
fore challenge the traditional safety demonstration of automation sys­
tems. Project owners are obliged to assess and justify the new
automation systems, and the regulatory body needs to approve the
safety assessment. Therefore, both actors need new competences at the
micro level (staff competent in new technology).
Each organization has these same mechanisms through which the
interaction within the organization is structured. Similarly, these
mechanisms also affect inter-organizational relationships. However,
significant macro-, meso- and micro-level factors are resolved on a case-
by-case basis. This requires identifying relevant external factors and
intraorganisational factors in each case.
A natural next step in the evolution of an organizational ORSAC
framework is to provide a more exhaustive list of external macro-level
factors and an explicit delineation of meso-level interconnections as
well as the interconnections between all levels. Overall safety in socio­
technical systems view requires attention to a nuclear power plant’s
external factors such as societal, political, and technological de­
velopments. This is an extension to the current safety thinking.
We suggest that the organisation-of-organisations view of a (na­
tional) nuclear community is also helpful in understanding how the
community reacts under external pressures beyond its own control, such

13
J. Hyvärinen et al.
as major shifts in the geopolitical situation. There are several historical
examples of national policies being triggered by external events: the
decision of France in 1970s to invest heavily in nuclear power to become
independent of oil producers, and the decision of Germany in 2011 to
abandon nuclear in the aftermath of Fukushima. In such cases, the whole
community reacts.
The German example shows that there is a risk that designs formerly
though safe enough become politically unacceptable. Evolution of the
society is not possible to predict over decades, therefore such a political
risk is inherent all investment decisions involving very long time con­
stants. This serves to remind the industry that societal acceptance ne­
cessitates continuous effort and interaction with the rest of the society.
The societal expectation regarding what qualifies as acceptably safe is
may change, rendering it impossible to predict, assess or guarantee
upfront the satisfaction of the safety criteria for the whole very long
operation lifetime of a nuclear power plant.
We also suggest that this view allows an estimation of the current
status of the robustness of the national system. This robustness is,
naturally, subject to temporally varying pressures and will change over
time; therefore, periodic re-assessment is appropriate, just as “Periodic
Safety Reviews” are appropriate, and mandated e.g. in the EU for the
technological safety of nuclear plants.
4. Discussion
Defence-in-depth is primarily about providing physical and func­
tional barriers against unwanted consequences—in nuclear safety this
means against inadvertent radioactive releases. The need for multiple
independent barriers has arisen to address the uncertainties—both
aleatory and epistemic—in the knowledge needed to design, dimension,
and assess the barrier performance in both a structural and functional
sense.
We propose that conservatisms and failure criteria (including fail-safe
principles) are best understood as means to increase confidence in the
successful implementation of safety functions, but as such neither are a
fundamental part of defence-in-depth. However, the following are
fundamental:
1) The notion of multiple defence levels;
2) Safety functions: the set of (independent) functions that need to be
fulfilled so that damage to physical barriers is minimized under all
postulated challenges.
The ORSAC framework is essentially a matrix of safety functions
overlaying the defence-in-depth lines. The framework is a powerful tool
depicting the whole plant (safety case) as a system of systems, producing
an easily understandable overall view of the safety characteristics (plant
architecture) and safety provisions (systems architectures) of nuclear
reactors.
The ORSAC framework only relies on the definition of multiple
defence lines and generic fundamental safety functions, making it
technology neutral.
The analysis of typical large LWRs and proposed SMRs shows that the
number of truly independent defence lines is in reality (3), much smaller
than in theory (5). This fact should be explicitly recognized in interna­
tional regulatory guidance to avoid the added complexity due to de­
mands for more independence between defence lines, and consequent
unwarranted confidence in such designs.
The ORSAC framework was first developed from the technical
defence-in-depth viewpoint and then extended towards organizational
aspects. In analogy to the nuclear plant as system of technical systems,
the nuclear community can be represented as an organization of orga­
nizations. Many useful analogies between technological and organiza­
tional structures can be easily identified, e.g. that each organization
needs to stick to their roles to guarantee independence from each other.
The institutional strength-in-depth (ISiD) concept provides a new
14
Annals of Nuclear Energy 178 (2022) 109353
conceptualization of robustness for a national nuclear community in
terms of safety. It is a useful concept because it provides a name for a
phenomenon (the robustness of a national nuclear community) that is
not described by any other concept. However, it is a relatively thin and
abstract conceptualization in terms of organizational factors. Therefore
it needs to be developed further and complemented with organizational
and safety culture related theories (Ylönen et al., 2020).
The sociotechnical systems view sets requirements for the overall
safety framework in terms of dealing with technical and organizational
factors simultaneously. The ORSAC framework includes both technical
and organizational aspects and is promising in this respect. However,
when there is a need for more detailed examination of the organizational
factors or interactions between the technical and organizational aspects,
the ORSAC model needs to be developed further towards taking better
into account the interconnectedness of technical and organizational
factors, interoperability, information transfer across boundaries, and
constant change.
The sociotechnical systems view signifies that overall safety needs to
pay attention also to factors which are external to a nuclear power plant,
such as societal, political, and technological developments. This is an
extension to the current safety thinking.
5. Conclusions
We conclude that defence-in-depth is a powerful conceptual tool,
upon which an overall safety framework can readily be built. In this
paper, we suggest that fundamental concepts include the notion of
multiple safety barriers and generic safety functions to protect them. We
present an ORSAC—Overall Safety Concept—that couples independent
defence lines with fundamental safety functions in a matrix form. The
matrix is a transparent and easily accessible visualization of the overall
safety justification of a nuclear power plant, i.e. how well the plant
meets its top stated safety goals.
The ORSAC framework provides a natural role for the concepts of
safety margins, conservatism, a single-failure criterion, and a fail-safe
design as means of increasing the confidence in barrier performance
and/or the reliability of safety functions. These concepts are not parts of
defence-in-depth but rather design options.
The ORSAC framework only relies on the definition of multiple
defence lines and generic fundamental safety functions, making it
technology neutral.
The application of an ORSAC analysis to large LWRs and proposed
SMRs shows that the number of truly independent defence lines is in re­
ality much smaller than in theory. This fact should be explicitly recog­
nized to avoid added complexity due to demands for more independence
between the defence lines, and consequent unwarranted confidence in
such designs.
The ORSAC model can be expanded to organizations as well. The
nuclear community can be represented as an organization of organiza­
tions. Many useful analogies between technological systems and orga­
nizational structures can be easily identified. The institutional strength-
in-depth (ISiD) concept provides a new conceptualization with regard to
the robustness of the national nuclear community in terms of safety, and
therefore the overall safety concept and framework can be developed by
including ISiD aspects.
The sociotechnical systems view maintains that overall safety needs
to pay attention also to factors which are external to a nuclear power
plant, such as societal, political, and technological developments. This is
an extension of the current safety thinking. The ORSAC framework in­
cludes both technical and organizational aspects and is promising in this
respect. However, a simultaneous examination of technical and orga­
nizational aspects, not to mention their interrelationships would require
further development. Furthermore, as there is a need for more detailed
examination of the organizational factors or interactions between the
technical and organizational aspects, the ORSAC model needs to be
improved further towards taking better into account the
J. Hyvärinen et al. Annals of Nuclear Energy 178 (2022) 109353

interconnectedness of technical and organizational factors, interopera­
bility, information transfer across boundaries, and constant change.
We argue that even separately presented, the technical and organi­
zational aspects of the overall safety framework provide valuable in­
sights into holistic understanding of safety, and as such they provide
useful tools to examine overall safety. Moreover, organizational and
technical aspects of the ORSAC framework can be used to model the
overall safety with semantic and system-modelling tools.
Janne Valkonen: Visualization, Conceptualization, Writing – review &
editing.
Declaration of Competing Interest
The authors declare that they have no known competing financial
interests or personal relationships that could have appeared to influence
the work reported in this paper.

CRediT authorship contribution statement Data availability

Juhani Hyvärinen: Conceptualization, Methodology, Visualization,
Data curation, Formal analysis, Funding acquisition, Supervision,
Writing – original draft, Writing – review & editing. Juhani Vihavai­
nen: Conceptualization, Methodology, Visualization, Data curation,
Funding acquisition, Project administration, Supervision, Writing –
original draft, Writing – review & editing. Marja Ylönen: Conceptual­
ization, Methodology, Visualization, Funding acquisition, Project
administration, Writing – original draft, Writing – review & editing.
Data will be made available on request.
Acknowledgments
The work was funded by the Finnish Research Programme on Nu­
clear Power Plant Safety (SAFIR 2022) in project OSAFE (Development
of overall safety framework, 2019-2020). The support is gratefully
acknowledged.

Appendix

Appendix 1. A brief history of defence-in-depth

The concept of defence-in-depth has a long history. This Appendix provides a brief review of the history of the concept to show how it has evolved
over the decades.
The idea of defence-in-depth was originally developed by the military to describe defences spread in multiple consecutive defence lines, instead of
one strong line. In the nuclear industry, the idea of a defence line can be understood as a structure (barrier against release, e.g. fuel cladding) or as a
function (e.g. to mitigate accident consequences in the plant). It is important to recognize that the functional interpretation is not unique, at least two
essentially different interpretations of functional defence-in-depth are possible:

1) A sequence of plant functions dedicated to accident prevention, accident mitigation, and emergency preparedness. This is the modern view
formalized by the IAEA, WENRA and Finnish legislation, and leads to the idea of plant architecture, from which the system architecture can be
derived (WENRA, 2013).
2) Design measures to enhance independence of defence lines and the reliability of systems performing fundamental safety functions that protect
physical barriers, namely criticality control, decay heat removal, and radioactivity confinement. These measures are redundancy, diversity, and
physical separation. This view often appears in the American literature (U.S. NRC, 2016), and drives the system architecture in the plant, while
implicitly creating a plant architecture.

To further complicate matters, the safety margin concept—which is vital for the detailed design of individual defence barriers—is sometimes also
understood to be an element of defence-in-depth.
Early developers of nuclear reactors for power production recognized that reactor operation would create a large inventory of radioactive material
that, if released from the plant uncontrollably, could cause health hazards to the plant operators and the surrounding population. Consequently, they
devised the idea of placing multiple, mutually independent barriers between the radioactive inventory and the public. From quite early on, power
reactors were equipped with containment or “accident localization” structures as a last resort measure against accidents that could develop in the
reactor system itself.
The U.S. NRC compiled a knowledge base of the history and definitions of defence-in-depth in the NUREG/KM-0009 report (Nrc, 2016). According
to the history review provided in the report, the first mention of a defence-in-depth -like concept appears in correspondence on March 14, 1956 from
the U.S. Atomic Energy Commission to the Congress of the United States, in the following form (U.S. NRC, 2016) (p. 3.2):
“1) Recognizing all possible accidents which could release unsafe
amounts of radioactive materials; 2) Designing and operating the
reactor in such a way that the probability of such accident is reduced
to an acceptable minimum; 3) By appropriate combination of
containment and isolation, protecting the public from the conse­
quences of such an accident, should it occur.”
Interestingly, this definition can be interpreted both in the structuralist and in the functional ways. Soon afterwards, in 1957, a strong structuralist
viewpoint was formulated in the first risk analysis of power reactors in the WASH-740 report, “Theoretical Possibilities and Consequences of Major
Accidents in Large Nuclear Power Plants” (U.S. NRC, 2016) (p. 3.2), which defined.
“multiple lines of defence … (1) the integrity of the reactor vessel;
and, (2) the integrity of the reactor container or vapor shell.”
Note that the WASH-740 report gave no credit to fuel cladding as the first release barrier. Multiple physical barriers first appeared in the U.S.
literature right after the TMI-2 accident. In 1979, the NUREG-0578 report “TMI-2 Lessons-Learned Task-Force Status Report and Short-term Rec­
ommendations” states that (U.S. NRC, 2016) (p. 3.3–3.4):

15
J. Hyvärinen et al. Annals of Nuclear Energy 178 (2022) 109353

“The underlying philosophy of nuclear reactor safety has provided

multiple levels of protection against the release of radioactivity, i.e.,
the concept of defence-in-depth. It includes diversity and redun­
dancy of various safety functions and systems and multiple physical
barriers (the fuel, the cladding, the primary coolant boundary, and
the containment) …” (underlining added),
where again safety system reliability was interpreted to be part of defence-in-depth.
After the Chernobyl accident, the IAEA developed and published the first internationally developed formalization of basic safety principles for
nuclear power plants (75-INSAG-3, 1988), including defence-in-depth. As quoted in (U.S. NRC, 2016) (p. 3–28), 75-INSAG-3 described defence-in-
depth as follows:
“All safety activities, whether organizational, behavioral or equip­
ment related, are subject to layers of overlapping provisions, so that
if a failure should occur it would be compensated for or corrected
without causing harm to individuals or the public at large.”
The document then goes on to state the principle of defence-in-depth is:
“To compensate for potential human and mechanical failures, a
defence in depth concept is implemented, centred on several levels of
protection including successive barriers preventing the release of
radioactive material to the environment. The concept includes pro­
tection of the barrier by averting damage to the plant and to the
barriers themselves. It includes further measures to protect the
public and the environment from harm in case these barriers are not
fully effective.”
As can be seen, the notion of physical barriers against radioactive release were clearly stated, and an embryonic form of functional defence in depth
can also be recognized in “…protection of the barriers themselves…” and “… further measures to protect the public and the environment from harm in
case these barriers are not fully effective.” Human and mechanical failures were treated on a more or less equal footing.
In 1996, the IAEA dedicated a whole report, INSAG-10 (1996) (INSAG, 1996), to defence-in-depth. INSAG-10 made a distinction between the then
operating reactors and future reactors. At the time of the publication, many plant vendors had begun active development of designs that relied, to a
large extent, on stored energy driven and gravity driven safety systems. These designs were AP600 by Westinghouse, SBWR by GE, and SWR-1000 by
Siemens; they later evolved into AP1000, ESBWR and Kerena, respectively.
In operating plants, defence-in-depth was enhanced, in particular to take into account operating experience feedback, to consider low power and
shutdown conditions in greater detail, and human factors. For future plants, INSAG-10 foresaw improved accident prevention through independence
of defence lines and improved containment functions, to explicitly incorporate severe accidents in plant design. “Independence of defence lines”
implies that the IAEA already then considered “defence lines” as consecutively implemented plant functions, instead of plant internal safety systems.
According to (§123) accident prevention was to be strengthened by, inter alia:

▪ increased thermal inertia (a favourable inherent characteristic),

▪ reduced complexity (however, this natural expectation is contradicted by (§125), which proposes reinforcing Level 2 by more systematic use
of limitation systems, independent from control systems; note that the limitation systems are here limited to I&C systems), and.
▪ passive features (the language is generic and appears to have been carefully chosen, not to market passive systems explicitly).

In addition to discussing the levels, INSAG-10 (§50-54) noted that appropriate conservatism, quality assurance and safety culture are prerequisites
that apply to all defence levels. Conservatism was emphasized for levels 1–3, with best estimate assessment becoming more important for levels 4–5. A
“safety margin” was mentioned as an association with conservatism, but not defined.
INSAG-12, published in 1999 (INSAG, 1999), was the first revision of the classical 75-INSAG-3 (1988). The defence-in-depth level definitions in
INSAG-12 are the same as in INSAG-10, indicating that the (technical) concept for functional levels began to mature.

Appendix 2. IAEA DID level definitions

The IAEA explains the five levels of defence as follows:

(1) The purpose of the first level of defence is to prevent deviations from normal operation and the failure of items important to safety. This leads to re­
quirements that the plant be soundly and conservatively sited, designed, constructed, maintained, and operated in accordance with quality management
and appropriate and proven engineering practices. To meet these objectives, careful attention is paid to the selection of appropriate design codes and
materials, and to the quality control of the manufacture of components and construction of the plant, as well as to its commissioning. Design options that
reduce the potential for internal hazards contribute to the prevention of accidents at this level of defence. Attention is also paid to the processes and
procedures involved in design, manufacture, construction, and in-service inspection, maintenance, and testing, to the ease of access for these activities,
and to the way the plant is operated and to how operating experience is utilized. This process is supported by a detailed analysis that determines the
requirements for operation and maintenance of the plant and the requirements for quality management for operational and maintenance practices.
(2) The purpose of the second level of defence is to detect and control deviations from normal operational states in order to prevent anticipated operational
occurrences at the plant from escalating to accident conditions. This is in recognition of the fact that postulated initiating events are likely to occur over the
operating lifetime of a nuclear power plant, despite the care taken to prevent them. This second level of defence necessitates the provision of specific
systems and features in the design, the confirmation of their effectiveness through safety analysis, and the establishment of operating procedures to prevent
such initiating events, or otherwise to minimize their consequences, and to return the plant to a safe state.

16
J. Hyvärinen et al. Annals of Nuclear Energy 178 (2022) 109353

(3) For the third level of defence, it is assumed that, although very unlikely, the escalation of certain anticipated operational occurrences or postulated
initiating events might not be controlled at a preceding level and that an accident could develop. In the design of the plant, such accidents are postulated to
occur. This leads to the requirement that inherent and/or engineered safety features, safety systems and procedures be capable of preventing damage to
the reactor core or preventing radioactive releases requiring off-site protective actions and returning the plant to a safe state.
(4) The purpose of the fourth level of defence is to mitigate the consequences of accidents that result from failure of the third level of defence in depth. This is
achieved by preventing the progression of such accidents and mitigating the consequences of a severe accident. The safety objective in the case of a severe
accident is that only protective actions that are limited in terms of lengths of time and areas of application would be necessary and that off-site
contamination would be avoided or minimized. Event sequences that would lead to an early radioactive release or a large radioactive release are
required to be ‘practically eliminated’.
(5) The purpose of the fifth and final level of defence is to mitigate the radiological consequences of radioactive releases that could potentially result from
accidents. This requires the provision of adequately equipped emergency response facilities and emergency plans and emergency procedures for on-site
and off-site emergency response.

Appendix 3. The Forsmark 2006 overvoltage incident

The Forsmark incident of 2006 provides an excellent example of failure modes shifting as a consequence of technological change.
In this case, the safety function was to provide uninterrupted AC supply from batteries, a DC power source. In the original design, the DC/AC
conversion was performed by electromechanical means which were very robust against supply voltage overshoots, but mechanically unreliable. Over
the years, electromechanical parts were replaced by power electronics equipment that could perform the DC/AC conversion using solid-state semi­
conductor components. The new technology was mechanically very reliable, to the delight of plant maintenance, but also required protection against
supply overvoltage, in order not to burn the semiconductor thyristors. Eventually, there was a plant transient initiated at the switchyard, which caused
the plant to disconnect from the national grid and created a major voltage disturbance that knocked out several of the DC/AC converters, disabling half
of plant safety instruments as a consequence. Among other things, only two out of four emergency diesel generators were able to operate. The situation
was successfully recovered by operator action improvised on the spot in the darkened control room.

References Levä, K. Turvallisuusjohtamisjärjestelmien toimivuus: vahvuudet ja kehityshaasteet

suuronnettomuusvaarallisissa laitoksissa, TUKES-julkaisu 1/2003 (DSc dissertation
in Finnish), 2003.
Application Documents for the NuScale Design, U.S NRC webpages, https://www.nrc.
Leveson, N.G., 2004. A new accident model for engineering safer systems. Saf. Sci. 42 (4),
gov/reactors/new-reactors/smr/nuscale/documents.html, (accessed June 30, 2022).
237–270.
Aven, T., Ylönen, M., 2018. A risk interpretation of sociotechnical perspectives. Reliab.
Leveson, N., 2012. Engineering a Safer World: Systems Thinking Applied to Safety. The
Eng. Syst. Saf. 175, 13–18.
MIT Press, Cambridge, MA.
Dekker, S., Cilliers, P., Hofmeyr, J.H., 2011. The complexity of failure: implications of
NEA 2007. Task Group on Safety Margins Action Plan (SMAP) Safety Margins Action
complexity theory for safety investigations. Saf. Sci. 49 (6), 939–945.
Plan - Final Report, NEA/CSNI/R(2007)9, https://www.oecd-nea.org/nsd/docs/
Emery, F.E., Trist, E.L., 1960. Socio-technical Systems. In: Churchman, C.W.,
2007/csni-r2007-9.pdf.
Verhulst, M. (Eds.), Management Science, Models and Techniques, 2. Pergamon
OECD NEA (2018). Country-Specific Safety Culture Forum: Sweden, OECD Publishing,
Press, pp. 83–97.
Paris, www.oecd-nea.org/hans/pubs/2018/7420-cssc-sweden.pdf.
Ha-Duong, M., Journé, V., 2014. Calculating nuclear accident probabilities from
OECD NEA (2019). Country-Specific Safety Culture Forum: Finland, OECD Publishing,
empirical frequencies. Environ. Syst. Decis. 34 (2), 249–258.
Paris, http://www.oecd-nea.org/hans/pubs/2019/7488-csscf-finland.pdf.
Hansson, S.O., 2012. Safety is an inherently inconsistent concept. Saf. Sci. 50 (7),
OECD/NEA. 1996. Boron reactivity transients. Proceedings of a Specialist Meeting, State
1522–1527.
College, PA, USA, 18-20 October 1995. NEA/CSNI/R(96)3.
Harvey, C., Stanton, N.A., 2014. Safety in System-of-Systems: Ten key challenges. Saf.
OECD/NEA. 2013. Updated Knowledge Base for Long Term Core Cooling Reliability,
Sci. 2014 (70), 358–366.
NEA/CSNI/R(2013)12.
Hollnagel, E., 2017. In: Safety-I and Safety-II. The Past and Future of Safety Management.
Rasmussen, J., 1997. Risk management in a dynamic society: a modelling problem.
CRC Press, London. https://doi.org/10.1201/9781315607511 (Accessed June 29,
Safety Sci. 27 (2/3), 183–213.
2022).
Report of the Fukushima Nuclear Accident Independent Investigation Commission, The
Hyvärinen, J., 1993. The Inherent Boron Dilution Mechanism in Pressurized Water
National Diet of Japan, 2012; https://www.nirs.org/fukushima/naiic_report.pdf.
Reactors. Nucl. Eng. Des. 145, 227–240.
Schein, E.H., 2004. Organizational Culture and Leadership, 3r Edition. Jossey-Bass, San
Hyvärinen, J., Kauppinen, O.P., Vihavainen, J., 2016. Overall Safety conceptual
Francisco.
Framework – ORSAC. Final Report. Nuclear Engineering, LUT School of Energy
Schein, E., Schein, P., 2016. Organizational Culture and Leadership, 5th ed. John Wiley
Systems. Lappeenranta University of Technology.
& Sons, Hoboken.
Hyvärinen, Juhani: On the fundamentals of nuclear reactor safety assessment: inherent
The Society for Risk Analysis (SRA), Glossary Society for Risk Analysis, 2018,
threats and their implications, Dr. Tech. dissertation, STUK-A135, December 1996.
https://www.sra.org/resources. (accessed March 12, 2022).
IAEA, 2007. Proposal for a technology-neutral safety approach for new reactor designs.
Turunen, Mikko. 2020. Overall safety of small modular reactors. MSc thesis. LUT
IAEA-TECDOC-1570. ISBN 978-90-0-107607-6. International Atomic Energy Agency
University 2020. https://urn.fi/URN:NBN:fi-fe2020120499439.
(IAEA), Vienna, 2007.
U.S. NRC, 2016. Historical review and observations of defence-in-depth. Nuclear
IAEA, 2016. Safety of nuclear power plants: design. IAEA Safety Standard Series. Specific
Regulatory Group (NUREG) publication NUREG/KM-0009. United States Nuclear
Safety Requirements (SSR) No. SSR-2/1 (Rev.1). ISBN 978-92-0-109315-8.
Regulatory Commission (U.S. NRC), 2016.
International Atomic Energy Agency (IAEA), Vienna, 2016.
Vihavainen, Juhani: VVER-440 Thermal Hydraulics as a Computer Code Validation
IAEA, 2016. Considerations on the Application of the IAEA Safety Requirements for the
Challenge, Dr. Tech. dissertation, Acta Universitatis Lappeenrantaensis 618,
Design of Nuclear Power Plants. IAEA- TECDOC-1791. ISBN 978–92–0–104116–6.
December 2014.
International Atomic Energy Agency (IAEA), Vienna, May 2016.
Wahlström, B., 2018. Systemic thinking in support of safety management in nuclear
INSAG, 1996. Defence in depth in nuclear safety. A report by the International Nuclear
power plants. Saf. Sci. 109, 201–218.
Safety Advisory Group (INSAG). INSAG series No. INSAG-10. ISBN 92-0-103295-1.
WENRA (2013). Safety objectives for new power plants. Study by the WENRA Reactor
International Atomic Energy Agency (IAEA), Vienna, 1996.
Harmonization Working Group (RHWG). Western European Nuclear Regulators’
INSAG, 1999. Basic safety principles for nuclear power plants 75-INSAG-3 rev. 1. A
Association (WENRA), 2013.
report by the International Nuclear Safety Advisory Group (INSAG). INSAG series
Ylönen, M., 2020. Assessing the goodness of the concept of Institutional strength-in-
No. INSAG-12. ISBN 92-0-102699-4. International Atomic Energy Agency (IAEA),
depth. In: Teperi, A.M., Gotcheva, N. (Eds.), Human Factors in Nuclear Industry.
Vienna, 1999.
Elsevier.
INSAG-27. 2017. Ensuring Robust National Nuclear Safety Systems – Institutional
Strength in Depth. A report by the International Nuclear Safety Group. IAEA.
Kleiner, B.M., Hettinger, L.J., Dejoy, D.M., Huang, Y.-H., Love, P.E.D., 2015.
Sociotechnical attributes of safe and unsafety work systems. Ergonomics 58 (4),
635–649. https://www.ncbi.nlm.nih.gov/pmc/articles/PMC4566878/#cit0022.
Le Coze, J.C., Pettersen, K., Engen, O.A, Morsut K., Skotnes, R., Ylönen, M., Heikkilä, J.
and Merlele-Coze, I. 2017. Sociotechnical systems theory and the regulation of safety
in high-risk industries – White paper. VTT Technology 293.

17
J. Hyvärinen et al. Annals of Nuclear Energy 178 (2022) 109353

Ylönen, M., Engen, O.A., Le Coze, J.C., Heikkilä, J., Skotnes, R., Pettersen, K., Morsut, K., Ylönen, M., Engen, O.A, Le Coze, J.C., Heikkilä, J., Skotnes, R., Pettersen, K. and Morsut
2017. Sociotechnical safety assessment within three risk regulation regimes. VTT K. (2017) Sociotechnical safety assessment within three risk regulation regimes. VTT
Technol. 295. Technology 295. SAF€RA STARS final report.
Ylönen, M., Kari, M. Gotcheva, N. and Talja, H. 2017. Overall safety and organizations -
institutional strength-in-depth and national actors. Research Report, DNRO SAFIR
32/2017. 8.3.2017. VTT-V-113017-16.

18