Lessons
Fukushima11032011
Lessons Learned and Checkpoints
based on the Nuclear Accidents
at Fukushima

Fukushima
37° 25‘ 26.57“ N, 141° 1‘ 56.87“ E11.03.2011

2|3

Table of Contents
1

Introduction 		4

2 Derivation of checkpoints from the„Lessons Learned“ after the Fukushima accident		 6
2.1 Derivation and assignment of checkpoints		 7
2.2 Evaluation of checkpoints		 8
2.3 IDA NOMEX working group		 102.4 Categorisation of checkpoints		 112.5 Processing status of checkpoints		 113 Presentation of checkpoints		 123.1 Focus Area: Design		 123.2 Focus Area: Emergency Management		 163.3 Focus Area: Experience Feedback		 213.4 Focus Area: Supervision		 223.5 Focus Area: Radiation Protection		 243.6 Focus Area: Safety Culture		 264 Further procedure		 274.1 Implementation of checkpoints		 274.2 Ongoing observation of the Fukushima event		 275 Annexe: Brief summary of „Lessons Learned“		 286 List of abbreviations		 34List of figures
Figure 1: Overview of dates of directives and measures, 2011 / 2012						

91 | Introduction

1

Introduction

The issue of “severe accidents” has playeda key role in the supervisory activities of
ENSI and its predecessor organisation, theHSK (Hauptabteilung für die Sicherheit der
Kernanlagen, Principal Nuclear Safety Division), not merely since the reactor accident
at Fukushima but for a long time before thatevent. The analysis of events in Switzerland
and abroad, and examination of their significance for the Swiss nuclear power plants, areincluded among the standing obligations of
the supervisory authority. After the accident
at Harrisburg, for example, the HSK (as itthen was) made it a requirement to back-fit
autonomous emergency standby systems
to cope with the effects of natural events
such as earthquakes, flooding, storms andlightning, and of those due to human activity
such as sabotage and aircraft crashes.
In response to the Chernobyl accident, theHSK developed a “Catalogue of measuresagainst severe accidents” (MSU) which includes (but is not limited to) measures toprevent core damage as well as measures tomitigate the consequences of massive coredamage. As a result of implementing the
MSU, for example, systems to deal with large
volumes of hydrogen in the containment
were set up, as were systems for controlled
and filtered venting of the containments.

For more than two decades, Probabilistic
Safety Analyses (PSA) have been usedin Switzerland to investigate core meltdown
accidents in detail. Complex hazard analyses of external events (such as earthquakes)
have been produced, and they are continuously adapted in line with the latest developments in science and technology.
“Severe Accident Management Guidance”(SAMG) – representing strategies to mitigate
the effects of a core meltdown accident –was also introduced at an early stage; thiswritten procedures, which is verified by thesupervisory authority, provides the Swiss
plants with optimal assistance for dealing
with accidents. In overall terms, Swiss nuclear power plants have attained a very highstandard in the area of severe accidents, ascompared to other countries.
Moreover, the safety of the Swiss nuclear
power plants is constantly reviewed as partof ongoing supervision activities, and especially in connection with the Periodic Safety
Review (PSR) that is conducted every
10 years.
Nevertheless, the accident at Fukushima
provides reasons to examine whether further
improvements should be made to the existing assessment of precautions against severereactor accidents, and whether any additional measures may need to be initiated for theprotection of the general public.

4|5

In this report, ENSI presents the checkpoints
which, on the basis of the analysis of theevents at Fukushima, have been assessed as
relevant for further improvements to nuclear
safety and emergency protection in Switzerland. The analyses were carried out by aninterdisciplinary team (the “Japan Analysis
Team”). The checkpoints are derived fromthe knowledge gained as a result of analysing the behaviour of people, technology andorganisations during the events relating to
the accident. These “Lessons Learned” areset out in the Annexe to this Memorandum.
They are based on the extensive investigations whose results were presented by ENSIin the reports entitled “ Event sequences inFukushima Dai-ichi and Dai-ni following the
Tohoku-Chihou-Taiheiyou-Oki earthquake on
11.03.2011” and “In-depth Analysis of the Accident at Fukushima on 11 March 2011 With
Special Consideration of Human and Organisational Factors” (both reports are posted on
ENSI’s website).
The measures relate to the areas of design,
emergency management, experience feedback, supervision, radiation protection andsafety culture. These areas are referred to in
the following text as “Focus Areas”, i.e. areas
where action is required. Among other aspects, they focus on the checkpoints to optimise emergency protection in Switzerland.
Some of these checkpoints are of an overriding character, so they fall primarily within
the responsibility of the Federal government
and the cantons, but they are also relevant
for ENSI. At Federal level, therefore, the Interdepartmental Working Group to Review
Emergency Protection Measures in case of
Extreme Events in Switzerland (IDA NOMEX)
was set up as long ago as 04.05.2011.

The implementation of measures required in
the short term was initiated by corresponding directives from ENSI; part of this process has already been completed, while themedium- to longer-term measures will beincorporated into an action plan as part ofongoing supervision. The aims of implementing any measures that might result from thecheckpoints are to continue increasing thesafety of Swiss nuclear power plants even incase of infrequent events, to optimise emergency protection and to make further improvements to supervision by ENSI.
So far, no significant safety shortcomings
have been identified in Swiss nuclear power
plants on the basis of analyses of the accident sequences. There are no indications
for the need to shut down according to thecriteria of the DETEC (Department of Environment, Transport, Energy and Communications, UVEK) Ordinance on the Methodology
and Boundary Conditions for Reviewing theCriteria for the Provisional Shut Down of Nuclear Power Plants (DETED Ordinance on the
Methodology and the General Conditions for
Checking the Criteria for the Provisional Taking out of Service of Nuclear Power Plants,
abbreviated as: “Shut Down” Ordinance). The
necessary improvement to the reliability of
the cooling water supply at the Mühleberg
nuclear power plant (NPP) was already
implemented during the 2011 inspection
shutdown.

2 | Derivation of checkpoints

2 Derivation of checkpoints
from the “Lessons Learned”
after the Fukushima accident
The checkpoints set forth in section 3 of thisMemorandum are based mainly on know­
ledge gained from investigating the events
relating to the accident in units 1 to 4 of the
Fukushima Dai-ichi NPP (it was possible tobring the units of the Fukushima Dai-ni NPP
into a safe condition and to stabilise themafter the earthquake and the tsunami). Thisbody of knowledge, referred to below as“Lessons Learned”, was developed by ENSI
on the basis of analytical work and reportingon the accidents. The “Lessons Learned” arechiefly based on the following ENSI reports:• “ Event sequences in Fukushima Dai-ichi
and Dai-ni following the Tohoku-ChihouTaiheiyou-Oki earthquake on 11.03.2011”,
Memorandum ENSI-AN-7614 Rev. 1 dated
26.08.2011• “ In-depth Analysis of the Accident at
Fukushima on 11 March 2011 With Special
Consideration of Human and Organisational Factors”, Memorandum ENSIAN-7669 dated 29.08.2011
In addition, ENSI has examined other aspects
linked to the accident:• L egal basis of nuclear supervision inJapan• Structure of the Japanese nuclear sector
Nach dem Unfall vonFukushima-Dai-ichi
plant die japanische
Regierung die nukleare
Aufsicht aus dem METI
auszugliedern und neu
unter der Führung desUmweltministeriums zu
bündeln• F ailures of electrical supply and equipment due to the earthquake and tsunami• B ack-fitting measures on boiling water
reactors with Mark I containment• R esults of the IRRS (Integrated Regulatory
Review Service) Mission to Japan in 2007• M easures based on the Fukushima accident in other countries with nuclear power
plantsAs the first step, ENSI’s “Lessons Learned”
were assembled without further evaluationof their relevance for Switzerland and theirapplicability to conditions in this country. For
this reason, the “Lessons Learned” (which
are summarised in the Annexe to this Memorandum) do not as yet constitute an evaluation or selection of the findings in respect of
their applicability to Switzerland.
The results of ENSI’s analyses were reviewed
by external experts from Germany, France
and the US. Knowledge gained and measures taken by organisations and supervisory
authorities in other countries such as the
IAEA, the Japanese government and the US
supervisory authority (NRC) were adduced
for the purpose of verifying the “Lessons
Learned” that had been defined. The aim of
this procedure was to ensure that the “Lessons Learned” for Switzerland are backed
by a broad basis of expertise. After evaluating the relevant conditions in Switzerland,
ENSI’s “Japan Analysis Team” used theseverified “Lessons Learned” to develop thecheckpoints, which it then assigned to six
Focus Areas, according to the subject matter
involved in each case.

6|7

2.1 Derivation and assignment of checkpoints

The “Lessons Learned” were assigned inadvance to various Focus Areas, so that thecheckpoints could be allocated to the relevant responsibilities and competences within
ENSI, the Swiss nuclear power plants and theother institutions concerned. The Focus Areas represent specific areas of competence
within ENSI which have always been elements of ENSI’s supervision of Switzerland’s
nuclear plants.

The checkpoints can all be assigned to thesix Focus Areas listed below. Safety culture
is mentioned as the last Focus Area because
its content impinges on all the other Focus
Areas, given that it fosters and requires safetyoriented thinking and behaviour but does
not establish new technical or organisational
requirements:

•
•
•
•
•
•

DesignEmergency management
Experience feedback
Supervision
Radiation protection
Safety culture2 | Derivation of checkpoints

2.2 Evaluation of checkpoints

In order to evaluate and specify the check­points, the “Japan Analysis Team” submitted
the developed proposals to the sections of
ENSI responsible for the relevant specialist
areas. Another objective here was to examine (where relevant) how far the proposals
had already been taken into account in current supervisory procedure, or whether any
omissions were identified in the existingsupervision of Swiss nuclear power plants
which created a corresponding need for action. In particular, the aim was to examine
whether proposed improvements or reviews
had already been initiated as immediate
measures on the basis of ENSI’s directives.
The following directives are involved:

1. ENSI’s directive dated 18.03.2011:
measures due to the events at Fukushima• Immediate review of the design against
earthquake and flooding in respect of shut
down criteria• Access to an external storage facility withadditional resources to mitigate severe accidents by 01.06.2011• As required: back-fitting of additional externally accessible connections for mobile
emergency equipment by 31.12.2012• Back-fitting of two physically separate
feeds for the external supply of the spent
fuel storage ponds by 31.12.2012• Proof of diversified coolant supply, of thedesign of the cooling system for the spent
fuel storage ponds, and of protection of
spent fuel storage ponds located outside
the primary containment, by 31.03.2011.
A statement by ENSI on this subject wasissued with the third directive dated
05.05.2011.

2. ENSI’s directive dated 01.04.2011:
Procedural requirements for the review
of design in respect of earthquakes andflooding• Redetermination of seismic hazard
assumptions (intermediate step prior tocompletion of the PEGASOS Refinement
Project, PRP) by 30.11.2011: proof of seismic stability based on the new earthquake
catalogue of the SED (Swiss Seismo-logical Service), and on the seismic hazard assumptions which were redetermined whensite data were recorded in connection
with the PRP. By 31.03.2012: deter-ministic
proof of ability to cope with the 10,000year earthquake.
• Deterministic proof of ability to cope withthe 10,000-year flood, by 30.06.2011. ENSI
evaluated the proof submitted by theoperators by 31.08.2011.
• Deterministic proof of ability to cope withthe combination of an earthquake andthe failure of the dam installations which
would be triggered by the earthquake inthe area of influence for the nuclear power
plant, by 31.03.2012.

8|9

3. ENSI’s directive dated 05.05.2011:

4. ENSI’s directive dated 01.06.2011:

Statement on the reports dated
31 March 2011

Re-evaluation of the safety margins for nuclear power plants in the framework of the
EU stress tests• Measures shall be proposed in responseto the plant-specific findings describedby ENSI in the area of spent fuel storage
ponds and coolant supply, by 31.08.2011•• Review of the design of the spent fuelstorage ponds, buildings and coolingsystems as per the procedural requirements stated in the ENSI directive dated
01.04.2011, by 31.03.2012

Obligation to participate in the EU stress
test: Re-evaluation of the safety margins
for earthquakes, flooding, power supply,
supply of cooling water; review of theeffectiveness of measures against severe
accidents• Evaluation of protection against hydrogen
explosions in the area of the spent fuelstorage ponds, by 31.03.2012

Fukushima event

Today

Shutdown criteria
Flooding

ENSI

Earthquake, combination of earthquake and flooding

ENSI

Event analysis and improvement measures
ENSI

Review of spent fuel storage ponds/Power Stations

Proposals spent fuel storage ponds/power stations

ENSI

Additional analyses of spent fuel storage ponds (earthquake, flooding)

ENSI

EU stress test
Operators

ENSI

EU Peer Review

EU

Improvement measures
Back-fitting measures and installations
Storage facilities

External connections for emergency equipment from the storage facility
Water supply at KKM(Mühleberg NPP)

03.11

04.11

05.11

06.11

Supervisory project / framework

07.11

08.11

Operators

Additional improvement measures
09.11

ENSI

10.11

11.11

12.11

01.12

ENSREG for EU stress test

Figure 1: Overview of dates of directives and measures, 2011 / 2012

02.12

03.12

04.12

05.12

06.12

07.12

Back-fitting measures / external storage facility

2 | Derivation of checkpoints

2.3 IDA NOMEX working group

On 04.05.2011, the Federal Council decided
to appoint an Interdepartmental Working
Group to Review Emergency Protection
Measures in case of Extreme Events in
Switzerland (IDA NOMEX). The remit of thisworking group, in which ENSI is also represented, is to examine in the light of experience gained from Fukushima whether there
is further need to take action regarding
emergency protection in case of extreme
events in Switzerland, and whether any new
statutory and organisational emergency
protection measures need to be taken. The
IDA NOMEX working group consists of representatives of the cantons, the Federal
Chancellery (BK) and the following departments: DETEC, EDI (Federal Department ofHome Affairs, FDHA), EJPD (Federal Department of Justice and Police, FDJP) andVBS (Federal Department of Defence, Civil
Protection and Sports (DDPS); it will review
matters including the Emergency Protection Ordinance (Notfallschutzverordnung)and the Ordinance on Nuclear, Biologicaland Chemical Accidents and Natural Events(ABCN-Einsatzverordnung) in view of experience gained from the events in Japan following 11.03.2011. DETEC will probably report to
the Federal Council on this work before theend of autumn 2011. The responsible departments will submit draft amendments to laws
and ordinances to the Federal Council by
mid-2012. The Swiss Federal Office of Energy(SFOE) is responsible for lead management
and coordination of the working group.

In parallel with the findings determined by
the Federal Council, the ENSI analysis has
also derived checkpoints regarding the
emergency protection measures implemented in Japan. Measures may need to be
initiated in various areas of emergency management, such as means of communication,
information provided to the general public,
evacuation and the regulation of interfaces;such measures fall primarily within the areasof responsibility of the Federal government
and the cantons. In this report, those checkpoints which are also considered under the
auspices of the IDA NOMEX review are specially flagged as such. These are checkpoints
9, 10, 15, 17, 18, 20, 21, 22, 23, 24, 33 and 34.

10 | 11

2.4 Categorisationof checkpoints

2.5 Processing statusof checkpoints

From the complex events related to theaccident at Fukushima, ENSI has derived 37
checkpoints which will help to achieve anadditional increase in the safety of Swiss nuclear plants. The checkpoints were assigned
to categories as follows, on the basis of the
defence-in-depth concept:

The status of processing of the 37 checkpoints relates to the date of issue of thisdocument.
• 13 checkpoints have already been implemented and/or initiated on the basis of
the ENSI directives.
• 12 checkpoints will be followed up by IDANOMEX or are dependent on IDA NOMEX.

Category I

Category II

Category III

checkpoints to prevent accidents
checkpoints to bring accidents
under control, in order to prevent inadmissible release ofradioactive substances
checkpoints to mitigate theconsequences of accidents• 6 checkpoints are already taken into
account as part of ENSI’s supervision
activities.
• 4 checkpoints still have to be initiated.
• 2 checkpoints have already been
completed.
The status of processing and/or implementation is reported separately for each individual
checkpoint in the following section.

To date,• 12 checkpoints have been identified
in Category I,• 9 checkpoints have been identified
in Category II, and• 16 checkpoints have been identified
in Category III.

3 | Presentation of checkpoints

3 Presentation of checkpoints

In the following sections the checkpoints listed summed up, with their allocations to thesix Focus Areas. The “Lessons Learned” onwhich the checkpoints are based are listed
for each checkpoint.

3.1 Focus Area: Design
The “Lessons Learned” from the accident inJapan have generated the following issues
in the Focus Area of the design of nuclear
plant; ENSI will focus on processing andreporting on these issues, in addition to continuing its regular supervisory activities.

Checkpoint 1 (Category I)
The hazard assumptions for earthquakeand external flooding, and also for extreme
weather conditions, must be re-evaluated totake account of the latest knowledge.
Explanation:
Extreme weather conditions include, in particular, snow loads, temperatures, winds
including tornado hazards, and heavy rain.
This evaluation is being carried out in addition to the regular review of external hazard
assumptions as part of the Periodic Safety
Reviews (PSR). Extreme weather conditionsfor Switzerland were re-analysed recently by
MeteoSwiss on behalf of ENSI. The results
will be incorporated into further analyses.
This checkpoint was derived from “Lessons
Learned” 6 and 18.

Implementation:
In connection with the ENSI directives of
18.03.2011, an additional targeted review wasrequested for earthquake and flooding, andfor the combination of earthquake and flooding. These reviews are also elements of the
EU stress test, which was ordered by ENSI on
01.06.2011.

Checkpoint 2 (Category I)
The control strategies for a long-lasting total power failure must be re-evaluated on
the basis of knowledge gained from Fukushima.
Explanation:
This checkpoint was derived from “Lesson
Learned” 32.
Implementation:
By its directive of 01.04.2011, ENSI obliged
the Swiss nuclear power plants to submit appropriate proof regarding the 10,000-year
earthquake and flood. In addition, this checkpoint is covered by the EU stress test, which
was ordered by ENSI on 01.06.2011.

12 | 13

Checkpoint 3 (Category I)
A review must be carried out to determine
whether the coolant supply for the safetysystems and the associated auxiliary systems is guaranteed from a diverse source
which is safe against earthquakes, flooding
and contamination..

Implementation:
This was already required on the basis of the
ENSI directives dated 01.04.2011, and was essentially completed by ENSI’s evaluation dated
31.08.2011. During its inspections, ENSI will also
ascertain that the tightness of buildings fromthe inside to the outside is guaranteed.

Explanation:
This checkpoint was derived from “Lesson
Learned” 18.

Checkpoint 5 (Category I)

Implementation:
This was required on the basis of the ENSI
directives dated 18.03.2011. In its directive
dated 05.05.2011, ENSI ordered improvement
measures based on the operators’ analyses.
Staggered failure of the ultimate heat sinks
required for heat dissipation will be considered within the framework of the EU stress
test, which was ordered on 01.06.2011.

Checkpoint 4 (Category I)
A review must be carried out to determine
whether the requisite tightness of buildings
containing important safety equipment isguaranteed in case of flooding of the site.
Explanation:
The escape of radioactive water into the environment must be prevented in the event ofleaks within the plant. This means that thebuildings must be watertight from the outside as well as the inside.
This checkpoint was derived from “Lesson
Learned” 32.

On the basis of experience gained from the
Fukushima accident, another review must be
undertaken to determine whether the availability of the instrumentation required toassess the condition of the plants is guaranteed adequately even in extreme situations.
Explanation:
The data are required in order to assess
the situation and/or to initiate the requisite
measures inside and outside the plant, andto communicate them. This also includes ensuring that control centres and onsite equipment are able to function in order to copewith severe accidents based on all the hazard assumptions under consideration.
This checkpoint was derived from “Lesson
Learned” 23.
Implementation:
The review of instrumentation to monitor the
spent fuel storage ponds was required within
the directive dated 05.05.2011. The additional
required incident overview displays are specified in ENSI guideline B12.

3 | Presentation of checkpoints

Checkpoint 6 (Category I)

Checkpoint 8 (Category II)

A review must be carried out to determine
whether control of leaks and long-termcooling of the spent fuel storage ponds areguaranteed in case of severe accidents.

The design and operation of the systems forfiltered venting of the containment must be
reviewed again.

Explanation:
This checkpoint was derived from “Lessons
Learned” 19 and 33.
Implementation:
In the directive dated 05.05.2011, the licenceholders were required to submit improvement
measures; these measures were submitted
by 31.08.2011 and are being assessed by ENSI.

Checkpoint 7 (Category II)
A review must be carried out to determine
whether the verifications regarding the prevention of hydrogen explosions should be
extended to additional areas of the plants
beyond the primary containment.
Explanation:
This checkpoint was derived from “Lesson
Learned” 29.
Implementation:
This issue is dealt with as part of the EU
stress test which was ordered on 01.06.2011.
Further details were specified for the spent
fuel storage ponds in the directive dated
05.05.2011.

Explanation:
The systems for filtered venting installed in
the Swiss nuclear power plants are intended
to prevent overpressure failure of the primarycontainment during sequences of events
involving a slow build-up of pressure. The
requirements were incorporated in guidelines
issued by the HSK (now: ENSI).
This checkpoint was derived from “Lesson
Learned” 26.
Implementation:
The system for filtered venting is examinedboth in the EU stress test (“Measures anddesign to protect the integrity of the containment”) and during ENSI’s inspections of
key points specifically related to knowledge
gained from the Fukushima-Dai-ichi accident.

14 | 15

Checkpoint 9 (Category II)
Covered by IDA NOMEX
It is necessary to carry out a new review ofdesign against earthquake and flood of themonitoring network for automatic dose ratemeasurement in the vicinity of nuclear power plants (MADUK), in relation to experience
gained from the Fukushima accident.

Implementation:
Requirements regarding technical equipment for the emergency protection of nuclear plants are stipulated in ENSI guideline
B12. Based on the knowledge acquired by
IDA NOMEX, ENSI is to define the specificrequirements for implementing this checkpoint.

Explanation:
This checkpoint was derived from “Lesson
Learned” 37.

Checkpoint 11 (Category III)

Implementation:
The specific requirements for implementing
this checkpoint will be defined on the basisof the knowledge acquired by IDA NOMEX.

Checkpoint 10 (Category III)
Covered by IDA NOMEX
A review must be carried out to determine
whether the emergency rooms and thesubstitute emergency rooms at the Swiss
nuclear power plants still meet the requirements, based on the experience gained fromthe Fukushima accident.
Explanation:
Nuclear power plants must have suitable,
seismically robust, appropriately protected,
ventilated and well equipped emergency
rooms and substitute emergency rooms
which can also withstand external impacts
such as earthquake or flooding. These rooms
require adequate equipment, and must beof such a nature as to guarantee the healthand radiological protection of on-site staff,
and to ensure that they are accommodated
and provided with supplies. The protectedroom for the ENSI emergency organisation(GENORA) must also be reviewed.
This checkpoint was derived from “Lessons
Learned” 9, 16, 24 and 25.

The access control system for nuclear
power plants and the associated arrangements must be reviewed to determine theaccessibility of rooms where intervention isrequired in case of severe accidents, while
maintaining appropriate plant security.
Monitoring of radiation protection must continue to be guaranteed in this context.
Explanation:
This checkpoint was derived from “Lesson
Learned” 22.
Implementation:
This checkpoint has already been initiatedand has been largely completed as part ofthe existing supervision activities, but withconsideration given to the additional knowledge gained from the Fukushima accident.

3 | Presentation of checkpoints

3.2 Focus Area: Emergency Management

The need for a functioning emergency ma­nagement system became clear during the
progression of the accident at FukushimaDai-ichi, and it was evident that appropriate
planning and precautions are also required
for the extremely unlikely case of a severe
accident. The operators of the Swiss nuclear
power plants and ENSI have already taken
extensive precautions in this regard as partof their emergency planning. As a practicalexample of the progression of a severe accident, Fukushima offers the opportunity toreview the suitability and completeness of
emergency planning in Switzerland at various levels and during various phases, and to
introduce improvements where applicable.

Checkpoint 12 (Category I)
The emergency measures for heat dissipation in case of a complete failure of thecooling water supply must be reviewed andverified under conditions resulting from thedestruction of the infrastructure and thepower supply.
Explanation:
This checkpoint was derived from “Lesson
Learned” 18.
Implementation:
By setting up the external storage facility(ordered by the directive dated 18.03.2011
and in place since 01.06.2011), resourceswere already made available for use in asituation of this sort in order to maintain thecooling function independently of the permanently installed safety systems. In addition, this checkpoint is an element of the EU
stress test, which was ordered by ENSI on
01.06.2011.

Checkpoint 13 (Category I)
It is necessary to review how the alternative
supply of water and power for emergencies
is ensured.
Explanation:
The connections required for this purposemust be compatible and must be positioned
so as to guarantee accessibility in caseof internal as well as external impacts. The
necessary actions must be included in the
documentation of decision guidance for
emergency management in case of severe
accidents (SAMG, Severe Accident Management Guidance) and appropriate training
must be provided on this aspect.
This includes restoration of the necessary
power supply from the external grid, froma nearby power plant, from another unit at
the site, or with a mobile emergency diesel
generator from the external storage facility.
For this purpose, the existing boundary conditions, including the envisaged periods oftime, must be determined and compared tothe terms of reference used for emergency
planning.
This checkpoint was derived from “Lessons
Learned” 18 and 22.
Implementation:
Additional supply options, e.g. to feed withextinguishing water, were already createdsome years ago in the Swiss NPPs in connection with the development of the SAMG. The
directive dated 18.03.2011 ordered anotherreview in the light of the accident at Fukushima

16 | 17

Checkpoint 14 (Category II)
It is necessary to examine the water resourcesthat can be made available to feed the reactor
pressure vessel, the spent fuel storage ponds
and the containment.
Explanation:
The original purpose of use (e.g. as fire extinguishing water) must be taken into accountin this context, and the ability to use thewater in case of severe accidents must be
defined.
This checkpoint was derived from “Lesson
Learned” 34.
Implementation:
The available water resources have alreadybeen verified and they are already documented in the existing emergency procedures. As far as is known at present, nofurther measures are required.

Checkpoint 15 (Category II)
Covered by IDA NOMEXEmergency management must be
reviewed to determine further potential for
improvement.
Explanation:
Organisational emergency protection measures must take account of human and organisational factors in emergency management.
In particular, these include the following
aspects:c Consideration given to aggravated physical and mental working conditions inemergency plans and education/training
for staff.
d Clarity regarding the roles and responsibilities of organisations involved in dealing
with an emergency, including interfaces
within and between the organisations.
This checkpoint was derived from “Lessons
Learned” 8, 9, 11, 12, 15, 16, 28, 30 and 35.
Implementation:
This checkpoint is being implemented under
the auspices of IDA NOMEX. The resultant
specific requirements for nuclear plants areto be supervised by ENSI.
The allocation of roles and responsibilities
for the emergency organisations, including
the interfaces, is already being practised andreviewed as part of the regular emergency
exercises.

Checkpoint 16 (Category II)
ENSI has identified the following issues ascheckpoints for improving emergency planning and emergency exercises:a Decision-making processes and pathwaysfor dealing with emergencies.

a The decision-making guidance for emergency management in case of severe accidents (SAMG) at nuclear power plants,
including the newly planned checkpoints
to deal with severe accidents, must be reviewed on the basis of knowledge gained
from the Fukushima accident. In this regard, it is particularly necessary to check:b Qualifications and competences of the individuals involved in dealing with an emergency (including the decision-makers inparticular).

• Whether adequate consideration is given
to a Station Blackout (SBO) of long duration and the simultaneous occurrence of
events in multiple-unit plants;

3 | Presentation of checkpoints• Whether there is any need for measures,
auxiliary resources and equipment thatmust be available to ensure that subcriticality is maintained over the long termin case of severe accidents.
b Consideration given to incidents involving
an SBO of long duration in the planning of
emergency exercises.
c Examination of whether the procedures
are trained often enough during emergency exercises. Particular attention should befocused here on a functioning interorganisation chain of communication across thevarious organisations.
Explanation:
The accident at Fukushima confirmed thatwellprepared emergency procedures arenecessary to enable speedy reactions – asappropriate to the situation – in order tocope with accidents.

Checkpoint 17 (Category II)
covered by IDA NOMEX
A review must determine whether and towhat extent the communication facilities aredesigned with adequate redundancy anddiversity.
Explanation:
In case of a power failure of long duration, it
must be ensured that the communication facilities required to cope with the emergency
are able to function.
For this checkpoint, it is also necessary to
examine the locations where communicationequipment is set up and the accessibilityof such equipment in case of extreme natural
events, so that communication with the
responsible units is guaranteed.
Also as part of this checkpoint, it must be
ensured that the staff required to deal withthe accident can be summoned.

This checkpoint was derived from “Lessons
Learned” 9, 10, 16, 24, 28 and 35.

This checkpoint was derived from “Lessons
Learned” 10, 14 and 25.

Implementation:
The Swiss NPPs have an extensive system
of incident and emergency procedures,
supplemented by the SAMG. ENSI considers
that a new review against the backdrop of
the events at Fukushima would benefit safety. This review should reevaluate the regulatory requirements (ENSI-B12) as well as theimplementation of the SAMG in the plants.

Implementation:
This checkpoint is being implemented under
the auspices of IDA NOMEX. The resultant
specific requirements for nuclear plants areto be supervised by ENSI.

As part of the implementation of the ENSI
directive dated 18.03.2011, external emergency storage facilities were already set up for
all NPPs in Switzerland on 01.06.2011. Amongother items, stocks of boron compounds are
kept in these facilities to ensure sub-criticality
in the long term.

18 | 19

Checkpoint 18 (Category III)
covered by IDA NOMEXCheckpoint 20 (Category III)
covered by IDA NOMEXAt all times, it must be ensured that
adequate staff are available to accomplish
all necessary emergency management
activities.

Transmission of plant parameter data must
be reevaluated with respect to an alternative, independent means of data transmission.

Explanation:
This includes ensuring that the necessary
qualified staff are available not only to thelicenceholders but also to ENSI and other involved authorities and institutions.

Explanation:
This also includes re-evaluation of whether
the transmitted data are adequate to trackand evaluate incidents. The term “data transmission” refers to the forwarding of the plantparameters that are used to track incidents
to the necessary internal and external units.

This checkpoint was derived from “Lesson
Learned” 16.
Implementation:
This checkpoint is being implemented under
the auspices of IDA NOMEX. The resultant
requirements for nuclear plants are to be supervised by ENSI.

This checkpoint was derived from “Lessons
Learned” 8, 23 and 24.
Implementation:
The specific requirements are to be formulated by ENSI on the basis of knowledge acquired by IDA NOMEX.

Checkpoint 19 (Category III)
Measures that increase the organisation’s
ability to react to unexpected events must
be reviewed again on the basis of experience gained from Fukushima.
Explanation:
The general aim of the measures is to ensurethat unforeseen events are virtually excluded.
The review of NPP design to protect against
external events was repeated for this purpose. Nevertheless, unexpected events orsequences of events cannot be totally ruled
out.
This checkpoint was derived from “Lessons
Learned” 1, 9, 10, 12, 15, 17, 18, 22, 23, 24, 25,
26, 28, 29 and 36.
Implementation:
Implementation of this checkpoint is to beclarified within ENSI.

Checkpoint 21 (Category III)
covered by IDA NOMEXThe evacuation concepts must be reviewed,
taking account of knowledge gained fromthe Fukushima accident.
Explanation:
This checkpoint was derived from “Lesson
Learned” 14.
Implementation:
This checkpoint is being implemented under
the auspices of IDA NOMEX.

3 | Presentation of checkpoints

Checkpoint 22 (Category III)
covered by IDA NOMEXCheckpoint 24 (Category III)
covered by IDA NOMEXCoordination with other international partners is required to determine whether andhow an international network for central
international emergency support can be
set up.

The following improvement measures wereidentified regarding information to be provided to the general public:

Explanation:
The services to be provided in an emergency
must be defined. Agreements must be
reached with the participating institutions
for this purpose.
This checkpoint was derived from “Lesson
Learned” 12.
Implementation:
This checkpoint is being implemented under
the auspices of IDA NOMEX. The resultant
requirements for nuclear plants are to be supervised by ENSI.

Checkpoint 23 (Category III)
covered by IDA NOMEX
A review must be carried out to determine
whether the necessary information regarding forecasts of releases and radiation exposure is provided in a timely and continuous
manner in case of an accident.
Explanation:
The correctness of the dispersion calculations must be reviewed, taking accountof several potential sources (multiple-unit
plants, spent fuel storage ponds).
This checkpoint was derived from “Lessons
Learned” 10 and 14.
Implementation:
The specific requirements are to be formulated by ENSI on the basis of knowledge
acquired by IDA NOMEX.

a It must be ensured not only that therequisite infrastructure and the necessary individuals and/or organisations andequipment are available for crisis communication, but also that the necessarymeans of communication are in place. The
relevant precautions must be taken. Regular training must be provided on the associated procedures. This point also includes
a functioning network of experts who areavailable to the media to supply neutral
and objective information.
b Review to determine whether the organisational responsibilities for informing the
public as well as the local authorities andsupport staff are clearly stipulated, andare uniformly understood by all involved
parties.
c A review should be carried out to determine whether the timely communicationof radiological effects, including calculated
forecasts, is also ensured beyond Switzerland’s borders.
Explanation:
This checkpoint was derived from “Lesson
Learned” 14.
Implementation:
The specific requirements are to be formulated by ENSI on the basis of knowledge
acquired by IDA NOMEX.

20 | 21

3.3 Focus Area: Experience Feedback
Checkpoint 25 (Category III)
It is necessary to examine the extent towhich the release of non-nuclear hazardous
substances in case of beycend design basis
events could exert an additional influenceon the accident progress, and which counter-measures are required.
Erläuterung:This checkpoint was derived from “Lesson
Learned” 39.
Implementation:
Implementation of this checkpoint has yet to
be initiated.

In order to continue strengthening the feedback of experience as part of regular supervision activities, ENSI defines the following
checkpoints under the key supervisory pointof the “Learning organisation”:

Checkpoint 26 (Category I)
The process of evaluating and examining theapplicability of national and international
operating experience must be optimisedon the basis of knowledge gained from the
Fukushima accident.
Explanation:
This checkpoint was derived from “Lesson
Learned” 1.
Implementation:
As part of the change to its organisation asof 01.09.2011, ENSI has already taken the firststep of combining the evaluation of national
and international operating experience in
one independent section.

Checkpoint 27 (Category II)
It must be guaranteed that the knowledge
gained from national and international
operating experience (the procedure forprocessing events) in the operators’ organisations reaches all the relevant individuals
and units (including those at group level).
Explanation:
According to ENSI guideline B03, the operators are already obliged to report the resultsof their event analyses to ENSI. However, it
may be possible to improve the procedure.
This checkpoint was derived from “Lessons
Learned” 2 and 15.

3 | Presentation of checkpoints

3.4 Focus Area: Supervision
Implementation:
The monthly reports inform ENSI about theexternal accounts of experiences feedback
that are processed in the Swiss nuclear power plants, and about any checkpoints that are
introduced. As part of the follow-up of the
Fukushima accident, the procedure for experience feedback from the licence-holders
must be re-evaluated.

This Focus Area comprises checkpoints that
relate to supervision by ENSI in general,and in particular those which relate to theregulations. This area also includes efforts atinternational level to harmonise global supervisory requirements in the nuclear sector,
and to have these requirements reviewed byinternational organisations.

Checkpoint 28 (Category I)
It must be ensured that internationally harmonised assessment standards for nuclear
safety are established at a high level ofsafety.
Explanation:
In connection with international reviews,
and especially as regards WENRA (Western European Nuclear Regulators Association), ENSI will continue its efforts to ensurethat internationally harmonised assessment
standards are applied at a high safety level.
This checkpoint was derived from “Lessons
Learned” 1 and 15.
Explanation:
ENSI applies the WENRA reference levels
and takes account of the IAEA standards.
In Europe, a first step was taken with Switzerland’s participation in the EU stress test,
as ordered by ENSI on 01.06.2011.

22 | 23

Checkpoint 29 (Category I)
Greater importance should also be accordedin the international sphere to the recommendations resulting from international
reviews (IRRS, OSART (Operational Safety
Review Team)) and from the regular Periodic Safety Reviews (PSR). The transparency
of ENSI’s supervision and of the operators’safety-related activities must be increased.
Explanation:
As part of its collaboration with IAEA, ENSI
advocates the conduct of international reviews as a binding requirement. In this context, ENSI will undergo a review by an international team of experts under the directionof the IAEA (Integrated Regulatory Review
Service, IRRS) for the second time in November 2011 (after the first such review in 1999).
However, the findings from the international
review should also be processed in the lightof the accident at Fukushima. In addition,
ENSI has undertaken to participate in the EU
stress test.
Moreover, ENSI has enhanced the transparencyof its own activities – especially as regards
measures following the Fukushima accident– by stepping up its public relations work.
WANO, the World Association of Nuclear
Operators, offers its members peer reviewsso that operating experience can beexchanged.
This checkpoint was derived from “Lessons
Learned” 1 and 20.

Implementation:
ENSI had already initiated the 2011 IRRS mission prior to the Fukushima accident. OSART
missions have been carried out in all Swiss
nuclear power plants. WANO peer reviews
are conducted regularly at the initiative of
the operators. Participation by Swiss nuclear
power plants in the EU stress test was ordered by ENSI on 01.06.2011.

Checkpoint 30 (Category II)
ENSI is reviewing the significance of the lessons
from the Fukushima accident for its supervision.
Explanation:
This relates to the following aspects in particular:a Review of regulatory documents (in particular
the ENSI guidelines) to determine whether
they cover all the relevant lessons from theaccident at Fukushima.
b Review of ENSI’s supervisory strategy in thelight of knowledge gained from the Fukushima accident.
This checkpoint was derived from “Lessons
Learned” 4 and 11.
Implementation:
This checkpoint has been partially initiated,
and its implementation must be integrated into
ongoing changes to the regulatory documents.
The change to ENSI’s organisation that was
already planned prior to Fukushima was implemented on 01.09.2011, with the inclusionof the newly-gained knowledge.

3 | Presentation of checkpoints

3.5 Focus Area: Radiation Protection

For the Focus Area of radiation protection,
checkpoints have been identified relating to
the deployment of staff, the monitoring ofsurrounding areas to determine releases ofradioactivity, and the management of radioactive waste in case of severe accidents.

Checkpoint 31 (Category III)
Additional emergency resources must be
kept in readiness for radiation protection incase of severe accidents.
Explanation:
The emergency resources must be stored ina manner which protects them against earthquake and flooding, and which ensures thatthey are accessible. Resources for monitoringradiation protection and the necessary protective equipment must be kept in readinessin the external storage facility, in addition
to the resources available within the power
plant.
This includes the availability of sufficient personal dosimeters and protective equipment,
taking account of measures to guaranteethat such equipment will function in case of
a power failure of long duration, and resources for iodine prophylaxis; these requirements
apply to the plant’s own staff, third party
staff, and to the staff of the emergency andrescue forces.
This checkpoint was derived from “Lessons
Learned” 13 and 16, 17.
Implementation:
An external emergency storage facilitiy was
already set up for all NPPs in Switzerland on
01.06.2011, on the basis of the ENSI directive
dated 18.03.2011.

Checkpoint 32 (Category III)
It is necessary to examine whether the emission and immission measurements in placeon the power plant sites in order to determine the substances released due to activities are guaranteed in case of loss of offsite
power (LOOP) or in case of an emergency.
Explanation:
This also includes a concept for substitutemeasurements in case of a total power failureof long duration which takes account of theexperience gained from the Fukushima accident.
This checkpoint was derived from “Lesson
Learned” 37.
Implementation:
This checkpoint has yet to be initiated.

Checkpoint 33 (Category III)
covered by IDA NOMEX
It is necessary to examine the extent towhich the availability of the meteorological
data required for dispersion calculations isguaranteed in case of extreme natural events.
Explanation:
The meteorological data required for dispersion calculations must be available in caseof severe accidents that result from extreme
natural events such as earthquakes or flooding. A concept for substitute measurements
should ensure that dispersion calculations
can still be carried out in case of a total power failure of long duration.
This checkpoint was derived from “Lesson
Learned” 37.
Implementation:
ENSI is to define the specific requirements forthe implementation of this checkpoint on thebasis of knowledge acquired by IDA NOMEX.

24 | 25

Checkpoint 34 (Category III)
covered by IDA NOMEX
It is necessary to stipulate arrangements
for dealing with contamination in the areasurrounding nuclear plants following severe
accidents.
Explanation:
In case of soil contamination, it is necessary
to examine which resources are suitable tocurtail the contamination and to limit its effects. In case of deployment, the necessary
resources must be available within appropriate periods, or must be kept in readiness.
These resources may include binders (spray
resins, cement), covering materials (to fix
or cover loose contamination) and cleaning
equipment (suction equipment, pumps, grippers and grabs, etc.).
For the case of personal contamination, it isnecessary to examine whether the requisite
resources and arrangements are also adequate for larger groups of people.
This checkpoint was derived from “Lesson
Learned” 13.
Implementation:
ENSI is to define the specific requirements
for the implementation of this checkpointon the basis of knowledge acquired by IDANOMEX.

Checkpoint 35 (Category III)
It is necessary to examine how to deal withlarge volumes of contaminated water, radioactive waste or environmentally hazardous
substances in case of severe accidents.
Explanation:
The stipulated procedures must be integrated into emergency management. It is necessary to examine how the necessary technicalresources can be made available in case of
deployment, and whether resources should
be kept in readiness.
This checkpoint was derived from “Lessons
Learned” 38 and 39.
Implementation:
This checkpoint has yet to be initiated.

Checkpoint 36 (Category III)As part of the emergency planning forsevere accidents, it must be ensured thatsufficient radiation protection staff areavailable on site.
Explanation:
In the stressful situations that must be expected, dose measurements at short noticeand safety-oriented planning of work must
continue to be possible, in order to protect
the plant staff.
This checkpoint was derived from “Lesson
Learned” 17.
Implementation:
This checkpoint has yet to be initiated.

3 | Presentation of checkpoints

3.6 Focus Area: Safety Culture

The accident at Fukushima-Dai-ichi has once
again demonstrated that safety culture mustbe given high priority in the operators’ organisations. ENSI regards this issue as very
important in connection with its supervision,
as reflected (for example) in the specialist
discussions on safety culture that are conducted at regular intervals. Taking account ofimpressions gained from the Fukushima accident, it is nevertheless necessary to examine
whether new knowledge has been gainedin the area of supervision that could enable
better development of the safety culture in
the operators’ organisations.

a Continuous improvement of safety.
b Measures to foster a good safety culture,especially in the areas of maintenancemanagement and change management.
c Prioritisation of safety amid the conflicting
interests of politics, safety and costeffectiveness.
A review is also required to determine
whether the events in Fukushima have yielded new findings which relate to the safetyoriented development of organisations andwhich have not yet received adequate consideration in previous supervisory practice, in
ENSI’s regulations or in ENSI’s strategy.

Checkpoint 37 (Category I)
The knowledge gained from the Fukushima
accident must be taken into account in the
programmes to foster and develop the safety culture in Swiss nuclear power plants.
Explanation:
Knowledge about safety culture gained fromcritical consideration of the Fukushima
accident is reviewed during the regular “Specialist discussions on safety culture” with
the Swiss licence-holders. Moreover, aspectsof safety culture are also covered by regularsupervision in the area of People and Organisation. The following aspects require particular attention here:

This checkpoint was derived from “Lessons
Learned” 1, 2, 3, 7, 15, 21 and 27.
Implementation:
During the specialist discussions on safety
culture and the regular supervision of organisational aspects, ENSI will brief itself on
progress with the ongoing promotion of thesafety culture.
As part of the forthcoming planning of supervision, a key point will be defined for the
purpose of implementing checkpoints in thearea of the management system.
The licence-holders keep ENSI continuously
updated about measures relating to safety
culture by means of monthly and/or annual
reports. These measures are also covered by
the PSR.

4 | Further procedure

26 | 27

4 Further procedure
4.1 Implementationof checkpoints

4.2 Ongoing observationof the Fukushima event

The implementation of the checkpoints derived from the “Lessons Learned” will help tocontinue improving the safety of the Swiss
nuclear power plants: the aim is to carry out
the inspections and tests and to implement
any resultant measures in the timeframe until
2015.

The analysis of previous severe accidents has
shown that it can take several years to record
all the details and to evaluate them. For example, access to the reactor of the stricken
Three Mile Island nuclear power plant was
not possible until years after the accident.
ENSI therefore expects the collection of facts
about the Fukushima accident to continue
for a long time to come. As time goes on,
further “Lessons Learned” will probably bederived from these facts, and more measures to improve safety at the Swiss NPPs will
follow. Accordingly, the checkpoints summarised here should be regarded as anotherinterim step in ENSI’s analysis of the Fukushima accident.

Measures of particular significance for safety
were introduced immediately after the accident at Fukushima, e.g. by the directive dated 18.03.2011 regarding examination of thedesign of Swiss nuclear power plants to withstand extreme natural events such as thosewhich led to the accident at Fukushima.
Those checkpoints still outstanding will betaken into account in the upcoming planningof supervisory activities, and will be coordinated across ENSI’s entire organisation. For
the coming years, ENSI will define key implementation points according to their importance for safety in each case, and will takethese as the basis for its detailed planning ofsupervisory work.

ENSI will continue to obtain and review information about the Fukushima accident, andto incorporate the resultant knowledge into
its own supervision activities. Where indicated, ENSI will issue new directives or initiate
other measures.

5 | “Lessons Learned”

5	Annexe: Brief summaryof “Lessons Learned”
ENSI has carried out a comprehensive analysis of the nuclear accident at Fukushima andhas published the results in two reports (seesection 2). The investigations have revealed aseries of organisational and technical shortcomings which caused the accident and/or
aggravated its damaging effects. The knowledge gained from the analyses completed
by ENSI is summarised here in 39 condensed“Lessons Learned”. These involve not only
ascertained facts but also hypotheses which
ENSI has derived from the available information (as at August 2011). The sequence ofLessons Learned is not determined by theircontent, but is the result of the in-depth
analysis mentioned above.

Lesson Learned 3
Downgraded safety because of costeffectiveness considerations
In its 2010 annual report, the operator’s company wrote that the frequency of equipment
inspections was reduced as part of a costcutting programme.

Lesson Learned 4
Lack of independence for the supervisory
authority (NISA)NISA was part of the Ministry of Industry(METI, Ministry of Economy, Trade and Industry). This resulted in conflicts of interest andnon-transparent decision-making structures.

Lesson Learned 5
Lesson Learned 1
Shortcomings in the development ofa learning organisation
Experience from national and international
events was not given sufficient attention. According to the 2007 IRRS mission to Japan,
events that received no public attention, as
well as events outside Japan, did not lead to
improvement measures in the Japanese nuclear power plants.

Lesson Learned 2
Deficient corporate culture
It appears that a corporate culture became
established in the operator’s organisation
which favours falsification and concealment.

Structural defects in the overall supervisorysystemThe roles and responsibilities of the Japanesesupervisory bodies were not clearly defined.

Lesson Learned 6
Inadequate depth of supervision
The supervisory authority carried out no examination (or only a superficial examination)of safety against tsunamis before the plant
was built and during its operation; this was
the greatest failure.

Lesson Learned 7
Deficiencies in the operator’s safety culture
Safety reviews were omitted or even falsified.
The consequence of this was deficient management of maintenance.

28 | 29

Lesson Learned 8

Lesson Learned 11

Deficiencies during the decision-making
The feed of sea water should have been initiated at an earlier stage. Inadequate communication (due to various reasons) between
the operator’s company, the supervisory authority and the government (Prime Minister)
impeded timely decision-making. The plantparameters required for decision-making
were not continuously available.

Regulatory shortcomings
The emergency measures to deal with severe
accidents were not adequately stipulated in
the relevant laws and regulatory documents.

Lesson Learned 9
Inadequate preparation of
emergency measures
In Japan, emergency measures were prepared by the operators on a voluntary basis.
The existing emergency plans displayed
various defects: inadequate emergency
procedures for technical decision-making
guidance in case of severe accidents (Severe
Accident Management Guidance, SAMG);
faulty communication plan; delayed provision of external emergency assistance; inadequate consideration given to simultaneousdestruction of the entire infrastructure; staff,
including emergency team, insufficiently prepared for an event of this scale. Back-fittingof diversified additional systems to cope withexternal events may only have been undertaken on a partial basis in Japan.

Lesson Learned 12
Shortcomings in emergency planningby the authorities
The local crisis team was not ready to deploy,
and/or was overburdened; in addition, there
were communication problems among all theparties involved. Moreover, the coordinationof international assistance was not adequate.

Lesson Learned 13
Inadequate radiation protection measures
As a consequence of the flooding, personal
dosimeters and protective equipment were notavailable for the staff in sufficient quantities.

Lesson Learned 14
Inadequate information for the public
The public was informed about the expecteddevelopment of exposure to radiation and contamination either inadequately, or too late.

Lesson Learned 15
Lesson Learned 10
Overburdened staff
SAMG measures to mitigate the impact of
a severe accident were not adequately implemented, so extensive releases occurred
over long periods.

Hazards of group dynamics
During the period of operation preceding theaccident, risks were underestimated, warnings
and facts were disregarded, and it is possiblethat “groupthink”, complacency and overconfidence developed within the operator’s management teams.

5 | “Lessons Learned”

Lesson Learned 16

Lesson Learned 19

Stressful working conditions
The accident entailed exceptional physicaland mental stress for the staff, exacerbatedby insufficient knowledge of the actual situation as the accident evolved.

Defects in structural design
The positioning of the spent fuel storage
ponds in the upper sections of the reactor
buildings made it difficult to initiate the necessary emergency measures. In addition, thelines connecting the buildings (e.g. cable andpipe ducts) were not tightly sealed, enabling
the escape of contaminated water or venting
gases from the reactor building.

Lesson Learned 17
No knowledge of the radiological situation
Coping with the crisis was made more difficult because the radiological situation was
unclear, especially in the initial phase of theaccident.

Lesson Learned 18
Inadequate design to withstandexternal events
The operator is responsible for the safety of
its plant. Its assumptions regarding the magnitude of the maximum credible earthquake aswell as the frequency and height of tsunamis
were too low. The design of the plants, which
was based on these assumptions, was therefore inadequate. The extent to which proof of
appropriate tsunami design was examined by
the supervisory authority is not clear.
As a result of the inadequate design, there
was flooding of the emergency diesel generators, the auxiliary cooling water system andthe decay heat removal systems. This flooding
led to a total and long-lasting failure of the installed power and cooling water supplies, andto the failure of heat removal.
The single air-cooled diesel generator in unit
6 of Fukushima-Dai-ichi was the only one thatwas still ready to operate, and it was possible
to make subsequent use of this generator todeal with the accident in units 5 and 6.

Lesson Learned 20
No obligation for safety reviews
Despite international reviews (in connection with the WANO and OSART missions)and the Periodic Safety Review (PSR), weak
points regarding safety were not rectified
by the Japanese bodies. Not least, this was
because the improvement measures specified by WANO (World Association of Nuclear
Operators) are commitments entered intoby the operator itself – and, moreover, they
are not transparent to outside observers. The
experts from OSART (Operational Safety Review Team) drew up their recommendations
on behalf of the IAEA, but there is no direct
obligation on the licence-holders to implement the checkpoints. In the case of the PSR,
the internationally valid requirements were
implemented to differing degrees.

30 | 31

Lesson Learned 21

Lesson Learned 24

Unfavourable and incorrect action
by the operator
Due to a technical regulation requiring compliance with a maximum shutdown cooling gradient, the manual shutdown (probably of one
train) of the emergency condenser for unit 1
took place ten minutes after the occurrence ofthe earthquake. The valves of the emergency
condenser were later closed locally, without theknowledge of the shift leader. As a result, theemergency condenser was no longer available
to deal with the accident at a later stage.

Local ambient conditions hinder
emergency measures
The ambient dose rate in the control rooms rose
sharply (with very sharp temporary increases),so the number of operators had to be reduced
and all the operators had to be evacuated attimes. Comparable conditions affected theemergency room (the workplace of the emergency staff on site). Here too, the radiologicalconditions, the deterioration in communication
conditions and the failure of the lighting imposed constraints on the ordering and implementation of emergency measures.

Lesson Learned 22
Restoration of supply equipment was hindered
The implementation of emergency measures(SAMG) was made more difficult due to impeded accessibility resulting from damage toplant components and rooms (debris), as well as
power failures following the tsunami. Connections for the mobile power supply equipment
had to be set up from scratch, and they did notwork at first. The provision of the sea water feed
may have posed technical problems.

Lesson Learned 25

Lesson Learned 23

Lesson Learned 26

Failure of electrical equipment
Failures of the lighting and plant instrumentation occurred due to the total failure of theemergency electrical power supply system inunits 1, 2 and 4. These plants had to be operated
under the most difficult conditions. For example,
there were failures of the filling level indicator
for the reactor pressure vessel.

Problems with venting
There were difficulties with carrying out ventingof the containment. The electrical actuators forthe valves were no longer available as a resultof the power failure. Operation from the control
room therefore ceased to be possible. Manual
local operation of the valves was prevented because access to the components was impeded.
In addition, excessive ambient dose rates meantthat the opening of the valves had to be interrupted several times.

Communication equipment was
not ready to operate
In some cases, the means of communication for
the emergency staff and for the transmission of
instructions were not initially ready to operate.
As well as the external (fixed) telephone andmobile telephone networks, this also applied tointernal communication equipment for the NPP
at Fukushima Dai-ichi.

5 | “Lessons Learned”

Lesson Learned 27

Lesson Learned 31

Shortcomings in maintenance
Unofficial sources suggest that importantsafety equipment was not adequately maintained. It is not possible to give a conclusive
assessment of the accuracy of thesesuggestions.

Inadequate power supply
The power supply was inadequately designed
to withstand external events, and was insufficiently diversified.

Lesson Learned 32
Lesson Learned 28
Delays for technical reasons
There may possibly have been delays in supplying sea water, because it was impossible
to reduce pressure in the reactor pressure
vessel. In addition, the volume flow rate of
the cooling water that was supplied was notadequate, given the decay heat power thatwas still present.

Lesson Learned 29
Inadequate precautions against
hydrogen explosions
It was not foreseen that explosions could occur in the reactor building due to leakagesof hydrogen from the containment. Accordingly, no provision was made for measures toprevent hydrogen explosions in the reactor
building outside of the containment.

Inadequate protection of safety equipment
The tsunami impaired many items of safety
equipment that were required to deal with
the incident. Sediment may have clogged thecooling water intakes, and the air intakes on
the buildings may have caused water penetration.

Lesson Learned 33
Deficient cooling of the spent
fuel storage ponds
A failure of the cooling system for the spent
fuel storage ponds was previously regarded
as a minor risk, because spent fuel assemblies
generate comparatively little heat, and theperiod and technical possibilities for restoring the cooling system were considered to
be non-critical. At Fukushima, however, there
were long delays and technical difficulties
with restarting the cooling system because of
severe damage to buildings and the accumulation of accidents in multiple plants.

Lesson Learned 30
Bottlenecks relating to equipment and staff
for the emergency measures
Implementation of the emergency measures
was made more difficult because the units
were not independent of one another interms of equipment and systems. This situation included jointly used pipe and cableducts, supply of compressed air, emergency
diesel generators and common exhaust air
stacks. There were also staffing overlaps between the units. This may have caused staffing bottlenecks when it came to dealing withthe accident.

Lesson Learned 34
Insufficient reserves of water
It is possible that no major internal reservesof water were available to feed the reactor
pressure vessel, because the supply of sea
water was started as early as 12.03.2011.

32 | 33

Lesson Learned 35

Lesson Learned 39

Insufficient reserves of boron
It is possible that no major reserves of boron
were available, because – according to press
reports – deliveries of boron from the US
started only a few days after the occurrenceof the event.

Hazardous substances
In addition to the release of radioactive substances, there were releases of other substances (e.g. oils, lubricants and corrosion
protection agents) which posed a hazard to
the health of the public and to the ecosystem.

Lesson Learned 36
Availability of passive systems
under accident conditions
With regard to unit 2, TEPCO and NISA drew
the conclusion that the Reactor Core Isolation Cooling System probably continued tooperate even after the battery capacity was
exhausted (for approx. 30 hours). This meansthat operation without the control technology equipment that was actually required
was still possible and expedient under theconditions of an extreme accident.

Lesson Learned 37
Environmental monitoring was impaired
Adequate radiological monitoring of the environment was impossible directly after theaccident, because the earthquake and thetsunami had damaged and/or destroyed therelevant equipment and systems.

Lesson Learned 38
Inadequate disposal of water
Large quantities of radioactively contaminated water were generated during the accident. The responsible parties had – and still
have – major difficulties with the intermediate storage, cleaning and disposal of this water and with avoiding its discharge into thesea and/or the soil.

6 | List of abbreviations

6 List of abbreviations

BEB

Spent Fuel storage ponds

BK

Federal Chancellery

EDI/FDHA

Federal Department of Home Affairs (FDHA)

EJPD/FDJP

Federal Department of Justice and Police (FDJP)GENORA

Protected room for the ENSI emergency organisation

HSK

Principal Nuclear Safety Division

IAEA

International Atomic Energy Agency

IDA NOMEXInterdepartmental Working Group to Review Emergency Protection
Measures in case of Extreme Events in Switzerland

IRRS

Integrated Regulatory Review Service

NPP

Nuclear power plant

MADUK

Monitoring network for automatic dose rate measurement in the vicinityof nuclear power plants

MeteoSwiss

Federal Office of Meteorology and Climatology

METI

Ministry of Economy, Trade and Industry (Japan)

MSU

Catalogue of measures against severe accidents

NFO

Emergency organisation

NISA

Nuclear and Industrial Safety Agency (Japan)

OSART

Operational Safety Review TeamPEGASOSProbabilistic Seismic Hazard Analysis for Swiss Nuclear Power Plant Sites

PRP - PEGASOSPEGASOS Refinement Project

PSA

Probabilistic safety analysis

PSR

Periodic Safety Review

RPV

Reactor pressure vessel

SAMG

Severe Accident Management Guidance

SBO

Station Blackout

SED

Swiss Seismological Service

TEPCO

Tokyo Electric Power Company

U.S. NRC

United States Nuclear Regulatory Commission

VBS/DDPS

Federal Department of Defence, Civil Protection and Sports (DDPS)UVEK/DETEC

Federal Department of Environment, Transport, Energy andCommunications (DETEC)WANOWorld Association of Nuclear Operators

WENRA

Western European Nuclear Regulators Association

Fukushima
37° 25‘ 26.57“ N, 141° 1‘ 56.87“ E11.03.2011

Issued by
Swiss Federal Nuclear Safety Inspectorate ENSI
Industriestrasse 19
CH-5200 Brugg
Phone +41 (0)56 460 84 00
Fax+41 (0)56 460 84 99
info@ensi.ch
www.ensi.ch
ENSI-AN-8001
Published 29.10.2011