ANTICIPATION AND RESILIENCECONSIDERATIONS A DECADE AFTERTHE FUKUSHIMA DAIICHI ACCIDENT

THE PUBLIC EXPERTON NUCLEAR AND
RADIOLOGICAL RISKS
IRSN’s mission includes providing expertise,research projects, protection, planning forthe future, and sharing resources to thebenefit of the French public authorities andthe public at large.
IRSN can boast the unrivalled capacity to
combine the expertise of researchers andexperts in order to plan ahead for the questionsof the future about nuclear and radiologicalrisks changes and how to control them.
IRSN teams aim to ensure that society atlarge is aware of their works and can share
their knowledge. With this approach, they help
to improve a wide access to information
and boost dialogue with stakeholders.

IRSN contributes to French public nuclear
security and safety policies, as well as health,environmental and crisis management
policies.
As a public industrial and commercial
establishment supervised jointly by the
French Minister of the Environment, theFrench Minister of Defence, and the French
Ministers of Energy, Research and Health,
IRSN comprehensively integrates its initiatives
in the Government’s modernisation policies
with its risk management approach and byimplementing a CSR policy.

IRSN HAS
AROUND

1,770

EMPLOYEES
including manyengineers,
doctors,
agronomists,
veterinarians,
technicians,
experts andresearchers.

To carry out its missions,
IRSN has

AN ANNUAL BUDGET
OF AROUND€275 million

“Accidents appear to be the result of highly complex coincidences which could
rarely be foreseen by the people involved. The unpredictability is caused by the large
number of causes and by the spread of information over the participants… Accidents
do not occur because people gamble or lose, they occur because people do notbelieve that the accident that is about to occur is at all possible.”
Wagenaar and Groeneweg, 1987

2

ANTICIPATION AND RESILIENCE - IRSN, 2021

EXECUTIVE SUMMARYOn March 11, 2011, an earthquake ofvery high magnitude (M=9.1) off the coast of
Tohoku province in Japan caused a tsunamiof an unprecedented magnitude, devastating
part of the east coast of the island. Several
nuclear power plants (NPPs) were affectedby these events. At the Fukushima Daiichi
NPP, the disaster could not be avoided: thefusion of the cores of three reactors resulted
in radioactive releases into the environmentthat led to lasting contamination of theterritories and very heavy psycho-social andeconomic consequences for the populations
living near the site and for the entire country.
This accident also had an impact on thegeneral state of health of the people mostaffected.
Like the accidents at the Three Mile
Island NPP in the United States in March
1979 or at the Chernobyl NPP in the USSR in
April 1986, the Fukushima Daiichi accidentof 2011 marked the history of civil nuclear
power and nuclear safety. Each of these
accidents had a significant impact on thedevelopment of safety approaches aimed
at preventing accidents and defining
provisions to limit their consequences asmuch as possible, on the preparation andmanagement of emergency and postaccident situations, supported by thecontinuous improvement of knowledge insafety and radiation protection.
Each accident has been analysed, thesafety demonstration of the facilities has

been completed, new research programs
have been initiated to improve knowledge,
and measures have been taken to ensurethat it doesn’t happen again. However,
although necessary to prevent events
previously unimagined or not taken into
account, this approach is more reactive thanproactive. Ten years after the accident at the
Fukushima Daiichi NPP, at a time when new
measures have been defined to improve thesafety of French nuclear facilities, it isimportant to look back at what this accident,
like others before it, teaches us about ourability to anticipate, our ability to identify
signs that could call into question theapproaches adopted to control risks ortheir implementation. What does it teachus about our state of preparedness toface a major accident and manage its
consequences in the short, medium andlong term?
The degradation of the safety of nuclear
installations can be insidious; it is essential
to remain attentive, at all times, to all signs
that could reveal a drift in this area. The
absence of any serious incident or accident
in recent years should obviously not lead us
to consider that safety has been achieved,
as it is never definitively achieved. On thecontrary, it is necessary to continue theefforts undertaken for many years in thefield of nuclear safety and radiation
protection, to more effectively exploit andshare experience feedback from theoperation of installations, to ensure the

ANTICIPATION AND RESILIENCE - IRSN, 2021

3

proper application of existing safety
approaches and to develop new ones,
particularly in the treatment of rare eventswith potentially severe consequences, forwhich expertise cannot be based solely on
established and definitive knowledge.
Assessing risks and evaluating theirimpact according to various hypotheses is,in a situation of high uncertainty, highly
complex. The current pandemic illustrates
this all too well. There is still room for
improvement in risk assessment, in theunderstanding of the behaviour of installationsin the event of an accident, in the evaluationof the consequences of accidents, and in
determining how best to manage them.
This must be done collectively, with theparticipation of all the relevant stakeholders.
This primarily involves a more efficientuse of experience feedback, based on
systemic approaches to better account forthe complexity and dynamics of the interactions
between the various components (human,organizational, technical, and managerial)that contribute to risk management. The aim
is to gain a better overall appreciation of thefactors that facilitate or, on the contrary, arelikely to disrupt the deployment of the risk
control measures chosen. Models must
be developed based on knowledge ofthe processes involved in the design andoperation of nuclear facilities. The new digital
tools that have emerged in recent years offer
new opportunities for analysis, exchange andsharing, which should be fully exploited.

4

ANTICIPATION AND RESILIENCE - IRSN, 2021

The safety approach for nuclear facilities
is built on a defence in depth concept, basedon the ability to anticipate risks and limit
the consequences of situations consideredplausible. The application of this approach
must always be improved, and thecompliance of the installations with theassociated requirements must be ensured
on a permanent basis. The accident at the
Fukushima Daiichi NPP nevertheless raises
questions about the ability to anticipate
combinations of events and failures likely toaffect nuclear installations, particularly rare
events whose consequences may be severe.
Assessing the risks associated with thesesituations remains difficult because the moreunlikely the situations under consideration,
the greater the uncertainties, and no approach
can completely rule out their occurrence.
The development of new, multidisciplinary
approaches must make it possible to advancein the knowledge of these phenomena andthe associated risks, in particular those which
may result from natural hazards. In addition,in order to better address the diversity ofreal situations that may occur and theirpotentially unexpected nature, it is necessary
to strengthen the response and adaptation
capacity of people and organizations tofoster the conditions for resilience.
Like the one at the Chernobyl NPP before
him, the accident at the Fukushima Daiichi
NPP confirmed, if necessary, the complex
and multidimensional nature of recovery after
a nuclear accident, which affects territories
and populations for decades. At every stage,

the management of such a situation must
involve the affected populations. Initially, thiswill mean involvement in the radiologicalcharacterization process (e.g. possibilities totake measurements in the context of sharedexpertise) and then in the decision-making
process regarding living conditions. In any
case, the intervention of experts must obey
ethical principles, in particular respect for
the autonomy and freedom of choice anddecision making of the persons affected.
In any event, evacuation, one of theactions to protect populations in the eventof an accident, requires preparation, as itprofoundly affects the living conditions of theevacuees, whether they are volunteers or not.
For its part, the lifting of evacuation orders
creates a difficult choice for the affectedinhabitants. Ten years after the accident at
the Fukushima Daiichi NPP, the return rate of
the inhabitants is about 20%.
To be ready to manage an accident at
a nuclear facility and its consequences,in the emergency or recovery phase,
emergency exercises help professionalize
experts and contribute, in the event of an
emergency, to individual and collective
resilience in the face of an unexpected
situation. The ongoing efforts to make these
exercises more realistic should be sustained:
longer exercise length, involvement of agreater number of participants - particularly
from the civil society -, more unexpectedscenarios, more extensive deployment in thefield of equipment and people to characterize

the contamination of the environment, people
and property, strong media pressure...
This report is intended for anyone
interested in nuclear safety issues, and moregenerally in risk management in any capacity,
whether public or private decision-makers,
institutional or non-institutional experts,
members of the public, etc. It invites us to
examine current practices in these fields,
how each actor contributes to the risk
management of nuclear installations, and theneed to develop other approaches to better
assess the risks, both in the context of normal
operation of installations and in accident
situations. Better assessment to prevent
nuclear accidents, better preparation tohandle them if they do occur, which cannot
be excluded: it is the responsibility of theexperts, including IRSN, to continue thediscussions, to improve knowledge, and todevelop new, more systemic approaches.
The purpose is to enable decision-makers tomake “well-informed” decisions in view of thechallenges of the protection of the people
and the environment, and the safety of theinstallations.
This report has no other ambition than topropose a few ideas to encourage discussions
to this end.

ANTICIPATION AND RESILIENCE - IRSN, 2021

5

TABLE OF CONTENTSEXECUTIVE SUMMARY......................................................................................................... 3

1 	EXPERIENCE FEEDBACK: A WEALTH OF INFORMATION WHICH MUST BE
BETTER USED.............................................................................................................. 9“The accident” and safety improvement............................................................................ 9Experience feedback and sharing information internationally....................................... 11
Towards a more effective treatment of experience feedback?...................................... 132 	
ROBUSTNESS OF FACILITIES AND ABILITY OF PERSONNELAND ORGANIZATIONS TO RESPOND TO UNEXPECTED SITUATIONS..................19
Improving the robustness of levels of defence in depth................................................. 21
	The independence of defence in depth levels with respect to events likely
to affect a facility............................................................................................................... 22
	The ability of sites to adapt to a wide range of situations and unexpectedcircumstances to be improved to complement the above provisions...........................233 	
HOW CAN WE PLAN FOR THE RISKS INHERENT TO COMBINED
MALFUNCTIONS OR EVENTS CONSIDERED AS HIGHLY IMPROBABLE?.............27
Considering rare events as part of nuclear safety........................................................... 28
Stage one: combining deterministic and probabilistic approaches...............................28
	“Practical elimination”: a means of taking the prevention of situations
with serious consequences a step farther....................................................................... 29
The accident at the Fukushima Daiichi NPP: appraising natural risks..........................31
New approaches to characterize natural hazards........................................................... 31
Continuing development programmes to further enhance risk assessments..............34

4 	
RECOVERY AFTER A NUCLEAR ACCIDENT:AN ESSENTIALLY SOCIETAL PROCESS.................................................................. 35
Recovery: a complex, multi-dimensional landscape...................................................... 35
What challenges for those involved in the rehabilitation process?............................... 38
Dialogue, independence and shared expertise............................................................... 42

6

ANTICIPATION AND RESILIENCE - IRSN, 2021

5

POPULATIONS AFTER THE EVACUATION...............................................................43	Evacuation: a protective action which is delicate to implement
and has inherent risks........................................................................................................ 44
 vacuation and rehousing have significant effects on the living conditions
Eand health of the people affected..................................................................................... 45
	After lifting the evacuation orders: the tough decision between returningor staying away ................................................................................................................. 46
Ten years later, few people have returned........................................................................ 47
	Evacuation and return of the population: What lessons can be learned fromthe Fukushima Daiichi NPP accident?............................................................................. 49
 he difficulties inherent to the long-term management of the consequencesTof significant regional contamination............................................................................... 51

6EMERGENCY EXERCISES, LIMITS AND OPPORTUNITIES.....................................55

	Exercises, a key factor in improving the response of an organization in the eventof an emergency….............................................................................................................. 55... However significant intrinsic limits remain.................................................................. 56
Exercises, sources of resilience........................................................................................ 56
	Lessons learned from the Fukushima Daiichi NPP accident in terms of emergency
management...................................................................................................................... 57
Exercises aiming to take things a step further….............................................................. 59

ANTICIPATION AND RESILIENCE - IRSN, 2021

7

8

ANTICIPATION AND RESILIENCE - IRSN, 2021

1

EXPERIENCE FEEDBACK:A WEALTH OF INFORMATION
WHICH MUST BE BETTER
USED

Experience feedback is intended to allow parties to learn lessons fromevents affecting nuclear facilities in order to improve their performances,
particularly in terms of risk control. The accident at the Three Mile Island
nuclear power plant in the United States in 1979 led to increasing international
concern over experience feedback and closer attention being particularly
paid to early warning signs. It was then accepted that an accident can becaused by a series of multiple material, human or organisational failures, andthat these failures can occur during minor incidents which can be handled
in a manner which triggers far more serious accident scenarios. Since thistime, experience feedback has been repeatedly exchanged at national andinternational level. And how is experience feedback handled today? Can theapproach be improved, and how?

“The accident” and safety improvement
Safety can primarily be improved thanks to technical progress based on knowledge
obtained, particularly from past accidents. Such knowledge is then used to reconsider
the design of the facilities currently in use and those in the development phase. Thisapproach was applied to the accident at the Three Mile Island (TMI) nuclear power plant(NPP) and led to multiple improvements to safety at French nuclear power plants: theoperation of facilities and associated instrumentation, the confinement of radioactive
substances, the deployment of emergency plans, etc. Many safety investigations werecarried out after this accident, and particularly focused on severe accidents, andprobabilistic safety studies were widely developed, leading to significant improvements
to safety many years later, e.g. for reactor shutdown states. In the same way,

ANTICIPATION AND RESILIENCE - IRSN, 2021

9

1

complementary safety assessments1 (CSA), carried out at all basic nuclear facilities inFrance within one year of the accident at the Fukushima Daiichi NPP in 2011, led to thedefinition of a “hardened safety core” concept comprising a certain number of items ofequipment which can be used to manage extreme natural risks, and progressively
adapted to the different types of nuclear facilities.
These historical accidents have provided lessons on how to structure technicalapproaches, highlighting “socio-technical” aspects of nuclear safety, i.e. those which
integrate interactions between equipment, personnel and organizations. On this basis,
the analysis of the Three Mile Island NPP accident highlights the importance of “humanfactors” and has led to many types of progress in terms of the structure of operational
teams (introduction of a safety engineer), the ergonomics of control rooms and operatingprocedures, and crisis management. After the Chernobyl NPP accident in 1986,
organisational, managerial and “cultural” aspects of risk management were reconsidered,particularly decision-making processes and the importance of arbitrating safetyconcerns and other types of concern. After the Fukushima Daiichi NPP accident,
improvements programmes focused on external hazards, any combined external
hazards, and short-, medium- and long-term emergency and recovery management. In
parallel, more political issues relating to “risk management” arise.
Risk management and the control of the nuclear industry were already consideredin this way before, to varying degrees depending on the country (Tokaï Mura accident inJapan in 19992, and the near-miss at Davis Besse in the United States in 20023). In
France, the media and political crisis in the wake of the Chernobyl NPP accident in 1986,
followed by health crisis in the 1990s (contaminated blood, mad cow disease, etc.) haveprogressively modified the French nuclear safety and radiation protection system. Many
years later, these changes led to the creation of a government appraisal body, operating
independently to industry (IRSN, in 2002) and a safety authority, operating independently
from public authorities (ASN, in 2006).
The impact of the different factors in nuclear safety, whether technical, sociotechnical or socio-political, has constantly varied based on the lessons learned fromeach of these major accidents. In 2020, safety is no longer considered as merely the
1 European stress-tests.
2 On 30 September 1999 at Tokai-Mura in Japan, a “criticality” accident took place at a uranium processing plant
operated by Japan Nuclear Fuels Conversion Company (JCO): nuclear chain reactions were triggered in
uncontrolled conditions, releasing radiation and radioactive gases and severely irradiating several workers, two ofwhom did not survive. The accident was brought under control around twenty hours after it started.
3 The vessel head of one of the power plant’s reactors was found to be seriously damaged by the metal corrosion ofpenetrations, caused by boric acid.
10

ANTICIPATION AND RESILIENCE - IRSN, 2021

1
result of the technical reliability of facilities. Will these changes to nuclear safety lead tothe improved characterisation and prevention of accidents, and limit the inherent
consequences? Is it besides necessary to characterise the accident in order to planahead for solutions?

Figure 1: Variation in the weight of the different componentsof nuclear safety.

Technical
processes

Humanfactors

Management andorganisational factors

Variouscriticality
accidents…

TMI,
1979

Chernobyl,
1986Ú Technical system Ú Socio-technical system

Risk management

Davis Besse,
2002

Fukushima
Daiichi, 2011

Ú Socio-political system

Experience feedback and sharing informationinternationally
After each major accident, the limits of plausible scenarios are pushed slightly further
back. To what extent could the events behind the accident have been planned for?
According to the international experts assigned by the Committee on nuclear
regulatory activities (CNRA) of the OECD Nuclear Energy Agency, in 2019, “almost all
recent significant events reported at international meetings had already occurred in someform or other”4. A similar conclusion had been reached in 1979, when analysing the TMI
accident: the report by the Kemeny investigation board indicated that several earlier
incidents could have been considered as “warning signs”, however these incidents were
not sufficiently analysed. In addition, the lessons learned were not widely advertised, orwere not communicated early enough. To give just one example, a similar incident had
4 https://www.oecd-nea.org/jcms/pl_14142

ANTICIPATION AND RESILIENCE - IRSN, 202111

1

occurred at Beznau, in Switzerland, in 1974, on a reactor designed by Westinghouse,
however no information was provided to either the US authority or the rival designer,
Babcock and Wilcox, designer of the TMI reactors. In 1977, a serious event occurred at
the Davis Besse power plant in the United States, with exactly the same scenario than the
one at TMI two years later. However, at TMI, operators understood what was actually
happening too late to prevent the core from melting down.
At the time, it was considered that “if the event had no real consequences, it was
not important”. International transparency and the sharing of experience were thendetermined as contributors to improving safety, as well as the facility design policy,
based on the defence in depth concept, or research. On this basis, the near-misses
at Davis Besse (United States, 2002) and Barsebäck5 (Sweden, 1992) had significant
consequences in many countries, firstly on the replacement or reinforcement of theoperational monitoring of primary side components produced using nickel alloys (trade
name: Inconel), and secondly on core cooling systems in accident conditions.
However, are such events systematically considered as important when handlingexperience feedback?
The design basis of facilities were reconsidered after the Fukushima Daiichi NPP
accident, based on extreme events and, more specifically, combined natural hazards.
This question was also clearly on the table in France, after the partial flooding of theBlayais power plant in Gironde in December 1999. Physical changes (raised levees,
provisions to protect rooms housing safety equipment from flooding, etc.) andorganisational changes (special operating rules6, changes to operator emergency plans7),
and later the launch of formal safety requirements (creation of an ASN flooding guide
published in 2013), were the main result of experience feedback from this “incident” (theflooding led to the loss of several safety systems) for all basic French nuclear facilities.
In fact, the partial flooding of the Blayais power plant and how operators and Frenchsafety bodies handled this flooding only appear to have been noticed (or rediscovered) atinternational level after the Fukushima Daiichi NPP accident, despite the fact that thelessons learned from this event in France were presented at several international
conferences. In June 2011, the Fort Calhoun power plant in the United States was largely
5 A steam leak on the boiling water reactor cooling system damaged the cladding on nearby pipes, carrying thefibreglass to the back of the building. The fibres clogged the filters at the core cooling pump inlet.
6 Flooding particular operating procedure: operating rule aiming for example to reinforce protective provisions atsites if flooding is forecast.
7 Consideration of events likely to affect all facilities at one single site.

12

ANTICIPATION AND RESILIENCE - IRSN, 2021

1
flooded after the Missouri river reached high water levels. Why weren’t the lessons
learned from the Blayais incident in France taken into greater consideration outside of
the country? In the same way, can we consider that events around the world have been
analysed appropriately in France?
The Blayais incident is not a one-off example, and reflects the difficulties inherent
in processing and transmitting experience feedback at international level. In order tobe identified as a “source of shareable improvements”, lessons learned from experience
feedback must be considered as transposable and refer to issues which industrial firms
and regulating authorities view as worth investing in, in terms of engineering, research,etc. On the other hand, it would appear that, if the topic raised is too specific (to the power
plant site, to the power plant technology, to local weather conditions, to an operator’sorganization, or even, more generally, to the “assumed” culture8, etc.), the lessons learned
will be deemed too complex to use and apply generally, as the scope is off the beaten
path and the assumption must be made that similar events could occur at other facilities,
at other locations, with other technologies, and with other organisational cultures.

Towards a more effective treatment of experience
feedback?
A question of time
Learning lessons from major accidents or key events is frequently a timeconsuming process and applying safety improvements can take even longer. While
initial technical conclusions can frequently be rapidly identified, as was the case after the
Fukushima Daiichi accident, a more in-depth analysis of experience feedback and eventsis required, considering the full level of complexity inherent to the many different aspects
at play (technical, human, organisational, managerial and political factors), in a context ofdifferent dynamic trends. This process frequently leads to technical or organisational
modifications, deployed over years, or even decades, after the completion of researchand development works and studies.
In this context, how can we be certain to reach all possible conclusions from theavailable information after an accident when media and political pressure often push8 The concept of “safety culture” arose after the Chernobyl NPP accident to indicate the relationship between theaccident and the “assumed” intrinsic Soviet regime culture, however this culture has never been seriously analysedor characterised.

ANTICIPATION AND RESILIENCE - IRSN, 2021

13

1

operators to implement rapid material and organisational modifications and authorities
to require improvements in the shortest possible time-scale? Once initial analyses havebeen completed, and the initial improvements required identified, how can we ensure thecontinuity of experience feedback, whose timeframes are sometimes incompatible withthe sustained pace of safety assessments and industrial imperatives?
In short, urgency should not obscure the fact that it is also necessary to take the time
for analysis, to draw all the relevant lessons from an accident, in order to avoid a similar
scenario happening again or that factors that proved to be key factors in the aggravationof a situation could once again be triggered.

Gaining knowledge and learning lessons
Experience feedback from incidents and accidents undeniably represents a wealthof information for improving the safety of nuclear facilities. However, it takes strengthof character to use this information effectively and appropriately. It is important to not
simply issue preliminary conclusions and analyses, which are frequently fragmentaryand could downplay the root causes of events and provide incomplete explanations:equipment failure, operator error. More in-depth questioning is necessary to avoid masking
any potential transpositions and inhibiting the general nature of the lessons to be learned,
but this process takes time and data on how the event occurred must be collected.
Matters such as how on-site teams managed the situation, during the Fukushima
Daiichi NPP accident, finding back-up solutions while exclusively using resources available
on the site, and reaching decisions with potentially tragic consequences, must all be studied
and conclusions can only be reached on the basis of precise data reflecting the actual
situation in terms of the intentions, decisions and actions of all operators. Research inhumanities and social sciences launched after the accident on this basis is starting to bringin knowledge. This knowledge must be used to further deepen the analysis of the accident.
The same applies for “incidents” (renamed “significant events” in the early years of
this century) which require formal and regulated declarations. Once again, a wealth of
information is available and the conclusions reached must not simply refer to technicalaspects. These events are “monitored” as non-compliances, they are analysed as warning
signs, reliability data for equipment used in probabilistic studies is updated, studies arelaunched, as well as research, potentially. However, they must be more extensively used
as input to further knowledge of how French facilities operate, operating difficulties, both

14

ANTICIPATION AND RESILIENCE - IRSN, 2021

1
material and organisational complexities, which will all lead to operating limitations andnegatively affect the workers performing these tasks on a daily basis.
These events are often systemic, and analysis must take this fact into account.
Causal relationships are not linear, static or pre-determined in actual accident
situations, even if post-accident reconstructions can give this impression. The sociotechnical systems involved are too complex and dynamic for such an assumption. A
systemic approach is required in order to incorporate this complexity and the interactions
between the different system components, and ensure that the analysis is pertinent.
Accident analyses must not simply involve the identification of independent causes,
but attempt to understand the bigger picture.
“Models” must be developed for this purpose, based on current knowledge of thephenomena influencing the management of design and operating phases for nuclear
facilities: which factors help to control risks? How do they occur? With this approach, theevent must not be considered as a “non-compliance” to be recognised, requiring an ad
hoc correction based on the direct and visible causes (local design fault, “undisciplined
action”, “inadequate skills”, etc.) for which a party or a group is responsible. The event is
the outcome of the failure (or success, as the event is detected and declared) of lines ofdefence, which, although not systematically identified as such in the safety analysis
reports provided by operators, help to control risks. The aim is to identify and understanddecisive factors, which disturb or simplify the implementation of the risk control
provisions selected by the socio-technical system. Actual “root causes” can be identified
using a systemic approach to incidents and accidents. The aim is not to conclude thatprofessionals make mistakes, but rather to identify which factors led to the errors
identified (missing or incorrect information, not enough time allocated to a task, unsharedtargets, unsuitable tools, etc.), over and beyond assumed individual characteristics(skills, cognitive bias, motivation, fatigue, miscellaneous ability, etc.).
The safety of facilities and operations can clearly be sustainably improved byinfluencing these causes, over and beyond the benefits of technical conclusions alone.

Opening up to conclusions from other sectors in order to consolidate analysis
reference documents
In the same way, it is essential to learn lessons from incidents and accidents in othersectors in order to add real-life reports to experience feedback. Should the historical

ANTICIPATION AND RESILIENCE - IRSN, 202115

1barriers between industrial segments be considered as obstacles to sharing conclusions
reached based on these accidents?
Some industrial accidents in France, such as the explosion at AZF (Toulouse, 2001),
the derailing at Brétigny-sur-Orge (2013) or the fire at Lubrizol (Rouen, 2019), provide
examples of sources of experience feedback on maintenance policies, the effects ofsuccessive restructuring programmes, inspections and compliance with regulations, notforgetting emergency management and communications. Remarkable analyses focusedon the accidents involving the NASA space shuttles in 1986 (Challenger) and 2003
(Columbia), and identified the factors which led to these accidents, and which can also
be found in many incidents or accidents in the nuclear field.
Some conclusions could undoubtedly be transposed to the nuclear sector. Accident
analyses can lead to a number of helpful concepts in relation to “minor” incidents and“major” accidents. For example, concepts such as the normalisation of deviance, thereversal of responsibility for providing proof in decision-making processes, organisational
complexity and bureaucratisation triggered by a plethora of rapid changes, could be used
to a greater extent to characterise the root causes of tangible non-compliance.

Using new technologies to analyse experience feedback and pass on
information
New digital tools have emerged in recent years, complementing the strict
methodology required for the analysis of experience feedback, and offering new
options for analysis, exchange and sharing.
Artificial intelligence, particularly machine learning, and natural language processes(for processing input data in the form of “stories” of events) are currently offering a clear
means of improving analyses. We can now construct operational analysis support
systems for experts, but also decision-makers. Despite this, algorithms cannot replace
experts, “weak signals” can only be identified from an in-depth analysis of events, and thetechnological, methodological and organisational conditions for success must be undercontrol in order to achieve actual results.
Thanks to technological progress over the last decade, new solutions exist forsharing information at national and international level. Clearly convenient means ofcommunication now exist to simplify virtual meetings. But the real progress lies in the

16

ANTICIPATION AND RESILIENCE - IRSN, 2021

1visualization of information and knowledge to be shared. It is indeed fundamental to beable to present data in an intelligible way (despite constantly-increasing volumes).
Concepts such as storytelling appear entirely appropriate, and aim to communicate
information on events and accidents while boosting the history records.
Multiplying and diversifying sources of expertise, and creating extra opportunities forsharing, have been targets for many years, and the methods and tools being developed
today must lead to yet more improvements in this respect.
Experience feedback must look at what is visible but also at what is not, as well asfactors which take longer to identify, information which is not directly accessible must
be obtained and subjected to a fresh and systemic view, taking a step beyond a meretechnical understanding of how the accident occurred, which is certainly necessary
but not sufficient.
If we take a look at the past 40 years of history, there have been significant
improvements, particularly after the most notable incidents, and accidents. In hindsight,
it is also possible to identify situations and incidents which should have been analysed in
more detail, and shared more widely, to enhance safety. The conclusions reached today
based on a serious accident, could also have been reached by considering other, lessvisible, less dramatic, less media-worthy, events. This is true for many reasons: thenumber of events, the potential for general application, the time available for theirtreatment, the analytical shortfalls of the socio-technical system as a whole.
Lessons learned based on experience feedback from events are still currently
over-focused on technical aspects, and do not systematically consider all factors
involved in risk control or lack of risk control.

ANTICIPATION AND RESILIENCE - IRSN, 2021

17

18

ANTICIPATION AND RESILIENCE - IRSN, 2021

2

ROBUSTNESS OF FACILITIESAND ABILITY OF PERSONNELAND ORGANIZATIONS TORESPOND TO UNEXPECTEDSITUATIONS

A nuclear facility must be designed and operated in compliance witha set of rules intended to control risks and protect the populations andthe environment in a satisfactory manner. The accident at the Fukushima
Daiichi nuclear power plant (NPP) raised the question of whether or not wecan plan ahead for any events likely to affect nuclear facilities and whether
the rules and assumptions applied when designing safety systems, whichwere invalidated during the accident, are sufficient. Safety can be improvedby reinforcing the application of the defence in depth approach, however
all combinations of events and failures considered cannot be covered as
design bases and it is important to ensure that design choices do not renderthe design and operation of facilities excessively complex, including for
new facilities. At the same time, a reflection on the possibilities of better
preparing people and organizations to deal with the diversity of real-lifesituations and unforeseen situations should be carried out.

In France, safety is defined as “all technical and organisational provisions applicableto the design, construction, operation, shutdown and decommissioning of basic nuclear
facilities, and the transport of radioactive substances, intended to prevent accidents orlimit their consequences”.
The selected safety approach is based on a defence in depth approach, according towhich, while provisions must be applied in order to avoid incidents or accidents as far as
possible, it is nonetheless important to assume that they could still occur. The suitable

ANTICIPATION AND RESILIENCE - IRSN, 202119

2means used to manage such events and limit their consequences must be studied andthe appropriate provisions must be implemented.
On this basis, the defence in depth approach aims to limit the consequences on the
population and the environment of human and technical failures considered as“plausible”, and ensure that the barriers set up between radioactive substances and theenvironment stay intact. This approach provides for graduated, but solid, protection fromthe hazards induced by a facility, leading to the implementation of successive levels,
each with an adequate degree of independence:• “The first level of defence is intended to prevent incidents;• The second level of defence is intended to detect the occurrence of such incidents andimplement actions in order to both prevent them leading to an accident and restore
normal operating conditions, or, failing this, to achieve and subsequently maintain thefacility in a safe state;• The third level of defence is intended to control unavoidable accidents, or, failing this, toprevent worsening as far as possible by recovering the control of the facility in order toreturn to and maintain the facility in a safe state;• The fourth level of defence is intended to manage accident situations which arise
subsequent to the failure of the provisions of the first three levels of defence in depth, andlead to fuel meltdown, in order to limit the inherent consequences, particularly for people
and the environment.
In addition, a fifth level of defence in depth, covering crisis management by publicauthorities, aims to mitigate the radiological consequences of likely radioactive discharges
in accident conditions.”
Nuclear power plant reactors raise specific risks (uncontrolled nuclear reaction, fueloverheating, dispersal of radionuclides) which can be prevented if three fundamental
safety functions are satisfied (controlled reactivity, fuel cooling, confinement ofradioactive substances). One level of defence in depth can incorporate several successivelines of defence, with each line defined as a series of technical, human or organisational
provisions, all of which contribute to controlling these specific risks for a given event andat a given level of defence in depth.
In order to effectively apply the defence in depth approach, any situations likely toaffect a facility must be suitably integrated, solid lines of defence must be set up for theincidents and accidents considered, and these lines must be independent to the expected
degree for any given event.

20

ANTICIPATION AND RESILIENCE - IRSN, 2021

2
Improving the robustness of levels of defence in depth
Safety has been constantly improved thanks to experience feedback from incidents
and accidents and knowledge acquired via research, particularly by considering a large
number of situations over the years. These improvements have primarily led to theinstallation of new equipment, which is sometimes complex due to the congestion of thepremises at existing facilities. We could consider the example of instrumentation andcontrol equipment, or low voltage electrical distribution systems for the hardened safety
core, which, unlike the ultimate back-up diesel generators, cannot be transferred to newpremises outside of the nuclear island buildings.
Installing new equipment will also have a significant impact on facility operation, withincreasingly complex technical specifications for operations (aiming to ensure that thisequipment is available and defining the action to take if not) and incident and accident
operating procedures, increased maintenance operations and periodic testing.
These considerations highlight that there are practical limits to the possibilities ofstrengthening defence in depth by adding new equipment to existing facilities, thus
forcing their shutdown. It is important to avoid reaching excessive levels of complexity
for facilities, or facility operation, as the effects of such complexity would be likely to
reduce the safety benefits of the new equipment.
On the other hand, the robustness of the lines of defence could be reinforced by
improving the ability to control facility state, and therefore maintain compliance withthe applicable requirements during operation in the long-term. Each facility mustindeed continue to comply with its operating reference document at all times. If a set
requirement is not met, the appropriate action must systematically be taken as rapidly as
possible. In fact, non-compliance is likely to weaken lines of defence in depth. Aging
phenomena, modifications to the facility, or maintenance operations, can lead to noncompliance, which may not be immediately detected. The sometimes large number ofprocesses, organizations, contributors and management tools can make it complex toanalyse the impact of all of these non-compliances on safety. Improvements could bemade in this respect. The compliance of the facility is a pre-requisite for the reliability oflines of defence and operators must consider this aspect as a priority.

ANTICIPATION AND RESILIENCE - IRSN, 2021

21

2

The independence of defence in depth levels withrespect to events likely to affect a facility
The independence of defence in depth levels is never total. On this basis, it isimportant to identify which events or failures could simultaneously affect several
defence in depth levels, e.g. if a specific failure is likely to prevent the application of theplanned provisions to limit the consequences of this failure, and to appraise if the action
taken is sufficient. Provisions are not independent (or not) in real terms, but with respect
to a given cause of failure for a given scenario. On this basis, the degree of dependence
between lines of defence must be characterised in order to design and assess the safetyof a facility.
While some types of dependence may be acceptable, the independence of levels ofdefence in depth must be targeted. From IRSN’s viewpoint, defence in depth levels 3 and4 must be as independent as possible. In fact, a core meltdown accident, should it occur,
must be the outcome of one or several events combined, and the failure of the lines ofdefence planned to avoid meltdown at defence in depth level 3. The provisions
implemented in order to limit the consequences of core meltdown accidents do not meetas demanding reliability and robustness requirements as level 3, due to the assumed
lower probability of the situation occurring.
In general, the question of whether the requirements applied to level 4 defence in
depth provisions are sufficient, or not, must be considered, particularly as the operating
conditions of the equipment will be significantly degraded (irradiation, humidity, pressure
and temperature conditions in particular) and periods of use could potentially be much
longer than for lower levels. These aspects must be considered as part of future reactor
development projects.
In addition, probabilistic safety studies (PSA) help to identify any failures which could
simultaneously endanger several lines of defence, estimate the corresponding degree of
dependence and assess the reconsideration of the graduated response planned for any
given event. Such studies can particularly be used to assess the risks of common cause
failure for support systems (instrumentation and control, including sensors andactuators, power sources, cooling sources, compressed air, etc.). PSA completed during
the design phase for new facilities can help to revise any design decisions, if necessary,and define diversification requirements in order to limit these risks.

22

ANTICIPATION AND RESILIENCE - IRSN, 2021

2
Hazards, particularly external hazards, are likely to simultaneously affect several
levels of defence in depth, and several lines of defence at any given level, as showedby the Fukushima Daiichi NPP accident. Historically, the provisions applied at thedifferent defence in depth levels are essentially defined based on the analysis of internal
events taken into consideration in the facility safety demonstration (e.g. the failure of acomponent or system, possibly combined with the failure of the planned provisions
against this event). Hazards are taken into consideration via design rules and assumptions
for the structures, systems and components (SSC) contributing to the fundamental
safety functions (e.g. physical or geographic separation, earthquake qualification).
However, for SSC which are required in the event of a hazard, the same hazards are
generally considered for all SCC at the design phase, regardless of the level of defence in
depth applied. In other words, all of the provisions taken at the different levels of defence
in depth, against natural hazards, could have been applied simultaneously if the facility’s
design basis risks were exceeded.
For this reason, the changes adopted in France after the Fukushima Daiichi NPP
accident aimed to reinforce the provisions applied at defence in depth levels 3 and 4
for seismic risks, flooding and extreme weather conditions; these changes involve
reinforcing existing provisions with a series of fixed and mobile equipment, human andorganisational resources, which can be used to control the conditions of site facilities
during the early days of an accident, until the off-site support services reach the site,
particularly in case of extreme hazards.

The ability of sites to adapt to a wide range ofsituations and unexpected circumstances to be
improved to complement the above provisions
The defence in depth approach is based on an ability to plan ahead for risks andlimit the consequences of any situations considered as plausible. However, it is
impossible to take all combinations of events and failures into consideration during
the design phase, and experience feedback regularly highlights anomalies which had
not been forecast, or for which the consequences had been incorrectly assessed.
The handling of events at the Fukushima Daiichi NPP, as well as at the Fukushima
Daini NPP just a dozen or so kilometres to the south, demonstrated to what extent theability of site teams to respond and adapt can prove a decisive factor when managing a
totally unexpected situation.

ANTICIPATION AND RESILIENCE - IRSN, 202123

2This ability to adapt cannot be considered as a factor in the safety demonstration ofa facility as such. However, it could prove indispensable when managing the wide rangeof actual situations which could occur and essential in unexpected circumstances.
According to research in human and social sciences, while resilience partiallyemerges in an emergency situation, and is indeed based on a share of creativity andimprovisation, by planning ahead, the right conditions and resources to promoteresilience can be identified (e.g. generic skills can be identified) and teams can beprepared to respond appropriately.
This planning process is different to the approach used for the safety demonstration,
particularly due to the different purpose. The aim, in this case, is to boost the ability ofsite teams to respond and adapt to any given situation, potentially outside of the scopeof the safety demonstration, e.g. by increasing resources or distributing them differently(shared emergency management resources). Operating procedures based on thephysical state of the facility were introduced after the Three Mile Island NPP accident in
the United States in 1979, and have already helped to improve the ability of operatingteams to manage the wide range of actual situations which arise, and can be used tocover a long list of situations. The required actions are defined on the basis of variationin the physical parameters of the facility (levels, pressures, temperatures, flow rates,
activity measurement, etc.) and not, as was previously the case, on the event identified
as the cause of the incident or accident situation. In addition, if one or several systems
required to fulfil the facility’s safety functions fail, other, replacement, systems will be
proposed. On this basis, several lines of defence are proposed and potentially
implemented to handle the situation faced.
Current brainstorming policies aim to take the improvement of the operating team’s
resilience, and more generally the resilience of all teams at the site, a step farther,ensuring they can adapt to unexpected situations not covered by operating procedures.
Other skills must be put to active use, such as expertise, but also behavioural skills, theability to make decisions in an uncertain context, to give meaning to the current situation,even when totally unplanned, skills such as coordination, communications, cooperation,
stress management and improvisation. Teams at the site must be able to take a stepback and define strategies and appropriate processes in order to handle an unexpected
situation in the best possible manner. To give just one example, team training must
include brainstorming sessions on what solutions they could adopt in unexpectedcircumstances.

24

ANTICIPATION AND RESILIENCE - IRSN, 2021

2
A resilient attitude in an emergency situation can be developed by ensuring theawareness of the limits of forward planning policies (risk analysis, rules, etc.),
knowledge of vulnerable points for the facility, and an understanding of routine
operations, but also via the day-to-day implementation of organisational provisions topromote the ability to respond and adapt.
Brainstorming and actions aiming to improve the resilience of the teams in charge ofmanaging such situations are one means of improving safety and should be enhanced.

ANTICIPATION AND RESILIENCE - IRSN, 2021

25

26

ANTICIPATION AND RESILIENCE - IRSN, 2021

3

HOW CAN WE PLAN FOR
THE RISKS INHERENT TOCOMBINED MALFUNCTIONSOR EVENTS CONSIDERED
AS HIGHLY IMPROBABLE?

High-risk industries in general, and the nuclear industry in particular,
invest large-scale resources in defining and implementing provisions
aiming to reduce the risks associated with facility operation. The
situation is regularly revised to integrate new knowledge and allow for
improvements, particularly with respect to situations considered as highly
improbable, but which could lead to serious consequences. The appraisalof these situations is still a complex issue and no approach can totally
prevent them from occurring. How can the risks incurred due to eventsor a combination of events considered as highly improbable, but which
could have particularly serious consequences, while uncertainty increases
in proportion to improbability for situations, be better understood? The
Fukushima Daiichi nuclear power plant (NPP) accident demonstrated that
this topic is still current in the field of nuclear energy.

This chapter gives an overview of the safety approaches implemented to date forrare accident situations with potentially serious consequences, and demonstrates how
these approaches have been modified over time to better integrate experience feedback,highlighting the benefits of new knowledge for handling purposes. This chapter refers tocurrent works focusing on the development of new methods, specifically with respect tosituations which could result from natural hazards, and indicates a few potential ideas totake the appraisal of the associated risks a step further.

ANTICIPATION AND RESILIENCE - IRSN, 202127

3Considering rare events as part of nuclear safety
A few years prior to the Three Mile Island NPP accident in the United States in
1979, the Committee on the safety of nuclear facilities (CSNI) of the OECD Nuclear
Energy Agency was already considering the limits of the approaches used at this time.
The risk was then appraised based on a two-dimensional model (frequency and gravity):
situations cannot be considered as acceptable if the gravity of their inherent
consequences is excessive with respect to the estimated frequency of occurrence. In
addition, the acceptability of the risk must be assessed, not only in terms of technicalaspects, but also from a social and economic viewpoint. The aforementioned model
provides the basis for the risk appraisal method still used to date, however these methods
have limits, particularly due to uncertainties, which increase in proportion to the rarity ofthe situations considered or the gravity of their consequences, making it complex toevaluate if the provisions which could potentially be implemented to prevent or limit theirconsequences are reasonable.
This difficulty can only partially be overcome by the defence in depth approach, which
is widely used in the nuclear safety field, and assumes that, by convention, incidents andaccidents could still occur despite the preventive provisions applied, and leads to thedefinition of measures to mitigate the consequences of such events, if necessary. Thisapproach has intrinsic limitations as an indefinite series of events cannot be assumed.

Stage one: combining deterministic and probabilistic
approaches
With this process, by boosting the complementary nature of deterministic andprobabilistic approaches - the underlying principles are briefly described below - a wider
range of events and combined events can be handled9 over time, and above all, theknowledge of the accident scenarios which could lead to situations, which are
undoubtedly rare, but must be considered as “plausible” in terms of nuclear safety, canbe improved.
With a deterministic approach, the possible consequences of a certain number ofsituations, resulting from unique trigger events assumed in principle based on plausible
failures for equipment or operating errors, are examined, considering the design of the
9 Which means checking that the selected provisions were sufficient to prevent these situations or limit the inherent
consequences, or, failing this, implementing new provisions.
28

ANTICIPATION AND RESILIENCE - IRSN, 2021

3
facility or operating practices, without reconsidering the series of events which could
lead to these situations. On this basis, this approach assumes that the incident or
accident occurs and leads to the definition of provisions in order to keep the inherent
consequences at an acceptable level. The assumed incidents and accidents are studied
according to a prudent approach, i.e. in conservative conditions, with appropriate safetymargins applied, some of which aim to cover uncertainties and the limits of knowledge.
The probabilistic approach is complementary and allows the risks associated withsituations with combined events to be understood on a more realistic footing, considering
operating experience feedback10 and current knowledge, and allows “complementaryprovisions” to be defined aiming to reinforce facility safety. By developing probabilistic
safety evaluations to complement deterministic studies, the level of detail of studies on
the accident scenarios which could affect the facilities has been considerably enhanced,
risks which the deterministic approached failed to identify are highlighted and safety isreinforced. However, results will clearly depend on the data processing methods used,
and on available information and knowledge: on this basis, the evaluation of thefrequencies of the different accident sequences highlighted depends strictly on available
knowledge on the reliability of equipment and on potential physical and chemical
phenomena; facility modelling will also affect results: e.g. simplified models are frequently
used for the reactor’s instrumentation and control system or human errors before orafter the accident due to the inherent complexity or modelling difficulties; in the sameway, reliability data is obtained straight from experience feedback, limiting thequantification of rare events.

“Practical elimination”: a means of taking theprevention of situations with serious consequences
a step farther
After the Chernobyl NPP accident in 1986, national and international discussions on
the design and safety of new nuclear power plants planned for construction in the early
21st century led the different parties to consider that significant improvements wererequired in terms of safety, compared with the power plants currently in operation, or
under construction, all of which had been designed prior to the Three Miles Island andChernobyl accidents, particularly with respect to some accident scenarios including acore meltdown, which were not previously taken into consideration or were assumed to
10 Consideration of experience feedback when quantifying the reliability of equipment, consideration of assumed
operator behaviour in particular.
ANTICIPATION AND RESILIENCE - IRSN, 2021

29

3

be sufficiently improbable to the extent that additional design efforts were not necessary.
A fourth defence in depth level aiming to limit the consequences of accidents withreactor core meltdown had already been introduced. However, for some situations inwhich a core meltdown is at least theoretically plausible, such as situations which could
drive rapid, high-energy, physical phenomena, leading to the short-term failure of thecontainment, it did not appear possible to set up realistic provisions to mitigate theconsequences. For the new reactors in question, the “practical elimination” of suchsituations was targeted. In this context, the term “practically” must not be understood as“nearly”, but rather as “in practice”.
The “practical elimination” approach is therefore mainly deterministic and aims
to make serious accident situations which could lead to the early failure of thecontainment of radioactive products either physically impossible or, failing this, highly
improbable, with a high degree of confidence, so that these situations can beconsidered as “excluded”. This approach should only be applied for serious accident
situations which cannot be covered by reasonable provisions with demonstrably limited
consequences. Nonetheless, this position is not systematically applied at international
level. As recent discussions have highlighted, interpretations of the approach vary, thesituations to which it should be applied are defined differently, and the weighting ofprobabilistic input varies widely.11
The practical elimination of a situation can only be strictly demonstrated if thesituation is physically impossible. Failing this, the designer must apply all reasonably
feasible design or operating provisions to ensure that the accident situation can beconsidered as highly improbable with a high degree of confidence. On this basis,
demanding requirements must be implemented to ensure that targets are met.
Probabilistic safety studies (PSA) are used to check that the situations to bepractically eliminated are highly improbable. However, these studies should be used withcaution due to the impact and sensitivity of the models used and the assumptions madefor the results. If a major accident occurs, subsequent analysis frequently concludes thatthe probability of the event occurring had been underestimated, in both the nuclear
industry and in other industries. Furthermore, is it necessary to identify situations
requiring “practical elimination” at an early stage in the design phase of a nuclear reactor,
and should the inherent requirements be discussed at this stage12.
11 In some cases, if a situation is estimated as highly improbable, it may not be necessary to implement
complementary preventive provisions, in addition to the existing defence-in-depth provisions.
12 “The “practical elimination” approach of accident situations for water-cooled nuclear power reactors” – IRSN,
2018. https://www.irsn.fr/practical-elimination-2018
30

ANTICIPATION AND RESILIENCE - IRSN, 2021

3
The accident at the Fukushima Daiichi NPP:
appraising natural risks
After the accident at the Fukushima Daiichi NPP, potential serious accidents which
could arise due to natural risks were considered in more detail. Limitations wererapidly identified. In fact, to take into account the total loss of power and ultimate heatsink affecting all of the facilities at a nuclear site, which could occur subsequent to amore severe natural hazard than those considered to date, implies to characterize thesehazards. In addition, while probabilistic safety studies in relation to seismic hazards havebeen developed and provided input, which has contributed to significant safety
improvements, the development of these studies is hindered by limited knowledge ofnatural hazards and the vulnerability of the facilities with respect to these hazards.
On this basis, in order to enhance the safety of nuclear facilities, hazards with a return
period well in excess of 10,000 years, i.e. hazards which have far less than one chance in
10,000 to occur each year, must be characterised, and the strength of structures and the
behaviour of facility equipment must be assessed with respect to such hazards.
Nonetheless, improving knowledge of natural hazards remains a priority in order toappraise stakes and enhance the safety of facilities in terms of rare events if necessary.
In recent years, new approaches aiming to better characterise highly improbable hazards
have been under development.

New approaches to characterize natural hazards
Over the years, exceptional events have led to the reinforced protection of French
nuclear facilities against natural hazards: extremely low temperatures affected theavailability of the ultimate heat sink at the Saint-Laurent-des-Eaux NPP during the winterof 1985, a high tide combined with strong winds partially flooded the Blayais NPP in late1999, an earthquake and tsunami struck the Fukushima Daiichi NPP in 2011. Designers
and operators have reconsidered their long-standing prevailing approach based on theseexamples. Previously, they integrated external hazards in the design for equipment while
ignoring or neglecting the effects of any combined events and all induced effects. Whiledesigners and operators attempted to demonstrate that the contribution made byexternal hazards to the probability of core meltdown or important releases is not decisive,
the aforementioned events highlight the limits of the knowledge used.

ANTICIPATION AND RESILIENCE - IRSN, 2021

31

3

On this basis, integrating external hazards in general, and potential combined
events, including combinations with internal failures, as part of the deterministic
approach, is still currently a concern. Work groups including experts from operators and
IRSN have been set up at national level by the French nuclear safety authority (ASN) in
order to define the methods used to integrate hazards and combined hazards; workgroups have also been set up at international level, particularly under the aegis of the
CSNI of OECD-AEN, in order to improve knowledge of natural hazards and develop
evaluation methods for these hazards, and for the vulnerability of facilities to hazards
which are insufficiently integrated during the design phases.
In France, one of the lessons learned from the partial flooding of the Blayais power
plant was the need to consider combined phenomena, which were previously neglected,
such as the combination of strong winds and tidal surge13 as a flooding scenario for
nuclear facilities located near the coast or an estuary. The 1999 flood also called into
question the way the tidal surge data was collected and used in the application of
statistical methods for flood risk assessment. By using unique data from reference
stations, sample data included singular points (or outliers). The outliers included in astatistical series represent a difficulty for experts, as the approach used to integrate or
exclude these data can lead to the overestimation or underestimation of the associatedrisks. After this flooding event, new approaches were developed in France in the field of
nuclear safety, by EDF and IRSN, in addition to the reinforced protective provisions
applied at facilities, in order to enrich the databases used to characterise flooding risks(flooding, heavy rain, etc.), by attempting to integrate data from wider geographic areas
and dating back to earlier periods. Regional approaches were initially developed andcould be used to expand the scope of the event data collected in order to boost available
data. A historical approach based on archive studies and field inspections can also
be used to find data for earlier events and, with the help of historians, interpret thisdata. This approach was enriched by the “Historical floods and storms” work group,
which comprises a multi-disciplinary scientific community (historians, geographers,
hydrologists, statisticians, etc.) and aims to share knowledge beyond the limited scopeof nuclear safety. Historical and regional approaches are now combined for operational
applications, to define sea levels in safety evaluations.
As part of the complementary safety assessments performed in France after the
Fukushima Daiichi NPP accident14, operators initially highlighted the margins gained
13 A tidal surge is the difference between the observed sea level and the forecast tidal level.
14 Complementary safety assessments were performed at each French nuclear facilities, at the request of theFrench Prime Minister, after the accident of 2011. They aimed to appraise the behaviour of these facilities in caseof natural hazards over and above those considered during the design phase.
32

ANTICIPATION AND RESILIENCE - IRSN, 2021

3from the prudent approaches implemented when designing their facilities thanks to theapplication of conservative methods and the design and construction standards used.
However, these margins are difficult to quantify and can vary over time, due to ageing
phenomena or non-compliances, which is why safety bodies insist on the in-depth
management of these non-compliances. A “hardened safety core” of provisions iscurrently being implemented at French nuclear facilities in order to manage the total lossof electrical supply and cooling at facilities in the event of “extreme” hazards, aiming toreinforce their ability to withstand these hazards, and such provisions will significantly
improve safety at these facilities. However, determining highly improbable (but very
intense) hazards using data which only covers more frequent (and less intense) hazards
by statistical extrapolation will require continued efforts in order to take full advantage ofregional and historical data. To date, this operational approach must be completed in the
future by modelling the physical aspects of phenomena and any potential combinations,which are currently subject to research, for all natural hazards.
In terms of earthquake risks, the unusual characteristics of the recent Teil earthquake15
in the Montélimar region highlights the difficulty of evaluating seismic risks in regions withmoderate seismic activity such as France, and the need to identify any potentially active
faults at the different sites in order to characterise earthquakes with very long return periods(more than thousands of years) which could affect these sites; this process is indispensable
when studying rare events as the knowledge obtained by analysing historical seismic
activity, the main design basis for existing facilities, only covers approximately 1000 years.
Once again, regional and historical approaches can be combined to generate new data,
which can prove helpful in attempting to control risks, even if uncertainty still applies.
These approaches must still be consolidated in order to fully contribute to expertise,
which must be based on data which is as objective as possible, and on scientificallyvalidated approaches, while some developments are still mainly at the scientific research
stage. The sharing of the efforts required for academic research must be encouraged inorder to generate new knowledge.
The development of innovative mathematical methods must be encouraged andcould confirm that the existing provisions are already sufficient, or, on the other hand,highlight that the reliability of the facilities must preferably be reinforced. Nonetheless,these methods will still come with uncertainty, regardless of the new knowledge they
may bring. Their contributions must therefore meet conditions to be defined in the futureprior to use for the safety demonstration.
15 Earthquake on 11 November 2019 which particularly affected the municipality of Teil.

ANTICIPATION AND RESILIENCE - IRSN, 2021

33

3Continuing development programmes to further
enhance risk assessments
While experts are frequently considered as knowledgeable and expertise as aprocess leading to an objective result, this viewpoint must be at least taken in perspective
for complex systems, particularly when focusing on rare events. Such risks are indeed
evaluated on the basis of knowledge which has not been confirmed and is subject touncertainty. Multi-party debates between stakeholders, particularly industrial firms,
safety bodies, and society at large, are all driven by these uncertainties, while contributing
to expertise. Any major accident will unavoidably lead to the reconsideration of thecontributions and limits of the applicable policies, and encourage new, more suitable andeffective, methods, if necessary. Scientific progress will also lead to regular reconsiderationof the assumptions applied when designing facilities.
While analysis of experience feedback, and research and development works, have
led to significant safety improvements for nuclear reactors, including those commissioned
in the 1970’s, these efforts must continue and methods must still be developed in orderto improve the appraisal of risks and identify cliff edge effects. Discussions between
experts and researchers, at both national and international level, provide input.

34

ANTICIPATION AND RESILIENCE - IRSN, 2021

4

RECOVERY AFTER A NUCLEAR
ACCIDENT: AN ESSENTIALLY
SOCIETAL PROCESS

Recovery after a nuclear accident is extremely complex, both for thevictims and for all parties managing the rehabilitation process. This
complexity is generally caused by two factors. Firstly, the radioactive
contamination of a region will affect all aspects of the day-to-day livesof the local populations, and all regional public and private services.
Secondly, unlike, for example, a natural catastrophe (flooding, earthquake,etc.), the radioactive contamination of a region must be considered overan extensive timescale (several decades, potentially more).

In this context, it is important to consider experience feedback from the Chernobyl
and Fukushima Daiichi accidents in order to support the preparation of recovery
management16.

Recovery: a complex, multi-dimensional landscape
Recovery after a nuclear accident is complex at several levels: for the individuals
and communities affected, but also for all contributors to rehabilitation management.
At individual level, the radioactive contamination of a region will substantiallydisturb all aspects of the day-to-day lives of the local populations over an extended
16 List of references:- Schneider, T., Maître, M., Lochard, J., Charron, S., Lecomte, J.-F., Ando, R., Kanai, Y., Kurihara, M., Kuroda, Y., Miyazaki,
M., Naito, W., Orita, M., Takamura, N., Tanigawa, K., Tsubokura, M., Yasutaka, T. The role of radiological protection
experts in stakeholder involvement in the recovery phase of post-nuclear accident situations: Some lessons fromthe Fukushima-Daiichi NPP accident. (2019) Radioprotection, 54, pp. 259-270.
- Gariel, J.C., Rollinger, F., Schneider, T. The role of experts in post-accident recovery: lessons learnt from Chernobyl
and Fukushima. (2018). Annals of the ICRP, 47 (3-4), pp. 254-259.

ANTICIPATION AND RESILIENCE - IRSN, 2021

35

4

period, affecting their standard of living and well-being. The following types ofdisturbance are considered:•a pprehension towards the quality of the environment due to the radioactive contamination;•d oubt over the safety and quality of food products;•u pset family relationships due to the differing reactions to this unusual situation;• s trong apprehension towards the future, particularly that of children;• c onflictual social relations based on different lifestyle choices between neighbours andacquaintances (some wish to leave, others stay, etc.)• s ignificant upset in terms of education, healthcare and businesses due to the disturbanceto the socio-economic system.
This situation is complex due to the many factors involved, and will oblige the victims
to face a dilemma, which we could summarise with the following questions:•F or those still in the affected region: should I stay or leave?
•F or those having left, voluntarily or otherwise: should I return or stay away?
Whatever the precise situation, it is easy to understand that no simple answer exists
to these questions.
Over and beyond individual preferences, this situation is just as complex at
community level. Social interaction will indeed be seriously disturbed, which will
reduce the cohesiveness of the community. This reduction in cohesiveness could also
be driven by a feeling of inequality in terms of the decisions taken by national and local
authorities. To give one example, compensation systems are generally launched basedon administrative borders, which can lead to two families living on either side of a border
not receiving the same compensation, which would trigger conflict. Finally, economic
upset will lead to major consequences, in the same way as those affecting the social
system and public/private services.
Business practices can also be overturned. Jobs can be lost or adjusted, and working
conditions must be adapted. Agriculture is generally the most affected segment, however
other fields may have to manage the consequences of any contamination of work andproduction sites. Services must be restored, sometimes with adaptations. Former
colleagues may not return while new workers will appear – sometimes without theirfamilies – to make up team numbers or decommission the damaged facility andreconstruct the area affected.

36

ANTICIPATION AND RESILIENCE - IRSN, 2021

4
In general, all such disturbances help to exacerbate the distrust shown towards
national authorities and institutional experts by those affected and as demonstrated in
the Fukushima prefecture, some parties will turn to the local authorities, and mayors inparticular. Such authorities will find themselves in a delicate position, where they must
contribute to the implementation of national decisions while considering the needs andexpectations of the people affected. Conflict between decisions reached at national
level and the concerns and expectations of the local communities, which may diverge
or even differ, appear in real form at local level.

What conditions are required in order to facilitate the rehabilitation for theaffected populations and territories?
The main condition, which is the basis for the reconstruction process, is thepossibility for the people and communities affected to be able to access reliable andeasy to understand information, allowing them to plan for and evaluate the radiologicalsituation both as individuals (i.e. for all day-to-day activities, particularly allowing people
to identify their own situation with respect to that of others) and groups (at community
level). Experts must support this phase, and as explained later, play an essential role
while paying close attention to their attitude towards the populations affected. Theseexperts must provide information on exposure to radiation, take measurements, andeven support inhabitants with taking measurements and helping to interpret the results.
The aim is to ensure that radioactivity, which is impossible to see, can be identified using
measurements. Allowing inhabitants to appraise the radiological situation is a key factor
in ensuring they can establish their own benchmarks, are able to make educateddecisions for their own protection and can also assess the efficiency of the actions taken
by both themselves and the public authorities.
A secondary condition required to simplify the rehabilitation process is thecommunity’s ability to respond and react to this unusual and highly destabilisingsituation. The aim is:• to invent new forms of cooperation with all stakeholders (whether experts, professionals,
local or national authorities, society at large, etc.) in a conflictual and distrusting context.
Creating the right conditions for mutual trust is a key factor in the rehabilitation process;• to provide inhabitants with a means of being directly involved in the radiologicalsituation via the decision-making processes and the actions implemented by the
local and national authorities to reduce the exposure faced by the populations(decontamination actions, waste storage, etc.).
ANTICIPATION AND RESILIENCE - IRSN, 2021

37

4What challenges for those involved in the rehabilitation
process?
While recovery is unusually complex for the inhabitants affected, the same can besaid for all contributors to the rehabilitation process. The situation is mainly complex
for the latter due to the multi-faceted nature of the situation, where the actions of allcontributors must be coordinated. Due to the many unique aspects of such a situation,
each authority or each expert will tend to act independently, without appraisingand considering all of the stakes. Radiation protection experts will tend to focus onlevels, measurements, and protective actions to be prepared and deployed, without
systematically considering any constraints due to other aspects which need taking into
consideration. This approach can lead to situations where conflicting provisions may be
applied by different decision-makers.
In this context, establishing dialogue involving all parties and covering all aspects
between the authorities, experts and people affected is critical. The Fukushima Daiichi
accident demonstrated that this type of dialogue is helpful.
Furthermore, it is important for experts to maintain a strictly neutral position whenfulfilling their roles, and show fairness when supporting and guiding all of the populations
affected, regardless of their preferences or decisions. When faced with an unwanted andunusual situation, people can react in many different ways and the expert must respectsuch differences. The wide range of choices made by inhabitants can lead to conflict anddivisions within the communities, and external parties must tread with care to avoid
exacerbating this situation by adopting viewpoints which could degrade community
cohesiveness.
To summarise and in all circumstances, experts and authorities must respect thedecisions made by individuals and communities.

The rehabilitation process is a societal affair
As described previously, recovery after a nuclear accident is a mainly societal
process. Experience feedback from the Chernobyl and Fukushima Daiichi accidents
demonstrate that the involvement of the people affected and their host communities isa key factor in rehabilitation. Establishing dialogue between all parties involved,

38

ANTICIPATION AND RESILIENCE - IRSN, 2021

4
including affected persons, is necessary for all fields covered (decontamination, waste
management, lifting of restrictions and evacuation orders, restoring social and economic
conditions, etc.), in order to jointly prepare the actions to be taken. Decisions must be
taken jointly between all of the parties involved. In this process, the role played by local
authorities, particularly mayors, is critical in order to meet the expectations of the
population, which may vary, and even conflict.

The involvement of local parties will vary over time
During the recovery process, the situation will change over time (emergency,transition and long-term phases), therefore the involvement of local populations can beadapted to match the current priorities. During the emergency phase, the main concernof the authorities is to protect the health of the populations based on benchmark values.
During this phase, the risk assessment and related communications and protective
actions are deployed by the national and local authorities with limited dialogue due to thedegree of urgency and the circumstances. From the transition phase, it is important tointeract with society at large and particularly to involve inhabitants in the radiologicalcharacterisation process. This involvement is simplified by rapidly developing radiologicalmeasuring systems that are easy to use and reliable. Protective actions could be
prepared and deployed via this joint characterisation process, on the basis of a sharedunderstanding of the radiological situation. As time passes, the purpose of the actions
taken will widen to include the restoration of living conditions in general, in many fields(social, economic, etc.), and the question of radiation protection will become one aspect
on a list of many others. This change of direction corresponds to greater interaction
between the different stakeholders.

What role do radiation protection experts play in recovery?
A factor which the Chernobyl and Fukushima Daiichi accidents have in common, isthe distrust shown by those affected towards the authorities and institutional experts.
This is, in part, due to the fact that, particularly for institutional experts, the population
affected feel that these experts adopt a knowledgeable approach, and provide informationfrom a “top-down” mind-set, without considering the expectations of the population andignoring their vulnerable circumstances. This partially explains the use of experts, often
from an academic background, selected by the local authorities, or non-institutional

ANTICIPATION AND RESILIENCE - IRSN, 2021

39

4individuals making a personal commitment. These experts are generally considered as
operating independently to the authorities and the nuclear segment, and more preparedto listen to the concerns of inhabitants. We can reach a few conclusions on dialogue
focusing on radiological risks based on the statements of several of these Japaneseexperts. It would thus appear that:• the purpose of this dialogue must not be to reassure inhabitants in the world ofuncertainty involved in exposure to low doses;• this dialogue must maintain the mind-set behind scientific knowledge and be managedwith humility, integrating uncertainties and the limits to current knowledge;• the vulnerable circumstances of the people affected in a totally novel situation must be
taken into consideration.
It is also important for experts to support the local initiatives of inhabitants andcommunities, particularly those aiming to better understand and evaluate the radiologicalsituation. Experts must listen to inhabitants in order to respect their approaches andviewpoints and work with them in the field. Experts must attempt to provide at least
partial answers to the questions and concerns of the individuals affected and help toshare knowledge with the latter. This approach will boost the expertise of local
parties and hence their ability to take action themselves. Promoting initiatives such asradiological measurement campaigns or testing radioactivity in local food can contributeto this trend.
In addition, the conclusion was reached that radiation protection experts mustensure that they never work alone in their own field of expertise, and systematicallycooperate with experts from other fields (health, food safety, socio-economic parties,etc.). This holistic approach will help to avoid actions with contradictory effects.

Reconciling experts and those affected: the joint expertise process
Past experience from Chernobyl and Fukushima Daiichi has proven that launching a
joint expertise process is one means, among others, that radiation protection experts
can use to open up long-lasting dialogue with the individuals and communities affected.
The aim of the joint expertise process is to involve stakeholders, including the
inhabitants affected, in the recovery in order to improve radiological protection by developinga radiation protection culture and by restoring their living conditions.

40

ANTICIPATION AND RESILIENCE - IRSN, 2021

4
Several phases can be identified when deploying this process:• establishing dialogue by identifying the difficulties and challenges faced by the
population;• involving those affected in radioactivity measurements in order to provide them withthe means of evaluating their exposure and establishing their own benchmarks,
particularly by comparing their exposure with that of others, within the community andelsewhere;• identifying protective actions, including self-protection, and implementing these actions
after the characterisation of the radiological situation;• finally, organising citizen monitoring processes and implementing local projects aiming
to restore sustainable living conditions at community level via social and economic
actions.
Prior to launching this joint expertise process, easy-to-use radioactivity measuring
equipment must be provided to individuals. Thanks to current technologies, such
equipment is relatively easy to deploy.

Experts must be involved in recovery at local level based on ethical principles
In a context where the people affected are extremely vulnerable due to the serious
disturbance to all of their benchmarks in their daily lives, experts supporting these
individuals must ensure that their actions are guided by ethical principles. The mainprinciple is to ensure that the independence, freedom of choice and freedom of decisionof the people and communities affected are maintained. In practice, this means that:• inhabitants must be voluntarily involved;• experts must provide transparent communication, and insist on what is actually known
from a scientific viewpoint, and what must still be determined;• experts must avoiding judging individual choices and decisions, and support allindividuals affected without exception;• experts must be able to report on their words and acts at any time.

ANTICIPATION AND RESILIENCE - IRSN, 2021

41

4

Dialogue, independence and shared expertise
Past experience gained in the wake of the Chernobyl and Fukushima Daiichi nuclear
accidents demonstrated the complexity of recovery and the wide range of factors
involved, which significantly disturb individuals and communities.
The first lesson learned is the importance of involving all stakeholders in theevaluation process and when managing these situations, but also in upstream
preparation. Radiation protection is not the only priority, sustainable living conditions
must be restored for the people affected. However, in these situations, society at largeceases to trust institutional – political, administrative or technical – bodies. On this basis,
it appears indispensable for all stakeholders to cooperate as closely as possible –national and local authorities, experts in various disciplines, whether institutional orother, society at large and economic contributors, etc. – in establishing and deploying an
open and transparent rehabilitation process.
In these situations, many problems are handled at local level, and radiation
protection experts must primarily target this level, and comply with ethical principles.
By listening and showing respect for each individual’s choices, experts can help to meetthe expectations and concerns of both individuals and communities, simplify initiatives
aiming to measure radioactivity and give it real form, via joint expertise processes, andpromote the emergence of a practical radiation protection culture allowing local parties
to recover a certain degree of independence and make more informed decisions. If we
combine these conclusions, it appears that, the question is not to determine if thoseaffected trust the experts, but whether the experts trust the initiatives of the people andcommunities affected.
At the end of the day, the rehabilitation process will depend on the stakeholders’ability to think and act jointly, leading to far stronger results than they could achieve as
individuals.

42

ANTICIPATION AND RESILIENCE - IRSN, 2021

5

POPULATIONS AFTER THE
EVACUATION

One potential protective action which can be implemented in the eventof a nuclear accident is the evacuation of populations in order to avoid
their exposure to radioactive releases and therefore radioactivity. Suchevacuation policies can be decided by the authorities, either preventively(i.e. before the releases start), or after releases and the characterisationof the radiological situation of the environment. In addition, as observed
during the Fukushima Daiichi accident in 2011, inhabitants in the area
affected by potential or actual releases can decide to leave their homes
and remain at a distance from the region by their own choice (“selfevacuation”).
Approximately 300,000 individuals were evacuated from the areaaround the Fukushima Daiichi nuclear power plant, half when orderedby the authorities, and the other half at their own initiative (sometimes
at the recommendation of the authorities). Although evacuation may benecessary, it is not a simple task, particularly in emergency conditions andin the context of the damage caused by the earthquake and the tsunami.
Evacuation will unavoidably cause damage, particularly for vulnerable
and dependant individuals. After setting up a post-accident zone (SDA
for “Special Decontamination Area”), approximately 150,000 people wererehoused by the authorities pending the lifting of the evacuation orders.
Almost ten years after the accident, it is estimated that less than 20,000
people have returned to their homes. Almost 24,000 inhabitants willprobably never return home as their houses are located in a “difficult-toreturn” zone, which is strongly contaminated and which, to date, has only
been punctually decontaminated. The low numbers of people returningreflects the difficulties inherent to the long-term management of theconsequences of significant regional contamination17.

17 List of references:- Croüail, P., Schneider, T., Gariel, J.-C., Tsubokura, M., Naito, W., Orita, M., Takamura, N. Analysis of the modalities ofreturn of populations to the contaminated territories following the accident at the Fukushima power plant (2020)
Radioprotection, 55, pp. 79-93.
ANTICIPATION AND RESILIENCE - IRSN, 2021

43

5

Evacuation: a protective action which is delicate
to implement and has inherent risks
Experience feedback from the Fukushima Daiichi nuclear power plant (NPP) accident
demonstrates the complexity of evacuations. The Japanese accident highlighted several
key points to be taken into consideration when implementing such action. The nuclear
accident itself was the consequence of two natural catastrophes (earthquake, tsunami),
which rendered the management of the accident itself even more complex.
• Preparation by authorities and the population is critical to limit the need for
improvisation. Due to the timeline of orders, the wide range of details (e.g. an evacuation
was recommended in some areas and mandatory in others), the step-by-step process(particularly repeated evacuation steps when the first gathering sites were found to be
in a contaminated area), the lack of clear information on the duration of the evacuationand its end date, the definition of evacuation zones and variation in these zones overtime, the populations affected were left with the impression that the authorities were
improvising and increasingly distrusted the former. It is essential to insist on theimportance of managing regular exercises in order to improve the preparation of bothpublic services and populations.
• Selecting the appropriate location for gathering areas for evacuees is essential and it
must be possible to adapt locations to the immediate conditions. It will never bepossible to predict contamination areas and several options must be pre-determined inorder to allow evacuees to gather in safe places, unlikely to be affected by contamination.
As shown by several examples, during the Fukushima Daiichi NPP accident, populations
had been gathered in zones with higher contamination levels than the areas they had
left, requiring a second evacuation process.
• Finally, the evacuation of vulnerable and dependent persons and the institutions thatreceive them is a central issue and specific preparation and planning is required. We
could mention the example of the retirement home in the village of IItate in Japan which
was not evacuated, based on a decision by the mayor, despite the instructions issued
by authorities. This decision led to a lower level of fatalities in this institution than inother similar institutions that were evacuated.

44

ANTICIPATION AND RESILIENCE - IRSN, 2021

5
Evacuation and rehousing have significant effects
on the living conditions and health of the people
affected
After the evacuation process, the inhabitants were housed in temporary dwellings.
Despite the efforts of municipalities, this rehousing policy had a hard-hitting effect on thecohesiveness of the local communities. While the elderly stayed in temporary housing,most families opted to purchase or rent accommodation elsewhere in Japan. Several
years after the evacuation, it is apparent that most of the occupants of temporary
dwellings are aged over 70, while the younger generations have resettled elsewhere. In
addition to hampering the cohesiveness of the community, this situation also separated
families and led to a feeling of isolation for the older generations. The compensation
system applied may also have aggravated this loss of cohesiveness. The compensation
system was indeed based on the post-accident radiological zones defined, which may
have led families living close to each other to receive different levels of compensation,
ranging from a factor of 1 to 10. This led to feelings of injustice and unfairness, breaking
up social relations and creating cleavages.
These evacuation and rehousing conditions generally and obviously affected thehealth of those displaced. While the levels of internal or external exposure to radioactivity
faced by the population remained relatively low, leading to health effects which will bedifficult to quantify, the same cannot be said for the indirect consequences of theevacuation and those attributable to changing living conditions.
Several studies have demonstrated that the Fukushima Daiichi NPP accident led toapproximately 2,000 “indirect” fatalities (i.e. not related to exposure to ionising radiation),
particularly in the most vulnerable populations (the elderly, ill, etc.).
In addition, due to the deterioration in their living conditions due to the evacuation,
health effects not related to exposure to ionising radiation were observed in groups ofevacuated inhabitants. Such health effects included diabetes, or a negative trend inindicators such as BMI, blood pressure or cholesterol, etc. This type of health effect wasalso observed for people who were not evacuated, but lived near to the areas with thehighest contamination levels due to stress after changes in their environment.

ANTICIPATION AND RESILIENCE - IRSN, 2021

45

5After lifting the evacuation orders: the toughdecision between returning or staying away
After the evacuation orders were lifted, each individual had to make the difficult
decision of whether to return or stay away, which combined with the radiological criteria
defined by the authorities and the deployment of actions to ensure these criteria weremet, dictated return dynamics.
Between July 2012 and August 2013, post-accident zones were set up gradually inthe areas with the highest contamination levels. Three zones were defined based onradiological criteria:• a “green zone” where evacuation orders were ready to be lifted when an external annual
dose of less than 20 mSv/year was reached;• an “orange zone” considered as the “Restricted Residence Zone” where only businesses
were authorised, or homes could only be occupied during the day. This zone corresponded
to exposure of between 20 and 50 mSv/year;• finally, a red “difficult-to-return” zone, where inhabitants will not be able to return before
a long period. The annual dose in this zone exceeded 50 mSv/year.
Decontamination operations were organised in the green and orange zones, as earlyas 2013, to allow people to return home, while the authorities defined three criteria for thelifting of evacuation orders in each municipality:
1| the completion of decontamination operations throughout the municipality (operationsorganised by the State), until the individual dose falls below 20 mSv per year;2| the rehabilitation or reconstruction of infrastructures (water, gas, electricity, healthcentres, shops, administrative services, schools, etc.);
3| coordination with all inhabitants.
In practice, lifting evacuation orders proved to be a lengthy and complex process.
Orders were lifted in stages due to the varying periods required to meet all three criteria
in each municipality. Within the populations affected, each individual, depending on theirlocation, needed to face the critical question of whether they should stay or leave, or ifthey were evacuated, whether they should return to the areas or stay away. This toughdecision depends on a long list of factors, in particular: belief in radiological protection for
yourself and your family, in a context of uncertainty and controversies, the provision ofaccommodation (the old or new accommodation), the restoration of infrastructures(services, networks, etc.), the continued existence of a job (the old or a new job, possiblywith adapted working conditions), conditions for children (school, day nursery) - as the46

ANTICIPATION AND RESILIENCE - IRSN, 2021

5
protection of children is a priority factor -, the restructuring of social activities withincommunities while neighbours or other relations may have changed, and the continuationof recreational and cultural activities.
The decision reached by each individual must be informed, respected and supported.
Nonetheless, the wide range of preferences may have led to conflict within families orcommunities, reducing cohesiveness. Such conflict hampered the preparation of joint
development projects at local level.
The completion of decontamination operations depends on achieving a set target interms of the exposure of inhabitants (below 20 mSv/year). To begin with, the authorities
defined the corresponding dose rate for this purpose, i.e. 3.8 µSv/h depending on theselected scenario. This level was particularly disputed by parents, who considered that it
was inappropriate to use a criterion generally applied to workers for their children.
Consequently, the authorities reduced this level to 0.23 µSv/h, corresponding to an
additional 1 mSv/year. The matter of thresholds notably led parents to limit the outdoor
activities of their children. The lack of exercise helped to increase obesity in young people
in the Fukushima region.
In addition, decontamination operations generated a substantial volume of waste,
which was stored in the municipalities for many years. These storage sites created aneye sore and could act as a source of re-contamination (e.g. in case of heavy rain), andalso discouraged people from returning to the area.

Ten years later, few people have returned
In general, few people have returned to the decontaminated parts of the SDA a
decade later. Table 1 (see also figure 1) provides an overview of the situation at end-2020
and shows that approximately 20% of inhabitants have returned to the twelve
municipalities considered on average. It is apparent that the date on which the evacuation
order is lifted correlates with the return rate: the later the order is lifted, the lower the
return rate.
We could mention the town of Naraha as an example of the low return rate. In Naraha,
the evacuation order was lifted in 2015 and, at that time, according to a survey carriedout by the reconstruction agency, less than 50% of the population was considering a
rapid return, 25% were uncertain and the last 25% did not intend to return. One year later,

ANTICIPATION AND RESILIENCE - IRSN, 202147

5less than 10% of inhabitants had returned and a total of 25% had returned the following
year. It was only in 2017 that Naraha population levels returned to approximately 50% of
the initial level. This difference observed between theoretical intentions and how many
inhabitants actually return reflects the difficulty faced by the latter in reaching a decision
in a context dominated by great uncertainty, in terms of the appraisal of both radiologicalrisk and living conditions, combined with apprehension of the degree of restoration of
infrastructures. In this respect, according to a survey carried out by Fukushima University
in 2012, evacuees mentioned the radiological situation as their main concern. However,three years later, the same survey indicated that the decision to not return to the originalmunicipality was dictated by living conditions rather than the radiological situation.

Table 1: Population variation between 2011 and 2020
in municipalities having received an evacuation order.

Municipality

Date onwhich theevacuation
order wasliftedStatus ofthe liftingof theevacuation
order

HironoSept. 2011

Total

5,490

4,216

77%

https://www.town.hirono.fukushima.jp/
index.html

TamuraMiyakoji

April 2014

Total

380

214

56%

http://www.city.tamura.lg.jp/soshiki/8/
hinanzyoukyou.html

KawauchiOct. 2014

Partial

3,038

2,523

83%

http://www.kawauchimura.jp/page/
dir000112.html

NarahaSept. 2015

Total

8,011

4,038

50%

https://www.town.naraha.lg.jp/admin/
cat337/006099.html

Katsurao

June 2016

Partial

1,567

327

21%

https://www.katsurao.org/life/4/20/65/

Minamisoma
Odaka

July 2016

Partial12,8424,293

33%

https://www.city.minamisoma.lg.jp/
portal/admin/tokeijoho/5307.html

Kawamata
Yamakiya

March 2017

Total

1,259

343

27%

https://www.town.kawamata.lg.jp/site/sinsai-saigai/
yamakiyatikukyojyuujyoukyou.html

IitateMarch 2017

Partial

6,509

1,482

23%

http://www.vill.iitate.fukushima.jp/
soshiki/2/424.html

Namie

March 2017

Very limited

21,4341,554

7%

https://www.town.namie.fukushima.jp/

Tomioka

April 2017

Partial15,9601,568

10%

https://www.tomioka-town.jp/
saigai_fukko/2201.html

Okuma

April 2019

Very limited

11,505283

2%https://www.town.okuma.fukushima.jp/
soshiki/jumin/1007.html

7,140

0

0%

https://www.town.fukushima-futaba.
lg.jp/5873.htm

Total~ 95,000~ 21,000

22%

48

ANTICIPATION AND RESILIENCE - IRSN, 2021

FutabaZone 3

No. ofNo. ofReturnpeoplepermanent
rate
registered as
residents in in Dec.
residents in
Dec. 2020
2020
March 2011

Source5
Figure 1: Map showing the area evacuated(SDA: Special Decontamination Area, black line)
and the municipalities affected (see table 1).
The hatched area is the “difficult-to-return” zone.

Evacuation and return of the population:
What lessons can be learned from the Fukushima
Daiichi NPP accident?
Conclusions reached based on the evacuation after the Fukushima Daiichi NPP
accident must be weighted by the fact that this was a secondary event coming after amajor earthquake and tsunami. Evacuation operations were therefore complicated by
the fact that many infrastructures (roads, power grid) had been destroyed, which added
chaos to chaos.
ANTICIPATION AND RESILIENCE - IRSN, 2021

49

5

The basic principle underlying an evacuation operation is to avoid aggravating thesituation by making inappropriate decisions. In order to achieve this target, it is necessary
to plan for which sites must be evacuated or not, how long will these evacuations takeand consider the drawbacks/benefits ratio for health establishments (hospitals, retirement
homes, etc.) and any industrial facilities which cannot be easily shut down. Various
scenarios must be considered, ranging from temporary evacuation (a few days to a few
weeks) to long-term evacuation (several months or even years). The temporary rehousingof several hundred to several thousand individuals must be planned in advance. Alternatives
to evacuation, such as extended shelter, must also be considered as part of management
plans. According to conclusions from the Fukushima Daiichi NPP accident, close attention
must be paid to living conditions during the rehousing period, particularly in terms ofmonitoring health and maintaining the cohesiveness of the evacuated community.
As demonstrated by the low numbers of returning populations, it is important toremain transparent from the evacuation phase: the authorities must clearly indicate thecriteria underlying the declaration to evacuate. Secondly, it is essential to involve thestakeholders (including inhabitants), as far as possible in a context facing high levels of
uncertainty, in the processes to be prepared in view of lifting evacuation orders andauthorising people to return. With this in mind, these processes must be prepared,
particularly in terms of the flexible criteria to be applied when lifting evacuation orders. In
particular, the use of radiological criteria, i.e. inflexible numerical values, demonstrated its
limits in a context with high uncertainty, in the context of the Fukushima Daiichi NPP
accident: the binary approach (good below, bad above) was sometimes unsettling, andeven led to discrimination. Finally, it clearly appears that the return of evacuees to thedecontaminated areas is a personal decision and must be made possible while
respecting the independence of the evacuees and maintaining decent living conditions,for both voluntary and mandatory evacuations.
According to the example of the Fukushima prefecture, ten years later, it will still takemany years to reconstruct and breathe new life into the regions affected, as themunicipalities have difficulty planning for the future and sizing their infrastructures dueto the low numbers of returning inhabitants. The decision to return to the area must be
reached by each family and each individual affected based on their preferences andchoices. To date, the municipalities are redirecting their activities, particularly economic
activities, while opting for innovative approaches. The aim is to both increase appeal forformer residents and attract new inhabitants. On this basis, municipalities must be able
to constantly adapt in order to be able to match the widely-ranging choices made by the
inhabitants affected by the consequences of the accident. In the coming years, the50

ANTICIPATION AND RESILIENCE - IRSN, 2021

5
profiles of inhabitants are expected to change and some will be new arrivals having
decided to take advantage of the opportunities offered by the revitalization plans,
primarily economic, implemented by local and national authorities.
When managing the populations affected returning to the area or new arrivals inregions previously affected by a nuclear accident, it is also important to consider themonitoring of long-term health effects. Inhabitants raise multiple queries in this respect.
Over and beyond concerns relating to the safety of the damaged facility (is the facility
really safe and could a new accident occur?), inhabitants are facing a long list ofquestions: are waste storage sites safe, could they contaminate the environment? Whatis the real level of exposure of the population? Is there any risk of transfer of contaminationfrom nearby non-decontaminated areas to already decontaminated surfaces? All ofthese questions are legitimate and answers must be provided as part of a structured
dialogue involving the population, authorities and experts. The role played by the latter iscritical. It is obvious that very few of them have received the necessary training andpreparation to manage this type of situation. According to observations in Japan, the roleof supporting and listening to the concerns of the people returning to the contaminatedareas was, in most cases, played by experts from an academic background or nongovernmental bodies, rather than the institutional bodies in charge of radiation protection.

The difficulties inherent to the long-term
management of the consequences of significant
regional contamination
After the accident at the Fukushima Daiichi NPP, the authorities decided to“reconquer” the contaminated areas, evacuated as part of a massive decontamination
campaign. How this type of situation is managed must be considered based on theanalysis of populations returning to the area, characterised by a low return rate after
the evacuation orders were lifted. Radiological, as well as socio-economic aspects,
needed to be taken into consideration while respecting individual and group decisions.
Timescales play a key role in this context, from various viewpoints:• during the evacuation, it appeared necessary to plan ahead, as far as possible, forsubsequent stages, and particularly the decision-making processes which would leadto the potential return of inhabitants. It is not easy to forecast future changes in thesituation, however the outcome of the Fukushima Daiichi NPP accident demonstrates
that it is helpful to prepare, particularly in terms of the future selected radiologicalcriteria, and focusing on their variation over time;

ANTICIPATION AND RESILIENCE - IRSN, 202151

5

• decisions regarding change in post-accident zones and lifting of evacuation orders
must be reached jointly and discussed with all stakeholders (clearly including
inhabitants) as they must integrate many factors ranging well beyond radiologicalissues.
The analysis of the management of the return of populations also highlighted the
key role played by the support mechanisms provided for populations, both during theevacuation period and when planning for people to return to the municipalities
affected. An ideal, totally fair, compensation system is most probably impossible toachieve, however it is essential to consider any compensation frameworks and postnuclear accident socio-economic booster plans during the preparation phase. In addition
to compensation, these mechanisms relate to housing benefits, the development of
infrastructures and support for pre-existing or new economic activities, and theimplementation of environmental and health monitoring programmes covering the
populations having decided to return to these areas. The evacuated residents, who
decided to stay away from the regions affected, must also be monitored and supported.
It is complex to decide on the format of these mechanisms, which play a key role both inguaranteeing decent living and working conditions for the people affected by the accident
and in allowing them to make an informed decision for their future.
After a nuclear accident, it is also essential to set up a monitoring programme forenvironmental contamination, as was the case in Japan. The long-term future andcontribution of such a programme to the organisation of a monitoring programme must
be planned for. The role of radiation protection culture and passing this culture on to theyounger generations must also be examined and planned for as the memories of theaccident and its consequences will tend to fade with time. In the same way, the monitoringof changes in the health of the populations living in the municipalities where theevacuation orders have been lifted must be reviewed. To what extent will the structures
set up meet the expectations of these populations and is the health monitoring
programme set up suitable to meet the challenges inherent in life in these regions?
Finally, according to the analysis of the conditions in which populations return tothe area, the ability to restore healthy socio-economic conditions in the municipalities
after the lifting of evacuation orders is a key factor. Each municipality is a special casedue to local particularities, the scale of contamination, the activities affected, thestructure of the population having decided to return, etc. In some municipalities, mediumand long-term socio-economic dynamics will sometimes depend on the agriculturalsituation, the ability to attract new inhabitants, environmental management guarantees

52

ANTICIPATION AND RESILIENCE - IRSN, 2021

5or the launch of a common development project at regional level. In this context, it isessential to consider the role to be played by radiation protection in more depth, assuch protection is only one of the facets of the aspects to be taken into consideration
to guarantee decent living and working conditions and support socio-economic
development projects while respecting the decisions of individuals and local communities.

ANTICIPATION AND RESILIENCE - IRSN, 2021

53

54

ANTICIPATION AND RESILIENCE - IRSN, 2021

6

EMERGENCY EXERCISES,
LIMITS AND OPPORTUNITIESEmergency exercises help improve the resilience of organizations andthe emergency management system as a whole. Nonetheless, how can
the factors identified as essential for effective emergency management
be leveraged via exercises and how can they be adapted in preparation for
unexpected situations?

Exercises, a key factor in improving the response ofan organization in the event of an emergency…
The ability of an organization, more generally a State, to manage an emergency
situation or a major nuclear or radiological crisis depends on its ability to mobilize a large
number of parties and effectively coordinate their actions. The roles and responsibilitiesof each party must be clearly defined for the purposes of effective coordination, not tomention interfaces, good mutual awareness, compliance with pre-defined lines ofcommunication, etc.
Actions, technical expertise, decision-making and communications must all becoordinated as a key part of emergency management. In order to improve the overall
abilities of an organization or a State, exercises must be organised aiming to test avarying list of components underlying a response force and how these components
interact.
For technical experts, exercises provide a means of practising technical evaluations
within periods compatible with decision-making requirements, testing inter-expert
communications, and their ability to meet the requirements of authorities or the media.
On this basis, these exercises can be used to assess their level of preparation.

ANTICIPATION AND RESILIENCE - IRSN, 2021

55

6…However significant intrinsic limits remain
Exercises incorporate significant intrinsic limits. They generally correspond to
specific and known accidents, rare but identified. Several types of exercises exist, withdifferent objectives, contributing parties and formats. National exercises operate at alarger scale to other exercises. These exercises mobilize a limited number of parties(Prefectures, operators, safety authorities, experts in radiological risks) and the respective
responsibilities are defined in texts (emergency plans, circulars, etc.). Although thisnumber of participants is limited by actual conditions, it does constrain the technicalscenario, which must allow all parties to participate.
Contributors to technical expertise are required to perform many tasks, such as
implement the different resources, for example a crisis centre used to investigate thesituation, use mobile equipment to deploy measuring strategies and apply analysis
methods, particularly for modelling purposes. While crisis centres are regularly set up by
experts during exercises, in the field deployment - particularly the measuring ofradioactivity in the environment, an essential task in order to determine the actual
situation for an event - are less frequent as the exercise scenarios and durations are notalways compatible with the organisation of role play in the field.
The duration of the exercises, generally limited to a dozen hours, is also limiting.
Some recent events, particularly the Lubrizol fire near Rouen in 2019, have highlighted
the full difficulty of investigating a situation, and therefore planning and reachingdecisions in situations with extreme uncertainty, setting a suitable tone in communications
on expert subjects such as identifying releases, all over a period covering several days.
Emergency exercises, as organised today, i.e. mainly focused on a combination ofexpertise and decision-making, are clearly not sufficient to cover the full complexity of thesubject. However, these exercises offer opportunities for role play, which help to approach
events, of different types to those covered during the exercises, more effectively.

Exercises, sources of resilience
Despite all the inherent limits, exercises have one essential virtue for allparticipants. Particularly in the eyes of experts, exercises allow all parties to establish
their own benchmarks, to assimilate the geographic scope and timescale covered by
the emergency, and to test the preparation and solidarity of team members, but also

56

ANTICIPATION AND RESILIENCE - IRSN, 2021

6
how they interact with decision-makers. To summarise, the aim is to acquire reflexes
and benchmarks which will allow the experts to focus on new aspects on the day an
accident occurs, boosting efficiency.
During the exercise, the experts will repeat their procedures using technical tools andworking methods, an indispensable step on the path to progress. Even if modifying
scenarios during emergency exercises is no easy feat, the aim is to securely anchor
basic emergency management skills in organizations, ensuring a smoother ride in an
actual radiological emergency situation. The aim is indeed to ensure that the experts,
subject to the inherent limits of these exercises, acquire the most detailed possible
understanding of their roles and the overall functioning of the emergency response
structure, to promote conditions which allow them to step away from pre-defined
response procedures and routines in the event of a new emergency situation, notrehearsed in previous exercises.
The traditional technical scenario includes a rapid series of events and failures, which
fit in the short time period allocated to the exercise, leaving the experts and othercontributors in general with little room for manoeuvre. When faced with a legitimately
high workload due to the demands of decision-makers on experts from the threat phase,experts must be able to adopt a position despite uncertainty. On this basis, these
exercises place experts in situations where responsiveness and forward planning are
essential, with reference to the criteria used to establish an order of priority for therequired investigations. In this case, the aim is to train contributors to plan ahead,establish an order of priority and reach decisions in situations with high uncertainties.
Despite the many limits, exercises help improve the professional response ofregular participants. Thanks to exercises, participants, and particularly experts, cancapitalize on the experience acquired during these exercises to boost resilience when
faced with an unexpected situation, either individually or collectively.

Lessons learned from the Fukushima Daiichi NPP
accident in terms of emergency management
The accident at the Fukushima Daiichi NPP highlighted the fundamental role
played by people and organizations in limiting the consequences of the accident if
the provisions and equipment set up at the facilities fail. In general, this accident led togreater awareness of the need to reinforce the resilience of organizations in order to

ANTICIPATION AND RESILIENCE - IRSN, 2021

57

6

manage combined events, which, even if they are considered as highly improbable, canoccur. The resilience of the teams involved in managing the situation at the facility itself
must be improved, however this is also true for all contributors in general, particularly
experts as part of the decision-making process.
On this basis, the preparation of experts is part of the more general changes definedby public authorities. After the accident at the Fukushima Daiichi NPP, plans weredeveloped aiming to boost the responses of States for several European countries, forexample, the national response plan to a major nuclear or radiological accident in France
and its adaptations in Defence Zones from 2014, or the Radiation Protection Act inGermany in 2017.
Based on works by the associations of European safety authorities (WENRA) andradiation protection authorities (HERCA) on extending the planning zones around nuclear
facilities, States updated their planning (extension of specific response plans (PPI) in France
in 2016, in Germany from 2014) and extended their stable iodine pre-distribution zones.
Post-accident strategies are defined or improved to integrate the lessons learned
from the Fukushima Daiichi NPP accident and are progressively implemented and tested
during exercises or workshops. To give just one example, in 2016, France organised an
initial exercise at governmental level (SECNUC) which was used to test the national
response plan.
The media is generally allowed to participate with, for example, in France, media
pressure simulated in most national exercises, affecting all participants, particularly
decision-makers, but also experts. The simulation of social networks is also becoming
more widespread.
The involvement of States in the efforts of the International Atomic Energy Agency(IAEA) aiming to propose an emergency coordination mechanism, mainly based onshared assessment methods, and, at European level, the global coordination policy
proposed by HERCA and WENRA in the event of a serious accident in Europe, has led tothe development and execution of many international exercises.
On this basis, the CONVEX exercises organized by the IAEA aim to improve exchanges
and the sharing of technical expertise as part of the application of the Convention on
early notification of a nuclear accident and the Convention on assistance in the case of a

58

ANTICIPATION AND RESILIENCE - IRSN, 2021

6
nuclear accident or a radiological emergency. European exercises are also organised asworkshops by HERCA or as part of research projects (FASTNET project - FAST Nuclear
Emergency Tools). Finally, initiatives are launched to reinforce coordination between
border countries and create networks of technical safety organisations (TSO) which canbe leveraged in the event of a crisis, such as the ETSON Crisis club.

Exercises aiming to take things a step further…
Greater realism
Despite their limitations, national emergency exercises allow the parties directly
involved in managing nuclear or radiological emergencies to regularly practice
approaches, ensuring progressive improvements. The execution of exercises highlights
certain difficulties, which would certainly arise in an actual emergency, in terms of
coordination, investigation, decision-making and communications processes.
In order to improve the technical realism of exercises, the content should bepermanently upgraded to integrate experience feedback from real emergencies.
Future developments could therefore take the form of a wider range of technical roleplay scenarios, directly inspired from the Fukushima Daiichi NPP accident (leaking fuelpools, accident involving several reactors at the same site, natural event) or moregenerally in relation to events which were rarely considered to date, such as multi-sitesituations or scenarios including errors or persistent technical inconsistencies.
From a more general viewpoint, simulating the questioning of experts by the media
or by the public at large, challenging institutional expertise on the basis of their own
questions or analyses, is certainly a factor which would improve the realism of theexercise.
Exercises with international participants must be encouraged. Experts contacting
experts in other countries, as occurred during the Fukushima Daiichi NPP accident,
would enhance the realism of handing a major nuclear emergency, with international
implications. Exercises involving nuclear facilities located close to a border must more
systematically include a cross-border component, at State level, involving their respective
experts required to share their data and compare their expertise.

ANTICIPATION AND RESILIENCE - IRSN, 2021

59

6

Extra unexpected factors
In order to reinforce the adaptation and improvisation skills of experts, the exercises
or role play sessions organised are starting to include a greater percentage of unexpectedfactors, e.g. using an unknown date for the exercise, or an unknown duration (which may
well exceed the usual 8 hours) or deliberately organising a lengthy session as preparation
for a long-lasting situation; or simulating a situation which is not directly mentioned in aplan.
Exercises must also be improved in terms of degraded operation. Experts must be
trained to be able to provide answers in different contexts, including disturbances suchas a concomitant cyber-attack, combined with other crisis, if the operator fails to comply
or by adapting to the new host organisations of their contacts. Exercises including othersituations, such as a natural catastrophe or deliberate misconduct, must also be
prepared.

Fields to be extended
The Fukushima Daiichi NPP accident demonstrated the importance of covering
previously under-tested fields in exercises. Suitable exercises must be prepared.
This is particularly true for the post-accident management of a situation having led
to large-scale radioactive contamination of the environment. These situations arecomplex to handle and involve many different parties, including some less involved
during the emergency phases such as decision makers, the population or associations,
therefore many queries will arise.
For the purposes of the technical evaluation and to answer these queries, new typesof practice must be thought up, particularly in interaction with these parties. Field training
for those specializing in environmental radioactivity measurements is another area to be
expanded, both for emergency situations and for recovery management. The elaborationof dedicated, highly organized and structured exercises, of long duration and on a large
scale, would make it possible to implement specific means of field expertise, such as
aerial mapping which played a major role in obtaining an overview of the areas with thehighest contamination levels during the accident at the Fukushima Daiichi NPP.

60

ANTICIPATION AND RESILIENCE - IRSN, 2021

IRSN
Email: contact@irsn.fr
IRSN Report n°2021-00176
All rights reserved IRSN
March 2021

Cover illustration: Visit to the Fukushima
Daiichi nuclear power plant in Japan bymembers of the International Atomic Energy
Agency (IAEA) on May 27, 2011. View ofreactor No. 3. © IAEA Imagebank.

Designed by: Chromatiques, Paris.
www.chromatiques.fr

Photo Credits: Greg Webb / IAEA.

31, avenue de la Division Leclerc
92262 Fontenay-aux-Roses cedex
RCS Nanterre B 440 546 018
MAILING ADDRESS
B.P. 1792262 Fontenay-aux-Roses cedex

TELEPHONE+33 (0)1 58 35 88 88
SITE INTERNET
www.irsn.fr
E-MAIL
contact@irsn.fr@IRSNFrance