Analysis
Fukushima11032011
In-depth Analysisof the Accident at Fukushimaon 11 March 2011
With Special Consideration of
Human and Organisational Factors

Fukushima
37° 25‘ 26.57“ N, 141° 1‘ 56.87“ E11.03.2011

2|3

Table of contents
1

Introduction and procedure 		42 Background information		
8
2.1

Nuclear supervision and energy policy in Japan 		 82.2 Legal basis for nuclear supervision in Japan		 103 In-depth analysis by ENSI 12		
12
3.1 Origin and development of the accident		 12		3.1.1 Organisational factors		 12		3.1.2 Human factors		 173.2 Management of the accident		 22
		3.2.1 Organisational factors		 22

		3.2.2 Human factors		 243.3 Consequences of the accident		 28		3.3.1 Organisational factors		 28		3.3.2 Human factors		 304 Conclusions		
32
5 Further procedure		 346 List of abbreviations		 367 References		38
List of illustrations
Figure 1 Overview of elements in the analysis by ENSI 							7Figure 2 Network of relationships between the government players in Japan‘s nuclear energy sector 			
9
Figure 3 Hierarchical structure of laws on the safety of nuclear installations in Japan			
11
Figure 4 Fukushima Dai-ichi: design, plant and actual height of the tsunami [4] 		
			
17Figure 5 There are hundreds of marker stones along the Japanese coast... 		 			18Figure 6 Extent of destruction, shown here for unit 4 at Fukushima-Dai-ichi
		(Source: n-tv online, Sunday 24 April 2011) and roads near the coast (Source: rp-online)			23Figure 7 Working with a total power outage and extreme exposure to radiation 		(Source: T-online News, 24.03.2011; Weltexpressinfo online, 25.03.2011)					
251 | Introduction and procedure

1 Introduction and procedure

Das ENSI hat dem inseiner Analyse inbesonderer Weise
Rechnung getragenund den menschlichen
und organisatorischen
Aspekten von Beginn
an denselben Stellenwert wie den technischen Aspekten
eingeräumt.

Following the accident at Fukushima Dai-ichi
on 11 March 2011, ENSI initiated an in-depth
analysis of the accident which aims toachieve the following objectives:• In-depth understanding of the sequenceof events and the contributory factors• D erivation of short-, medium- and long-term
requirements and/or measures for the licenceholders• C onsideration of ENSI‘s own supervisory
work and, as appropriate, derivation of
measures• Verification of the results from reviews by theoperators, as per Article 2, paragraph 1, letterc and paragraph 2 of the DETEC Ordinanceon the Methodology and Boundary Conditions for Reviewing the Criteria for theProvisional Shut-Down of Nuclear Power
Plants dated 16 April 2008 (SR [SystematicCollection of Federal Law] 732.114.5), which
stipulates that in case of events at othernuclear power plants classified as INES-2 orhigher, the holders of an operating licence(licence holders) must review the design of
their own nuclear power plants forthwith andmust immediately notify the regulatory bodyof the results of such review.
In order to do justice to the scope andcomplexity of this event, a dedicated interdisciplinary analysis team was formed within
ENSI. This team comprises experts in thefields of social and organisational sciences,
radiation protection, electrical engineering,mechanical/plant engineering, materials
technology and systems engineering. As
necessary, other sources of expertise werecalled in to assist, both within and outside
ENSI.

It is an undisputed fact that the technicallyinadequate design of the nuclear plants at
Fukushima Dai-ichi, in respect of protection
against the tsunami that occurred as aconsequence of the earthquake, represents a
key factor in the origin and development of
the accident. However, only an integral
analysis of the accident will be able to clarify
how these blatant design defects cameabout, and why the accident developed as it
did. For this purpose, the human and organisational aspects must be taken into accountalongside the technical factors. What appeared at first glance to be a technical plantfailure triggered by natural events very soon
proved to be a complex event in whichhuman and organisational aspects play
crucially important parts.
ENSI has given particular consideration tothis point in its analysis and, from the outset,
has accorded the same status to the humanand organisational aspects as to the technical aspects.

4|5

The main difficulty with collecting facts in
the human and organisational area, including
radiation protection, was posed by confirming and verifying the dependability of theavailable information. ENSI had no directaccess to information. For this reason, its
analysis is based on generally accessible
sources, including in particular informationfrom authorities, operators, expert organisations and (to a considerable extent) media
reports.
International analyses to date have provided
few detailed statements regarding the
aspects of people and organisation. The
official reports on the accident (which arestill awaited) will play a further part inanswering questions that remain open
regarding people and organisation, in
verifying information that has not yet beenadequately confirmed, and/or in testing
hypotheses. For the reasons just stated, andon account of the high degree of complexity,
ENSI‘s analytical process cannot yet be
regarded as complete. This also applies, inparticular, to the radiological effects of theaccidents.

ENSI‘s analysis takes account of the dramatic
circumstances during and after the accident,
under which individuals in Japan had to deal
with the situation on site in conditions ofunimaginable distress. The purpose of ENSI‘sfindings and conclusions is not to level
criticism at the Japanese players and to
distance ourselves from the events; ENSI‘s
aim is rather to use the accident as anopportunity to undertake a critical analysisof the situation in Switzerland. Although thisreport focuses on identifying (presumed)
weak points and deficiencies which contributed to the accident and/or which impeded
the measures taken to deal with it, it isexplicitly not our intention to imply thatTEPCO and the Japanese authorities did not
do everything in their power to bring theaccident under control and/or to mitigate its
consequences. It will also be possible tolearn lessons from things which „went well“,
i.e. factors that helped to prevent the progression and effects of the accident frombecoming even worse (e.g. the vast andtireless efforts of the staff in the plant during
the days, weeks and months after the
inception of the accident). Nevertheless, thecurrent status of information, together with
the need to derive the most urgent measuresfor nuclear plants in Switzerland and all over
the world as quickly as possible, have so far
prevented (international) analyses fromfocusing on this important area.

1 | Introduction and procedure

Given the scale and duration of the accident
and the number of individuals involved, it
must also be acknowledged that only a small
number of people were killed or injured, andthat the number of individuals exposed toinadmissible doses of radiation has been
relatively low. Nevertheless, ENSI takes eachand every one of these cases seriously, andwe regard it as our duty to learn the necessary lessons from each case.
The procedure for the in-depth analysis is
structured in the form of elements that build
on one another (see Figure 1). This procedure
started with the collection of facts regarding
the sequence of events (i.e. a reconstructionof what happened after the earthquake andthe tsunami), and also regarding the background and previous history. Insofar as
possible, the sequence of the accident wasreconstructed on the basis of the available
information [1]. Even the official organisations of the Japanese government and/or
authorities and the operator, TEPCO (Tokyo
Electric Power Company), are (still) not
aware of all the relevant data and facts dueto the lack of operating data and the very
limited ability to inspect the plants up tonow; this means that a complete and definitive reconstruction of the accident sequence is
not possible as yet. Consequently, manyquestions arose while the facts were being
collected − especially regarding the humanand organisational aspects – to which it has(thus far) been impossible to provide
answers.

For the purposes of the in-depth analysis,
the presumed contributory factors were thencollated. This entailed answering two questions: why did the accident occur? And why
did it proceed in such a manner? To achievethis, three further questions were formulated
in relation to specific key events during the
progression of the accident at Fukushima
Dai-ichi:
1. Origin and development of the accident:
Why did a Station Blackout (SBO)1 occur
on 11 March 2011 after the earthquake andthe tsunami?
2. Management of the accident:
Why did damage occur to the fuel assemblies and and why did all the safetybarriers fail, with the subsequent releaseof massive amounts of radioactivity into
the environment?
3. Consequences of the accident: Why were
the plant staff and the public exposed,
and why was the environment contaminated?

Description of a „Station Blackout“: Failure of alternating current supplies, with the sub-categories of lossof standard emergency electrical power supplies and total loss of all alternating current supplies (dependent on the basic design of the respective plants and specific back-fitted equipment as applicable). In thecase of units 1 to 4 at Fukushima Dai-ichi, this involved a total loss of alternating current supplies.

1

6|7

For each of these three questions, hypotheses were formulated for the presumed
contributory factors relating to the areas oforganisation, people and technology. Insofar
as possible, each of these hypotheses was
expressed in specific terms and was substantiated with the help of information fromvarious sources which were as dependable
as possible. In the course of this analysis, it
was possible to identify numerous relationships and interactions between the factors of
influence relating to people, technology andorganisation.

On the basis of the presumed contributory
factors, it is planned to deduce findings fromthe accident in the form of „lessons learned“.
A comparison with the current situation in
Switzerland will show how these findings canbe applied to Switzerland and which measures can be derived from them, where appropriate.

Figure 1: Overview of elementsin the analysis by ENSI

2 | Background information

2 Background information
2.1

Nuclear supervision and energy policy in JapanThe structure of the Japanese nuclear sector
is very complex. A large number of different
players − whose tasks, responsibilities andrelationships to one another are difficult tograsp − have active roles in the supervisionand development of nuclear energy (cf.
Figure 2).

•

Supervision of the safety of nuclear plants
was reorganised in 2001 in connection with areform of the ministries, partly with a view tocreating more independence between theentities responsible for supervision and those
responsible for energy policy.

In the nuclear sector, MEXT includes:

Within the administrative system, the following bodies are basically responsible forthe development and supervision of nuclear
energy:Nach dem Unfall vonFukushima-Dai-ichi
plant die japanische
Regierung die nukleare
Aufsicht aus dem METI
auszugliedern und neu
unter der Führung desUmweltministeriums zu
bündeln•

Two commissions: the Atomic Energy
Commission (AEC) and the Nuclear
Safety Commission (NSC), both within
the Prime Minister‘s Cabinet Office.

•Bodies within the Ministry of Economy,
Trade & Industry (METI) and the Ministryof Education, Culture, Sports, Science andTechnology (MEXT).

•The ministries are supported and/or
advised by a series of Advisory Commi–
ttees and Subcommittees.

Within METI, two different bodies deal withquestions related to nuclear energy:• he Agency for Natural Resources andT
Energy (ANRE), which is responsible forthe development of nuclear energy.

The Nuclear and Industrial Safety Agency(NISA), with responsibilities which include
supervision of commercial nuclear
reactors. NISA is supervised and auditedby the NSC. It is supported by the Japan
Nuclear Energy Safety Organization(JNES).

•

An organisational unit dealing with theadvancement of nuclear technology(research and development).

•

 unit which is responsible for the superA
vision of safety (Science and Technology
Policy Bureau, STPB). The STPB‘s responsibilities include the supervision ofre­search and test reactors.

Following the accident at Fukushima, particular criticism was levelled by the media andofficial bodies at the regulatory body‘s lackof independence, and at the personnel
overlaps within the nuclear sector between
government organisations and the nuclear
industry, which lead to conflicts of interest as
regards supervision and energy policy. The
structure of the organisations involved insupervision, with their interlaced areas ofcompetence and responsibility, was alreadycriticised in 2007 in connection with a reviewof the authorities‘ activities carried out by aninternational team of experts headed by the
IAEA (known as an IRRS Mission (IRRS =International Regulatory Review Service))[8].
Following the accident at Fukushima Daiichi, the Japanese government is planning to
remove nuclear supervision from METI and,as a new feature, to concentrate the relevant
activities under the direction of the Ministryof the Environment [24].

8|9Parliamentelectsappoints
political

Prime Minister
appoints

supervision

leads
oversees
advises

leads
leads
reports toreports toadvisesreports to

leads

leads

commissions /checks

leads

leads

leads

leads

leads

leads

inspects

inspects

leads

Parent Company

Key
ACNRE
AEC
ANRE
JNES
METI
MEXT
MLIT:
NISA:
NISS:

Advisory Committee for Natural Resources and Energy
Atomic Energy Commission
Agency for Natural Resources and Energy
Japan Nuclear Energy Safety Organization
Ministry of Economy, Trade and Industry
Ministry of Education, Culture, Sports, Science and Technology
Ministry of Land, Infrastructure, Transport and Tourism
Nuclear and Industrial Safety Agency
Nuclear and Industrial Safety Subcommittee

Figure 2: Network of relationships
between the government players inJapan‘s nuclear energy sector

2 | Background information

2.2

Legal basis for nuclear supervision in JapanThe legal basis for nuclear supervision in
Japan consists of legislation, Cabinet Orders,
Ministerial Ordinances and Ministerial Public
Notices (see Figure 3). Legislation is passedby parliament. Cabinet Orders are issued by
the Prime Minister, whereas Ministerial Ordinances and Public Notices are issued by the
responsible ministers in each case.
The main items of legislation regarding
nuclear supervision are: the Atomic Energy
Basic Act, the Reactor Regulation Act, theRadiation Hazard Prevention Act and the
Act on Special Measures concerning Nuclear
Emergency Preparedness. Another basis fornuclear energy is provided by the Electricity Business Act, which regulates the entire
energy sector in Japan and is not restricted
to nuclear energy.
Regulatory Guides are published by the Ministry of Economy, Trade & Industry (METI)
and the Nuclear Safety Commission (NSC).
METI primarily reviews technical standards
drawn up by various engineering companies.
45 technical standards are approved at present. The NSC issues Regulatory Guides for
its review of the regulatory body, NISA. Although these Guides are described as internal
NSC documents, NISA and the operators arealso guided by them.

From an in-depth examination of the NSC‘s
Regulatory Guides, it was noticeable thatthese documents are worded as recommendations rather than instructional directives.
Accordingly, in its report to the IAEA Ministerial Conference, the Japanese government
mentions that some aspects of emergency
management have an insufficient legal basis,and that the legislative structures must
be reinforced. Until now, for instance, thepreparation of measures to control incidents
that exceed design specifications, known
as Severe Accident Management Guidelines(SAMG), is not required by law but is merely
recommended.

10 | 11

Figure 3: Hierarchicalstructure of laws on thesafety of nuclear istallations in Japan [3]3 | In-depth analysis by ENSI

3. In-depth analysis
by ENSIThe current status of the in-depth analysis
of contributory factors relating to people
and organisation is discussed below. For
the technical aspects, please refer to ENSIAN-7614 Rev. 1.

3.1

Origin and development of
the accident
Question 1: Why did a Station Blackout(SBO) occur on 11 March 2011 after theearthquake and the tsunami?

3.1.1		 Organisational factors
3.1.1.1		 Operator‘s safety culture
Hypothesis: Deficiencies regarding thedevelopment of a learning organisation
Two key features of a safety-oriented organisation are a fundamental attitude of criticalanalysis and review, and a readiness to improve continuously in matters of safety, i.e. tolearn from the experience of other organisations as well. This feature was not present toan adequate extent in the case of the operator, TEPCO. In its report for the IAEA dated
June 2011, the Japanese government refers
to the necessity of building up a suitable newsafety culture in this context [2].

National and international occurrences in nuclear plants were not given sufficient attention by the operating organisation, TEPCO,
i.e. external findings were not adequately
incorporated into the cycle of continuous
improvement by means of appropriate measures. In 2007, this was confirmed by the recommendation of the IRRS team, according
to which NISA was to ensure that the operators would establish effective processes
to take account of international operating
experience. In the opinion of the IRRS team,
there was also potential for improvement
regarding the use of the national database
containing detailed information on occurrences kept by JANTI (Japan Nuclear Technology Institute) in order to exchange experienceat national level [8].
What has been said above about the inadequate consideration given to national andinternational occurrences also applies to theinsufficient attention paid to the current state of scientific and technological knowledge
regarding the use of calculation methods(specifically in the field of probabilistic safety
analyses, PSA), and to warnings issued by
Japanese scientists about the earthquake
hazard at the Fukushima Dai-ichi site [2].

12 | 13

Hypothesis: Operator‘s unfavourable
corporate culture

Hypothesis: Conflict between safety
and cost efficiency

Signs that nuclear plant operators areadequately meeting their responsibilities
for safety include the complete and correct
representation of the plant‘s actual situationand the implementation of safety reviewsin accordance with regulations. Omissions
and falsifications at the Fukushima Dai-ichi
plant were already known in 2002. TEPCO
itself confirmed 16 cases of discrepancies
or omissions in the safety review that werereported to NISA between 1986 and 2001
via the anonymous reporting system that it
operates [2].

In its 2010 annual report, TEPCO states thatit reduced the frequency of inspections of its
equipment as part of a cost-cutting programme. This reduction is justified by the
results of detailed analyses. This possible
contributory factor should be mentioned inconnection with the inadequate maintenanceof the plant described above [6].

Over time, a culture that favoured falsification and concealment apparently became
established within the TEPCO corporation.
Especially worrying is the following fact: In
2004 TEPCO had publicly communicatedan action plan against falsifications. Nevertheless, 10 days before the earthquake, andshortly after receiving a licence for a 10-year
lifetime extension for Fukushima Dai-ichi Unit
I from the regulatory body NISA TEPCO sent
NISA a document reporting that (contrary to
information provided previously) 33 safetyrelevant components had not been inspected[29]. NISA consequently attested that theoperator‘s maintenance management was
inappropriate and that the quality of theinspection work was inadequate. It requested a new maintenance plan from TEPCO(by 2 June 2011). These repeated cases offalsification and concealment, spread overmany years, indicate insufficient assumptionof responsibility for safety and suggest thatthe safety culture at TEPCO developed in a
problematic manner [2].

3 | In-depth analysis by ENSI

3.1.1.2		 Strategy and practice ofgovernment supervision
Hypothesis: Insufficient independenceof the regulatory body
Section 2.1 mentions the complex networkof intertwined relations between the variousorganisations involved in nuclear supervision. NISA (the Nuclear and Industrial Safety
Agency), the regulatory body, is part of METI
(the Ministry of Economy, Trade and Industry) and is supervised by the NSC (Nuclear
Safety Commission, part of the Cabinet Office). The areas of development and supervision of nuclear energy were separated (andassigned to ANRE and NISA respectively)
within METI when the governmental reform
was implemented at the start of the last
decade, but both areas report to the same
Minister, which entails potential conflictsof interest. The Japanese government also
acknowledges that this arrangement is problematic. For this reason, the government has
decided to make NISA independent of METI
and to incorporate it into the Ministry of theEnvironment [2], [24].
There are numerous media reports about several job changes by holders of high-ranking
positions between ministries and operatingcompanies in the past. This practice, which
can obviously lead to conflicts of interest,
is referred to in Japanese as „amakudari“(descending from heaven, i.e. civil servants
move into private industry after they retire)or also „amaagari“ (ascending to heaven).
The personal relationships between policymaking bodies, authorities and operators
have created a closely-knit nuclear energy
community and have led to a lack of transparency in decision-making structures. To
the outside observer, at least, it is not always
clear where and by whom decisions are ac-tually taken, and/or how independently they
are reached. One indication of NISA‘s lack ofde facto independence, for instance, is thedisclosure of the identity of an anonymous
reporter by NISA to TEPCO; at the end of
the 1990s, this individual entered violations
by TEPCO in connection with safety reviews
into NISA‘s anonymous reporting system.
At the time, NISA justified this step on the
grounds of lack of legal protection for thereporter [30].
Despite the government reform of 2001, in
the course of which NISA achieved de jureindependence, the above remarks suggest
a non-transparent („informal“) culture ofsupervision, which made it especially difficult
for NISA to carry out its supervisory function
to an adequate extent and with the required
independence, and therefore to implement
its own requirements consistently by way of
enforcement.

Hypothesis: Structural deficiencies in
the overall supervision system
One of the problems with the overall systemof nuclear supervision in Japan is that theroles and responsibilities of the Japanesesupervisory bodies are unclear. The supervision system is split into a large number ofbodies and is highly complex (see Figure 2).
This problem was already addressed in 2007
by the IRRS Mission, which recommended
clarification of the roles of NISA and the NSC
in connection with drawing up guidelinesand directives. An analysis by 15 scientists
from the Atomic Energy Society of Japan(AESJ) also concludes that the unclear roles
and responsibilities of the supervisory bodies
substantially impeded communication during
the accident at Fukushima [7]. The Japanese
government has already decided to standardise nuclear supervision [2].

14 | 15

In addition to the lack of clarity regardingroles and responsibilities, it is also the casethat NISA was insufficiently empowered tocarry out its supervisory function. The IRRS
Mission recommended that greater efforts
should be made to build up a pool of qualified technical experts in the long term. It
would be difficult to ensure continuity due tothe rotation of jobs every two or three years,
and the lack of full-time positions. Moreover,
NISA is only able to carry out inspectionsin the plants within time windows that areannounced in advance. For these reasons,the IRRS team recommended that NISA‘sinspectors should be guaranteed unimpeded
access to the plants for inspection purposes
at all times [30].
As a country that is poor in raw materials,
Japan has focused the strategy of its energy
policy heavily on the use of nuclear energy. The development of nuclear energy has
also received strong direct support fromthe Japanese government. For example, thestate also participates indirectly in a newlyestablished enterprise (International Nuclear Energy Development of Japan, JINED),
which aims to promote Japanese nuclear
technology on an international basis [30].
The municipalities where the nuclear power plants are sited rely on financial support
from the government and the nuclear power
plant owners, so they are subject to longterm dependency [32]. Critical opinions on
nuclear safety issues were lost in the construct or ignored. According to media reports,
for example, complaints by the public that
operators of nuclear power plants were
underestimating the earthquake hazard had
little chance of success [31].

Hypothesis: Insufficient supervision
In 2007, the IRRS Mission team submitted several recommendations to improve supervision of the plants in operation [8]; in the lightof the Fukushima accident, the deficiencies
underlying these recommendations emerge
as suspected contributory factors:•

As a new feature, the periodic safety review (which has only been required since2003) should also be submitted to NISA
in the form of a written summary.

•Rather than starting to monitor theageing of systems and components bymeans of separate ageing management
only after 30 years of operation, NISA
should require and assess such monitoring on the basis of safety reviews at an
earlier stage.

•

The development of requirements andsupervision for the human and organisational areas should be driven ahead. In
contrast to the technical area, there are
no clear shutdown criteria for the areas ofoperational management and organisation.

Dies ist Blindtext und hat
keine Bedeutung

3 | In-depth analysis by ENSI

Press reports mention that supervision has
essentially comprised a review of the documents submitted by the applicant. NISA, it
is said, has not adequately ascertained thecorrectness of the information stated bycarrying out its own inspections and checks.
The IRRS Mission also considered that theregular interaction between NISA and theoperators was in need of improvement [8].
In view of the impression created by theaccident at Fukushima Dai-ichi, deficient
and/or excessively superficial review ofprotection against earthquakes/tsunamis by
the authority should be assessed as a central
shortcoming in supervision. The tsunami
hazard in particular was assessed using unsuitable methods, and it was not examined
critically by NISA [2]. According to press
reports, the scanty documents submitted
by the operator regarding the earthquake
and tsunami hazard were not subjected toadequate critical examination by the authority [33].

One key reason for the official acceptance ofthe condition of the plant in terms of protection against earthquakes and tsunamis
was the non-binding nature of the requirements in the legislation and the guidelines.
In 2002, the Japan Society of Civil Engineers(JSCE) drew up recommendations regarding
the consideration of tsunamis in design, butthese recommendations were not binding forthe operators. The operators were also free
to choose the assessment method. Studies
on probabilistic safety analyses (PSA) were
undertaken by the operator only on a voluntary basis and were not adequately developed for cases of infrequent natural events[2]. It should also be mentioned that the statutory approval process for the constructionof new nuclear power plants is not linked tocompliance with requirements for beyond
design incidents. According to the statutory
requirements, there is no need to take account of such incidents because operationalsafety should be guaranteed by the design,and by preventive protective measures. The
government is planning a complete revisionof the legislation and guidelines on nuclear
safety, including the measures for dealing
with severe accidents [2].

16 | 17

3.1.2 Human factors

Hypothesis: Underestimation of risks

In contradistinction to the organisational
factors already described, the following
section considers psychological phenomena
and behaviours on the part of the humans
involved, which may have helped to make itpossible for the Station Blackout (SBO) tooccur after the earthquake and the tsunami.
However, not all aspects of these two areas
can be clearly demarcated. Psychologicalphenomena naturally play a part at bothindividual and group level (i.e. at the level ofthe organisation).

The earthquake and tsunami risks were
evidently underestimated. In retrospect, thisis an undisputed fact and, at least as regards
the tsunami risk, it is confirmed both by the
IAEA [8] and by the Japanese government[2]. Moreover, incorrect assumptions weremade regarding the maximum possible
earthquake strength at the site. The American seismologist Robert Geller, who teaches
at the University of Tokyo, stated in thejournal „Nature“ that the Japanese authorities had the fixed idea that a severe quake
was to be expected on the southern Pacificcoast of the island nation, and that they
underestimated the risk of a serious earthquake in the north-east of the country [34].
The maximum height of a tsunami was alsosignificantly underestimated for the affected
locations (see Figure 4) [34].

Conversely, the organisational factors described above are also closely related to the
behaviours of the organisations involved, andto the mental/emotional phenomena that
affect them.

Reactor building
Seawater pump

Turbinebuilding

Height of tsunami
Design

Shaft
Cable tunnel

Emergency diesel
Generator

Protective wall

Figure 4: Fukushima Dai-ichi:
design, plant and actual heightof the tsunami [4]3 | In-depth analysis by ENSI

Experts and the media consider that thisunderestimate of the risk is directly related tothe methods and bases that are used by operators and authorities in Japan to calculate
and/or model these risks, and to the failure to
take account of progress over recent decades
in the fields of seismology and risk calculation[35], [36]. For example, one criticism madeis that the calculation methods used ignored
important uncertainty factors (e.g. as yet
undiscovered geological deformations or extreme - albeit very infrequent - earthquakes).
In addition, probabilistic considerations were
not included to a sufficient extent. On thecontrary: the calculations were based moreon historical data, i.e. on previous events
involving earthquakes and tsunamis that are
documented (see Figure 5).

Figure 5: There are hundreds of marker stones along
the Japanese coast bearing the inscriptions:• „Do not build lower than this stone!“ and/or• „In case of earthquake, beware of tsunamis!“(Source: AP, Spiegel Online, April 19, 2011)

Paradoxically, however, it seems that these
historical data were not used in their entirety,
but merely on a selective basis: in the past, it
is highly likely that earthquakes and tsunamis
occurred in Japan in excess of the maximum
strengths on which the design of the Fukushima Dai-ichi plants was based (e.g. a hugetsunami wave following the Jogan earthquakein 869). However, only those tsunamis occurring after 1896 were taken into account forthe design of the plants.
The underestimation of risks can partially be
explained by the proven weakness of humans
when it comes to the correct assessment ofrisks. But in respect of the accident at Fukushima, this explanation falls short of themark. To be specific, it hardly explains why
the risks were not perceived and taken into
account despite scientific and historical evidence which, in retrospect, is overwhelming.
It therefore appears that greater importanceattaches to more subtle – yet fundamental –psychological mechanisms which help people
to protect their convictions and actions, andhence also their self-worth.

18 | 19

These mechanisms should not primarily be
regarded as inadequacies of human nature,
but rather as part of the normal adjustmentsthat people must make every day in responseto their environment and/or the requirements
expected of them. They help people to be
and remain capable of taking any action in
the first place, and they generally lead todesirable results. In certain situations, however, these fundamental human traits canresult in undesirable and occasionally catastrophic effects unless they are cushioned
by appropriate organisational measures andoverall cultural conditions. It is therefore crucially important for an organisation (operator,
authority, etc.) to be aware of these psychological mechanisms, and to implement suitable precautions and stipulate organisational
measures so that the (potentially) negative
effects of human behaviour can be identified
and intercepted, and/or to provide people
with a suitable framework of conditions fortheir actions.
The next section discusses some of the psychological mechanisms which – when considered today – would appear to have played apossible role in the history of events leading
up to the accident.

Hypothesis: Disregard of warnings
and facts
As has already been described, a series of(potentially) known and documented facts aswell as warnings from individual experts andorganisations were disregarded. They were
not incorporated into the design or backfitting of the nuclear plants, and they werealso given insufficient consideration by theauthorities and were not integrated sufficiently into regulatory documentation or supervisory work [2].

In 2005, for example, Professor KatsuhikoIshibashi of the University of Kobe warned aparliamentary commission about the consequences of earthquakes and tsunamis inrespect of the Hamaoka nuclear power plant(which, at the request of the Prime Minister,
was provisionally shut down for back-fitting
after the accident at Fukushima). In an expert
report, the Professor set out the expected
progression of an incident after an earthquake and subsequent tsunami. According to media reports, this progression corresponds tothe sequence of events which unfolded at Fukushima from 11 March 2011 onwards [37]. Moreover, a Japanese geologist allegedly warned
the government that a severe earthquakewith a large tsunami wave was to be expected in the north-east of Japan. METI rejected
the evidence that was presented and TEPCO
also did nothing to improve the protection of
the plants at Fukushima against high tsunami waves. It is said that a presentation of thegeologist‘s research results to representativesof the Fukushima nuclear power plant wasscheduled for a few days after the earthquake
and tsunami [37].
But why did such warnings come to nothing?
It must be assumed that psychologicalsuppression or rationalisation mechanisms,
together with selective perception, caused
newly published and/or produced (scientific)
knowledge and facts to be ignored, played
down or re-interpreted so that they would
not jeopardise previous decisions and actions(or omissions), or cast fundamental doubt
over the operation of certain nuclear plants
at specific sites. Over recent decades, for example, active fault lines were discovered close
to various plants. The plant operators initiallytended to downplay these deformations. One
case is reported in which the operator repeatedly had to make upward corrections to thedata on the length of a newly discovered fault

3 | In-depth analysis by ENSI

line located close to its own plant. When theoperator finally acknowledged the scientists‘
findings in full, it stated that the plant was
designed so that it would withstand an earthquake triggered by this deformation [31].
Another example of rationalisation processesof this sort is reported by Associated Press
journalists [36]. In 2007, it is alleged that two
TEPCO employees, together with three external researchers, published their approach tothe assessment of the tsunami risk at Japanese nuclear power plants in the „Pure and Applied Geophysics“ journal. They also recommended that the plants should be designed
for the highest tsunami (quote: „at the site
among all historical and possible future tsunamis that can be estimated“). However, they
immediately qualified this statement again by
excluding facts about tsunamis that occurred prior to 1896 from the analysis, because
the documented data might be unreliable on
account of „misreading, misrecording andthe low technology available for the measurement itself“. They concluded: „Records thatappear unreliable should be excluded“ [35].
A further indication of rationalisation andsuppression processes is the tendency to use
new calculations to confirm original results
and statements. A few months before theaccident at Fukushima, TEPCO concluded
on the basis of its own new calculations thata tsunami wave at Fukushima Dai-ichi would
not exceed the 5.7 m mark. A TEPCO construction engineer is quoted as saying: „We
assessed and confirmed the safety of thenuclear plants.“ [35]Another possible way of evading new knowledge and the higher requirements for safety
precautions that it creates was reported by
the New York Times [35]. When the authorities started to exert more pressure regarding

the seismic design of plants after the Kobe
earthquake in 1995, the operators – who werefocussing on the construction of a dozen
new reactors – defended themselves against
stricter regulations. They evaded the pressure
by means of delaying tactics, for example bynot sending any delegates to meetings onearthquakes organised by the Nuclear Safety
Commission of Japan (NSC).
A reluctant approach to external recommendations is also noticeable on the part of theauthorities. In particular, it seems as if therecommendations of the 2007 IRRS Mission
were only being implemented after a delay.
Furthermore, the follow-up mission originallyplanned for February 2010 was postponed.
As far as is known at present, no invitation has yet been issued to the IAEA for thisfollow-up visit and no definite date has been
set [11].

Hypothesis: „Group Think“
The organisational phenomena describedhere should not only be regarded at the individual level, as defence mechanisms on thepart of specific persons; they are also boundto be reflected at collective level, i.e. at thelevel of the organisations involved (operators,
supervisory authorities, policy-making andlegal bodies, etc.) and of society as a whole. Against the backdrop of a political andsocial climate in which very great emphasis isplaced on promoting the use of nuclear energy, there is a growing risk that findings andarguments running counter to this trend will
be suppressed. This is also demonstrated, forexample, by the fact that plaintiffs from thegeneral public who launch court proceedings
against nuclear plant operators on grounds ofsafety deficiencies have virtually no chanceof winning their actions in court [31]. It mustalso be assumed that such trends are favoured by a supervisory apparatus which has

20 | 21

little ability to assert itself and must base its
work on regulations that fail to cover decisive
requirements.
Accordingly, the phenomena described here
must also be considered from a socio-psychological perspective. It is difficult for any
attention to be paid to new knowledge andwarnings brought to the notice of collective
bodies (organisations) by external parties.
One possible explanation for this is suppliedby the phenomenon known in socio-psychology as „Group Think“, as described by thepsychologist Irving Janis. This concept explains why groups can take extremely unreasonable or even obviously incorrect decisions
under certain circumstances, even though theindividual group members would never takethe same decisions on their own [10].
On the basis of the information available todate, it is impossible to arrive at a definitive
assessment of the extent to which GroupThink processes actually played a part in the
run-up to the accidents at Fukushima (and/or after the accident had occurred). However,statements such as the one cited here by the
Chairman of the Nuclear Safety Commissionof Japan suggest that such processes cannot
be ruled out: „He said the guidelines [referring to the Regulatory Guidelines of NSC on
the design of nuclear power plants – editorialcomment] were not revised because experts
on nuclear power generation are an enclosed
group and they tend to avoid vigorous discussions and uncomfortable subjects“ [39].

Hypothesis: Complacency andexcessive trust
Another obvious assumption is that a lengthy
period without any incidents induced by earthquakes and (in particular) tsunamis could have
led to a certain degree of complacency. Consequently, both operators and authorities might
not have paid sufficient attention to potential
safety deficiencies in the design of nuclear
plants and/or may not have reacted as promptly as was required to any safety concerns [33].
The belief that „nothing is going to happen“ isalso likely to have been reinforced by the factthat earthquakes are virtually an everyday event
in Japan, and they usually have no negative
effects on nuclear power plants. This tendency
to complacency and excessive trust in nuclear
technology was confirmed in June 2011 by the
METI Minister at the IAEA Ministerial Conferencein the following words: „In Japan, we have something called the „safety myth“. (…) It‘s a factthat there was an unreasonable overconfidence
in the technology of Japan‘s nuclear power
generation.“ The result of this was that safety
thinking in the nuclear industry was based on
weak foundations [40]. This is also reflected by
the fact that there has been no review of thedesign guidelines since 1990. For example, theseguidelines explicitly excluded the need to consider long-lasting power failures (quotation: „along-term power failure can be ignored as emergency back-up systems are expected to supply
electricity“) [39]. The Chairman of the NSC isquoted by NHK, the Japanese public television
broadcaster, as saying that he had not given
this statement any attention until the accident
at Fukushima, and he regretted his ignorance inthis regard.

3 | In-depth analysis by ENSI

3.2

Management of the accident
Question 2: Why did damage occur to thefuel assemblies and and why did all thesafety barriers fail, with the subsequent
release of massive amounts of radioactivity
into the environment?

3.2.1		 Organisational factors
3.2.1.1		 Operator‘s maintenance andemergency management
Hypothesis: Deficient maintenancemanagement
In 1991/92, a tightness test on the safetycontainment of unit 1 at Fukushima Dai-ichi
was manipulated by introducing additional
air [2]. In retrospect, however, whether thisaction impaired the function of safetysystems during the sequence of events in theaccident is not possible to answer. The samecan be said of the 33 untested components
which (according to media reports) TEPCO
only reported to the regulatory body after
the lifetime-extension of the plant had been
granted. At this point, shortly before theaccident, NISA attested that TEPCO‘smaintenance management was deficient, andcalled for a new maintenance plan by 2 June
2011 [29] (cf. also section 3.1.1.1).

rector pressure vessel based on its interpretation of the authorities‘ position to thismatter. Nevertheless, the local director of theplant is said to have ordered the feed (forunit 1, approx. 28 h after the tsunami wave
arrived). The Japanese government also
confirms that the director of Fukushimaordered this measure and that some confusion prevailed in the decision-making chain
between the government and TEPCO [2].
Likewise, media reports state that the Prime
Minister did not receive all the information
required to arrive at a decision. Instead,
TEPCO attempted to downplay the accident.
The Prime Minister was said to be fundamentally suspicious of a system that consisted of
powerful operators and a loyal authority, so
he did not have recourse to the communication channels and decision pathways forwhich provision was made [41]. As a result, it
is possible that delays occurred in thedecision-making process.

Hypothesis: Inadequate emergency plan
A direct influence on measures to deal withthe accident so as to prevent core damage
and the release of radioactivity was probably
exerted by the available emergency planwith the emergency regulations on dealing
with severe accidents, the „Severe AccidentManagement Guidelines“ (SAMG).

Hypothesis: Delayed decisions
Given the sequence of events [1], it becomes
clear that, in technical terms, the seawater
feed for unit 1 was ready to operate at aconsiderably earlier point in time than when
it was actually started. Whether the instruction was delayed and, if so, who was responsible for the delay, are questions to which theanswers are unknown at present. According
to press releases [41], TEPCO headquarters
prohibited the supply of seawater into theThis „Emergency Action Plan“ was alsoavailable at Fukushima Dai-ichi, but it did notgive adequate consideration to an accident
on this scale.

22 | 23

Even though certain accident management
measures did function (manual supply ofwater via fire extinguishing hoses), theemergency action plan ultimately failed to alarge extent [2]. Various aspects contributed
to this failure [2]:•Inadequate emergency procedures forsevere accident management measures•

Deficient communication plan between
TEPCO‘s headquarters (Off-site Head
Office), TEPCO‘s site management and/or
governmental authorities•

National, external emergency assistance(rescue squads) with logistical support
were only able to provide on-site help
after some time had elapsed•

Insufficient consideration was given to
the simultaneous destruction of large
parts of the infrastructure in the surrounding area – availability of heavy equipment for severe accident management
measures (see Figure 6)•

Adequately trained staff to deal with an
event of this scale and duration were notavailable•

The members of the emergency team
were not given adequate training for an
event of this scale and duration during
regular emergency exercises

Hypothesis: Staff to implement severe
accident management measures were
not available or were overcharged
A particular problem arose for the multi-unit
plants because several reactors were impacted simultaneously by the accident. There
was a bottleneck of qualified staff, who wereunable to be present simultaneously at all
the reactors affected by the accident. As wellas the technical separation of the units, italso seems sensible to set up independent
emergency organisations for each reactor
unit [2].

Figure 6: Extent of destruction,
shown here for unit 4 at FukushimaDai-ichi (Source: n-tv online, Sunday
24 April 2011) and roads near thecoast (Source: rp-online)

3 | In-depth analysis by ENSI

3.2.1.2 Bases of emergency
protection and emergency
action planning by theauthorities

Due to the deficient structures, the Japanese
government was unable to adequately coordinate the international assistance that wasoffered, and was therefore unable to makeprompt use of it [2].

Hypothesis: Deficiencies in the supervision of emergency measures and theunderlying legislative and regulatory
framework

3.2.2 Human factors

Measures to bring severe accidents undercontrol were drawn up by TEPCO in 2002
on a voluntary basis. The relevant guidelines
were issued as long ago as 1992 and havesince been partially updated on only one
occasion (1997) [12]. The inadequate development of the emergency measures is attributed in particular to the lack of legislativerequirements in the Act on Special Measures
Concerning Nuclear Emergency Preparedness [2].

Hypothesis: Omissions in official
emergency action planning
The authorities‘ preparations for an accident of this scale were equally inadequate.
The emergency centre at the site (the local
Nuclear Emergency Response Headquarters,
NERHQ) was not ready to operate due toinsufficient shielding and the lack of infrastructure, so it was necessary to switch to alocation in the surrounding area [2].
Communication problems also arose between the local NERHQ, the NERHQ, thegovernment (the Prime Minister), the TEPCOHead Office and TEPCO‘s on-site operational
management. As well as the initial failure ofmeans of communication, this was due inparticular to the unclear emergency procedures and the related lack of clarity regarding responsibilities [2].

Hypothesis: Difficult working
conditions for the staff
The staff at Fukushima Dai-ichi had to work
under extremely difficult conditions after theearthquake and the tsunami (and to someextent, they probably still have to do so atpresent). Little confirmed information about
the actual working situation on site is available as yet, but the pictures repeatedly published by the media send out a clear message.
Difficult physical working conditions:
The physical conditions on site made emergency management and/or the workers‘
activities more difficult. Due to the power
outage, large areas of the plants were in
darkness (see Figure 7), including parts ofthe control rooms; the instrumentation had
partially failed and/or the information thatwas still available was not reliable; communication within the plant and to the outside
world was impeded. Only restricted accessto systems and rooms was possible due todebris, damaged doors, flooded buildings
and plants and the risk of explosion, etc.
Work was also made more difficult by theambient conditions such as high ambient
dose rates (ADRs), noise, heat, and high air
humidity. There are reports of cases of dehydration and heat stroke due to long periodsof working in full protective suits without
cooling [13]. In addition, there was a healthhazard for staff (which still exists to someextent) due to high exposure to radiation.
At the outset, for example, the local emer-24 | 25

gency centre was not adequately protectedagainst penetration by radioactivity, andthis led to an accumulation of impermissible
doses of radiation in the case of at least one
person [14]. Moreover, the health of thoseworking on site was (and still is) endangeredby highly radioactive debris located on thesite [15]. Finally, it has been reported that it
was initially impossible to fit all members of
the intervention teams with dosimeters andprotective equipment (masks in particular)
in order to carry out the emergency measures [16]. These conditions made it far moredifficult to implement planned emergency
measures.
Difficult psychological working conditions:
It is likely that the psychological stresses under which the staff had to work on site wereat least as onerous as the physical conditions[42]. Although this has not yet been confirmed either by official sources or by media
reports, it must be assumed that some ofthe staff were in a state of shock after theearthquake (which lasted for 90 seconds)
or after the tsunami, if not before. Anotherfactor was that many employees were afraid
for their family members. The employees had
no possible way of contacting their relatives
and in some cases had to assume that they
could have fallen victim to the tsunami or theearthquake. The media also reported individual stories of employees who remained in
the plant although they knew that their families had been swept to their deaths by thetsunami [42]. Finally, the staff had to copewith the deaths of several workers in theplant. Two of them drowned in the floodwater in the plant, and were found at the end of
March in the turbine building of unit 4 [17].

Figure 7: Working witha total power outage
and high exposure toradiation (Source:
T-online News,
24.03.2011; Weltexpressinfo online,
25.03.2011)

3 | In-depth analysis by ENSIÄusserst schwierige
Arbeitsbedingungen.

It is also highly likely that the general conditions under which the staff had to work
were extremely difficult for a considerable
time. According to media reports, the supplyof food for the staff was inadequate in theinitial period. It is reported that during thefirst days, 500 employees slept together ontatami mats in a nearby secondary school,with no showers and meagre rations offood [43]. At the outset, moreover, it is very
probable that the staff could not be relieved
for a lengthy period, which is bound to have
led to over-tiredness or even conditions of
exhaustion [42]. Shortage of staff made theemergency measures more difficult.

If we consider the physical and psychologicalconditions just described, which continued
for several weeks and to some extent still
persist today, we are bound to conclude thatthe on-site staff accomplished the utterly impossible and displayed almost superhumanbehaviour, regardless of how successful theyultimately were in gaining control over theaccident and/or its consequences. Rumoursthat the staff fled from the plant after theearthquake and the tsunami are largely refuted by media reports. A few of the 900 orso persons present at Fukushima Dai-ichi left
the plant due to concern about their families,
but most of them remained in the plant.

Another definite psychological stress factor
was the need for on-site employees to takedecisions and to act without knowledge ofthe actual condition of the plant (also see
below). Likewise, it must be assumed thatthe situation for the on-site staff became
increasingly desperate as time went on, because new and unexpected events occurred
repeatedly and many of the measures taken
were not successful. In some cases, the staff
had to take action against the sequences ofaccident-related events simultaneously inthe different units, and it is likely that theyfelt that they had lost control of the situationin the plants for a lengthy period.

The evacuation of the staff, except for 50
persons, which took place on 14 March was
officially ordered by TEPCO. TEPCO evenasked the Prime Minister for permission
to withdraw the entire staff. However, thisrequest was vehemently declined by thePrime Minister [41]. At a later stage, theon-site staff was increased again so that thenecessary work on the site could be carriedout. The precise figures and the numbers ofpeople present on site at different times are
not yet available to ENSI.

26 | 27

Hypothesis: Inadequate awarenessof the situation
It must be assumed that the on-site staff had
no precise knowledge of the actual situationand condition of the plant for long periods[44]. At least temporarily, this is also likely
to have resulted in incorrect assessments ofthe situation. The first incorrect assessment
was probably made just a few minutes after
the earthquake, following the first tsunami
warning issued by the Japanese meteorological institute, and referring to a wave
with a height of at least three meters („major tsunami“) [18]. Based on this warning,which did not make it possible to foresee thetrue scale of the expected tsunami, it wasprobably thought that no special technicalmeasures were occasioned at Fukushima
Dai-ichi and that there was consequently no
particular cause for concern. The fact thatthe first version of the plan presented by
TEPCO to bring the plant back under control
had to be adapted again after a short time,
and the estimated time of occurrence of core
meltdown in unit no. 1 had to be corrected[45], suggest that the correct assessmentof the condition of the plant will prove to bevery difficult for a long time to come.

It is impossible at present to make definitive
statements regarding a whole series of issues
because insufficient information is available.
For example, it is not possible (as yet) toassess the adequacy of the staff‘s behaviourin planning and implementing the emergency measures. Moreover, it is impossible to sayat this stage whether the existing regulations
were followed. Nevertheless, it can alreadybe stated that the conditions described arelikely to have made emergency management
considerably more difficult. The accident at
Fukushima Dai-ichi impressively confirmsthat emergency management must not be
regarded as a purely technical matter thatis confined to the availability of technicalmeasures and resources. The physical andpsychological stresses, and the overall organisational conditions under which people
have to work in an emergency, must also betaken into consideration.

Personal hatt keine
genauen Kenntnisse
der tatsächlichen
Situation.

3 | In-depth analysis by ENSI

3.3

Consequences of the accident
Question 3: Why were the plant staff andthe public exposed, and why was theenvironment contaminated?

3.3.1		 Organisational factors
3.3.1.1 Protective measures for theoperating staff and the intervention teams
Hypothesis: Inadequate protective
measures for the operating staff andthe intervention teams
Although the authority had increased thedose limit from 100 to 250 mSv for those
staff deployed to deal with the accident who
were exposed to radiation for occupational
reasons, the limit may possibly have been
exceeded in the case of two persons, witha whole body dose in the range from 200
to 580 mSv [19]. These possible breachesof the limit values for the whole body dose,
which consists of exposure in the radiation field and the incorporation (bodily
uptake) of radioactive substances – mainly
radioactive iodine – could be an indicationthat protective measures for the staff were
inadequate at the start of the accident. Fullprotection masks with active carbon filters
would have prevented the inhalation of I-131,
which contributes significantly to the wholebody dose.

Serious contamination of persons occurred
on 24 March 2011 in the case of two employees working in the turbine building of unit
3. Due to inadequate protective equipment,
direct contact with water polluted by betaemitters caused contamination of the individuals‘ feet and legs, causing partial bodydoses of up to 3 Sv in both cases. The highly
uncertain nature of the dose information
prompts ENSI to conclude that there weredifficulties regarding personal dosimetry.
Japanese health organisations criticised the
deficient monitoring of doses for the operating staff and the intervention teams, and theincrease in the limit for the whole body dosefrom 100 to 250 mSv [20].
Shortcomings in radiation monitoring forthe staff are explained by the flood-induced
destruction of many personal dosimeters
and the initial difficulties with measuring
radiation on the plant site [2]. It is obviousthat neither the local authorities nor theministries‘ offices were adequately prepared
to measure ambient dose rates or to determine concentrations of radioactivity in the
air. ENSI is unable to understand why only
incomplete information from the operator on
ambient dose rates (ODL) was available, withno measurements by independent authorities.

28 | 29

3.3.1.2 Information and protective
measures for the generalpublicHypothesis: The general public wasinadequately informed
Although the evacuation of the public fromthe more immediate vicinity of the plant wasquickly initiated by the authorities, there is
criticism of the inadequate information supplied to the public and the local authorities
in the (wider) surrounding area regarding
the likely development of the accident andits impact on the exposure of the public toradiation. During the acute phase, the public
was not adequately informed about potential
exposure to direct radiation and the ingestion of radioactive substances. Likewise, thepublic was not briefed sufficiently about thepersonal protective measures to be applied.
Reasons that can be cited for this include theorganisational problems mentioned below
and the non-availability of destroyed meansof communication [2].

Hypothesis: Inadequate protective
measures for the public
At the start of the accident it was not clear
who actually bears the main responsibility
for protecting the public in case of an
emergency. This was principally due to thecomplex supervisory structures and the large
numbers of supervisory bodies involved [2].
Even though the evacuation of the public in
the areas surrounding the Fukushima Dai-ichi
plant took place quickly, the evacuation
zones were not sufficiently adapted to theprevailing local radiation contamination. At
the outset, the measures were not based on
the guidelines of the International Commission on Radiation Protection (ICRP) and the
IAEA [2]. One example of this is the very lateevacuation of the village of Iitate, which issituated outside of the 30-km radius to thenorth-west of Fukushima Dai-ichi.
Likewise, the evacuation zones were notinitially determined on the basis of propagation calculations by the system envisaged forthis purpose, i.e. SPEEDI (System for Prediction of Environmental Dose Information) [2].
The monitoring organisations in the provinceof Fukushima only have one device available,
which can measure about ten persons perday, to handle the announced whole bodymeasurements of the affected members of
the public (about 200,000 people) in orderto determine potential instances of incorporation caused by inhalation or ingestion ofradioactive substances [21].

3 | In-depth analysis by ENSI

3.3.2 Human factors
Hypothesis: Inadequate knowledge ofthe radiological situation and stressinduced errors
As outlined in connection with the explanations of contributory factors in the organisational area, the reporting on personaldoses – although still incomplete – suggeststhat several individuals received doses ofradiation that were above the applicable
limit values for them. In official statements,
this is attributed in part to the initial lack ofan adequate number of electronic dosimeters and to disruptions in the recording of
measured data, as well as to major problems
with measuring radiation on the plant site
during the first days following the accident.
In the case of the employees of an external
company whose legs were contaminated byradioactive water on 24 March 2011, it mustalso be assumed that the staff were working
without knowledge of the actual radiologicalsituation and/or that they had assessed thesituation incorrectly. TEPCO assumes thatthey took the values measured on the previous day as their basis and were not aware of
the changed working conditions despite thealarms from their dosimeters [22].

Another example of avoidable incorporationis the incident which took place on 13 June
2011: an employee working outside the unit 2
reactor building only realised after completing two hours of work that he had forgotten
to fit a filter to his full protection mask [23],although the consequences in this case wereminor with a committed (effective) dose of
0.5 mSv.
Even if the incidents of avoidable exposure
to radiation, contamination and incorporation reported here are individual cases,
they must nevertheless be included in theanalysis. From the individual perspective, it
must be assumed that errors are favoured insituations such as this. In the cases described, for instance, dosimeter alarms were notheeded or individuals forgot to fit the active
carbon filter.

30 | 31Since the basic assumption has to be thaterrors are committed, especially under theconditions in which staff were working tocope with the accident at Fukushima, it isessential to consider the cases of exposure
to radiation, contamination and incorporation described here from an organisational
perspective as well. In so doing, it is necessary to examine whether the company‘s
own staff and third-party personnel, as wellas the intervention teams, were adequately
trained and whether they were sufficiently
prepared for the individual tasks that had
to be performed. In the case of the employees who were contaminated on 24 March
2011, TEPCO gave an assurance that its own
staff and third-party personnel had received
fundamental instruction on the recognitionof a dosimeter alarm [22]. Whether these
individuals had ever worked previously in aradiation field with open radioactive substances and whether they had understood the
instruction are matters which, in ENSI‘s view,
cannot currently be clarified. It therefore
seems legitimate to question the organisational measures taken to protect the employees, including the general training measuresand the specific preparation for the tasks to
be undertaken (e.g. in the context of „prejob briefings“), and also to ask whether theorganisation of the on-site radiation protection was suitable in order to cope with anaccident of these dimensions. In this regard,particular emphasis should also be placedon the need for organisational measures thatare appropriate to human behaviour traits(especially in extreme situations).

It has to be assumed that the Japanese andinternational authorities and the operator,
TEPCO, will follow up the issue of staff training and preparation in the course of further
investigations and analyses.

4 | Conclusions

4 Conclusions

The findings presented in this report must be
regarded as provisional results from the analysis. It will take months or years to carry out
the analysis, before all the lessons from theaccident at Fukushima can be learned and implemented. A large number of the (presumed)
contributory factors that have been identified thus far are hypothetical in nature. Thisis because, on the one hand, it is still difficultat present to fully verify the dependability of
the information that has been gathered – inparticular as regards the areas of people andorganisation (including radiation protection).
A substantial part of the information available
to date was taken from media reports. So far,it has been impossible to undertake a comprehensive review of the correctness and completeness of this information. It is also to be
expected that it will never be possible to haveall of the information confirmed by official
reports. On the other hand, it will be equally
impossible to verify a number of hypotheses,
especially those relating to the history prior to
the accident, since no direct causal link can beestablished between individual events in thepast (e.g. the non-availability of systems due
to deficient maintenance) and the accident.
The accident can be explained only by thevery specific conglomeration of events andcircumstances, and their specific coincidence,but not by linear, causal concatenations ofevents and circumstances. For these reasons,the precise role of each of the identified
contributory factors in the causation of theaccident cannot be conclusively proven.

ENSI‘s analysis has yielded the following
results:•

The (presumed) contributory factors
identified to date range across the areas ofpeople, technology and organisation witha variety of interlinked relationships and/orinteractions. This applies to the origin anddevelopment of the accident, the measurestaken to deal with it and its consequences.
This report focuses on the results in thearea of people and organisation.

•

The (presumed) contributory factors identified in the area of people and organisation relate to the operator (TEPCO) as wellas to political and official bodies.

•Organisational aspects that relate to thesafety culture of the operator, TEPCO, andthe structural deficiencies of the entire
system of nuclear supervision in Japan, as
well as the underlying psychological mechanisms that form the basis for human behaviour, contribute towards an explanationof the technical shortcomings in the run-up
to the accident.

•

Crucial importance attaches to the humanand organisational aspects of emergency
management in connection with measures
to deal with the accident (e.g. emergency
sequences, procedures, decision-making
and communication pathways, training anddeployment of staff, etc.). The influenceof the difficult physical and psychologicalworking conditions on the performanceability of staff in emergency situations
must be considered in depth, and must
be taken into account for the planning of
emergency actions by operators of nuclear
plants and by the supervisory authorities(assumption of a worst-case scenario).

32 | 33

As regards the further steps in the analysis,
it is important to continue considerations as
to how the identified contributory factors
could materialise in the first place, i.e. which
fundamental mechanisms and phenomena
provided the basis for them. The accident at
Fukushima can be attributed in particular toa design error. Therefore, the design of Swiss
nuclear power plants must undergo renewed
critical analysis against the particular backdrop of the knowledge gained in Japan. But
above and beyond the review of the designof nuclear power plants, the decisive question
is: How could it come about in Japan that an
inadequately designed plant did not undergo
adequate back-fitting during its long period
of operation? The (presumed) contributory
factors identified by this report in the areaof people and organisation already supply amajor contribution towards a differentiatedconsideration of the conditions and complex
combinations of circumstances which led
to the accident at Fukushima and/or influenced its progression. However, the search for
explanations must give even more thoroughconsideration to the fundamental human andorganisational mechanisms that underlie thebehaviours, omissions and errors describedin this report. Mechanisms of this sort havealready been tentatively addressed in thereport. Why were the deficiencies in designand supervision – which appear so obvious in
retrospect – not identified at an earlier stage?
Why did the plants at Fukushima not havebetter protection against tsunamis, although it
was known that very high tsunamis had already caused major destruction in Japan in the
past? Why were the operators and authorities
not better prepared to cope with an accidentof this sort?
It would definitely not suffice to imply that individual decision-makers in Japan were merely
irresponsible or committed deliberate errorsof conduct. It must be assumed that basic human and organisational mechanisms (behaviour-shaping mechanisms, [25]) are also
among the underlying factors. Such mecha-

nisms and external conditions can have a strong
impact, and may have the effect that facts whichappear to be self-evidently obvious in retrospect
are not identified or are suppressed, rationalised
or explained away beforehand. It is also possiblethat over a lengthy period of time, gradual changes in perceptions and practices occur that arerecognised with hindsight as obvious major changes, but which are difficult to identify at an earlier
stage because they „creep in“ (Drift into Failure,cf. [26]). Phenomena of this sort must be regarded as inherent characteristics of socio-technicalsystems. These behaviours reflect the constantly necessary adaptations in people and/or thesocio-technical systems within which people
operate, in response to changing conditions (cf.
e.g. Hollnagel [27]). These mechanisms affect all
the players, from the operator and the regulatory
body and/or political bodies all the way throughto society as a whole. It is the responsibility andduty of all players in the nuclear industry (operators of nuclear plants, governments, supervisory
authorities and expert organisations, etc.) to understand the potential and actual effects of thesemechanisms and to accommodate them in theirorganisations by means of appropriate structuresand processes, and with the help of a culture thatis safety-oriented and mindful. These mechanisms
cannot be eliminated by simple and case-specificmeasures such as new regulations or the further
automation of technical systems, because there
will repeatedly be new and unexpected situations that were not foreseen by any engineer or
regulatory body. Rather, the organisations musthave the ability to cope with the unexpected.
They must be resilient, i.e. they must be capableof adapting before, during and after changes anddisruptions, so that they can maintain control at
all times, under expected and unexpected conditions alike [28]. Although the effectiveness ofmany of the mechanisms described here cannot
be fully proven in specific cases, it is neverthelessimportant to deal with them as the further analysis of the accident at Fukushima proceeds. This is
the only approach that allows a full considerationof the applicability of the accident to Switzerland
so that the relevant lessons for Switzerland canbe learned.

5 | Further procedure

5 Further procedure

The following areas of action regarding
the issues of safety culture and emergency
management were identified on the basis ofthe (presumed) contributory factors related
to people and organisation. As part of its supervisory activities, ENSI will conduct a specific review of the situation for these areas ofaction in Switzerland. For this purpose, ENSI
has formulated a series of specific findings.
A comparison with the actual situation in
Switzerland will show which of these findings are applicable to Switzerland and what
measures can be derived from them, whereappropriate.
It is still necessary to clarify the radiological effects of the accident (see question 3).
ENSI will deal with this aspect in more detailin a separate report. Once the personal dosimetry data are available, ENSI will also carryout an analysis of the instances of exposure
to radiation that actually occurred.

Safety culture(Origin and development of the accident,
see question 1)
The framework of organisational, official,political and social conditions and the underlying mechanisms of human behaviour and of
the functioning of organisations must be taken into account when assessing the eventsin Japan, and they must be included when
considering the applicability of these eventsto the situation in Switzerland. The nature of
their impact and their (potential) effects on
the safety of nuclear plants must be identified and understood. It is the responsibility
and duty of every organisation in the nuclear
sector, and specifically of the operators of
nuclear plants and the supervisory authorities, to understand the potential and actual
effects of these mechanisms and to takeaccount of them in their organisations and/or
actions by means of appropriate structuresand procedures, and with the help of a culture that is safety-oriented and attentive.
ENSI is carrying out a detailed review todetermine whether the events in Japan leadto new knowledge regarding the safetyoriented development of organisations thatwere as yet given insufficient consideration inprevious supervisory practice and regulationsof ENSI, and also in ENSI‘s own organisation.
In this context, account must also be taken of
the nature and impact of the overall system(i.e. the interaction of all the players involved, from the industry-side organisations,the regulatory body and the political bodies
through to society as a whole).

34 | 35

Emergency management(Measures to deal with the accident and its
consequences, see questions 2 and 3)
The events at Fukushima clearly demonstrated that emergency management plays adecisive role in influencing the progressionof a severe accident. For this reason, all thebodies involved must accord correspondingly high priority to emergency management
by operators and authorities (supervisory
authorities and local authorities as well asinternational organisations). In addition to
the technical aspects of emergency management (e.g. the availability of technicalequipment to initiate emergency measures),crucial importance also attaches to the human and organisational aspects (e.g. emergency sequences, procedures, decision-making and communication pathways, training
and deployment of staff, etc.). In particular,
the necessary attention must also be paid
to the organisational measures to protect
on-site staff against impermissible exposure
to radiation while they are dealing with theaccident. A central factor here is that the aim
is not merely to plan and prepare for measures to cope with the broadest possible rangeof expected events.

In addition, it is necessary for considerations
to include the ability of the participatingorganisations to deal with unforeseen eventsin which the planned measures do not work.
Knowledge available to date also suggeststhat the working conditions for the staff
present on site after the accident at Fukushima were extremely difficult in both physicaland psychological terms. The impact of suchconditions on the performance ability of individuals in an emergency situation requires
in-depth consideration, and it must be taken
into account by operators of nuclear plants
and by the supervisory authorities whenplanning emergency actions.
Based on the assumption of a worst-casescenario, ENSI will review the extent to whichfindings from measures to cope with theaccident at Fukushima influence the existing
requirements for emergency management inrespect of the operators and of ENSI itself,and ENSI will initiate improvement measures
as and when this is necessary.

6 | List of abbreviations

6 List of abbreviations
AEC

Atomic Energy Commission

AESJ

Atomic Energy Society of Japan

AN

Memo

ANRE

Agency for Natural Resources and Energy

ENSI

Swiss Federeal Nuclear Safety Inspectorate

IAEA

International Atomic Energy Agency

ICRP

International Commission on Radiological Protection

INES

International Nuclear and Radiological Event Scale

IRRS

Integrated Regulatory Review Service

JAIF

Japan Atomic Industrial Forum, Inc.

JANTIJapan Nuclear Technology Institute

JINED

International Nuclear Energy Development of Japan

JNES

Japan Nuclear Energy Safety Organization

JSCE

Japan Society of Civil Engineers

METI

Ministry of Economy, Trade & Industry

MEXT

Ministry of Education, Culture, Sports, Science and Technology

NERHQ

Nuclear Emergency Response Headquarters

NHK

Nippon HosoKyokai, Japan Broadcasting Corporation

NISA

Nuclear and Industrial Safety Agency

NRC oder U.S.NRC United States Nuclear Regulatory Commission
NSC

Nuclear Safety Commission

NYT

New York Times

ODL

Ortsdosisleistung

PSA

Probalistic Safety Analyzes

SAMG

Severe Accident Management Guidelines

SBO

Station Blackout

SPEEDI

System for Prediction of Environment Emergency Dose Information

STPB

Science and Technology Policy Bureau

TEPCO

Tokyo Electric Power Company

Fukushima
37° 25‘ 26.57“ N, 141° 1‘ 56.87“ E11.03.2011

7 | References

7 References

1	Ereignisabläufe Fukushima Dai-ichi und
Daini infolge des Tohoku-Chihou-Taiheiyou-Oki Erdbebens vom 11.03.2011, ENSIAN-7614 Rev. 1, Eidgenössisches Nuklearsicherheitsinspektorat ENSI, 2011-08-26
2	Report of Japanese Government to the
IAEA Ministerial Conference on Nuclear
Safety, - The Accident at TEPCO‘s Fukushima Nuclear Power Stations -, Nuclear
Emergency Response Headquarters,
Government of Japan, 2011-06-18 		
kantei.go.jp/foreign/kan/topics/201106/
iaea_houkokusho_e.html
3	Convention on Nuclear Safety, National
Report of Japan, Fifth Review Meeting,Government of Japan, September 20104	Das schwere Tohoku-Seebeben in Japanund die Auswirkungen auf das Kernkraftwerk Fukushima-Dai-ichi, Bernhard
Kuczera, Internationale Zeitschrift für
Kernenergie, Sonderdruck aus Jahrgang
56 (2011) Heft4/5, April/Mai
5	Lessons Learned from TEPCO Nuclear
Power Scandal, Speech and PresentationTokyo Electric Power Company (TEPCO),
2004-03-25 tepco.co.jp/en/news/presen/
pdf-1/040325-s-e.pdf
6	Annual Report 2010, Optimal Energy
Services, Our Focus in Value Creation,
Tokyo Electric Power Company (TEPCO),
Juli 2010 tepco.co.jp/en/corpinfo/ir/tool/
annual/pdf/ar2010-e.pdf
7	JAIF Earthquake Report No. 77: 18:00,
May 10, Japan Atomic Industrial Forum
Inc. (JAIF), 2011-05-10
jaif.or.jp/english/news_images/pdf/
ENGNEWS01_1305023353P.pdf

8	IAEA: “Integrated Regulatory Review
Service (IRRS) to Japan”, Bericht IAEANSNI-IRRS, 2007-12-20
9	IAEA International Fact Finding Expert
Mission of the Nuclear Accident Following
the Great East Japan Earthquake andTsunami, International Atomic Energy
Agency (IAEA), 2011-06-01 			
iaea.org/newscenter/focus/fukushima/
missionsummary010611.pdf
10	Sozialpsychologie, Aronson, E. , Wilson,
T. D. & Akert, R. M., 4. Auflage. München,
Pearson Studium, 2004
11	Convention on Nuclear Safety National
Report of Japan for the Fifth Review
Meeting, Government of Japan, September 2010 nsc.go.jp/anzen/shidai/genan2010/genan053/siryo2-3.pdf
12	Presentation “Summary of Safety Regulation in Japan”, Nuclear and Industrial
Safety Agency (NISA), 2011-05-24
nisa.meti.go.jp/english/files/en20110526-11.pdf
13	JAIF Earthquake Report No. 104 18:00
June 06, Japan Atomic Industrial Forum
Inc. (JAIF), 2011-06-06
jaif.or.jp/english/news_images/pdf/
ENGNEWS01_1307352120P.pdf
14	Press Release (May 02,2011), Report oninvestigation of cause and developmentof preventive measures regarding exposure exceeding dose limit to radiation doseengaged person at Fukushima Daiichi
Nuclear Power Station to NISA, Tokyo
Electric Power Company (TEPCO),
2011-05-02 tepco.co.jp/en/press/corpcom/release/11050211-e.html
15	JAIF Earthquake Report No. 105 18:00
June 07, Japan Atomic Industrial Forum
Inc. (JAIF), 2011-06-07
jaif.or.jp/english/news_images/pdf/
ENGNEWS01_1307442268P.pdf

38 | 39

16	JAIF Earthquake Report No. 98 18:00 May
31, Japan Atomic Industrial Forum Inc.
(JAIF), 2011-05-31 jaif.or.jp/english/news_
images/pdf/ENGNEWS01_1306833181P.
pdf

23 J
 AIF Earthquake Report No. 112 18:00
June 14, Japan Atomic Industrial Forum
Inc. (JAIF), 2011-06-14 jaif.or.jp/english/
news_images/pdf/ENGNEWS01_­
1308042843P.pdf

17	Seismic Damage Information (the 92nd
Release), Nuclear and Industrial Safety
Agency (NISA), 2011-04-14 nisa.meti.go.
jp/english/files/en20110416-7-1.pdf

24 JAIF Earthquake Report No. 175 12:00
August 16, Japan Atomic Industrial 		
Forum Inc. (JAIF), 2011-08-16
jaif.or.jp/english/news_images/pdf/		
ENGNEWS01_1313463676P.pdf

18 Tsunami Information (Estimated Tsunami
arrival time and Height), Japan Meteorological Agency, 2011-03-11, 14:49
jma.go.jp/en/tsunami
info_04_20110311145026.html

25 M anagement in a Dynamic Society: A
Modelling Problem Rasmussen, Jens
Safety Science, 27 (2/3), pp. 183-213 		
(1997)

19	Press Release (Jun 03,2011), Status of
Evaluation Exposure Dose limits of
TEPCO employ¬ees at Fukushima Daiichi
Nuclear Power Station (Continued
Releases), Tokyo Electric Power Company(TEPCO), 2011-06-03 tepco.co.jp/en/press/corp-com/release/11060311-e.html

26	Drift into Failure, From hunting broken
components to understanding complex
systems, Dekker, S.W.A., Aldershot, UK:
Ashgate (2011)

20 JAIF Earthquake Report No. 116 18:00
June 18, Japan Atomic Industrial Forum
Inc. (JAIF), 2011-06-18
jaif.or.jp/english/news_images/pdf/		
ENGNEWS01_1308388162P.pdf

28	European Organisation for the Safety of
Air Navigation (EUROCONTROL), A
White Paper on Resilience Engineering
for ATM, 2009 eurocontrol.int/esp/
gallery/content/public/
library/A%20White%20Paper%20Resilience%20Engineering/A_White_Paper_
Resilience_Engineering.pdf

21 JAIF Earthquake Report No. 100 18:00
June 2, Japan Atomic Industrial Forum
Inc. (JAIF), 2011-06-02 jaif.or.jp/english/
news_images/pdf/ENGNEWS01_­
1307006763P.pdf
22 P
 ress Release (Mar 25,2011), Result of theinvestigation on exposure to radiation ofwork-ers from cooperative companies at
Unit3 in Fukushima Daiichi Nuclear Power
Sta-tion(March 25, 2011), Tokyo ElectricPower Company (TEPCO), 2011-03-25
tepco.co.jp/en/press/corp-com/
release/11032503-e.html

27 B arriers and Accident Prevention, Hollnagel, Erik, Aldershot, UK: Ashgate (2004)

29	Japan Extended Reactor’s Life, Despite
Warning, New York Times, 2011-03-21
nytimes.com/2011/03/22/world/
asia/22nuclear.html
30	Culture of Complicity Tied to Stricken
Nuclear Plant, New York Times, 2011-0426 nytimes.com/2011/04/27/world/
asia/27collusion.html

7 | Referenzen

31 J
 apanese Officials Ignored or Concealed
Dangers, New York Times, 2011-05-16
nytimes.com/2011/05/17/world/
asia/17japan.html?ref=japan
32 In Japan, a Culture That Promotes Nuclear Dependency, New York Times,
2011-05-30 nytimes.com/2011/05/31/
world/asia/31japan.html
33	AP Exclusive: Fukushima tsunami plan asingle page, Associated Press, 2011-05-27
34	Forscher: Japan schätzte Bebengefahr
falsch ein, Österreichischer Rundfunk
ORF, 2011-04-14 science.orf.at/stories/1681378/
35	Nuclear Rules in Japan Relied on Old
Science, New York Times, 2011-03-26
nytimes.com/2011/03/27/world/
asia/27nuke.html?_r=3&hp
36	AP IMPACT: Nuclear plant downplayed
tsunami risk, YAHOO! News, 2011-03-27
37	Die Warner, die nicht gehört wurden- Ausland: Japan im Ausnahmezustand,Tagesanzeiger, 2011-03-28 tagesanzeiger.
ch/ausland/die-tsunami-katastrophe/
Die-Warner-die-nicht-ge-hoert-wurden/story/20980711?dossier_id=88538	The geologist who predicted Japan‘stsunami, The Week, 2011-04-12 theweek.
com/article/index/214132/the-geologistwho-predicted-japans-tsunami
39	Madarame: Plant guidelines should befully revised, NHK World, 2011-06-05		
www3.nhk.or.jp/daily/english/05_23.html

40	‘Safety Myth’ Left Japan Ripe for Nuclear
Crisis, New York Times, 2011-06-24
nytimes.com/2011/06/25/world/
asia/25myth.html?ref=japan

41	In Nuclear Crisis, Crippling Mistrust,		New York Times, 2011-06-12 nytimes.
com/2011/06/13/world/asia/13japan.
html?ref=japan
42	Letters From Fukushima: Tepco Worker
Emails, Wall Street Journal, 2011-03-28
blogs.wsj.com/japanrealtime/2011/03/28/
letters-from-fukushima-tepco-workeremails/
43	Economy Sends Japanese to Fukushima
for Jobs, New York Times, 2011-06-08
nytimes.com/2011/06/09/world/
asia/09japan.html
44	Tepco weiss nicht, was abläuft,		
Tagesanzeiger, 2011-03-22		
tagesanzeiger.ch/ausland/die-tsunamikatastrophe/Tepco-weiss-nicht-was-ablaeuft story/­24725993?dossier_id=88545	Core of reactor 1 melted 16
hours after quake, The Japan Times,
2011-05-16 search.japantimes.co.jpcgi-bin/
nn20110516a1.html

Fukushima
37° 25‘ 26.57“ N, 141° 1‘ 56.87“ E11.03.2011

Issued by
Swiss Federal Nuclear Safety Inspectorate ENSI
Industriestrasse 19
CH-5200 Brugg
Phone +41 (0)56 460 84 00
Fax+41 (0)56 460 84 99
info@ensi.ch
www.ensi.ch
ENSI-AN-8000
Published 29.08.2011