Fukushima Daiichi Human and Organisational Factors

Part 3: Implications for Regulatory Oversightof Human and Organisational Factors

Summary 4

1 Introduction 8

1.1 ThetenthanniversaryoftheaccidentattheFukushimaDaiichinuclearpowerplant 8

1.2 TheHOFSectionanditsoversightactivity 8

1.3 Thetopicsinthisreport 11

2 TheFukushimaDaiichiaccidentfromasystemicperspective 12

2.1 Considerationofthesystemicapproach 15

2.2 Conclusionforoversightinrespectoftheconsiderationofthesystemicapproach 17

2.2.1 Oversightofhumanandorganisationalfactorsindueconsiderationofthesystemicapproach 18

2.2.2 Oversighttopicsinthehumanandorganisationalfactorsareaaspart ofaconsiderationofthesystemicapproach 20

3 Theresilientorganisation 24

3.1 Resilience 25

3.2 Safety-IandSafety-II 28

3.3 ThetaskofthesupervisoryauthoritiesinthecontextofresilienceandSafety-II 34

3.3.1 Interimconclusion 38

3.4 ConclusionsfortheHOFSection 39

3.4.1 Basicconsiderations 40

3.4.2 MethodsforSafety-IIoversightinthehumanandorganisationalfactorsarea 42

4 Decision-makinginemergencysituations:influencingfactors 48

4.1 Decision-makingunderuncertainty(situationaleffects) 49

4.2 Individual-relatednegativeeffectsinthedecision-makingprocess 50

4.3 Peoplewhomakegooddecisions 51

4.4 Impactmodelofhumanperformanceunderextremeconditions 53

4.5 Oversightrelatingtothetopicofdecision-making 54

4.6 Conclusion 55

5 Adigressionconcerningresilience:aninputfromcivilaviation 56

5.1 Developmentandtraining:processadaptation,improvisationanddecisions 57

5.2 Fromflightpreparationtofinaldestination:raisingawarenessoftheunexpectedintheday-to-dayroutine 58

5.3 Thefourpotentialsforresilience 60

5.4 Reflection–learningfromthespecialfeaturesofcivilaviation 61

5.5 Reflection–conclusionsfortheoversightoftheHOFSection 61

6 Closingwords 62

7 References 64

8 Endnotes 68

TableofContents

The Fukushima Daiichi reactor accident – Human and organisational factors | Part 3

SincetheaccidentattheFukushimaDaiichiNuclearPowerPlanton11March2011,theHumanandOrganisationalFactors(HOF)SectionofENSIhascontinuedtoconsiderwhatlessonscanbedrawnfromit.Onthetenthanniversaryoftheaccident,itispublishingareport,derivedfromthefindings,ontheimplicationsforitsregulatoryactivity.

Theaccidentfromasystemicperspective

TheanalysisoftheFukushimaDaiichiaccidenthasshownthatavarietyofinteractinghuman,technicalandorganisationalfactorscontributedtoboththeoriginsandcourseoftheaccident.Theoccurrenceoftheaccidentcannotbeexplainedbysimplelinearcausalrelationships.Likewise,itisnotsufficienttofocusexclusivelyontheHTOsystem(human-technology-organisation)oftheFukushimaDaiichinuclearpowerplant.Rather,theviewmustbeextendedtoincludethecomplexbehaviourandnetworkofthehigher-levelsystemsofvariousactors,includingthesupervisoryauthorities.Therefore,asystemicapproachisneededbothforaccidentanalysisandintheoperationandsupervisionofnuclearinstallations.

Acrucialtoolforapplyingandmonitoringasystemicapproachisaneffectivemanagementsystemthattakesintoaccounttheinteractionbetweenthehuman,technicalandorganisationalcomponentsofthesystem.ThismanagementsystemisstructuredcyclicallybasedontheprincipleofcontinuousimprovementandcoverselementsoftherelevantHTOsystematthework,processandstrategylevelonthebasisofthesystemicapproach.

Oversighttopicstakingintoaccountthesystemicapproach

Initsoversight,theHOFSectionchecksthedegreetowhichthesystemicapproachhasbeentakenintoaccountbythesupervisedorganisationsalongsidetheelementsofthecontinuousimprovementcycleonthebasisofconcreteoversightitemsandpriorities.These

oversightitemsconcerntopicssuchasthepurpose,visionandstrategyofthesystem,thesystembound-ariesandtheexternalcontextofthesystem(atthestrategylevel),theprocessesandactivitiesforeffectiveandsafeoperation(primarilyattheprocesslevel),theHTO-relatedinfluencesforsafety-relatedactivitiesinthedailyworkofthemembersoftheHTOsystemunderconsideration(attheworkinglevel)aswellastheeffectivenessofmeasures(attheprocesslevel)andthecontinuousimprovementofsystemrobustnessandresilience(atthestrategylevel).

Oversighttakingintoaccountthesystemicapproach

Acentralprincipleofoversightisthatthelicenceholders,andconsequentlytheoperatorsofnuclearinstallationsareresponsibleforsafety.Themannerinwhichthesupervisoryauthorityinterpretsandperformsitstaskinpracticeinfluencesthecapacityandwillofthesupervisedpartiestoassumeresponsibility.FortheoversightofcomplexHTOsystemstakingintoaccountthesystemicapproach,notonlyaretheoversightitemsimportant,butthewayinwhichtheoversightitselfisperformedisalsosignificant.

Intheliterature,adistinctionisoftenmadebetweentwobasic«regulatorystyles».A«compliance»-orientedoversightfocusesonspecifiedproceduresandchecksifthesearestrictlycompliedwithbythesupervisedparties.In«performance»-orientedoversight,thesupervisoryauthorityassessestheperformanceofthesupervisedpartiesinrespectofpredefinedcriteria,leavingthewayandmethodofachievingtheobjectiveswithintheremitofthesupervisedparties.ForcomplexHTOsystems,oversightthatisexclusivelycompli-ance-oriented,inparticularforthesupervisionofhumanandorganisationalfactors,isjudgedtobeunsuitableandtohindertheassumptionofrespon-sibilitybythesupervisedorganisations.ComplexHTOsystems,suchasthenuclearinstallationssupervisedbyENSI,thereforerequirearegulatorystrategyandoversightapproachesbasedonthesystemicapproach

Summary

5Summary

thataresuitableforcopingwiththecomplexityandcontext-dependencyofthesesystems,andforstrengthening,oratleastnotimpairing,thesystems’assumptionofresponsibility.Itisnotpossibletomeettheserequirementswitha«standardised»,alwaysinvariableregulatorystrategyandmethodology.Theconceptof«responsiveregulation»representsapossiblewayofdealingwiththedynamicsofcomplexHTOsystemswhereoversightisconcerned.«Respon-siveregulation»referstoaformofoversightwhichisnotbasedonauniformandinvariableregulatoryapproachforallsupervisedorganisations,butratherallowsthesupervisoryauthoritytousedifferentregulatoryapproachesandinterventions,dependingonthecontextandbehaviour,thecultureandthelevelofsafetyofthesupervisedorganisations,enablingittoescalatefromdialogue,convictionandself-regula-tion-basedoversightthroughincreasinglydemandingandprescriptiveinterventionsuptoandincludingwithdrawaloflicencesorprosecution.

Theresilientorganisation

InviewofthehighcomplexityofmodernHTOsystems,organisationsmustaccepttheinsightandfactthat,inspiteofthebestpossiblepreparationforanticipatedevents,theycannotprotectthemselvesagainstallpossible(undesirable)eventualitieswithtechnicalandorganisationalmeansorpreparethemselvesspecificallyforallpossibleeventualities.Theymustexpecttheunexpectedandbeabletodealwithitwhenitoccurs.Inotherwords:They–andtheiremployees–mustberesilient.Theperformanceofanorganisationisresilientwhentheorganisationcanfunctionasrequiredunderbothexpectedandunexpectedconditions.Acentralelementoftheresilienceconceptistheadaptivity(adaptivecapacity)ofthesystemunderconsideration(e.g.ofanorganisation)andthedevelopmentandmaintenanceofthiscapability.Itisnotjustaquestionoftheabilitytorecoverfromhazardsandstrains,butoftheabilitytoachievetherequiredperformanceunderthevarietyofdifferentconditionsandtorespondappropriatelytobothdisturbancesand

opportunities.Thisconceptofresilienceisbasedonanunderstandingofsafety,whichinthesafetysciencesiscalled«Safety-II»,asopposedtothetraditionalunder-standingof«Safety-I».Insimpleterms,Safety-Iimplieslearningfromthingsthatgowrong,withthefocuson«work-as-imagined»,andisaimedatstrengtheningcompliance.Safety-II,ontheotherhand,implieslearningfromthingsthatgorightwithafocuson«work-as-done»,andisaimedatstrengtheningresilience.TheSafety-IIviewonsafetyfocusesonanorganisation’sabilitytoguidetheadaptabilityofpersonnelandsystemsbyunderstandinghowcomplexsystemsareforthemostpartsuccessfulandonlyoccasionallyfail.Safety-IandSafety-IIarenotmutuallyexclusive.Rather,theSafety-IIperspectiveencompassesorextendstheSafety-Iperspective,thusmakingitpossibletodealwithsituationsinwhichtheSafety-Iapproachisnot(anylonger)appropriatebecauseoftheincreasingcomplexityofHTOsystems.

OversightagainstthebackgroundofresilienceandSafety-II

Thesupervisoryauthority,throughitsoversight,influencesthecapacityofthesupervisedorganisationstooperateinaresilientmanner.Itmustthereforedesignitsoversightinsuchawaythatitstrengthens,ordoesnothinder,thedevelopmentofpracticesandculturesinthesupervisedorganisationsaimedatreinforcingtheresilienceandintegrationoftheSafety-IIapproach.Dialoguewiththesupervisedpartiesisacentralelementofanappropriateregulato-rystrategyinthecontextofresilienceandSafety-II.Aspartofitsoversight,itisessentialforthesupervisoryauthoritytounderstandhowthesupervisedorganisa-tionfunctionsonaday-to-daybasisandwhichfactors(includingsituationalandcontext-related)influencethisfunctioning.Oversightmustbecharacterisedbyaninsightintothenormalfunctioningofthesystem.

TheHOFSectionhassetitselftheobjectiveofques-tioningandfurtherdevelopingitsoversightworkinthecontextofSafety-IIandresilience,andofdeveloping

regulatoryapproachesandmethodsthatappearsuitableforstrengtheningtheresilienceandtheSafety-IIapproachinthesupervisedorganisations.Forexample,thefocusofoversightactivityinthehumanandorganisationalfactorsareashouldnotbeexclusivelyoncompliance,butalsoonstrengtheningreflectionanddirectresponsibilityofthesupervisedpartiesinthesenseofperformance-orientedoversightaswellasonunderstandingthenormal,everydayfunctioningofthesupervisedorganisationinitssitua-tionalcontext.Therefore,theobjectofoversightshouldincreasinglybe«work-as-done»,thatisthewayinwhichworkisactuallycarriedout,asopposedto«work-as-imagined»,i.e.anidealisedconceptionofhowitshouldbecarriedout.Thisalsomeansthatattentionintheoversightshouldnotonlyfocusonthe«negative»,butalsoonthe«positive»or«normal».SuchSafety-II-orientedoversightinthehumanandorganisa-tionalfactorsareafocusesonmethodsthatpromotedialoguewiththesupervisedpartiesandtheirself-reflection.

Decision-makinginemergencysituations

Decisionsplayacentralroleinsituationswhereresil-ienceisrequired,forexampleinemergencysituationssuchasthoseduringtheaccidentattheFukushimaDaiichinuclearpowerplant.Insuchcircumstances,decisionsmustbemadeunderconditionsofuncertain-ty,timepressureandstressandfrequentlywithoutthenecessaryinformationbeingavailable.Incomplexemergencysituations,decision-makingisinfluencedbysituationalfactorsaswellasfactorsthataffectasinglepersonoranentiregroup.Toolssuchasemergencyprocedureshelptoreducethecomplexityofthesituationbystandardisationandreductionofthescopeofaction.Ontheotherhand,however,theexpansionofthescopeofactionthroughflexibilityandlearningalsohelpsindealingwithcomplexity.Inthisrespect,learningandintegrationofknowledgearefocalpointsandlearningopportunitiesplayanimportantroleineverydayoperations.

Inemergencysituations,inadditiontosituation-relatedinfluences,therearealsoeffectsrelatedtoindividualsthatcaninfluencethedecision-makingabilityofindividualsorgroupsofpeople,suchastheso-calledcognitiveemergencyresponseinindividualsorgroup-thinkwheregroupsofpeopleareconcerned.Suchperson-relatednegativeeffectscanbeprevented,forexamplebytraining.Effectiveself-managementisimportantinpreventingacognitiveemergencyres-ponse.Peoplewithgooddecision-makingskillscommu-nicateeffectivelyandassumeleadershipandresponsi-bility.Forexample,toavoidgroupthink,arationalandbalancedinformationsearchisimportant,andeachgroupmembershouldbeabletoexpresstheirthoughtsandargumentsindependentlyoftheothers.Incomplexsituations,aplannedapproachbasedonclearlydefinedproceduralrequirementsandthehelpofsuitabledecision-makingaids(e.g.checklists)isrecommended.

Insummary,eveninemergencysituations,humanabilitiesandcharacteristicsaswellastechnicalandorganisationalfactorsaffecthumandecision-makingperformanceinawidevarietyofways.Therefore,attentionmustbepaidtoallinfluencingfactors.

DecisionsaresubjecttotheoversightoftheHOFSectioninavarietyofcircumstances.Forexample,theyareconsideredinspecialistdiscussionsorinspections,inwhichformalprocesssequencesarechecked.Decision-makingbehaviourisobservedduringemergencyexercisesorlicencingexamsontheplantsimulatororevaluatedduringeventassessments.

Learningfromotherindustries

Valuableinsightsandapproachesinthehumanandorganisationalfactorsareacanalsobederivedfornuclearsafetyoversightfromthemethodsandexperienceofcivilaviation.

7Summary

Aresilientorganisationstrivestobealertandflexiblesothatitcanadaptatanytimetotheprevailingsituationandisthereforepreparedforunexpectedsituations.

Abriefinsightintotheeducationandtrainingfor,aswellasimplementationintothedailyworkroutine,ofpreparingandcarryingoutaflightbyanairlinecabincrewillustrateshowpreparationfortheunexpectedisperformedonapracticalbasisinanotherindustry.Inadditiontorobusttrainingintheareaofsafety,aircraft-specifictrainingandan«onthejob»introductionperiod,recurrenttrainingandtrainingsequencesalsohelpinexercisesdealingwithconstantlyvaryingsituationsandrequirements.Forexample,thetrainingteacheshowtoimproviseifemergencyequipmentismissingandhowtodealwithnewsituations.Pre-flightcrewbriefingsarealsousedtolearnfromeachcrewmember’sexperienceandtoprepareforanyunexpectedevents.Eachmemberofthecabincrewpaysattentiontounexpectedsituationsbeforetheflight,duringthesafetycheckontheaircraft,passengerboarding,thepreparationfortake-off,duringandaftertheflight,isawareofpossiblesignalsandpreparesthemselvesmentallyforvariousscenarios.Theindustryuseswell-practisedtechniquesandprocedures.

Crewmembers,withtheirimplicitandexplicitknowledge,experience,training,alertness,situationalawareness,flexibilityandcreativity,theirdecisionsandtheinherentscopeofactiontheyneedtoadapttheiractionsandbehaviourareconsideredassafetyfactorspreparedandqualifiedtorespondtounexpectedsituations.

OutlookThisreportisthestartingpointforfurtherreflectionanddevelopmentoftheoversightoftheHOFSectionagainstthebackgroundofthefindingsgleanedfromtheaccidentintheFukushimaDaiichinuclearpowerplantandthecurrentstatusofthesafetysciences.Fromtheidentifiedtopicsandpresentedmethodsandapproachesforfutureoversight,theHOFSectionwilldevelopanactionplanforshort,mediumandlong-termimplementation.

The11March2021marksthetenthanniversaryoftheaccidentattheFukushimaDaiichinuclearpowerplantonandtheassociatedmemoriesofthiseventremainattheforefrontofpeoples’minds.ENSIemployeescanstillremembertheimagesandnewsthatarrivedinasteadystreamandthegrowingcertaintythathighlysignificanteventswereplayingoutatFukushimaDaiichi.

Sincetheaccident,theHumanandOrganisationalFactors(HOF)Sectionhasbeenconsideringtheeventsduringtheaccidentaswellasthecausesoftheacci-dent.Itdiscussedtheseinparts1(/11/)and2(/15/)ofthisseriesofreports.Sincethen,ithasalsobeencontinuouslyworkingonthelessonsitcanderiveforits

TheHOFSectionistheorganisationalunitwithinENSI,which,basedontherelevantlegalandofficialregula-tions,monitorscompliancewiththesafety-relevantaspectsoftheinteractionofhuman,technicalandorganisationalfactorsinanuclearinstallationandreviewstheassociatedprojects.Itsremitalsoincludesperiodicallyreviewingand,ifnecessary,revisingtheofficialregulationslaiddowninENSIguidelinesinthecontextofthehumanandorganisationalfactorsofanuclearinstallation.Itisbasedoninternationallyharmo-nisedrequirementsaswellasonthestateoftheartinsafetyresearch.

ownoversight.Althoughitisnowtenyearssincetheaccident,recentfindingshavearisenfromtheexperi-enceofitsownoversightactivitiesandfromtheexperiencesharedbyothersupervisoryauthoritiesacrosstheworldininternationalcommittees,fromwhichtheHOFSectionhasbeenabletodrawconclu-sionsforitsownoversight.

TheHOFSectionofENSIisthereforepublishingathirdreporttomarkthetenthanniversary.Unlikethefirsttworeports,inwhichthemainfocuswasontheanalysis,i.e.theunderstandingoftheaccidentandthecircumstances(/11/,/15/),thisreportdealswiththeimplicationsfortheoversightactivityoftheHOFSectionderivedfromthefindings.

TheHOFSectionofENSIisaninterdisciplinaryteamconsistingofworkandorganisationalpsychologistsaswellasengineers.BothprofessionalgroupsundergofurthertraininginthesubjectareasoftheHOFSectionbothtechnicallyandinrespectofoversightmethods.

1.1 ThetenthanniversaryoftheaccidentattheFukushimaDaiichinuclearpowerplant

1.2 TheHOFSectionanditsoversightactivity

1 Introduction

9Introduction

TheoversightactivityoftheHOFSectionincludesinparticularthefollowingtopics:effectivenessandcontinuousimprovementofthemanagementsystem;suitability,trainingandauthorisationoflicencedpersonnel;inspectionofthereportsofthesupervisedparties;designoforganisationalprocesses,worksystemsandworkequipment,forexampleinthecourseoftechnicalchangestoanuclearinstallation;measurestopromotethesafetyculture,suchas,amongothers,leadership,responsibilityordeci-sion-making;evaluationofeventsinthehumanandorganisationalcontext;configurationoftheorganisa-tionandemployee-relatedaspectsinthecontextoforganisationalchanges.

ThelegalmandateofENSIistoensurecompliancewiththeapplicablestatutoryandofficialregulationsbytheoperatorsofnuclearinstallations(seeArt.72NEA/36/).Theimplementationofthismandateisbasedontheviewthatoversightisnotonlyaboutmonitoringcompliancewiththeregulatoryframeworkbutalsoaboutstrengtheningsafety(/10/,/14/).Itshouldalsobeborneinmindthatinthehumanandorganisationalcontext,theabove-mentionedregulationsareoftenformulatedingeneralandabstractterms1andcannotalwaysbeclearlymeasured.TheseissuesarereflectedinthediverseoversightmethodsusedbytheHOFSection.Thesemethodsarebrieflydescribedbelow.

TheoversightmethodsusedbytheHOFSectioncaninprinciplebedividedintomethodsof«target-actualcomparison»(oversight«inthestrictersense»,see/12/)ormethodsfortriggering(self-)reflectiononsafety(oversight«inthebroadersense»,see/12/).

The«target-actualcomparison»representstheclassic«compliance»approach.ENSIcheckswhethertheinternalspecificationsofthesupervisedpartiesandtheworkcarriedoutaspartofthenuclearinstallation’severydaylifecomplywiththestatutoryrequirements.Thiscategoryofoversightmethodsincludes,inparticular,inspections,themonitoringofreportsofthesupervisedpartiesandtheassessmentofreportableevents(see/13/).With«target-actualcomparison»methods,topicsforwhichclearlymeasurablerequire-mentsexistintheregulatoryframeworkaremonitored.The«triggerfor(self-)reflection»occursingroupdiscus-sionswiththehelpofaspecificfacilitationofthedialoguebyENSI.ENSIconsidersacapabilityfor(self-)reflectionasanindispensableprerequisite,forexample,tolearnfromexperience.Thiscategoryofoversightmethodsincludes,inparticular,specialistdiscussions,inwhichsubjectareaswithabstractandgenerallyformulatedlegalregulationsareexamined.

1| AnexampleofsuchagenerallyformulatedrequirementcanbefoundinArt.5oftheNuclearEnergyActNEA(/36/),wheretheestablishmentofasuitableorganisationisrequiredasaprotectivemeasurefornuclearsafety.However,itisnotspecifiedwhatismeantbya«suitable»organisation.

Box1:MethodsusedbytheHOFSectionindiscussionswithsupervisedparties

• Inspections:Inspectionsareusedintarget-ac-tualcomparisonsofoversightitems.TheHOFSectionleadsinspectionsofthemanagementsystem,forexample,andparticipatesintheinspectionsofothersections.Thelatterare,forexample,inspectionsthattakeplaceonsiteattheinstallationandwhoseinspectionobjectsrequiregreaterorganisationandcoordinationoftheparticipatingpersonsbelongingtothesupervisedparties(e.g.performanceofperiodictests,commissioningofmodifiedplantparts).

• Specialist discussion promoting a dialogue on safety culture(see/12/):Bymeansoftheseopenandconstructivespecialistdiscussions,theaimoftheHOFSectionistoinitiateself-reflectiononthepartofthesupervisedpartiesinrespectoftheirsafetyculture.Thediscussionstakeplaceeverythreeyearsandconsistoftwoparts,eachapproxi-matelythreehourslongandseparatedbyaperiodofafewweeks.Inthefirstpartthereisadiscussionaboutasafety-culturerelatedissuespecifiedbytheHOFSection.Inthesecondpart,thereflectioniscontinuedingreaterdepth.ThisdeepeningisbasedonfindingsandhypothesesthattheHOFSectionhasdevelopedfromthefirstpartofthediscussion.

• Exploratory specialist discussion: Thisdiscussionalsoservestotrigger(self-)reflection.ItisconductedbytheHOFSectionaloneortogetherwithtechnicalexpertsfromothersections.Theannouncementletterexplicitlycontainsquestionsthatareintendedtotriggerquestioningandreflectionontheissuestobediscussed.Thesediscussionsusuallylast,dependingonthetopic,oneandahalftothreehoursandarethenclosed.Exploratoryspecialistdiscussionsareconduct-edtodiscussmoresensitivetopicsinthehumanandorganisationalcontext(e.g.ontopicssuchasresourcesandleadership)orquestionsaboutorganisationallearningwiththesupervisedparties.

• Information discussion: Thistypeofspecialistdiscussionisusedtocollectinformation,e.g.afterevents,inthecaseoforganisationalchangesorinthecontextoftechnicalmodernisationprojects.SpecialistinformationgatheringdiscussionsareoftenconductedtounderstandchangesthatmustbeapprovedbyENSIortoobtainthenecessaryknowledgetobeabletoawardapermit.TheHOFSectionalsoconductsanannualspecialistdiscussionwiththeoperatorsofthenuclearpowerplantsoncurrenttopicsandupcomingchangesinthecontextofpersonnelororganisation.

ThisreportdealswithhowtheoversightactivityandmethodsoftheHOFSectionaretobedevelopedfurtheronthebasisofthefindingsfromtheaccidentattheFukushimaDaiichinuclearpowerplantandbasedonrecentdevelopmentsinthesafetysciences.

2| TheoversightactivityoftheHOFSectionisnotonlybasedondiscussions,butalsotoasignificantextentonthedocumentsandotherdataavailableinwriting(e.g.safetyindicators)ofthesupervisedparties.

Box1illustratestheoversightmethodsbasedondiscussionswithexamplesofoversightitemsoftheHOFSection2.

11Introduction

ThenumerouseventanalysesoftheaccidentattheFukushimaDaiichinuclearpowerplantrevealalargenumberofcontributingfactors.Aselectionoftheseissuesiscoveredinthisreport.Inaseriesofwork-shops,theHOFSectionidentifiedthefollowingmaintopics,whichitconsiderstobecentraltoitsoversightactivityandwouldliketodeepeninthecontextofthisreport.

Thesystemicapproachrecognisesthecomplexityofsystemsandconsidersthemtogetherwiththeirinterfacesandinteractionsintheirentirety.Thewholeismorethanthesumoftheindividualcomponents.Theneedtoapplyasystemicapproachtotheopera-tionofnuclearinstallationsandtheiroversightisoneofthekeyfindingsandrecommendationsfromtheanalysesoftheaccidentattheFukushimaDaiichinuclearpowerplant(e.g./31/).Section2ofthisreportdealswiththeFukushimaaccidentfromasystemicperspectiveanditsimplicationsfortheoversightexercisedbytheHOFSection.

InviewofthehighcomplexityofmodernHTOsystems,organisationsmustaccepttheinsightandfactthat,inspiteofthebestpossiblepreparationforanticipatedevents,theycannotprotectthemselvesagainstallpossible(undesirable)eventualitieswithtechnicalandorganisationalmeansorpreparethemselvesspecificallyforallpossibleeventualities.Theymustexpecttheunexpectediandbeabletodealwithitwhenitoccurs.Inotherwords:they–andtheiremployees–mustberesilient.Section3ofthisreportdealswiththeconceptof(organisationalwithadigressiontoindivi-dual)resilienceandtheunderlyingunderstandingofsafety(«Safety-II»).ThesectionfocusesontheimportanceofresilienceandSafety-IItooversight.TheHOFSectionderivesimplicationsforitsownoversightworkfromthis.

TheaccidentattheFukushimaDaiichinuclearpowerplanthasalsoshownthecentralimportanceofappropriatedecision-making.Thisisthesubjectofsection4ofthisreport.

Section5containsadigressioninwhichthetopicsunderconsiderationarediscussedinthecontextofcivilaviation.Itdescribes,usingconcreteandpracticalexamples,howmembersoftheflightcrewpreparethemselvesfortheflightandwhatmethodstheyusesothattheyarealwayspreparedfortheunexpected.

Finally,section6summarisestheimplicationsthattheHOFSectionhasidentifiedforitsoversightanditsintentionsregardingitsimplementation.

Withintheindividualchapters,inadditiontothetheoreticaldiscussionofthetopicsandconcepts,implicationsfortheoversightoftheHOFSectionarederived.Thesearetobeunderstoodaslong-termprojectsoftheHOFSectionandwillbeintroducedgraduallyinfutureoversightworkandcontinuouslydevelopedfurther.Thereportdoesnotinanywayclaimtobecomplete.Rather,itservesasthebasisandstartingpointforthecontinuousdevelopmentofthetopicsandoversightmethodsandthefollowingupoftherelevantliterature.

Thereportisaimedatatechnicallyinterestedaudi-ence.Itsaimistodeepenthetreatmentofthetopicscoveredandtoderiveconclusionsandmethodsdirectlyapplicabletooversight.Inaddition,itisintendedtostimulatetechnicalexchangeswithinterestedparties(e.g.thesupervisedpartiesorspecialistsinthehumanandorganisationalfactorsareainothersupervisoryauthoritiesorinternationalwork-inggroups).Thisiswhy,wherenecessary,thereportalsousesspecialisttermsandconceptsinthefieldofhumanandorganisationalfactors.

1.3 Thetopicsinthisreport

TheanalysisoftheFukushimaDaiichiaccidenthasshownthatavarietyofhuman,technicalandorganisa-tionalfactorscontributedtoboththeoriginsandthecourseoftheaccident.Moreover,thesefactorsweremutuallyinteracting.Theverydynamiccourseoftheaccidentandtheextremelycomplexsituationduringtheaccidenthaveshownthattheaccidentcannotbeexplainedbysimplelinearcausalrelationships.Itwouldalsobeanoversimplificationtostatethattheaccidentwascausedsolelybyinsufficienttechnicalprecautionsintheformofinsufficienttsunamiprotectionandalackoftechnicalemergencypreparednessbecausethedeficienciesinthedesignoftheplantwere,inturn,duetodeeperunderlyingreasonsinnon-technicalareas.Therefore,thequestioninconnectionwiththecauseoftheaccidentis,whythedeficitsinthesafetyprecau-tionscouldhavearisenandwhytheyweretoleratedforsolong.ItturnedoutthatthecausesarenotonlytobefoundintheHTOsystem(human-technology-organisa-tion)oftheFukushimaDaiichinuclearpowerplant,butextendfarbeyondthat.

2 TheFukushimaDaiichiaccidentfromasystemicperspective

13 The Fukushima Daiichi accident from a systemic perspective

HTO system “nuclear installation”

Supplier,designer

International level (WANO, IAEA, OECD/NEA, etc.)

ResearchPolitical parties,

NGO’s

Public

Supervisory authority

Others…CustomerMedia

National level

Box2:HTOsystem(human-technology-or-ganisation)anditsbehaviour

AnHTOsystem,suchasanuclearinstallation,isadynamicwholewithavarietyofdifferentfunc-tionsthatarenetworkedandinteractwitheachother.Afunctionreferstooneormoreactivitiestoachieveaspecificobjective(output)asasub-taskforfulfillingthepurposeofthesystem.Here,itdoesnotmatterwhoorwhatperformsthefunctionwithinthesystem:theorganisation,thetechnologyorhumans.InanHTOsystem,functionalactivitiesareinfluencedbyavarietyofhuman,organisational,andtechnicalfactors(seeFigure1).

ThebehaviourofHTOsystemsiscomplexbe-causethefunctionsinteractwitheachotherinaspecific,dynamicrelationshipandinmanyways

(/44/).Interventionsinsuchcomplexsystems(e.g.workonsite)notonlyaffectindividualfunctions,butcancauseavarietyofchangesinneighbouringfunctionsandaffecttheoverallsystem(/44/).Duetothehighdegreeofinter-connectednessanddependenciesandthepossi-blecombinedeffects,itisnolongerpossibletodescribefullyallfunctionswiththeirpropertiesandallpotentialinteractions(/6/,/44/).Small,localdeviationsmayspreadthroughthesysteminadifficulttopredictmanner(non-linearity).Therefore,thepredictabilityofsystembehav-iour(output)andcontrollabilityareparticularlydemandingincomplexsystems(/44/).

Whenwetalkabout«system»,«overallsystem»,etc.inthefollowing,thismeansanHTOsystemunderstoodinthisway.

Figure1:The«nuclearinstallation»HTOsystemanditsexternalstakeholders

Externalstakeholders,suchastheparentcompanyTEPCOasthelicenceholder,thesupervisoryauthorities,theJapanesegovernment,politicsandthegeneralpublicinJapanhadadecisiveimpactonthesafetyoftheFukushimaDaiichinuclearpowerplant.Inthissense,thiswasembeddedintheoverallnuclearpowerprogrammeinJapan.Fortheirpart,theseexternalstakeholdersconstantlyinteractedwitheachother.Fortheaccidentanalysis,itwasthereforenecessarytogobeyondtheHTOsystemrepresentedbytheFukushimaDaiichinuclearpowerplantandlookbeyonditforcontributingfactorstothecauseoftheaccident.

FactorscontributingtotheshortcomingsinthesafetyprecautionsoftheFukushimaDaiichinuclearpowerplantincludedfactorsaffectingtheparentTEPCOgroupasthelicenceholder.Forexample,anineffectiveprogrammefortheexploitationofnationalandinterna-tionaloperationalexperiencefeedbackledtoanoverlyslowassessmentandtreatmentofexternalthreatssuchasearthquakesandtsunamis(/31/).

Theaccidentanalysisalsoshowedthatthesupervisoryauthorities,inparticulartheNuclearandIndustrialSafetyAgency(NISA),didnotapproachtheiroversightworkinasufficientlysystemicway.Amongstotherthings,the2015IAEAreport(/31/)stressedthattheagencyfrequentlyconsideredissuesbasedoncompart-mentalisedthinkinganddidnotaddressmattersinasufficientlycomprehensiveandsystemicmanner,i.e.notallaspectsrelevanttosafetywereincluded.Particu-larattentionwaspaidtotechnicalaspects,butlittleattentionwaspaidtooperationalaspectsortohumanandorganisationalfactors.Inaddition,thesupervisoryauthoritieswerenotinclinedtolearnfrominternationalexperienceandshowedatendencytoisolatethem-selves.TheyfrequentlyarguedthatforeignexperienceandapproacheswerenotapplicableinJapan(/31/)ii.

ApplyingthesystemicapproachtotheFukushimaaccidentgivesrisetothefollowingfindings:

• Ontheonehand,thesystemicexaminationoftheaccidentanalysishasenabledidentificationofalargenumberofcontributinghuman,technicalandorganisationalfactors,andtheirmutualinfluenceoneachother.Indoingso,itwasnecessarytogobeyondthelimitsofthe«Fukushi-maDaiichinuclearpowerplant»HTOsystemandtoincludetheexternalcontextofthevariousmutually-influencingstakeholders.

• Ontheotherhand,theanalysisalsoshowedthattheresponsiblemanagerswerenotsufficientlyawareofthesystemicapproachtoassessingandimprovingpowerplantsafetyprecautionsintheperiodpriortotheaccident.ThisisconfirmedbytheIAEAinvestigationreport(/31/).Thisshowedtheimportanceofthecontinuoususeofthesystemicapproachforeffectivesafetyprecautions.Accordingly,oneofthekeyIAEArecommenda-tionsfromtheanalysisoftheaccidentrelatestotheapplicationofasystemicapproachbyallparticipatingactors(/1/)iii.

AnessentialrequirementoftheIAEArulesandregula-tions(/32/)istheneedforaneffectivemanagementsystem.Thisappliestoallphasesofthelifecycleofanuclearinstallation.Inordertoachieveandmaintainaneffectivemanagementsystem,theIAEAregulatoryframeworkandtheENSIguidelineontheorganisationofnuclearinstallations,ENSI-G07(/9/),emphasisetheimportanceoftakingintoaccounttheinteractionbetweenthehuman,technicalandorganisationalsystemcomponents.Managersatalllevelsoftheorganisationarerequiredtoidentifyandconsidertheseinteractionsintermsoftheeffectivenessoftheoverallsystemintheirimplementationofthemanagementsystem.Theresultsofsuchregularcheckingoftheeffectivenessofthemanagementsystemshouldbeusedtobetterunderstandtheoverallsystemanditsmultitudeofinteractions,andtocontinuouslyimprovesafety.Theconsiderationofthesystemicapproachinordertoachieveaneffectivemanagementsystemhasalreadybeenenshrinedinnationalandinternationalrulesandregulationsanditsapplicationinthecontextofcontinuousimprovementcannotbeavoided.

TherequirementsoftheIAEA(/32/)forthesystemicapproachreferredtoareinnosmallpartduetoexperiencegleanedfromtheanalysisoftheFukushimaDaiichiaccident.Thequestionofhowtoapplythesystemicapproachisnoteasytoanswerbecausethenetworkofhuman,technicalandorganisationalfactorsaffectingasystemsuchasanuclearpowerplantleadstocomplexinteractionsoffunctions.Engineeringbackfitsandanincreaseinthevolumeoforganisation-alregulationshaveledtoanincreaseinthenumberoffunctionsandtheirlevelofinterconnectioninnuclearinstallations.Consequently,thesystembehaviourhastendedtobecomemorecomplex,makingitevenmoredifficulttounderstandandpredict.Thismeansthatwhileadoptingthesystemicapproachhasbecomeevenmoreimportant,italsohasbecomemoredifficult.

ThetopicsshowninFigure2introducedinthereporton«HumanandOrganisationalPerformance»oftheWorkingGrouponHumanandOrganisationalFactors(WGHOF)oftheOECD'sNuclearEnergyAgency(NEA)provideassistanceonwhichtopicsneedtobead-dressedfortheapplicationofthesystemicapproachatthestrategic,proceduralandworkinglevel.Dependingonwhichsystemisconsidered,theindividualtopicsfromFigure2needtobedealtwithinmoreorlessdetail.Foratechnicalsafetysystemwhosepurposeistofeedcoolantintothereactorinanemergency,thetopicstobeconsideredareprimarilyattheprocessandworkinglevel,whereastheentirenuclearpowerplantasanHTOsystemwithitspurposeofgeneratingelectricityalsohastodealwithimportanttopicsatthestrategiclevel.Theindividualtopicsareexplainedinmoredetailinsection2.2.2wheretheirrelevanceforoversightisdiscussed.

2.1 Considerationofthesystemicapproach

Thesetopicsfollowtheprincipleofcontinuousim-provementofthemanagementsystem(PDCAprinciple«Plan-Do-Check-Act»),onthebasisofwhichtheeffectivenessofthemanagementsystemisalsocheckedandcontinuouslyimproved.Thecyclicalapplicationofthetopicsisofprimeimportancebe-causethisistheonlywaytoguaranteeacontinuouslearningprocessthatensuresprogressinunderstandingandimprovingsystembehaviour.Thisisunavoidablegiventhecomplexityanddynamicsofthesystemdescribedabove.

Anyconsiderationofthetopicsrunsfromthemacroleveltothemesoleveltothemicrolevelandbackagaininacyclicalsequence.Thedetailedviewatthemicroorworklevelisnotlimitedtoaparticularlevelinthehierarchy.Itconcernsallhierarchylevelsinanorganisa-tion,fromthetopmanagementthroughtotheimple-mentinglevel.

ThetopicscanbeappliedtoanyHTOsystemafterthesystemlimitshavebeendefined.Inprinciple,thesesystemlimitscanbefreelyselected.Thelimitsofa

systemrelativetoitsenvironment,i.e.toasurroundingsystem,arenotabsolutelyspecified,butaretobedefineddependingontherespectiveperspectivefromwhichthesystemislookedat.Forexample,aparticulardepartmentofacompanyisasubsystemfromanorganisationalpointofview,whilefromthepointofviewofthedepartment,theorganisationistobeviewedaspartofthesystemenvironment(/44/).Innuclearinstallations,individualprocessesortechnicalsystemscanalsobeconsideredinthisway.However,itshouldbenotedthatanexclusivelyisolatedviewofindividualsubsystemsisnotsufficienttounderstandoverallsystembehaviour,sincethesesubsystemsareinturninterconnectedandinteractwitheachother.Fromasystemstheorypointofview,itthereforemakessensetoincludeallfunctionsthatcontributetotheresult(output)ofthesystembeingconsidered,forexampleintermsofproductivity,innovationorsafety(/59/).Irrespectiveoftheselectedsystemlimits,externalinfluencingfactors,i.e.influencesstemmingfromtherespectivehigher-levelsystem,mustalwaysbeincludedintheconsideration.

Level Topics

Macro(strategic level)

Meso(process level)

Micro (work level)

(4) Interrelations between the processes and activitiesÞÞ Key activities(5) HOF for the key activities

(6) Measure, monitor and control the effectiveness

(8) Involvement of humans at all levels

(2) System boundaries and external context

(1) Purpose, vision and strategy of the system

(3) Processes and activities for an effective and safe operation

(7) Continuous improvement of system robustness and resilienceFigure2:Continuous

improvementcyclebasedonthesystemicapproach

TheaccidentattheFukushimaDaiichinuclearpowerplantoccurredbecausethesafetyandemergencypreparednessforanexternalhazardintheformoftsunamiswasinsufficient.TheoperatorTEPCOwasresponsibleforplantsafety.Nevertheless,theJapanesesupervisoryauthoritieshadtoverifythatTEPCOeffectivelyassumedthisresponsibility.Todoso,theyhadtoassesswhetherthesafetyprecautionsfortheFukushimaDaiichinuclearpowerplantwereinlinewiththeapplicableregulatoryframework.

Asdescribedabove,thecausesoftheaccidentcannotsolelybetracedbacktothelackofassumptionofresponsibilitybytheoperator.Theroleofoversightinthehigher-levelnuclearpowersysteminJapan,therelationshipbetweenoperatorsandsupervisoryauthoritiesandtheunderlyingregulatoryframeworkwerealsocontributingfactors.

Againstthebackgroundofacollectiveassumptionofsufficientrobustnessofthetechnicaldesignoftheplantinthefaceofexternalhazards(see/31/andsection3),thesupervisoryauthoritiesdidnotrecognisethatthereweredeficienciesinthesafetyprecautionsandthereforedidnotaddressthemeffectively.

Thisomissionbythesupervisoryauthoritieswas,ofcourse,facilitatedbyaninadequatenationalregulatoryframework.Atthattime,however,therewerealreadyinternationalrulesandregulationsinplace(/32/)thatrequiredtheoperator’smanagementsystemtobeeffective.ThisimpliesthattherewasaprocessinplaceforcontinuousimprovementwhichincludedanactivesearchforopportunitiesandrisksintheHTOsystem.

AnimportantfindingfromtheIAEAreport(/31/)andtheaccidentreportsoftheJapanesegovernmentisthatthestakeholdersinvolved,inparticularoperators

andsupervisoryauthorities,didnotlookactivelyenoughfordeficienciesinthesafetyprecautionsinthenuclearpowersysteminJapan.

Thislessonfromtheaccidentshouldalsobealong-termguidefortheoperatorsandthesupervisoryauthorityinSwitzerland.Anactiveefforttodiscoverpossiblelatentdeficienciesinsafetyprecautionsrequiresthebasicattitudeofimprovedunderstandingofthesystemunderconsideration,whileatthesametimeacceptingthatthisunderstandingwillneverbecompleteandfinalised,butratherrepresentsacon-tinuouslearningprocessduetothecomplexityanddynamicsoftheHTOsystemsunderconsideration.

InSwitzerland,ENSIpursuesthisobjectivewithitsintegratedoversight.Aprerequisiteforstrengtheningsafety(missiontakenfromENSImissionstatement/10/)includeseffortstocontinuouslyimprovetheunder-standingofthemonitoredHTOsystemsunderchang-ingframeworkandboundaryconditions.ThequestionishowbesttoachievethisinthecontextofoversightactivityandhowtofurtherdevelopoversightsothatthesupervisoryauthoritycontributesaseffectivelyaspossibletothecontinuousimprovementofthesafetyperformanceofthesupervisedHTOsystems.

Inthecontextofthesystemicapproach,thisisontheonehandaboutthetypeofoversightinthehumanandorganisationalfactorsarea(section2.2.1)andontheotherhandaboutthefocusoncertainoversighttopics(section2.2.2).

2.2 Conclusionforoversightinrespectoftheconsiderationofthesystemicapproach

Afundamentalprincipleofoversightisthatthelicenceholders,andconsequentlytheoperatorsofnuclearinstallationsareresponsibleforsafety(see.Art.22NEA/36/and/14/).Themannerinwhichthesupervisoryauthorityinterpretsandperformsitstaskinpracticeinfluencesthecapacityandwillofthesupervisedpartiestoassumeresponsibility.Intheworstcase,itcanevenhaveanegativeimpactonthem,forexamplebymaintainingatooprescriptiveregulatorystyle,i.e.byprescribingtothesupervisedpartiesintoomuchdetailwhattheymustdo.Inthiscontext,adistinctionisoftenmadeintheliteraturebetweentwobasic«regulatorystyles»,wherebytheseareusuallynotappliedinoneortheotherpureform,butusuallyoccurinacombinationofbothwithdifferentfocus(/59/):«compliance»-orien-tedoversight(prescriptiveoversight)asopposedto«performance»-orientedoversight(orgoal-orientedoversight,results-orientedoversight).Compliance-or–ientedoversightfocusesonspecifiedregulationsandchecksifthesupervisedpartiesstrictlycomplywiththem.Inperformance-orientedoversight,thesuperviso-ryauthorityassessestheperformanceofthesupervisedpartiesinrespectofpredefinedcriteria,leavingthewayandmethodofachievingtheobjectiveswithintheremitofthesupervisedparties(/59/).Wilpert(/59/)identifiesanumberofpotentialnegativeeffectsof(strict)«compliance»-orientedoversight,suchasasharpincreasein(regulatory)requirements,excessiveinter-ventionbythesupervisoryauthorityintheday-to-dayoperationsofthesupervisedparties,anincreaseinconflictandmistrustintherelationshipbetweenthesupervisoryauthorityandthesupervisedparties,anincreasingdemotivationandatendencytoblindlymeettheregulatoryrequirementsonthepartofthesuper-visedparties,anegativeinfluenceonlearningforallinvolvedpartiesandanincreasingtakingoverofresponsibilitybythesupervisoryauthority.HeconcludesthatincomplexHTOsystemssucharegulatorystyleisunsuitable,especiallyforthesupervisionofhumanand

organisationalfactors.Withintheframeworkofaperformance-orientedoversightapproach,self-assess-mentbythesupervisedorganisationbecomesmoreimportant.Acrucialaspectoftheregulatoryworkisthedialoguebetweenthesupervisoryauthorityandthesupervisedpartiesinordertodefineappropriateperformanceindicators.Wilpertseesacultureofopenandself-criticalcooperationbetweenthepartiesandakindofcommon«managementbyobjectives»asnecessary,whichresultsinasharedlearningprocessforbothsides.

SidneyDekker(/6/)statesthatcomplexsystemscannotbe(exclusively)regulatedbymeansofacompliance-basedapproach.Oversightisconsideredaspartofthe«protectivestructures»inthesystem,thepurposeofwhichistobringdiversityintothesystem.Inspectorsplayademandingroleinthisunderstandingofover-sightandmustbeboth«insiders»and«outsiders».Thismeansthatontheonehand,theymusthavesufficientknowledgeandexperienceofthesystembeingsuper-visedsothattheyknowwhattolookforandareabletodetectweaksignals.Ontheotherhand,iftheyaretoostrongly«insiders»,theywillnolongerbeabletobringdiversityintothesystem,i.e.anexternalviewandthusimpulsesforfurthersafetyimprovements,impulseswhichthesupervisedpartiesthemselvesarepossiblynolongerabletogeneratebecauseoftheirdirectinvolve-ment.AccordingtoDekker,oversightimpliesbeingsensitivetothecharacteristicsofcomplexity,forexampleinterdependencies,interactions,diversityorlearning.Thismeansthatinspectionsofsystempartsmustinparticularlookforpossibleinteractionswithsurroundingpartsofthesystemorothersystems.Itisimportanttolistentodifferentnarratives,i.e.toincludediverseperspectivesfromdifferentactorsfromdifferentpartsofthesystem(/6/).

2.2.1 Oversightofhumanandorganisationalfactorsindueconsiderationofthesystemicapproach

Theexplanationsonoversightinconnectionwiththesystemicapproachincomplexsystemsshowthatitisnotpossibletodefineandapplya«standardised»,alwaysinvariableregulatorystrategyandmethodology.Theconceptof«responsiveregulation»representsapossiblewayofdealingwiththedynamicsofcomplexHTOsystemsinoversight.«Responsiveregulation»referstoakindofoversightwhichdoesnotapplyauniformandunchangingregulatoryapproachforallsupervisedorganisations,butratherusesdifferentregulatoryapproachesandinterventionsbythesupervisoryauthority,dependingonthecontextandbehaviour,cultureandsafetylevelofthesupervised

Figure3:Exampleofaregulatorypyramid(source:QueenslandWorkplaceHealthandSafety(Australia)/63/)

organisations(/2/iv,/24/).Toillustratetheapproachof«responsiveregulation»,aso-calledregulatorypyramid(seeFigure3)isgenerallyused,whichdescribestheescalationlevelsfromoversightbasedondialogue,convictionandself-regulationatthelowestlevels,toincreasinglydemandingandprescriptiveinterventionsuptothewithdrawaloflicencesorprosecution.Theroleofthesupervisoryauthorityortheinspectorsisaccordingly,atthelowestlevel,theopeningofadialoguewiththesupervisedorganisationanditsmotivationtomakecertainchanges.Atthehighestlevels,ithasatitsdisposalpunitiveinstrumentsincludingstrictsanctions(/52/).

SanctionsCourtsanctions

Criminalproceedings

AdministrativesanctionsEnforceableundertaking

InfringementnoticeSeizuree.g.equipment,plant,

workplaceSuspensionofoperationorcancellation

oflicenceorapprovalsandrelateddisciplinaryaction

DirectingcomplianceOrdertosecurecompliance

ProhibitionnoticeDirectiontomakeunsafeelectricalworkelectricallysafe

ElectricalsafetyprotectionnoticeUnsafeequipmentnotice

ElectricalsafetynotificationDangerousgoodsdirective

ImprovementnoticeRiskcontrolplansVerbaldirections

EncouragingandassistingcomplianceIncidentinvestigations

Targetedworkplaceinspections,AuditsTechnicalservices

PreventionprogrammesInformation,guidance,eduction,adviceandrecommendations

Recognitionandawardsprograms

Basedontheimprovementcycleconsideringthesystemicapproach(seeFigure2)theHOFSectionhasderivedoversightitemsfromthetopicsmentionedthere,atthemacro,mesoandmicrolevels,whosesupervisionprovidesabetterpictureofwhetherandhowthesupervisedpartiespursueasystemicapproachforensuringaneffectivemanagementsystem(seeFigure4).Aspartofthesupervisoryprocedureex-plainedinsection2.2.1,thegrowingunderstandingofthetopicsandtheHTOsystemshouldalsoincreasethechancesofimprovingthesafetyprecautions.

Thefundamentalacceptancethat,duetothecomplexi-tyanddynamicsoftheHTOsystem,theremayalwaysbeweaknessesinthesafetyprecautionsthatarenotknowntotheoperatorsandthesupervisoryauthorityleadstothefindingthat,inparallelwiththeeffortstoidentifyandaddresstheseweaknesses,itisessentialtoprepareforunexpectedsituations(seesection3).

AtthemacrolevelinFigure4,topic(1)relatestothepurposeandobjectivesofthesystemandthestrategytoachievethem.InrespectofthesupervisionofnuclearpowerplantsinSwitzerland,thespecialrela-tionshipbetweenthelicenceholderandtheplantmanagercanbeidentifiedasakeyoversightitem.Essentially,theresponsibilityforsafety-relateddecisionscannotbetransferredtothirdparties.ThelicenceholderisresponsibleforthesafetyofitsnuclearplantinaccordancewithArt.22oftheNuclearEnergyAct(/36/).AccordingtoArt.30para.4NEO/37/,thelicenceholdermustdesignatetheplantmanagerwhoisresponsibleforthesafeplantoperationincludingthesafety-relateddecisions.Thisresultsinasharedassump-tionofresponsibility,whichintheworstcasecanleadtoaconflictofobjectivesbetweenthelicenceholder,representedbytheExecutiveBoardappointedbythelicenceholder,andtheplantmanager.

AnyuncleardirectionorstrategyresultingfromapossibleconflictsituationcouldhaveanegativeimpactonthepeopleinvolvedinthenuclearinstallationasanHTOsystemandthusunfavourablyinfluencesafety.TheHOFSectionhasbeenlookingatthetopicofsharedresponsibilityaspartofitsoversightforalongtimeandwillcontinuetopursueitinthefuture.

Anotherimportantoversightitematthemacrolevelistopic(2)«Systemboundariesandexternalcontext»inFigure4.TheboundariesoftheHTOsystemunderconsiderationmustbeclearlydefined.

Theexternalcontextoutsidetheboundariesofthesystemofthenuclearinstallationmayhaveaninfluenceonthenuclearinstallation.Thiscantaketheformofpoliticalandeconomicinfluence,forinstance.Anotherexampleisthenegativepublicperceptionofnuclearenergy,whichmayhaveanimpactontheattractivenessofcompaniesinthenuclearenergysectoraspotentialemployers(/50/).Theconsequencescanbelong-termproblemsinrecruitingnewemployees,whichcouldbeexacerbatedbyadeclineintrainingopportunitiesinthefieldofnuclearengineering.Economicpressure,whichcanarisefromfallingearningsonthemarkets,couldbemanifestedintheformofcostreductionprogrammesforoperatorsofnuclearinstallations.Concerningtheoversightofhumanandorganisationalfactors,theexternalcontextinwhichthenuclearinstallationsoperatesmustbecloselymonitoredandsocial,politicalandeconomicchangesneedtobetakenintoaccount.

Atthemesolevel,topics(3)«Establishingprocessesandactivitiesforeffectiveandsafeoperation»and(4)«Identifyinginteractions»areaboutdesigningthenecessaryprocessesandactivitiesfortheeffectiveandsafeoperationoftheHTOsystem.TheprocessesandactivitiesrequiredforanHTOsystemsuchasanuclearinstallationaresoextensivethatacomplexnetworkofinteractionsbetweenthemiscreatedthatcannotbefullyunderstood,especiallyintermsoftheiroveralleffect.However,sinceanoverallunderstandingofthesystemisthemainobjectiveandthebasisforthe

2.2.2 Oversighttopicsinthehumanandorganisationalfactorsareaaspartofaconsiderationofthesystemicapproach

continuousimprovementofthesystem,itisnecessarytocontinuouslylearnfromtheongoingoperatingexperience.Withappropriateawareness,thisiterativelearningprocesscanresultinabetterunderstandingoftheinteractionsbetweenprocessesandactivities.Inaddition,itwillbepossibletoidentifykeyactivitieswithaparticularlyhighdegreeofcross-linkingandwhicharethereforeparticularlyimportantforsystemperformance.

TheHOFSectionhasbeensupervisingtheregula-tion-compliantdesignofmanagementsystemprocess-esformanyyearsandhasidentifiedspecialkey

Level Topics

macro(strategic level)

Meso(process level)

Micro (work level)

(4) Interrelations between the processes and activitiesÞÞ Key activities(5) HOF for the key activities

(6) Measure, monitor and control the effectiveness

(8) Involvement of humans at all levels

(2) System boundaries and external context

(1) Purpose, vision and strategy of the system

(3) Processes and activities for an effective and safe operation

(7) Continuous improvement of system robustness and resilience

Integrated systemassessment

Resilience

Corporate governance

Work-as-done vs. Work-as-imaged

Effectiveness

Employees involvement

External context

processesofinterestforsafety.However,theinterac-tionbetweenprocessesandactivitieshasstillonlybeenaddressedinarudimentaryfashion.Inthisrespect,thismaybeafutureoversightfocusinanefforttomakeprogressinunderstandingimportantinterrelationsbetweenprocessesandactivitiesandgainanevenmorein-depthunderstandingofthesystem.

Figure4:Derivationofoversightitemsfromthecontinuousimprovementcycle

TheexperienceoftheHOFSectionsofarshowsthatinterdisciplinarycooperationisanessentialsuccessfactorfortheidentificationofinteractions.Forexample,therehavebeeneventswhereaclosecollaborationbetweenthespecialistsfromdifferentdisciplineswererequiredtoanalysethecausesbothattheoperatorandatENSI.Aregularinterdisciplinaryexchangepromotesthiscooperationandprovidesanopportunitytoidentifyandaddresscross-organisationalinteractions.Infuture,theHOFSectionaimstopromotethisinterdisciplinarycooperationwithintheoperators’organisationsthroughitsoversightandtoachieveanevenmoreintenseinterdisciplinaryexchangewithinitsownorganisation.

Withthekeyactivitiesidentifiedundertopic(4),i.e.activitieswithaparticularlyhighdegreeofinterlinkingandthereforeofparticularimportanceforsystemperformance,itispossibleatthemicroleveltolookmorespecificallyattheinfluencingfactorsinrelationtoeachofthesekeyactivitiesundertopic(5)«Determin-ingHTOinfluencingfactorsforkeyactivities».Fromthesupervisoryauthority’spointofview,thefocushereisalwaysonthesafety-relatedimportanceoftheseactivitiesfortheHTOsystem.Atthislevel,itisnowpossibletocarryoutahuman-centredassessmentoftheactivity,includinganyinfluencingfactorsthatmakethisactivityasuccess.Thisapproachisconcernedwithidentifyinghuman(individualabilities,situationalaware-ness,mentalstate,etc.),technical(human-machineinterface,accessibility,technicalautomation,etc.)andorganisational(workdocuments,schedule,workequipment,etc.)influencingfactors.

Especiallywhenassessingreportableeventscausedbyindividualerrors,theHOFSectiondoesnotprimarilylookforthecausesoftheeventintermsofthepersonwhocommittedtheevent-triggeringerror.Rather,itisamatterofidentifyingfactorsintheorganisationthathavecontributedtoanindividualerrorattheendofachainofactorsthatcouldhave(safety-relevant)consequences.

TheHOFSectionwillbeinformedofsucherrorsifthecorrespondingeventsarereportable.ThesituationisquitedifferentforthemultitudeofdailyactivitiesthataresuccessfullyprocessedintheHTOsystemofthesupervisedpartiesandwherethissuccessismoreoverbasedonthefactthatpeople,becauseoftheirabilitiesandmotivation,areabletorespondproperlytothevagariesthatareconstantlyoccurringinrealityandtomakethenecessaryadjustmentssothattheactivitycanbecarriedoutsuccessfully.AdetailedobservationbythesupervisoryauthorityofdailyactivitiessuccessfullycarriedoutcanprovideimportantinformationonthefunctioningoftheHTOsystemintwoways.Ontheonehand,itisaquestionofrecognisingwhethertherequirementsthathavebeendefinedatthestrategicandprocesslevels(«work-as-imagined»3)areactuallypracticableandapplicableattheworkinglevel.Ontheotherhand,theadaptabilityofpeopleandteamsattheworkinglevelinthesenseofasuccessfulresponsetotheunpredictable,everydayenvironmentalfluctuationsprovidesindicationsastohowwellpeopleandthusthesystemcanrespondtounpredictableevents(«work-as-done»4)(seealsosection3).Thisiswhereitbecomesclearhowimportantanunderstandingofeachindividu-alactorintheHTOsystemisforthepurpose,objectivesandstrategyoftheoverallsystem,sothatperformanceattheworkinglevelcanbeadaptedforthebenefitofthesystemanditssafety.

Thereinforcementofoversightattheworkinglevelappearstobeausefulstepinfurtherdeepeningtheunderstandingofthetwopointsmentionedabove(seealsosection3.4).

3| Theterm«work-as-imagined»referstotheassumptionsorexpectationsofhowworkshouldbecarriedout(see/29/).Thisisdefined,forexample,intheplanningofwork,inproceduresorinprocessesofthemanagementsystem.

4| Theterm«work-as-done»referstothewayinwhichaworkisactuallycarriedoutbytheemployees(see/29/).

Withinthecontinuousimprovementcycle,topic(6)«Effectiveness»isaboutevaluatingtheeffectivenessofsystemperformanceintermsofthestrategicandprocessobjectives.Theassessmentshouldtakeplaceonasmanylayersaspossibleandshouldconsiderbothquantitativeandqualitativemethodsforassessingeffectiveness.

ThequestionoftheeffectivenessofmeasuresisonethattheHOFSectionhasbeenraisingformanyyearsinthecontextoflearningfromeventsinthesupervisednuclearinstallations.Thechallengeistobringtogethermanyfindingsfromoperatingpracticeandtosubjectthemasawholetoanassessmentofeffectivenessattheoverallorganisationallevel.Inthisway,theoperat-ingresultscanbeusedinanaggregatedforminordertocreatethenecessarydecision-makingbasisforfurtherstrategicmanagementbytheseniormanage-ment.Continuous,overallorganisationallearningisonlypossibleifthepotentialforimprovementisderivedfromtheoperatingresultsandtheirassessedeffectivenessatthestrategiclevel,andleadstoareadjustmentoftheobjectivesandstrategyofthesystem.ThisreadjustmentshouldalwaysbearinmindthepurposeoftheHTOsystem.

TheHOFSectionwillcontinuetofocusontheassess-mentoftheeffectivenessofthemeasurestakenbythesupervisedpartiesasabasisforawellworkingcon-tinuousimprovementcycle(/51/).

Topic(7)«Continuousimprovementofsystemrobustnessandresilience»isaimedatthecontinuousimprovementoftheHTOsystem.Onthebasisofthefindingsfromeffectivenesschecks,itmakessensetodevelopthesystemintwodirections.Ontheonehand,thisrelatestoidentifyingpossiblesafetygapsaspartoftheprecautionsandthenclosingthemwithappropriatemeasures.Here,acontinuoussearchforandassessmentofrisksaswellastheresultingoppor-tunitiesrelatingtothesafetyoftheoverallsystemisrequired.Ontheotherhand,aneffortshouldbemadetoimprovethemanagementoftheunexpected.This

resultsfromtheawarenessthat,inspiteofextensivesafetyprecautions,unexpectedconditionsoreventscanalwaysoccur.Thisisespeciallytrueforveryinfrequentcrisissituations.AdetailedconsiderationoftheresilienceoftheHTOsystemandderivedfindingsforoversightisdiscussedinsection3.

Thedriversforthecyclicapplicationofthesystemicapproacharethepeopleinvolvedinsystemperfor-mance.Asustainablelearningprocessisonlycreatediftheparticipantsatalllevelsareinvolvedinthecon-tinuousimprovementprocess(topic(8)).Eachpersonneedstounderstandtheircontributiontotheoverallsystemandshouldbemotivatedtodothistothebestoftheircapabilitiesandtoconstantlyimproveit.

Likewise,adifferentiateddiscussionoftherisksandopportunitiesregardingsystemperformanceshouldalsotakeplace,consideringtheinteractionsbetweentheindividualfunctionsoftheHTOsystem.Againstthisbackground,anongoinginterdisciplinaryex-changeandinterdisciplinarycooperationshouldtakeplacebetweenthepeopleinthesystem.

Thequestionoftheinvolvementofemployeesintheprocessofsystemunderstanding,interdisciplinarycooperationandtheirmotivationtolearnandimprovehasbeenaddressedbytheHOFSectionforalongtimewithintheoversightframework,especiallyinthecontextofsafetyculture.

TheanalysisoftheFukushimaDaiichiaccidenthasdemonstratedthat,overthedecades,adeeplyrootedcollectiveassumptionhademergedandwasalsocontinuouslymaintainedamongtheJapanesenuclearindustry,regulatoryauthorities,politicsandsociety,accordingtowhichtheJapanesenuclearpowerplantsweresufficientlyprotectedagainstexternalandinternaleventsduetotheirrobusttechnicaldesignandtheadministrativeandorganisationalmeasurestaken,andthatalargescaleaccidentcouldnotoccur(/31/).Thisdeeplyrootedcollectiveassumptionledtotheactorsnotanticipatingsuchanevent.Asaresult,theplantswereinadequatelydesignedandinsufficientlyorganisa-tionallyprepared.Theeffectsoftheearthquakeandsubsequenttsunamiwavesimpactedontheminanunexpectedmanner.

TheprevailingbasicassumptionthattheJapanesenuclearpowerplantsweresufficientlysafealsoledtotheregulatoryframeworkcontaininginadequatespecificationsforaddressingthetsunamirisk.Thesupervisoryauthority,NISA,wasoftheopinionthat,whereemergencypreparednesswasconcerned,itwasnotnecessarytoanticipateaneventthatwouldcausesuchlargereleasesofradioactivityrequiringprotectivemeasuressincerigoroussafetyrequirementsaswellas

safetyinspectionsandanadequatemanagementofoperationswerealreadyimplementedinJapanv.Accordingly,thesupervisoryauthoritydidnotimple-mentitsregulatoryactivitiesinasufficientlyproactiveandeffectivemanner(seesection2)(/31/).

Ontheotherhand,duringtheaccident,inspiteofextraordinarilydifficultworkingandoperatingcondi-tions,employeeswereabletoimprovisesolutions,thankstotheirtireless,selflessandcourageousefforts,theknowledgeandexperienceofthoseinvolved,andtheirabilitytoimproviseusingthefewavailablere-sourcesandtechnicalsystems.Theemployeeswereabletoadapttheorganisationtothedynamicrequire-mentsofthesituationandpreventtheaccidentfrombecomingevenmoreserious(/17/;seealsothedetaileddescriptionoftheeventsinthefirstdaysaftertheearthquakeandtsunamifromtheperspectiveofthepeopledirectlyinvolvedonsiteinpart2oftheENSIreport/15/).

3 Theresilientorganisation

25 The resilient organisation

3.1 Resilience

TheeventspresentedhererelatingtotheaccidentattheFukushimaDaiichinuclearpowerplant–thenatureoftheresponseofthesiteemployeesaftertheacci-dentoccurred,butalsothelackofanticipationofthepossibilityofsuchaneventandthecorrespondinglyinsufficientpreparationaswellasthelessonslearnedfromit,bothinJapanvandelsewhere–canbecon-sideredfromtheviewpointoftheconceptof«resil-ience»5,vi.Thisconceptisusedinvariousscientificandtechnicaldisciplines(e.g.ecology,psychology,sociolo-gy,medicine,engineering,etc.)(see,forexample/17/,/29/,/61/)andisalsodiscussedinparticularinthesafetysciencesinvarioussectors(e.g.inhealthcare,airtrafficcontrol,etc.(/61/)).Theconceptofresiliencehasalsobeendiscussedinthenuclearindustry,atleastsincetheaccidentatFukushima(e.g./38/,/39/,/47/).OneofthekeyconclusionsdrawnbytheIAEAfromitsanalysisoftheaccidentattheFukushimaDaiichinuclearpowerplantpointstotheneedforresilienceinorganisations,wherebythisabilitymustbedevelopedwellbeforeunexpectedeventsoccur,i.e.,undernormaloperatingconditions.Atthesametime,appropriatemeansmustbemadeavailabletorespondtounexpectedevents(/31/vii).

Therearemanydefinitionsforresilienceinthelitera-ture.Dependingonthefieldofapplication,differentaspectsandlevelsintheoverallsystemareemphasised(see/17/,/43/,/65/).Commontothevariousconceptsisthebasicprinciplethatallorganisedhumanandtechnicalactivitiesaretoacertainextentcharacterisedbyinherentvariability.Suchvariabilityisnecessaryforthesuccessfulfunctioningofsocio-technicalsystems,astheconditionsunderwhichpeopleoperatecon-stantlychangeandpeoplethereforehavetoconstantlyadapttheiractivitiestothesechangesandthecurrentsituation(/56/).Asafurthercommonfeature,resilienceimpliestheactiveuseofdifferentsocio-technicalresources(e.g.skills,knowledge,relationshipsbetweenactors,technicalequipment,values,creativity,etc.)tocopewiththosesituationsthatthreatentheobjectivesthatarecurrentlybeingpursued(/43/).

Acentralelementoftheresilienceconceptisthustheadaptivity(adaptivecapacity)ofthesystemunderconsideration(e.g.ofanorganisation)andthedevel-opmentandmaintenanceofthiscapability.AccordingtoWeickandSutcliffe(/58/),resiliencerequireselastici-tyandrecovery:ina«resilienceepisode»,somethingisneededthatcanstretchandbendwithoutbreaking,andthenatleastpartiallyreturntoitsoriginalform.However,thisdoesnotnecessarilymeanthattheoriginalstateofthesystemmustbecompletelyrestored.Adaptationalsoincludesatransformationofthesystemsothatitcancopewiththeneworchang-ingrequirements(see/65/).Resilientorganisationsarenoterror-free,butneverthelesstheyarenotdisabledbyerrors(seeforexample/58/viii).Toputitanotherway:«resilientsystemsfailgracefully»(/65/,p.18).

Socio-technicalsystemsareoftencomplexandoperateincomplexenvironments(seesection2;seealso,forexample,/28/).Theyarethereforeconfrontedwithuncertaintiesandmustbeabletocopewiththemonaday-to-daybasis.Adistinctionismadebetweentwobasicwaysofdealingwithuncertaintiesintheorganisa-tionalsciences:minimisationofuncertaintiesthroughstandardisationandreductionoftheactors’scopeofactionthroughcentralisedcontrolontheonehand,aswellascompetenthandlingofuncertaintiesthroughflexibility,increasingtheactors’scopeofactionanddecentralisationontheother(/18/,/44/,/49/;seealsosection4ofthisreport).AccordingtoGrote,anorgani-sationorteammustfindasuitablebalancebetweenstabilityandflexibility,dependingontheuncertaintiesandrequirementswithwhichtheymustcopeortowhichtheymustrespond(/19/).Anorganisationmustbeabletoadaptquicklytochangingconditionsandrequirements(/21/).Theabilitytorespondtochangingrequirementsbyadjustingthemodeofoperationisafeatureofresilienceinorganisations.

Resilienceisthesubjectofoneofthefivecriteriaofso-called«HighReliabilityOrganisations»(HRO)(«commitmenttoresilience»/58/).Basedonthe

5| «Resilience»referstotheabilityofpeople,aloneortogether,tocopewitheveryday,minororsignificantsituationsbyadaptingtheirperformancetothecondi-tions.Theperformanceofanorganisationisresilientiftheorganisationcanfunctionasrequiredunderbothexpectedandunexpectedconditions(changes/distur-bances/opportunities)(/29/).

understandingofWeick&Sutcliffe(/58/),resilienceisacombinationofkeepingerrorssmall,improvisingemergencysolutionstokeepthesystemfunctioning,andabsorbingchangesinordertopersist.Amongstotherthings,theyconsiderthedevelopmentofanextensiverepertoireofskillsasacentralconditionfortheformationandmaintenanceofresilience,forexamplethroughthepresenceofpersonnelwithdiverseknowledge,experienceandabilities,i.e.thepresenceofdiversitywithintheorganisation.Asaresult,thereisawiderangeofactionsandtheabilitytoimproviseavailableforcopingwithunexpectedsituations.

ErikHollnagel(/29/)differentiatesbetweenfourpoten-tialsorabilitiesthatmustbeavailableinanorganisationforittobeabletofunctionresiliently.Consequently,inHollnagel’sunderstanding,itisnottheorganisationitselfthatisresilient,butratheritsperformanceoritsfunctioning.Thefourpotentialsofresilienceare:

• The potential to RESPOND: «Knowingwhattodo»;theabilitytorespondtoregularorirregularchang-es,disturbancesandopportunitiesbyactivatingpreparedactions,byadaptingthecurrentfunction-ingorbyinventingorcreatingnewwaysofdoingthingsix;

• The potential to MONITOR:«Knowingwhattolookfor»;theabilitytomonitorwhatmayaffectanorganisation’sperformance–positivelyornegative-ly–inthenearfuture(i.e.withinthetimespanofthecurrentoperationorworkprocesses,e.g.thedurationofaflight).Themonitoringmustincludeboththeorganisation’sownperformanceandalsoitsenvironmentx;

• The potential to LEARN:«Knowingwhathashappened»;theabilitytolearnfromexperience,especiallytolearntherightlessonsfromtherightexperiences.Thisincludesboththesmalllearningcircle(singleloop)fromspecificexperiencesandthelargelearningcircle(doubleloop),whichisusedtochangeobjectivesxi;

• The potential to ANTICIPATE: «Knowwhattoexpect»;theabilitytoanticipatefuturedevelop-ments,suchaspotentialdisturbances,newrequirementsorconstraints,newopportunitiesorchangingconditionsxii.

Theconceptofresilienceisoftenassociatedwiththeabilitytorespondtonegative,undesirableeventsorconditions.However,asMacrae&Wiig(/43/)pointout,anintegratedconceptofresilienceshouldalsointegrateapositiveperspectivexiii.Thisaccentuationofthepositiveornormalfunctioningandthedevelop-menttowardamorecomprehensiveunderstandingoftheconceptofresilienceisalsoreflectedintheevolu-tionofthedefinitionofthistermovertime(/29/).Therefore,resilienceisnotjustaquestionoftheabilitytorecoverfromhazardsandstrains,butratheroftheabilitytoachievetherequiredperformanceunderavarietyofdifferentconditionsandtorespondappropri-atelytobothdisturbancesandopportunitiesxiv.

Suchanencompassingconceptofresilienceisbasedonanunderstandingofsafety,whichinthesafetysciencesiscalled«Safety-II»,asopposedtothetradi-tionalunderstandingof«Safety-I»(/28/).

Box3:Individualresilience

Individualresilienceisnotanoversighttopic.Nevertheless,asasupplementtotheresilienceoforganisations,theconceptofindividualresiliencewillbebrieflyoutlinedhere.

Anappropriaterepresentationforindividualresil-ienceistheLotoseffect.TheLatintermresiliremeans«bounceoff»or«jumpback»andcanbeobservedwithLotosplants(/5/).Resilienceistheabilitytosuccessfullyhandlechallenges,difficultcircumstancesandcrises.Itisnotan«all-or-noth-ing»propertyand,likepersonalitytraits,itis

relativelystable.Nevertheless,resiliencecanbechanged.Therearevariousapproachesforfurtherdevelopingandpromotingpersonalresilience,forexamplethroughmindfulnesstraining(/35/),embodimentexercises(/5/),autogenictraining,meditation,yoga,etc.

Thecharacterstrengthsandvirtuesmentionedinpositivepsychologyformabasisforthefurtherdevelopmentofpersonalresilience(/48/and/23/).Theseare:

Organisationscanbenefitfromresilientemployeesbecauseperformance,ideasandflexiblethinkingcomefromtheemployees.Ifemployeesareresil-ient,itstrengthenstheorganisation(/1/).However,itwouldbefatalforbothsidesifanon-resilientorganisationwaskeptgoingbyresilientemployees.Intheextreme,thiscouldmeanthatemployeeswouldconstantlyhavetofindwaysandmeanstofulfilthecompany’sperformancewithouttheorganisationtakingresponsibilityforfunctioninginfrastructureandprocesses.Itwouldjustbeamatteroftimebeforeemployeesburntout,leavingthecontinuedfunctioningoftheorganisationtootherresilientemployees.

Thepromotionofresiliencewithinanorganisationisanattitudeoftheorganisationandanexpressionofthecorporateculturethatisreflectedonmanylevels.Resilientteamsarecharacterisedbydiversity,awiderangeofknowledgeandideasaswellaswillingnesstoconsideranddrawfromavarietyofresponseoptions.Inaddition,anetworkbasedontrustisneeded(/1/).

Virtues characterstrengths

Wisdomandknowledge Creativity,curiosity,abilitytojudge,loveoflear-ning,perspective

Courage Bravery,perseverance,honesty,drive

Humanity Love,kindness,socialintelligence

Justice Socialresponsibility,fairness,leadership

Moderation Forgiveness,modesty,discretion,self-control

Transcendence Appreciationofbeauty,gratitude,hope,humour,spirituality

3.2 Safety-IandSafety-II

Insimpleterms,Safety-Iimplieslearningfromthingsthatgowrongwiththefocuson«work-as-imagined»3(/28/),andisaimedatstrengtheningcompliance.Safety-II,ontheotherhand,implieslearningfromthingsthatgorightwithafocuson«work-as-done»4(/28/),andisaimedatstrengtheningresilience(/41/xv).TheSafety-IIviewonsafetyfocusesonanorganisa-tion’sabilitytomanagetheadaptabilityofpersonnelandsystems(«guidedadaptability»)byunderstandinghowcomplexsystemsareforthemostpartsuccessfulandoccasionallyfail(/49/).

ThefollowingelementsofSafety-IIaredescribedintheliterature(see/28/xvi,/29/,/41/):

• Understanding of safety: Safetyisnotdefinedastheabsenceoferrorsorundesirableevents(Safety-I),butastheabilitytoensurethingsgoright.

• Understanding of safety management: Safetymanagementisaimedatmaintainingtheadaptivecapacitytorespondeffectivelytounexpectedevents.

• The role of people: Peoplearenotseenprimarilyasriskfactors,ratherasaresourcenecessaryforsystemflexibilityandresilience.

• Accident/event investigation:Theaimofeventinvestigationsistounderstandhowthingsnormallygoright,becausethisisthebasisforunderstandingwhytheysometimesgowrong.

• Risk assessment:Theassessmentofrisksisfocussedonunderstandingconditionsunderwhichthevariabilityinperformanceisdifficultorimpossibletomonitorormanage.

BasedonaresiliencemodeldevelopedspecificallybytheFrenchenergycompanyEDFforuseinnuclearpowerplants,Park,Kim,Lee&Kim(/47/)developedamodelofSafety-IIandtesteditusingunexpectedreactortripsatKoreannuclearpowerplants.Themodel,whichisconsideredbytheauthorsasawayofsupplementingthetraditionalprobabilisticanddeter-ministicsafetyassessments,distinguishesfiveelementsofSafety-II:

• Anticipation: Measurespreparedbeforeaneventoccursandwhichareavailable.Elementsofantici-pationareemergencyprocedures,trainingpro-grammes,personnelresources,organisationalandsafetycultureaswellasergonomichuman-technol-ogyinterfacessuchasalarmsystems,displays,operatingelements,supportsystems,etc.Accord-ingly,anticipationisameasureofthereadinessoftheemergencysystemwithregardtoanevent.

• Robustness: Themannerinwhichtheemergencysystemdeterminestheappropriatestrategydepend-ingontheeventandinwhichitimplementstherequiredactivities.Elementsofrobustnessincludesystemresponse,decision-makingandexecution.

• Adaptation:Thewayinwhichtheemergencysystemdevelopsthestrategytomanagetheeventoradapttoit.Elementsofadaptationareverifica-tion(theabilityofthepersonneltoverifywhetherthecurrentstrategies,rulesorproceduresareappropriateforthecurrentconditions)andrecon-figuration(theabilityofthepersonneltoadaptthestrategyorrulesbasedontheevolutionofevents).

• Collective functioning: Theextenttowhichtheplantpersonnelworkasateamtoaccomplishataskorachieveacommonobjective.Elementsofcollectivefunctioningarecommunicationandteamwork.

• Organisational learning: Theprocessbywhichtheorganisationgeneratesnewknowledgeormodifiesexistingknowledge.Theeffectivenessoflearningdependsonwhicheventsandexperiencesareconsideredandhowtheeventsareanalysedandassessed.

Inhisbachelor’sthesisontheassessmentofthelevelofintegrationofSafety-IIintheoversightpracticeofENSI’sHOFSection(seesection3.3),G.R.Geeser(/16/,p.14ff.)identifiedthefollowingbasiccharacteristicsofSafety-IIfromtheresearchliteratureonSafety-II:

• Proactive: Safety-IIisaproactiveapproach.Itrequiresthecontinuousanticipationofundesirableevents.Itrequiresanunderstandingofhowthesystemunderconsiderationworks,howitsenviron-mentandconditionsdeveloporchangeandhowfunctionsdependoneachotherandinfluenceeachother.

• Just culture: A«justculture»isaprerequisitefortheSafety-IIapproach.Tounderstandthefunction-ingofasystem(«work-as-done»),itmustbepossibletospeakopenlyabout«work-as-done»withoutfearofrecrimination.

• Consideration of the system as a whole: UndertheSafety-IIperspective,asystemisnotdividedintoitsindividualcomponents,butratherconsi-deredasawhole.Theworkflowsandinteractionsinthesystem,itsstructures,barriersandresourcesshouldbeunderstoodascomprehensivelyaspossible.

• Breadth before depth:IncontrasttotheSafety-Iapproach,whereeacheventisconsidereduniqueandtheeventanalysislooksforthespecificcausesoftheevent,eacheventisnotseenasuniqueintheSafety-IIapproach,butasonethat(inasimilarform)hasalreadyhappenedinthepastandcouldhappenagaininthefuture.Therefore,differentpathsthatmayhaveledtotheeventareexamined,differentperspectivesontheeventareconsidered,andpatternsandrelationshipsbetweendifferenteventsarelookedfor.

• Variability and execution adaptations: Variabilityandperformanceadjustmentsareinherentproper-tiesofallsystemsandanintegralpartofday-to-daywork(seesection3.1).Theycanresultinsuccessbutalsoinfailure.Therefore,thevariabili-tiesmustbemonitoredandhandledsothatthey

canbedetectedingoodtimeandcontainediftheywouldresultinthingsgoingwrong,andsupportediftheywouldresultinthingsgoingright.

• Understanding of resources and limitations:Toidentifyandunderstandvariabilityandexecutionadaptations,theavailableresourcesandcon-straintspresentintheworkingcontextmustbeunderstood.

• Involvement of field experts: Tounderstand«work-as-done»inthesystemunderconsideration,fieldexperts,thatisthepeoplecarryingoutthework,mustbeinvolved.Inthisway,itispossibletoobtainarealisticpictureoftheon-siteworkingconditions,andunderstandingoftheoverallsystemisreinforced.

• Focus on positive or normal functioning:Tounderstandsuccessandfailure,dailyworkanditsactualexecutionmustbeunderstood.Thediffer-encesbetween«work-as-done»and«work-as-ima-gined»mustbeunderstood.Thefocusisnotonwhatproblemsexist,butonhowtheyaresolved.

Safety-IandSafety-IIarenotmutuallyexclusive.Rather,theSafety-IIperspectiveencompassesorextendstheSafety-Iperspective(seeFigure5)andthusmakesitpossibletodealwithsituationsinwhichtheSafety-Iapproachisnot(anylonger)appropriatebasedontheincreasingcomplexityofHTOsystems(/28/).Thisunderstandingisbasedontherecognitionthatvariabili-tyisinevitableorevennecessary.Theaimofsafetymanagementistoenableorachieveasafevariability(«guidedadaptability»)andnottosuppressvariability(/49/).Provanetal.(/49/)makethedistinctionbetweenSafety-IandSafety-IIclearbymeansofthefollowingcomparison:Safety-Iis«planandconform»,whileSafety-IIorguidedadaptabilityis«planandrevise»xvii.GuidedadaptabilityorSafety-IIisthereforenotaboutthechoicebetweencentralcontrolandadaptation,butaboutsupportingsafeadaptations.Allactors(manag-ers,thoseresponsibleforsafetymanagement,employ-eesatthesharpend6)must(beableto)determine,dependingonthecontext,whenthesafeworkingprocesswillbeachievedbyfollowingstandardisedproceduresorwhenitwillbeachievedbyadaptation(/49/xviii).

SuchanintegratedunderstandingofsafetyissetoutbyworkinggroupDoftheComitéd’orientationsurlesfacteurssociaux,organisationnelsethumains(COFSOH)(/4/),whichwascreatedin2012bytheFrenchnuclearsupervisoryauthorityASN(Autoritédesûreténucléaire),underthedenomination«sécuritéconstruite»,«con-structedsafety».Itpointsoutthenecessaryinterplaybetweenthetwoconceptsof«sécuritéréglée»(«regu-latedsafety»,comparabletotheconceptofSafety-I)and«sécuritégérée»(or«sécuritéadaptive»,i.e.adaptivesafety).Thus,theconceptof«constructedsafety»integratestheapproachesdescribedabovefordealingwithuncertainty(minimisationofuncertaintiesvs.competenthandlingofuncertainties)andthediscussedbalancebetweenflexibilityandstabilityasacentralfeatureofresilienceortheSafety-IIapproachinanorganisation.

Theconceptof«constructedsafety»(/4/)doesnotseesafetyasafixedparameter.Safetyisalwayscon-text-sensitiveandisalways«constructed»anewintheday-to-dayactionsoftheactorsthroughdecisionsandreactionstothesituationsencountered.Itisalwaystheresultofconsiderationsandcompromisesbetweenconflictingobjectivesandchangingconditions.Trade-offsandcompromisesaremadebyallactorsandatalllevelsoftheorganisation.Thisunderstandingcorre-spondstotheassumptionunderlyingtheconceptsofresilienceandSafety-IIofeverysystemhavinganintrinsicvariabilityofperformanceandbehaviouranditscontinuousadaptationtodifferentandchangingrequirements,whichoriginatefromthesystemitselforfromtheoutside.

6| Theexpression«sharpend»referstothoseactivitieswhichorthoseworkerswhointeractdirectlywith(dangerous)processesintheirworkrolesuchaspilots,doctors,op-eratorsetc.Theyarethereforethepeoplewhoworkdirectlyatthetimeandplacewhereaccidents(can)occurandwheremistakeshavedirectconsequences.Incontrasttothemaretheactivitiesandworkersatthe«bluntend»,whoinfluencesafetyindirectly,inthattheyhaveaninfluenceontheconditionsandresourcesoftheemployees«inthefield»,i.e.atthe«sharpend».Theconditionsofthe«sharpend»arethusdeterminedbyactionsanddecisionsofotheremployeesmadeatanearliertimeandinanotherlocation(/26/).

ResilienceFocus of Safety-II:Everyday actions and outcomes:Risks und Opportunities

Focus of Safety-I:Undesirable events

(accidents, nearmisses)

Figure5:Relationshipbetweentheconceptsofresilience,Safety-IandSafety-II(accordingto/28/)

Inresponsetoforeseeableorunforeseendisturbancesandevents,theconceptof«constructedsafety»doesnotassumeaneither/orapplicationofeither«regulatedsafety»(reactiontothedisturbancebystandardisationandformalisation)or«adaptivesafety»(reactiontothedisturbancebyflexibilityandlearning).Thereactions,actionsanddecisionsoftheactorsarebasedonacom-binationofresourcesofbothapproaches,i.e.bothonspecifiedrules,trainedskillsandpractisedroutinesontheonehand,andontheexpertiseandinitiativeoftheparticipantsandtheirabilitytoinnovate,adaptandreactflexiblyontheother(seeFigure6).

Fromtheabove,itcanbededucedthataresilientperformanceisbasedonapredictable,but,especiallyintheeventofanunpredicted,unexpectedsituation(e.g.asuddeneventsuchastheaccidentatFukushimaoramoreslowlydevelopingcrisissuchastheCOVID-19pandemic)isalwaysbasedonanoptimalcombinationofthedifferentapproaches(standardisation/stability/Safety-Ivs.flexibility/adaptability/Safety-II).Thismeans,ontheonehand,thatprepared,immediatelyaccessibleandpractised(emergency)measures,highcompetenceandlong-termexperienceofemployeesatalllevelsandinallfunctionsinthehandlingofthetechnicalsystemsandworkequipment,in-depthknowledgeoftheplantsandsystemsonthepartofemployees,standardisedorganisationalprocessesandahightechnicalavailabilityoftherelevantsystems,includingimportantinforma-tionaboutthestatusofsystemsandprocessesarenecessary.However,ontheotherhand,theflexibilityof

structuresandprocessesandtheabilityoftheorganisa-tiontoadaptitsfunctioningasnecessarydependingonchangingrequirements,andtheabilityofpersonneltoinnovateandimprovisebothatanindividualbutalsoatcollectivelevelsareessential(seealsotheremarksinsection4of/15/).

Predictable disturbances/

events

Unexpected disturbances/

events

Resources: Rules, automatisms, training,

management

Resources: Human expertise, initiative,

functioning of collectives

Trade-off, agreement, compromise

Constructed safety

Figure6:Conceptof«constructedsafety»basedon/4/

Box4:Leadershipstylestopromoteresilience

TheaccidentattheFukushimaDaiichiandFukushimaDaininuclearpowerplantsfromtheviewpointofleadershipinthefieldThesituationprevailingduringtheaccidentattheFukushimaDaiichinuclearpowerplantrepre-sentedanextremelydemandingsituationforallconcerned,especiallyforthemanagement(seepart2oftheENSIreportseries/15/).Completelywithoutexternalpowersuppliesand,withtheexceptionofunits5and6,withoutfunctioningemergencygenerators,virtuallyallmonitoringinstrumentsinthecontrolroomshadfailed.MostofthesystemsatFukushimaDaiichihadtobeoperated«blindly»fromonemomenttothenext.Theroadswerefloodedanddestroyed,sothatoutsideassistanceandreplacementmaterialscouldnotbeobtainedintimetocoolthenuclear

reactorsandrepairthedamage(see/15/).Coremeltdownsand/orexplosionsfollowedinfourreactorunits.Theon-siteemployeeswereexposedtohighdosesofionisingradiationandwereunabletofindoutaboutthecircumstancesofotherfamilymembersduetothefailureofcommunications.

ThesituationattheFukushimaDaininuclearpowerplant,locatedabouttenkilometresfurthersouth,alsoonthecoastofJapanandalsoope-ratedbyTEPCO,wassomewhatbetter(/22/).ElectricalpowerwasstillavailableatFukushimaDaini:apowerlineandanemergencygeneratorwerefunctional.Themonitoringinstrumentsinthecontrolroomwereworking.Nevertheless,excel-lentleadershipaptitudewasnecessarytopreventaworseoutcome.Ultimately,Dainiovercamethetsunamiwaveswithouteithercoremeltdownsorexplosions(/22/).

Theapproachofthesitesuperintendent,NaohiroMasuda,atFukushimaDainihasbeenanalysedinvariousstudies(e.g./22/)andwasdescribedasapositiveexampleofresilientleadership.ParticularlyworthyofhighlightingwasMasuda’swillingnesstoadapthisunderstandingofthesituationandthewaytoproceedinthefaceofnewsetbacksandproblemsiteratively.

Inemergencysituations,itmaynotbepossibletowaitanddecisionsmustbemadequickly(e.g.inthecaseofresuscitationofanunconsciousperson;seealsosection4).However,therearealsoemergencysituationswhereitispossibletodelaydecisions.Todelayinmakingdecisions,evenwheneverybodyaroundisshoutingforthem,isverydifficulttosustainandcreatesanunpleasantfeeling(referredtoinpsychologyas«cognitivedissonance»).Peoplehaveastrongreflextoreduceuncertainties,unpleasantfeelingsandcognitivedissonancesasquicklyaspossibleinordertofeelmorecomfortableagain.Thisurgeissostrong

thatinemergencysituationspeoplemaybecomecarriedawayintheheatofthemomentandmakedecisionstooquickly.However,ifdissonancescanbeheldatbayforaslongaspossible,theresultismoretimetothinktheproblemthrough.SitesuperintendentNaohiroMasudasucceededindoingthisatFukushimaDaini.

Masudahadallemployeesgatheredtogetheronsiteandprocuredawhiteboard.Hepresentedtheavailableinformationonthewhiteboard.Masudadidnotmakeanyoverlyhastydecisions,didnotmakeanydramaticandout-of-touchspeeches,andonlydistributedtheinformationthatwasdemonstrablyproventobereliable.Heinformedtheemployeesaboutthestrainoftheexistinguncertaintyanddoubtsandgavethemtimetobecomeawareoftheextentofthesituation(/22/).

Inthisway,Masudaallowedemployeestoparticipateintheprocessof«sense-making»,inwhichexistinginformationisinterpretedinordertounderstandthemeaningbehindit(see/58/).Masudaandtheemployeesworkedtogethertodevelopanunderstandingoftheactualsituation(/22/).

Masudaandhisemployeescameupagainstalotofunexpectedsetbacksandproblems.Theywerewillingtoquestiontheirknowledgeoftheactualsituationtimeandagain,toreviseanditerativelyadapttothenewobstacles,variancesanddistur-bances.Problembyproblem,theyworkedtheirwaytowarddecoding,understandingandfinallycopingwiththecircumstances(/22/).

Resilientorsituation-adaptiveleadershipGrote(/21/)arguesthatorganisationalresilienceislinkedtothecorecompetenceofbeingabletofunctionindifferentwaysofworkingandtosuccessfullyswitchbackandforthbetweendifferentmodesofworkandmodesofoperation(seealsosection3.1).Withresilientleadership,organisations,managersandteamscanreactinasituation-dependentmannertochangingcircum-stances(variancesanddisturbances)(/40/,/57/).

Somesituationsmayrequirestability(e.g.operationmustcontinuetobestableandsafe)andflexibility(e.g.acauseorsolutionmustbefound)atonce.Managersareconfrontedwithaso-called«managingparadox»,forexample,whenroutinetasksmusttakeplacesimultane-ouslywithexploratory,innovativetasks(/21/).Groteproposesthatthemanagementstylebeadaptedtothestabilityandflexibilityrequire-mentsofthesituation.Todothis,managersmustbeabletocontinuouslyreviewthestabilityandflexibilityrequirementsposedbythecurrentsituationandmakeadjustmentsasnecessary.Managersmustbeadaptivethemselvesandadapttheirroleandbehaviourtothesituationrequirements(/21/).

Managersshouldhaveawideportfolioofdifferentmanagementstylesavailablefordifferentsituations.Ifthesituationisassociatedwithhighstabilityrequirements,directivespecificationsusingrulesaresuitable.Ifthesituationrequiresahighdegreeofflexibility,forexampleininformallearningandknowledgeexchange,asharedteamleadershipinwhichamanagerbehaveslikeaworkcolleagueofequalstandingisappropriate(/21/)toachievethebestpossibleexchangeinadialogue.Thislowpowerdistancebehaviourcanonlybesuccessful,ifamanagerisawarethattherearesituationsinwhichhierarchicalthinkingcanhindersafety(/21/).

Asanexampleofsituation-adaptiveleadership,Yun,FarajandSims(/64/)showthatinemergen-cymedicalsituations,adirectmanagementstylewassuccessfulincomplexsituationswithlessexperiencedteammembers.Bycontrast,inlesscomplexsituationswithmoreexperiencedteams,asupportive,personality-promoting,participatorymanagementstyle(empowerment)waseffective.

AccordingtoGrote(/21/),therequirementsformanagerstoadapttheirbehaviourtotheneedsofthesituationcanbedescribedasfollows:

1. Managersmustbeable to be adaptive themselves,thatistosay,torecognisethechangesthataretakingplaceandtoadapttheirownrolesandbehaviourtothechang-ingdemandsofstabilityandflexibility.

2. Organisational mechanismsandinstrumentsmustbecreated that support individual and collective adaptivity,forexamplebyensuringthatrulesandstandardsnotonlypromotestability,butalsothatrulesaredefinedtoenableflexibility,forexample,proceduresthatspecifygoalsorprocesses(asopposedtodetailedinstructionsforaction).

3. Thethirdrequirementrelatesto the role of managers in the development of organisa-tional culture.Inadditiontothepromotionofamindfulandinformedculture,whichisusuallyconsideredasabasisforresilience,thefundamentaleffectofcultureasapowerfulstabilisingforce,whichsupportsthecoordina-tionoftheactionsofthemembersoftheorganisationandtheintegrationoftheworkprocessesindecentralisedandflexiblemodesofoperation,shouldalsobeactivelyexploi-ted.Groteenvisagesaculture of interdiscipli-nary appreciation,whichbringstogethertheentireknowledgeoftheorganisationtofindthebestwaytopromotesafetyandtocopewithconflictingdemands,asbeneficialfortheresilienceofanorganisation.

Thestrengtheningofresilienceandfurtherdevelop-mentofasafetyunderstandinginthesenseofSafety-IIinorganisationsthatoperatetechnologiesandprocess-eswithahighhazardpotentialsuchasnuclearinstalla-tions,canonlybeachievedwithasystemicapproach(seesection2).Thismeansthattheoverallsysteminwhichtheseorganisationsareembeddedmustenablesuchfurtherdevelopment.Inparticular,thismeansthatthesupervisoryauthoritymustsupportthesupervisedparties’developmentoftheirpracticesandculturestoreinforcetheresilienceandintegrationoftheSafety-IIapproach.Dependingonhowthesupervisoryauthorityexercisesitsoversightandwhatkindofregulatoryphilosophyitpursues,itcanstrengthenorevenhinderthedevelopmentofthepracticesandculturesofthesupervisedparties(see/42/xix).Oversightinstrumentsandpracticesaimed(exclusively)atcontrollingbeha-viourinacentralisedandstandardisedmannerseemtocontradicttheimportanceattributedtolocalinnova-tion,flexibility,adaptability,problemsolving,vigilanceandimprovisationrelatingtoresilience(see/42/xx).Oversight,whichplacesitsprimaryorexclusivefocusoncompliance,canleadtothesupervisedorganisationsfocusingprimarilyoncompliancewithregulatoryrequirementsinordertoavoidregulatorysanctions,attheexpenseofalossoffocusontheactualrisks(see/42/xxi).

Nevertheless,littleresearchhasbeendoneontherelationshipbetweenregulationandresilienceandtheroleofregulation(oversight)inpromotingorobstruct-ingresilienceandSafety-II(see/62/,/42/).Usingtheexampleofhealthcare,LeistikovandBal(/41/),notethatinrecentdecadestherehasbeenashiftfromcompliance-basedoversightto«responsiveandrefle-xive»oversight7.Thesupervisoryauthoritiesarefocus-singlessonregulationsanddocumentation(i.e.on«work-as-imagined»)andmoreonthecontextandinteractionswiththesupervisedparties.Leistikowand

BalseethisdevelopmentasalinktotheSafety-IIapproach.BothinSafety-IIandinacorrespondingoversightapproach,theaimistounderstandsituationsinthecontextoftheirsocialdynamics,i.e.torecognisethemeaningofanobservedsituationinitscontextxxii.Thismeansthatthefocusisprimarilyon«work-as-done».

Leistikovetal.(/41/)derivethefollowingconsequencesforoversightfromconsiderationsonSafety-II:

• Understanding of safety: AssafetyintheSafety-IIapproachisdefinedastheabilitytoensurethatthingsgoright,dialogueisneededbetweenthesupervisedpartiesandthesupervisoryauthoritiesonwhat«right»8meansandhowthesupervisedpartiescandemonstratetheirperformance.Thisislikelytobeachallengeincomparisonwithidentify-ingerrorsanddeviations,sincethemerefactthataprocessissuccessfulinitsfinalresult(objectiveachieved)andno(obvious)errorsandproblemshaveoccurreddoesnotnecessarilymeanthat«thingshavegoneright».Accordingly,thesupervi-soryauthoritycanaskthesupervisedpartiesforexampletoshowwhattheydefineas«right»andwhetherasystemicapproachisused,takingintoaccountdifferentperspectives.Itcanalsoexaminetowhatextentthesupervisedorganisationsachieveaminimumdegreeofthis«right»andhowthisisreflectedintheir«work-as-done».

• Safety management: Asthefocusofsafetyman-agementisnotonrigidrules,butratheronadap-tivecapabilitieswithintheorganisation,thesuper-visedpartiesmustdemonstratethattheyhavethenecessarystructuresandprocessestoeffectivelyrespondtounforeseensituations.Thesupervisoryauthoritycanthereforediscusswiththesupervisedorganisationshowtheyhaveorganisedtheirsafety

7| Seetheexplanationsinsection2.2.1formoreinformationon«responsiveregulation».«Reflexiveregulation»drawsonaregulatoryunderstandingwhichdoesnotbuildonafixedapproach,butisbasedonconstantevaluation(reflection)ofthecurrentcircumstancesandproblems,thesuitabilityofthemethodsusedandtheir(unintended)sideeffectsaswellasonthecorrespondingadaptationandfurtherdevelopmentofthemethodsused(/52/).Thecharacteristicsofreflexiveregulationareitsrecognitionofuncertainty,theparticipationofdifferentactors(e.g.differentauthorities)anditsfocusonlearning.Reflexiveregulationisseenasahigher-leveltheoryofvariousregulatoryapproaches,including«responsiveregulation»(/52/).

8| InconnectionwithconsiderationsonSafety-IIandresilience,«right»means«normal».Itisthereforenotamatterofhighlightingparticularlygoodoroutstand-ingactivities,resultsorevents,butratherofthenormal,successfulfunctioninginday-to-dayoperations,takingintoaccountthedailyvariabilityofbehaviouraswellasofrequirementsandconditions.Therefore,incontrasttotheSafety-Iapproach,thefocusisnotprimarilyonthosesituationsinwhichundesirableresultshaveoccurred,errorshavebeenmadeordisturbanceshaveoccurred,noronthosesituationswhicharejudgedasparticularlypositive,butratheronthosesituationsthatarenormalandinwhichthetaskissuccessfullyperformed.

3.3 ThetaskofthesupervisoryauthoritiesinthecontextofresilienceandSafety-II

managementinrespectofdealingwithunexpect-edissues,andcheck,withintheframeworkofinspections,theextenttowhichthisisreflectedintheir«work-as-done».Theauthorsarguethatoversightshouldnotbebasedonclassicalquanti-tativeindicatorsorkeyfigures,butratheronaqualitative,narrativediscourse.Forexample,thesupervisedorganisationsmaybeaskedtoproduceannualreports.Therearenoformalrequirementsforthesereports.Thesethenserveasabasisfordiscussionwiththesupervisedorganisationsabouttheirsafetymanagementandasastartingpointforinspectionsoftheactualwork(«work-as-done»)intheeverydayworkofthesupervisedorganisations.

• The role of people: Ifemployeesareexpectedtobearesourceforflexibilityandresilience,theworkdesignmustenableemployeestoassumethisrole.Thisrequires,forexample,afocuson(interdiscipli-nary)cooperation,easyaccessibilitytoseniormanagementforthesafetyconcernsofemployees,jobsatisfaction,etc.Employeesmustbesufficientlyalerttorecognisethingsthataregoingwrong,andbeempoweredtoreportingthemandactingaccordingly.Thetaskofthesupervisoryauthorityinthiscontextistoaskthesupervisedorganisationstoshowhowtheycanensurethatemployeescanfulfiltheirroleasaresource.

• Accident/event investigations: AcombinationofSafety-IandSafety-IIseemsappropriatetotheauthors.Boththeinvestigationofthecausesofanundesiredeventandtheinvestigationofwhythesameprocessthatwentwronginthiscasenormal-lyrunswell,allowgreaterin-depthlearning.Indoingso,forexample,classicalinvestigationmethodscanbecombinedwithaFRAManalysis9(see,forexample/29/).

• Risk assessment: Themonitoringandunderstand-ingofday-to-dayperformancevariabilitiesshouldformpartoftheriskassessmentbythesupervisedparties.Thesupervisoryauthoritymaythereforeencourageororderthedevelopmentanduseofmethodsforrecordingandmonitoringperfor-mancevariabilities.

Insummary,Leistikovetal.(/41/)advocateashiftinthesupervisoryauthority’sfocusawayfromcompli-ancetowardsconsistency.Thereby,thequestionofhowthe«work-as-imagined»presentedbytheman-agementisreflectedintheorganisation’sactualdailyperformance(«work-as-done»)shouldbecentral.Theoversightworkofthesupervisoryauthorityshouldthereforenot(primarily)bebasedonprescriptiveoversightbasedonsafetyindicators,butratheronthesupervisionofthemanagementsystem,withaparticu-larfocusonconsistencybetween«work-as-imagined»and«work-as-done».Theauthorssummarisethisapproachasashiftfromregulatory«oversight»toregulatory«insight»xxiii.

WorkingGroupDoftheComitéd’orientationsurlesfacteurssociaux,organisationnelsethumains(COFSOH)(/4/)presentssimilarconsiderationsinrespectofoversight,buildingontheconceptof«constructedsafety»(seesection3.2).Itcompares«normativeoversight»with«constructiveoversight»,whichiswhatshouldbestrivedforfromtheworkinggroup’spointofview.«Normativeoversight»assessescompliance,basedonaretrospectiveviewandonadefinedstandard.ItisbasedonaSafety-Iviewandprimarilysearchesfordeviationsfromthestandard.Itisbasedonthehypothesisthattheeliminationofdeviationsortheascertainmentofconformitycontrib-utestoguaranteeingsafety.Incontrast,«constructiveoversight»isnotlimitedtotheascertainmentofthe

9| FunctionalResonanceAnalysisMethod(FRAM):TheobjectiveoftheFRAMmethodistoanalysehowsomethingisdone,hasbeendone,orcouldbedone,andtopresentthisgraphically.Thereby,thefunctionsthatdescribetheanalysedactivityareidentifiedandtheinterrelationshipsandinterdependenciespresented.Eachfunctionisdescribedusingthefollowingsixaspectsandthenassociatedwithotherfunctions:Input(I),Output(O),Preconditions(P),Resource(R),Control(C),Time(T).Thisresultsinapresentationofthefunctionsofasystemandtheirdevelopmentinaspecificsituationorcontext,i.e.takingintoaccounttheperformancevariabilities./27/and/30/inparticularcontaindetailedinformationaboutFRAM.

conformitywiththerules.Thestandardsandrulesareonlyoneofthepossibleresources(seeFigure6).Theaimoftheinspectorsistoassesstheappropriatenessoftheactionscarriedoutonthebasisofthegeneralobjectivesofthesystemunderconsideration.Thistypeofoversightrequiresintensiveinteractionbetweentheinspectorsandthesupervisedpersons,wherebytheconsiderationofthecontext,theconstructionandthediscussionofthecriteriaareofgreatsignificance.Togethertheyworkoutarepresentationofthepresent(actualsituation)andthepathstothefuture.Indoingso,alearningprocessoccursonbothsides.

Anumberofconditionsmustbemetfor«constructiveoversight»tobesuccessful(/4/).Theinspectorandthesupervisedperson,mustbeawarethattheysharethesameobjective,namelyimprovingsafety.Thisrequiresmutualtrust.Theinspectormusthavegoodknowledgeofthe«field»andtheactualframeworkconditionsofthesupervisedactivities(experience).Thesupervisedpersonmustthemselveshaveapositiveattitudeandnotwantjusttopresenta«goodpicture»ofthem-selves.Theoversightmustthereforebebenevolent(empathic,support-oriented),performedwithintegrity(honest,basedonsharedvalues)and(technicallyandsocially)competent.Itmustbebasedonopendialogue,inwhichmistakescanbeadmittedandthefearofsanctionsremoved.Theoversightisaimedatdevelop-inganunderstandingofthesituation,notjustfindingmistakes.Theinspectorsfocusontheday-to-daybehaviourofthesupervisedpartiestomaintainsafetyandontherealityoftheactivitiesandsituations(«work-as-done»).Thisimpliesamethodologicalapproachintheoversight,whichallowsaccesstothe«reality»ofday-to-daywork.TheCOFSOHworkinggroup(/4/)recommends,forexample,theuseofmentalsimulation(«whatif…?»),discussionswithdifferentactorsanddirectobservation.Italsoencouragesthedevelopmentofnewoversightmethodsthatpromoteimmersioninsituationsandaccesstotheactors.

Wiig,AaseandBal(/60/)advocatethecreationof«reflexivespaces10,xxiv«attheinterfacebetweenthesupervisoryauthorityandthesupervisedorganisationsbasedontrust,dialogue,respectandapsychologicallysafeatmosphere.Inthisrespect,oversightinstruments,e.g.performanceindicatorsoreventassessmentsarenotused(primarily)asameasureofthedegreeofcompliancewithregulatoryrequirements,butratherasavehicleforcreatingreflexivespacesinwhichdiscus-sionsaboutsafetyareconducted.Thevaluesoftheindicatorsortheeventreportsarethereforenotthefocusofthesupervisoryauthorityperse,ratherthereflectionthatistriggeredbythem.Insuchanoversightapproach,thesupervisoryauthorityalsouses«softsignals»fromdifferentsources.Indoingso,itdoesnotintervenedirectlyinresponsetothesignals,rathergathersthemtogether,searchesfortheirsenseandmeaning(«sense-making»)byplacingtheminthecontextofwhatisalreadyknown.Withthefindings(orhypotheses)gainedinthisway,itconfrontsthesuper-visedorganisationandentersintodialoguewithitwithintheframeworkofareflexivespace.Theaimofthisprocedureistoleaveresponsibilityforsafetywiththesupervisedorganisationasfaraspossible,whileatthesametimecheckingitsabilityandwilltoassumeandbearthisresponsibilityforsafety,accordingtothemotto«trust,butassesstrustworthiness»xxv.

Grote(/21/)stressestheneedforthesupervisoryauthorityandthesupervisedorganisationtohavethesameviewastowhetherandtowhatextentdifferentmodesofoperationofanorganisationarelegitimate.Dependingontheregulatoryphilosophyofthesupervi-soryauthority,itmaybedifficulttoachievethiscom-monunderstanding.Forexample,ifthesupervisoryauthoritypredominantlystandsforaprescriptiveregulatoryapproachandaworldviewbasedprimarilyonstandardisationandcentralisation(i.e.Safety-I),itisunlikelytoacceptanorganisationofthesupervisedpartiesbasedonflexible,decentralisedstructuresand

10| Wiigetal.(/60/)consider«reflexivespaces»asphysicalorvirtualplatformsonwhichareflexivedialoguebetweenpeopletakesplace.Thepracticeofreflexivedialogueisseenascentraltolearningprocesses,asitcreatesabridgebetweenimplicitandexplicitknowledge.Reflexivespacescanbringpeopletogethertoreflectoncurrentchallenges,theneedforadjustmentsorotherdemandsindailywork,etc.Theypromoteresponsibilityandfeedback.

procedures.Therefore,accordingtoGrote,opendialoguebetweenthesupervisoryauthorityandthesupervisedorganisationsisessentialinensuringtheoperationalflexibilityrequiredforaresilientmodeofoperationofanorganisationxxvi.

TheHOFSectionmonitorsthestateofscienceandtechnologyintheareaofhumanandorganisationalfactorsandthesafetysciencesnotonlyforthepurposeofderivingrequirementstobeappliedtothesuper-visedorganisations,butalsostrivestounderstandtheimplicationsofnewconceptsfromthesafetysciencesforitsownregulatoryworkandtoconstantlydevelopitsoversightinstrumentsandpracticesaccordingly.Foranumberofyears,theHOFSectionhasbeenaddress-ingresilienceandtheSafety-IIapproach.Therefore,in2016,itinitiatedaprocessofreflectionontheimplica-tionsoftheSafety-IIapproachforoversightintheHOFareaand,aspartofabachelor’sthesis,carriedoutananalysisofitslevelofconsiderationtothoughtsonSafety-IIinitsoversightpracticeofthetime(/16/).Theanalysisshowedthatoversightmustbemorefocusedon«work-as-done»andthevariabilityintheday-to-dayfunctioningofthesupervisedorganisationthanwasthecaseinearlierpractice.Correspondingdevelop-mentpotentialthereforerelatestoagreaterinvolve-mentofthoseemployeeswhocarryouttheworkatthe«sharpend»andhavethecorrespondingpracticalexperienceandexpertise(so-calledfieldexperts).Sincethesepersonsarespecialistsintheirfieldofactivity,theirinvolvementisindispensableinordertounder-stand«work-as-done»(/16/).

TheanalysisresultedinanumberofrecommendationsforactiontotheHOFSectioninordertointegratetheSafety-IIapproachmorecloselyintoitsoversightactivities:

• Howfieldexpertscanbemoreinvolvedintheregulatoryactivitiesofthesectionshouldconcre-tised.ThisimpliesdirectcontactbetweentheemployeesoftheHOFSectionandtheemployeesatthe«sharpend»,i.e.attheworkplacesonsite,inthenuclearinstallations.Forexample,workobservationscouldbecarriedout.

• OpendialogueontheSafety-IIapproachshouldbeconductedwiththesupervisedparties,e.g.withintheframeworkofspecialistdiscussions.ThisenablesdevelopmentofacommonunderstandingofSafety-IIanditspracticalimplementationinoversight.

• Thefocusinoversightshouldnot(only/primarily)beonthesearchforexistingproblems,butalsoonthequestionofhowproblemsaresuccessfullymanaged.Toachievethis,Geeser(/16/)suggeststhatdiscussionswithfieldexpertsbecarriedout.Ineachcase,twofieldexpertsshouldparticipateintheconversation,asthedialoguebetweenthemcouldprovidemorecomprehensiveinformationandthusalsostrengthenunderstandingofthesystem.Inaddition,thesediscussionsshouldtakeplaceattheworkplaceofthosebeingsurveyedsothattheHOFSectionrepresentativecangainafeel-ingfortheday-to-daywork.

TheconsiderationsandapproachesfromtheliteraturethatdealwiththequestionofanappropriateregulatorystrategyinthecontextofresilienceandSafety-II,leadtotheconclusionthatdialoguewiththesupervisedpartiesmustbeacentralelementofoversight.IncontrasttotheSafety-Iapproach,inwhichdeviationsfromapredefinedtargetstatearerelativelyeasytodetectandassess,theSafety-IIapproachrequiresaconsensustobefoundonthetargetstateinrelationtothecontext,i.e.whatcanbeassessedas«right»,takingintoaccounttherespectivecontextfactors.Theremustbecontinuousdiscoursebetweenthesupervisoryauthorityandthesupervisedparties,inwhichtopicssuchastheday-to-day,«normal»functioningofthesupervisedorganisation,theday-to-dayvariabilityofperformanceandbehaviour,thedifferentwaysoffunctioningoftheorganisationsindifferentsituationsandtheirhandlingoftheunexpectedorofuncertaintyareexplicitlyreflectedupon.Foroversight,itisessentialtounderstandhowthesupervisedorganisationfunc-tionsonaday-to-daybasisandwhichfactorsinfluencethisfunctioning.OversightmustbecharacterisedbyInsightinthenormalmodeofoperation,andtheremustbeacommonunderstandingofthismodeofoperation,theframeworkconditions,challengesandsafety-relatedobjectivesbetweenthesupervisoryauthorityandthesupervisedparties.Therefore,thesupervisoryauthoritymustgainaccesstothe«reality»ofday-to-daywork.Animportantfocusofthesupervi-soryauthoritywillthereforebeon«work-as-done»andontheconsistencybetween«work-as-imagined»asdefinedbythesupervisedorganisationand«work-as-done».Consequently,initsoversightactivities,itmustinvolve,notonlytheleaders,theemployeeswhoperformmanagementtasksorspecificsafety-relatedfunctions,etc.(i.e.employeesatthe«bluntend»6),butalsoemployeeswhoperformthework«on-site»,intheplant,intheworkshop,etc.(i.e.«fieldexperts»atthe«sharpend»).Inaddition,itneedsappropriateoversightinstruments,withwhich,ontheonehanditcanmonitorandassessthemodeofoperationofthe

supervisedpartiesand,ontheotherhand,itcanpositivelyinfluencetheirresilienceandSafety-IIap-proach.Thereby,thesupervisoryauthorityitselfneedstobeflexibleandadaptive,i.e.resilient,andtocontinu-allyquestionitsregulatoryinstrumentsandapproaches–inthesenseofreflexiveregulation–andtoadaptthemtothechangingrequirementsandtothesituationoftheindividualsupervisedorganisations.OversightworkagainstthebackgroundofSafety-IIandresilienceisthereforeademandingtaskinwhichthesupervisoryauthorityadoptsadoublequestioningrole,bothinrelationtotheorganisationsitoverseesandinrelationtoitself.Thisrequiresittohaveastrongcapacityforself-reflectioninordertoplaceitsownroleandinflu-enceonthesafetyofthesupervisedpartiesunderconstantself-scrutiny(/31/xxvii).

TheHOFSectionhassetitselftheobjectiveofquestion-inganddevelopingitsoversightworkagainstthebackgroundofSafety-IIandresilience.Thefollowingsectionthereforedrawspracticalconclusionsforthefutureoversightofhumanandorganisationalaspectsandproposesconcreteideasforcommensurateoversightactivitiesorthefurtherdevelopmentofexistingoversightmethods.

3.3.1 Interimconclusion

ENSI (HOF Section) Supervised parties

Concept resilience/Safety-II

Regulation (ENSI Guidelines, orders, requirements, etc.):• Content of the regulation

(requirements in respect of resilience/Safety-II)

• Form of the regulation (type of formulation of the requirements)

Management system/internal specifications/principles in respect of Safety-II-approach for own organisation

Oversight

Methods, oversightinstruments,action channels

(Capability/possibility of the) implementation of the Safety-II approach in the day-to-day routine of the nuclear installation

Assessm

‘work-

as-imagined’

Specifications

Assessment‘work-as-done’ Im

Effect …… of the oversight

… on the oversight

3.4 ConclusionsfortheHOFSection

Althoughnotexplicitlydiscussedintheliteraturecitedhere,intermsoftheroleofthesupervisoryauthorityinthereinforcementorinfluencingoftheresilienceorSafety-IIapproachofthesupervisedorganisation,adistinctionmustbemadebetweentwo–thoughnotcompletelyindependent–aspectsofregulatoryoversight: regulation,i.e.theformulationofrequire-mentsintheformofguidelines,regulations,decrees,demandsetc.ontheonehand(seequadrant1inFigure7)andontheotherhandtheoversight activityitself(seequadrant2inFigure7).Intermsoftheoversightactivityitself,itisthennecessarytodifferen-tiatebetweenthewayofmonitoringandtheassess-mentofcompliancewiththerequirements(oversightinthe«strictersense»,see/12/;seealsotheorangearrowsinFigure7)andthestrivingtopositivelyinfluencethesafetyandsafetycultureofthesuper-visedpartiesthroughtheexerciseofoversight,forexamplebyaimingtotriggerself-reflectionintheoperatorofanuclearinstallation(oversightinthe«broadersense»11,see/12/)(seetheupperbluearrowinFigure7).Bothaspectsoftheworkofasupervisoryauthorityhaveaneffectontheabilityandpotentialof

thesupervisedorganisationtofunctioninaresilientmanner.Conversely,culture,strategyandpracticeinthefieldofsafetymanagementonthepartofthesupervisedpartieshaveaneffectonthemannerofdoingoversightofthesupervisoryauthority(seethelowerbluearrowinFigure7).Considerationsregardingadesignoftheoversight,whichpositivelyinfluencesoratleastdoesnothindertheresilienceofthesupervisedparties,mustthereforeincludebothaspects(regulationandoversightactivity).However,ENSIprimarilydealswiththeimplicationsoftheseresilienceandSafety-IIconsiderationsfortheregulatoryframework(regula-tion)inthefieldofhumanandorganisationalfactorsaspartofthedraftingofnewguidelinesandtherevisionofexistingones12andarenotthesubjectofthisreport(quadrant1inFigure7).Accordingly,thefocusofthisreportisonthe oversight activityandontheapproachesandmethodsusedinoversightrelatingtoresilienceandSafety-IIconsiderations.

11| Aspresentedin/12/,inENSI’sunderstanding«oversightinthestrictersense»includesmonitoringwhetheralicenceholderperformsitsdutiesandtheninterventionwhenitdoesnot.«Oversightinabroadersense»alsoincludestriggeringoftheself-reflectionofthelicenceholderbythesupervisoryauthority.ENSIhasformulatedthiscomprehensiveunderstandingofitsownroleinitsmissionstatement(/10/).Inadditiontofulfillingitsstatutorymandate(inparticular,GuidingPrinciple1),italsoconsidersthestrengtheningofthesafetycultureandtheself-responsibleactionofthesupervisedpartiesaspartofitstask(GuidingPrinciple2,point3).

12| ThisprimarilyconcernstheguidelinesENSI-G07«TheOrganisationofNuclearinstallations»(/9/)andENSI-B10«BasicTraining,RecurrentTrainingandCon-tinuingEducationofPersonnelinNuclearInstallations»(/8/).

Figure7:OversightinrespectofresilienceandSafety-IIfromdifferentperspectives

TheconsiderationsoftheHOFSectiononthe(strength-ened)integrationoftheSafety-IIapproachintoitsfutureoversightarepresentedbelow.Indoingso,itisnottheaimtomakearadicalchangetooversightbyabandoningtheSafety-IapproachandreplacingitwiththeSafety-IIapproach.Rather,itisaquestionofconsideringbothapproachesintheircomplementarityandtakingthemintoaccountinoversightinthehumanandorganisationalfactorsarea.Theideasandmethodsdiscussedbelowarethereforeintendedasasupple-menttotheoversightmethods(notdiscussedhere)thataremorelikelytobeassignedtotheSafety-Iapproach.

Inaccordancewiththeabove-mentioneddistinctionbetweenoversight«inthestrictersense»andoversight«inthebroadersense»,adistinctionismadeherebetweenSafety-IIoversight«inthestrictersense»andSafety-IIoversight«inthebroadersense»(seeFigure8),althoughthedistinctionbetweenthetwotypesofoversightisnotalwaysasharpone.

Inthefirstcase,itisamatterofidentifyingandassess-ingthesafetystatusofthesupervisedorganisationsfromtheSafety-IIpointofview.TheSafety-IIfocusisprimarilyonunderstandingthenormalfunctioningoftheorganisationandthesituationalandcontext-relatedrealityofday-to-daywork(«work-as-done»)aswellasinthecomparisonbetween«work-as-imagined»and«work-as-done».Theaimisto identifyatanearlystagewhenperformancevariabilityandadjustments,whichareanecessarypartofdailyactivity,developintoaproblemandthentointerveneinatimelymannerbeforeinterventionsinlinewithSafety-I(prescriptiveregulatoryordersuptoandincludingsanctions)becomenecessary(«proactivereaction»).

Moreover,itshouldbenotedthateveninthepastquiteafewSafety-IIelementswerealreadyputintopracticeintheareaofhumanandorganisationaloversight.Therefore,thesearenotcompletelynewideasandapproachesthatwill,goingforward,beappliedinoversightfromsomeparticularpointintime.Rather,itismuchmoreaboutasmoothtransitiontowardanintegratedoversightapproachwhichtakesequalaccountofSafety-IandSafety-II.

Thesecondcase,ontheotherhand,isaboutstrength-eningthesafetyofthesupervisedpartiesthroughtheuseofappropriateoversightinstruments,inparticularbystimulatingself-reflectionintheirorganisationsandfosteringtheassumptionofdirectresponsibility(«pro-activeaction»).Thisapproachalsorequirescontinuousself-reflectiononthepartoftheinspectorsintermsoftheimpactoftheiroversightonthepotentialandcapabilityofthesupervisedpartiestoimplementtheSafety-IIapproachintheirorganisation,andonthesuit-abilityofoversightmethodsandcontentdependingonthesafetystatusofthesupervisedparties(seethebluearrowsinFigure7).A«reflexiveoversight»approachisthereforenecessary(seesection3.3).

3.4.1 Basicconsiderations

Accordingly,theHOFSectionderivesthefollowinghigher-levelrequirementsforitsoversightusingtheSafety-IIapproach:

• Focussingnotsolelyoncompliancewiththerequirementsoftheregulatoryframeworkandtheinternalregulations(evaluation,target-actualcomparison,compliance-orientedoversight),butalsoonstrengtheningreflectionandthedirectresponsibilityofthesupervisedparties(perfor-mance-orientedoversight)(seesection2.2.1)− Strengtheningthedirectresponsibilityofthe

supervisedpartiesbycallingfortheformulationofdevelopmentobjectivesandmeasures

− Holdingthesupervisedpartiesaccountablebyaskingforandprovidingfeedbackontheachievementofobjectivesandtheeffectivenessofmeasures

• Focussingnotonlyondeterminingcompliancewiththerequirementsoftheregulatoryframeworkandinternalregulations,butalsoontheunder-standingofthesysteminitscontext

• Focussingnotexclusively/primarilyonthe«nega-tive»(events,deviations,non-compliancewithproceduresetc.);increasedfocusonthe«positive»orratherthe«normal»− Whatisgoingrightandwhy?− Howdoestheworknormallyfunction?− Howare/haveproblemsbeensolved?(In

contrastto:whichproblemsexist/existed?)

• Focussingnotexclusively/primarilyonthe«speci-fied»(work-as-imagined);morefocusonthe«actual» (work-as-done)− Howisday-to-dayworkactuallycarriedout?− Whichframeworkconditionsdefinethework?− Whichvariabilitiesareapparent?

• Increasedcomparisonof«work-as-imagined»and«work-as-done»byincludingrepresentativesofboththe«bluntend»andthe«sharpend»intheoversight− Towhatextentdothefactspresentedbythe

managementortheemployeesatthe«bluntend»coincidewiththeactualsituationandworkingmethodsoftheemployeesatthe«sharpend»(fieldexperts)?

− Howcananydiscrepanciesbeexplained?Whichconditionsmake«work-as-imagined»moredifficult?

• Reinforcingdialoguewiththesupervisedparties

• IncreasedfocusonthepotentialsofresilienceandSafety-IIamongthesupervisedparties:thepoten-tialtoreact,thepotentialtomonitor,thepotentialtolearn,thepotentialtoanticipate.

Recognise safety and assess:- (Increased) focus on the day-to-day/normal:

Understand how the supervised organisation functions (values & world views, behaviour, framework conditions) by observation of the day-to-day routine («work-as-done»); looking and listening, identifying patterns

- Comparison of «work-as-imagined» and «work-as-done»

- Identify changes (both in the positive and problematic direction), especially if something is «getting out of control»

- Dialogue with the supervised parties

Keep the «big picture» in mind and recognise:- systemic approach- interdisciplinary approach

à «Proactive reaction» : Identify signals and take quick action

Strengthen safety by triggering (self-) reflection among the supervised parties:- Dialogue with the supervised parties- Ask questions- Confront, reflect

… and promotion of self-responsibility:- Selection of suitable oversight approaches, methods and

foundations (suitable level of prescription)- Agree development objectives and measures and hold

supervised parties accountable

Do not weaken safety:- Self-reflection ENSI/HOF Section (oversight culture)- Avoid assuming (too much) responsibility (i.e. avoid

specifying solutions, prescriptive requirements, limitation of the scope of action)

à «Proactive action» : achieve effectà Increase the number of things that go right

Safety-II oversight in the «stricter sense» Safety-II oversight in the «broader sense»

Figure8:OversightwithfocusonSafety-II

TheHOFSectionusesdifferenttypesofmethodsinitsoversight,withwhichitpursuesdifferentpurposesanddealswithdifferenttopics(seeSection1.2).Allover-sightmethodscanalsobeusedinaccordancewithSafety-II.WhilesomeofthemarealreadyconceivedasSafety-IImethods(inparticulartheinstrumentsthatareexplicitlyusedtopromoteself-reflection),othersmustormaybedeliberatelyenrichedwithSafety-IIelements(namelythosethatprimarilyservethepurposeofthetarget-actualcomparisonandarethereforegenerallyusedasinstrumentsforcomplianceverificationandthusasSafety-Imethods).

The announcementofthespecificoversightactivitiestothesupervisedpartiesbythesupervisoryauthorityisofparticularimportance.Typically,specialistdiscussionsandinspectionsareinitiatedbyanannouncementletterfromENSI,withwhichthetopicandthereasonfortheannouncedoversightactivityarecommunicated.Thetopicisfrequentlyclarifiedbyspecificquestions,whichENSIwouldlikethesupervisedpartiestoanswer.Thenatureoftheformulationofthesequestionslargelydeterminesthenatureandcontentofthespecialistdiscussionorinspection,becauseitinitiatescorrespond-inginternalpreparationonthepartofthesupervisedorganisation.InthesenseoftheSafety-IIapproach,itisthereforeofkeyimportancetoformulatethetopicsandquestionsinsuchawaythattheyinitiateself-reflectionamongthesupervisedpartiesandstrengthenthedialoguebetweenthesupervisedorganisationandtheHOFSection.

Forthe performance ofspecialistdiscussionsandinspections,theassemblyofoversightteams(consistingofatleasttwomembersofthesectionoronememberoftheHOFSectionandonememberofasectionfromanotherspecialistarea),whohavedifferentback-groundsandexperienceandadoptdifferentstancesisrecommended.Forexample,itmaymakesenseforthespecialistdiscussionorinspectiontobejointlycarriedoutbyanemployeeinthesectionwithin-depthknowledgeoftheorganisationconcerned,dueto(manyyearsof)oversightexperienceintheorganisation

tobesupervised,andanemployeewithappropriateexperienceinanothersupervisedorganisation.Whiletheformercanintegratethefindingsfromtherelevantspecialistdiscussionorinspectionintothebigpictureoftheorganisation,thelattercanbringinnewimpulsesthroughtheir«externalperspective»andatthesametimegaininsightsfortheiroversightroleintheorgani-sationstheyprimarilysupervise(seealsosection5.5).

Amongotherthings,theoversightinstrumentsde-scribedinsection1.2andtheirpossibleuseaspartofaSafety-IIoversightapproachareexaminedbelow.

• Specialist discussion promoting a dialogue on safety culture: Thedialogueonsafetyculture,whichtheHOFSectionhasconductedeverythreeyearssince2005withthesupervisedparties(see/12/),canbeattributedtotheSafety-IIapproach.Itfollowstheprimaryobjectiveoftriggeringaself-reflectionprocessamongthesupervisedparties.Indoingso,itsupportstheHOFSectionindeepen-ingitsunderstandingofthecultureandfunctioningofthesupervisedpartiesandindeterminingthecongruenceofthisunderstandingwiththatofthesupervisedorganisation.Moreover,ithelpstheHOFSectionitselftoreflectonitsoversightanditsimpactonthesafetycultureofthesupervisedpartiesinthatitreceivesfeedbackfromthelatter.− Therefore,withreferencetothesespecialist

discussions,inprinciplethereisnoneedtoadapttheprocess.

− Inthesenseofameta-reflection,thequestionofhowresilienceandSafety-IIare(canbe)implementedandpractisedbythesupervisedpartiesandembodiedintheregulatoryrelation-shipbetweenthemandENSIwouldbeappro-priateasapossibletopicforconductingthedialogue.

− Theinclusionofawiderrangeofpersonnelcategories(i.e.notonlyseniormanagementexecutivesorexpertswhoexplicitlydealwithsafetycultureintheirdailywork)wouldallowallparticipantsandENSItoformamore

3.4.2 MethodsforSafety-IIoversightinthehumanandorganisationalfactorsarea

comprehensiveanddeeperunderstandingofthefunctioningoftheoverallsystem.Thiscouldbeperformedeitheraspartofonediscussionoraspartofvariousseparatediscussions.

• Exploratory specialist discussion: Likethedialogueonsafetyculture,theexploratoryspecialistdiscus-sionservestostimulatetheself-reflectionofthesupervisedpartiesandusessimilarmethods,althoughheretopicsthatdonotreferencesafetyculturearealsodiscussed.− Theexploratoryspecialistdiscussionissuitable

forconfrontingthesupervisedpartieswiththefindingsandresultsfromthevariousoversightactivities(inspections,specialistdiscussions,statements,permits,etc.)inthehumanandorganisationalfactorsareaandtheindividualobservationscollectedoverayear,which,althoughnotincludedinthesystematicsafetyassessmentofENSI,do,however,intheirentirety,indicatepossiblepatternsortrendsintheday-to-dayfunctioningofthesupervisedorganisations(seealso/12/).ThedatacollectedandevaluatedinthiswaybytheHOFSectionisreportedbacktothesupervisedpartiesintheformofaggregatedfindingsandhypothesesandarethenconsideredjointlywiththem.Thisfeedbackisanopportunityforthesupervisedorganisationtocompareitsself-imagewiththeexternalimageofthesupervisoryauthorityandtoreflectonitsownday-to-dayfunctioning.Ontheotherhand,thediscussionservestodeepentheHOFSection’sunderstandingofthefunctioningofthesupervisedorganisationandfortheconsiderationofitsoversightanditseffect.

− Inadditionto(low-level)deviationsfromanexpectedstateand/orweaksignals,whichcouldpotentiallyindicatedeficiencies,theHOFSection’sobservationsandfindingsshouldalsoincludeexplicitlypositivefindings,whichindicatethesuccessfulfunctioningofthe

organisation.Inaddition,specificattentionshouldbepaidtoperformancevariabilityonaday-to-daybasis,forexample,toprioritisationofworksorchangingpriorities.

− Inthequalitativeevaluationandinterpretationoftheresultsoftheoversightofhumanandorganisationalfactors(e.g.frominspectionsandevents,see/12/and/13/),thefocusshouldnotonlybeondeviationsandtheneedforimprovement.Rather,assessmentsthatmatchexpectations(«normality»)andthosethatexceedexpectation(«goodpractice»)shouldexplicitlybeincludedintheoverallviewaswell.

− Conductingexploratoryspecialistdiscussionsinvolvingfieldexpertsfromthe«sharpend»orgroupsofparticipantswithdiverseback-groundsallowsvaluableinsightsintothefunctioningofthesupervisedorganisationtobeobtained.

• Information discussion: Thistypeofspecialistdiscussion,whichisusedtoobtaininformationandfactsaboutactualissues(e.g.relatingtoevents,projectsorpermitsrelatedtoorganisationalortechnicalchanges,etc.),can,dependingonitsalignment,concernbothSafety-IandSafety-IIaspects.Forexample,whendealingwithevents,itcanbeusedprimarilytounderstandwhytheundesirableeventoccurredandwhatcanbedonetopreventtheeventfromreoccurring(Safety-Iapproach).Oritcould(also)beusedtounderstandtheconditionsunderwhichtheworkinwhichtheundesirableeventoccurrednormallyfunctionsandwhyithasnotoccurredpreviously(Safety-IIap-proach).− Informationdiscussionsshouldthereforealsobe

usedtocollectasmuchinformationaspossibleaboutthenormalfunctioningandtheday-to-dayperformanceofworkandtounderstandwhichchangingconditionsandrequirementsinfluencethenormalexecutionofthework.Inaddition,theycanbeusedtomakeacompari-sonbetweentheplannedideal-typicalexecu-tionofthework(«work-as-imagined»)andtheactualexecutioninpractice(«work-as-done»).

− Informationdiscussionsshouldbeconductedwithdifferentpersonnelcategories.Indoingso,theinvolvementofpersonnelfromthe«sharpend»shouldinparticularbeconsidered.

− Informationdiscussionsdonotnecessarilyhavetobeheldinameetingroom,rathercanalsobeheld,atleastinpart,atin-situworkplaces.Thismakesparticularsenseifemployeesfromthe«sharpend»areinvolved.Inaddition,itenablesabetterunderstandingof«work-as-done»andtheconditionsandworkingcircum-stancesinfluencingthework.

− Wheninvolvingemployeesatthe«sharpend»,discussionscanbeheldwithtwoemployeesatthesametime.Theresultingdialoguebetweenthefieldexpertscanalsosupporttheacquisitionofvaluableinsightsinto«work-as-done».

• Inspection: Withinthescopeofaninspection,compliancewiththerequirementsoftheregulatoryframework(laws,regulations,guidelines)ischecked.Inspectionsarecarriedoutwithregardtoitemsunambiguouslyregulatedintheregulatoryframework.Typically,thefocusisondeviationsfromthetargetstatespecifiedintheregulatoryframe-work,wherebytheregulatoryframeworkusuallytakesnoaccountofsituationandcontext-relatedadaptations.Therefore,inspectionsareprimarilyaSafety-Iinstrument.Forexample,theHOFSectioncarriesoutannualinspectionsonthemanagementsystemofthesupervisedparties.Indoingso,itselectsaprocessfromthemanagementsystemandcheckswhetheritmeetstherequirementsoftheregulatoryframework,inparticularthoseofGuidelineENSI-G07«TheOrganisationofNuclearinstallations»(/9/).Italsocarriesoutannualinspec-tionsonthetrainingofpersonnelinnuclearpowerplants,basedontherequirementsofGuidelineENSI-B10,BasicTraining,RecurrentTrainingandContinuingEducationofPersonnelinNuclearInstallations»(/8/).− InthesenseoftheSafety-IIapproach,when

definingthesubjectmatterforinspectionsofthemanagementsystem,infutureitshouldbeconsideredwhetherthesecanbecarriedoutintwoparts.Here,asinthepast,inthefirstpart,atarget-actualcomparisoncouldbecarriedoutbetweentheprocessesandspecificationsinthe

managementsystemandtherequirementsfromtheregulatoryframework(«work-as-imagined»).Inasecondpart,theimplementationoftheprocessesandspecificationsfromthemanagementsystemcouldbeexaminedasdirectlyaspossibleatthe«sharpend»andwiththeinvolvementoftheexecutingemployees(«work-as-done»)usingactualpracticalexamples.Thefocusshouldbeontheconditionsunderwhichtheworkiscarriedoutandthepersonnel’sadaptationeffortstosuccessfullycarryoutthework,theirapproachtosolvingproblemsthatarise,etc.Participatingemployeesshouldprimarilybeseenasa«resource»andnotas«riskfactors».

− Withintheframeworkofinspectionsonhumanandorganisationalfactors,thescopeistobeextendedbyinvolvingdifferentcategoriesofpersonnelindifferentfunctionsspreadbetweenthe«bluntend»andthe«sharpend»intheinspection.

− Inaddition,differentmethodsshouldbeused,forexampleinterviews,workplaceobservations,plantwalkdowns,etc.Both«work-as-imagined»and«work-as-done»aspectsshouldbetakenintoaccount.

• Event processing: Intheanalysisandevaluationof(reportable)eventswithhumanandorganisationalaspects,thefocusshouldnotonlybeontheundesirableevent(whatwentwrong),ratherthepositiveaspectsshouldalsobetakenintoaccount.Inadditiontotheclarificationofthecausesoftheeventandthedefinitionofmeasurestopreventitsrecurrence(Safety-I),thereasonswhytheaffectedprocessnormallyrunssmoothly(Safety-II)shouldalsobeconsidered.− Whenprocessingthehumanandorganisation-

alaspectsoftheevent,theHOFSection(e.g.inthecontextofinformationdiscussions,seeabove)alsoaskswhichmoreseriousconse-quencescouldbepreventedandhow,andwhichprotectionfactorscontributedtotheascertainedoutcomeoftheevent.

− Withinthescopeofeventprocessing,theeventsshouldnot(only)beconsideredindivid-ually(so-called«singlelooplearning»),butalsointhecontextofotherevents(ifpossiblealsoincludingnon-reportableeventsornearmisses)(«doublelooplearning»).

− Inthecontextoftheireventanalysis,theHOFSectionalsoevaluatethefollow-upactionsinthehumanandorganisationalfactorsareadefinedbythesupervisedpartiesaccordingtoSafety-IIcriteria.

− Shouldtherebeanyrequirementsforactionsinthecontextofeventprocessing,theseshouldbeformulatedinsuchawaythattheystimulateself-reflectionwithinthesupervisedorganisa-tionandstrengthenitsdirectresponsibility.

• Safety-II forum across nuclear power plants: TheorganisationofareflectionforuminvolvingallorseveralsupervisedorganisationsontheSafety-IIapproachwouldcontributetostrengtheningdialogueandacommonunderstandingofthesignificanceandimplicationsoftheSafety-IIapproachbetweenthesupervisedpartiesandtheHOFSection.

Inadditiontotheplanningandimplementationofindividualoversightactivitieswiththevariousoversightmethodsdescribedabove,jointlearningfromtheexperiencegainedaspartofoversightwithintheHOFSectionisanimportantpartofaSafety-II-orientedoversight.Withintheframeworkofaperformance-ori-entedoversight(seesection2.2.1),exchangeandjointreflectionontheinsightsandfindingsgainedareessentialfortherequiredunderstandingofthefunc-tioningofthesupervisedorganisationsintheirrespec-tivecurrentcontext,becauseasimpletarget-actualcomparisonbasedonclearcriteria,asisthecasewiththeSafety-Iapproach,isnotpossible.

Inthesenseofcontinuousimprovement-oriented«reflexiveoversight»,the(joint)reflectionontheeffectoftheoversightactivitywithregardtothesafetyandthesafetycultureofthesupervisedpartiesisalsoofgreatimportance.Thecreationof«reflexivespaces»(seesection3.3)isthereforeimportantnotonlyintheinteractionbetweentheHOFSectionandthesuper-visedparties,butalsowithintheSectionitself.

Box5:Digression:RequirementsforthefacilitationofconversationswithinthecontextofaSafety-IIoversightapproach

DiscussionsplayacentralroleintheworkoftheHOFSection,inparticularintheimplementationofthedescribedmethodsforSafety-IIoversight,whicharetoalargedegreedialogue-based.ThismeansthatemployeesintheHOFSectionmustalsohavespecificskillsinleadingconversations,inadditiontotheirtechnicalcompetencies.

Whenheadinganyspecialistdiscussionaimedatstimulatingtheself-reflectionofthesupervisedparties,employeesintheHOFSectionoftenassumetheroleofa«facilitator».Inthisrole,theyguidethecontentofthediscussions–byspecifyingthetopicofthediscussionbymeansoftheannouncementletterandthequestionsformulatedinit(seesection3.4.2)–andtheycanalso,atleastinpartorincertaintypesofspecialistdiscussions,influencetheprocessofthediscussionandthusitscourse.

AcentralelementinconductingreflectiondiscussionsisaquestioningattitudetobeadoptedbyHOFSectionemployees.Theques-tionsrelatingtoreflectiondiscussionsare

thereforenotprimarilyaimedatthecollectionofinformation.Rather,byaskingquestions,theaimistostimulateacollectivethinkingandlearningprocess.Theformulationofquestionssuitableforthispurposeisthereforeofgreatimportancebothinthepreparationofthediscussionwiththedraftingoftheannouncementletterandalsothroughoutthecourseofthediscussion.

TheexperienceoftheHOFSectionshowsthattherearetwoimportantaspectsofthefacilitationofthediscussionthatmustbeconsideredduringreflectiondiscussionsorthatareanecessarypreconditionforachievinganopendialoguebetweenENSIandthesupervisedparties:1.)theefforttoachievecongruentandauthenticcom-munication,whichmeansthatthecharismaandwordsoftheinterlocutorsmatcheachotherandareperceivedascredible;2.)(active)listening.Inadditiontoattentiveandinterestedlistening,thisincludes,forexample,elementssuchaspara-phrasing,thatis,therepetitionofwhathasbeensaidinanalternativephraseology,thesummaris-ingofwhathasbeensaid,questioningtocheckordeepentheunderstandingofwhathasbeensaid,oralsotoprovidefeedbackonwhathasbeensaid.

AftertheearthquakeinJapanin2011andthesubse-quenttidalwavethatfloodedtheFukushimareactorbuildings,thoseinchargehadtomakemanydecisions.Inaframeofuncertainty,timepressureandstressparticularlytheFukushimaDaiichisitesuperintendenthadtobeabletogetalltheinformationherequiredasthebasisforhisdecisions.Withthebenefitofhind-sight,itisnowknownthatlotsofinformationwasincompleteorevenmisleading.Yet,nevertheless,decisionshadtobemade(/15/).

Incomplexemergencysituations,similartothesitua-tionatFukushima,decision-makingisinfluencednotonlybysituationalfactors,butalsobyfactorsthataffectasingleindividualoranentiregroup.Beforetheinfluencingfactorsrelatingtodecidingpersonsareexaminedinmoredetail,theexternalcircumstancesofemergencysituationsarediscussedbelow13.

13| Thetopicofdecision-makingisaveryextensiveandmultifacetedresearchfield(seeforexample/34/).Theexplanationscontainedinthisreportarelimitedtojustasmallpartofit.

Inemergencysituations,theresponsiblepeoplearesometimesforcedtomakedecisions–evenifinforma-tionis,atbest,incomplete.Mistakescanoccurifinformationhastobeprocessedundertimepressureoriftoomuchinformationhastobeprocessed.Thebrainisoverloadedandtriestooptimisebetweeneffortandbenefit.Asaresult,thinkingerrorsoccur.Errorsarisefromtheinteractionbetweenindividualperceptionandsituationalcharacteristics(/3/).

Incomplexemergencysituations,thereisrarelyenoughtimetogatherandverifyallinformation.Theresultisdecision-makingunderuncertainty.

4 Decision-makinginemergency situations:influencingfactors

49Decision-making in emergency situations: influencing factors

Situationsinwhichdifficultdecisionsneedtobemadeundertimepressureareoftenrathercomplex.Suchsituationsoftenconsistofextensiveandnetworkedissuethreadsthatarelinkedtogetherinunclearanddynamicways,undeterminedanduncertainintheirimpact(/7/).Therefore,handlinguncertaintyisanimportantrequirementforpeopleeveninnormalsituations.Withinanorganisation,thisuncertaintymustbeaddressedatdifferentlevels.Incomplexandhighlynetworkedorganisations,asystemofruleshelpsbecausepeopleactinglocallycannotoverseealltheconsequencesoftheiractions(/20/).

Incomplexdecision-makingchallenges,situationalfactorssetadditionalrequirementsonapersonactingordeciding.Theserequirementsincludeskillssuchasanalyticallyregisteringdetails,butnotlosingsightoftheoverallpicture,orchoosingtherightdepthofinformationandtherightextentofinformation.Italsoincludestheabilitytoreacttochangingframeworkconditionsandtoconducttheentiredecision-makingprocessinaself-reflectivemanner(/3/).

Thereareseveralwaystoreducecomplexityandminimisetheassociateduncertainty(seealsosection3.1).Oneoftheseistoreducethescopeofactionbymeansofstandardisation(/44/).Theexecutionofemergencyproceduresisamethodusedinpracticeinwhich,intheeventofdesignfaultsinnuclearinstalla-tions,aflowdiagramisprocessedaccordingtoclear

inputcriteriainordertoeffectivelycombattheeventandregaincontroloftheinstallation.Theseregulationsreducecomplexitywithclearproceduresandclearcriteriaforresponsibilitiesanddecisions.Moreover,theirapplicationispractisedregularlyinexercises.

Anotherwayofdealingwithcomplexityistocopewiththeuncertaintyassociatedwithcomplexityusingflexibil-ityandlearning.Insteadoflimitingthescopeofactiontoimprovesafety,thescopeofactionisincreased.Deviationsinday-to-dayoperationsareperceivedaslearningopportunitiesandtheapplicationofrulesishandledmoreflexibly(/44/).Thispath,whichisbasedonlearningandtheintegrationofknowledge,showshowimportantanopenattitudeandpersonalexperi-encegatheredfromday-to-dayoperationsare.Devia-tionsareperceivedasanopportunitytolearnsome-thingandnotasameanforpointingafingerataguiltyparty.Suchapathrequiresanopenandprejudice-freehandlingoferrorsandnearmisses.

Howthetwoapproachesoflimitingorextendingthescopeofactioninorganisationscanbehandled,wasdiscussedinsection3.

4.1 Decision-makingunderuncertainty (situationaleffects)

Evenifinanemergencythesituationalcircumstanceswereoptimalfordecision-making,thereareperson-re-latednegativeeffectsthatcaninfluencethedeci-sion-makingcapabilityofanindividualoragroupofpeople.Therefore,thefocusshouldbeinthefollowingontheindividualsorgroupsofpeoplewhomakedecisions.Relatingtoanindividual,onecauseofanegativeinfluencemaybethecognitiveemergencyresponse(/54/).Acognitiveemergencyresponsecanoccurwhenapersonfeelsthattheircompetenciesareatriskandconsequentlytheyaresubconsciouslyobligedtomaintaintheillusionoftheirownabilitytoact.Becauseofthesubconsciousprocess,itispracticallyimpossibletorecogniseone’sowncognitiveemergencyresponse.

Inanemergencyscenario,thepersoninchargeisrarelycompletelyisolated.Ideally,thepersoninchargeissurroundedbyaneffectiveteam.Thisbegsthequestionofwhetherthecognitiveemergencyresponseofasinglepersoncanbecompensatedforbyagroupdecision.Unfortunately,therearealsoeffectsassociatedwithgroupconfigurationsthatcanhaveanegativeimpactondecision-making.Thedecisionofanindividu-alisnotnecessarilyimprovedifitisreplacedbyagroupdecision.Groupdecisionstoohaveassociatedpotentialnegativeeffects.Forexample,groupthinkaccordingtoJanis(/33/).Groupthinkariseswhenanattempttoachieveagreementdominatesthedecision-makingprocessofagroupoflike-mindedpeoplewithstrong

cohesion,suchthatpeople’sperceptionofrealityisimpaired.Contributingelementstogroupthinkareahighlycohesivegroupofpeopleisolatedfromalterna-tivesourcesofinformation,withtheleaderclearlyfavouringoneparticularsolution.Ingroupdiscussions,theseboundaryconditionscancreatetheillusionofone’sowninvulnerabilityandtherationalisationofone’sownactions.Informationthatappearsinconsist-entorincompleteisdowngradedorignored.Thisprocesstakesplacebothindividually,intheformofself-censorship,aswellasbetweenindividuals,intheformofpressuretoachieveaconsensus.Thefollowingsectionconsiderswhatshouldbetakenintoaccountinordertomakegooddecisions.

4.2 Individual-relatednegativeeffectsinthe decision-makingprocess

Person-relatednegativeeffectscanbepreventedwithrespecttobothgroupthinkandcognitiveemergencyreaction.Optimallytheycanbeavoidedaltogether.Thisrequiresanattitudethatcanbetrainedandimplementedduringday-to-dayoperations.Peoplewhoarenotsubjecttocognitiveemergencyresponsearecharacterisedbygoodself-management.Theycanwithstanduncertaintyanddonotseetheirowncompetencethreatenedbyadifficultsituation.Theycanmanagetheirownstressreactionswell,evenphysicalreactions,andallocatetheirattentiontodifferentaspects.Moreover,theycanalsohandletheirownfeelings.Ifapersoncombinesallthesecharacter-istics,thentheypossessalevelofself-managementthatissuitableforhandlinganemergencysituation,whichshouldnotleadtoacognitiveemergencyresponse.Peoplewithgooddecision-makingskillscommunicateeffectivelyandassumeleadershipandresponsibility(/25/).Thenegativeeffectsofgroupthinkcanalsobeeliminatedbyarationalandbalancedsearchforinformationwiththeinformationthenusedaccordingly.Moreover,thepersonleadingthegroupshouldnotexpresstheirpreferencesinadvance.Eachmemberofthegroupshouldbeabletoexpresstheirthoughtsandargumentsindependentlyoftheothers14.Itisalsousefultodefineproceduralrequirementsforthedecision-makingprocess(/55/).

14| Inpracticalterms,forexample,leadersofanemergencyresponseteamgathertogethertheopinionsofthevariousteammembersandthenmaketheirdecisions.

15| Resourcesherearedefinedas:personnelresourceswhocangatherinformation;timeresourcestoperformtheinformationsearchandtobeabletocarryoutanassessment/prioritisation;informationsourcesfromwhichtoobtaintherelevantinformation,etc.

16| Crisisexpertise:Knowledgeabouthowfirstresponderorganisations(emergencyservices)functionandact,andhowtheinterfacesaremanaged.

Makinggooddecisionsrequiresresourcesevenduringcalmperiods15and,optimally,agooddealofexperi-ence.Managerswhohavecomethroughcrisesreport-edthattheywerehelpedbycrisisexpertise16,self-managementskillsandexperienceinthecrisissituation(/53/).

Whenmakingdecisionsincomplexsituations(includ-ingemergencysituations),itisadvisabletoproceedasmethodicallyaspossible,evenwhentimepressureseemstodominatethesituation.Tomaintaincontrolofaccidentsinnuclearpowerplants,technicalsystemsstartupautomatically,andthenwell-foundedcheck-listswithdecisiontreesareavailable.Thiswinsvaluabletime.Thetimegainedcanbeusedtostruc-turethedecision-makingprocess(/25/).Structuringelementsaretheformationofobjectives,manage-mentofinformation,modelling,planning,deci-sion-makingandcontrol(seebox6).Afteradecision,self-reflectionshouldbecarriedoutcalmlyandunhurriedlyinordertotriggerlearningprocesses.

4.3 Peoplewhomakegooddecisions

Box6:Structuringofthedecision-makingprocessaccordingtoHofinger(/25/):

Unambiguousandclearobjectivesaredrawnupduringobjectivesetting,withpartialandintermediateobjectivesbeingdefined.Contra-dictionsshouldberecognisedandbalanced.Itisimportanttosetprioritiesandbuildconsensuswithinthegroup(N.B.:remainawareoftheeffectsofgroupthink).

Themanagementofinformationincludestodeterminewhatisnotknownyet.Additionalneededinformationisstilltobeobtainedandexcessinformationrejected.Theavailablefactsmustbeevaluatedandcheckshavetobemadetoseewhetherthedepthofdetailoftherequiredinformationissufficient.

Thedevelopmentofacommonunderstandingisimportantforateamtoprovideabasisforaction(modelling).Therefore,itisimportanttocreateanoverview,toobtainaviewoftheinterrelation-shipsandtorecognisecriticalpoints.Assump-tionsaboutcausesandconsequencesmustbemadeandforecastscreated.

17| Inpractice,differentmethodsareusedforstructureddecision-making.Forexample,amongtheoperatorsoftheSwissnuclearpowerplants,themethodFORDEC(Facts–Options–Risks–Decision–Execution–Check),orvariantsthereof,namelyFOORDEC(Facts–Objectives–Options–Risks–Decision–Execution–Check)havebecomeestablishedfordecision-makinginsituationswheretimeisnotthelimitingfactor.

Theserecommendationsforstructuringdecision-makingprocessescanbemoreeasilyimplementedinemergenciesif(complex)decision-makingprocesseshavealsobeenperformedinday-to-daysituationsbasedonthispattern.Inthisway,helpfulroutinescanbedevelopedandunfavourablepatternsidentifiedandeliminated17.

Stepsinthecourseoftimeshouldbepre-definedandthesituationalcharacteristicsconsideredasboundaryconditions(planning).Wherepossible,branchingpointsandalternativeroutesshouldbeplannedinadvance.Possiblefrictionpointsshouldbeconsideredandbuffersplanned.Thedistributionoftaskswithintheteamshouldbedefinedandinterfacesbetweentheactionsofindividualmembersplanned.

Fordecision-makingitisimportanttoesta-blishdeadlinesandpre-definedecision-makingmechanisms.

Timingsandcriteriaforchecksshouldbeesta-blishedandthefour-eyesprincipleshouldbefollowed.Withintheteam,mutualchecksarebothanadvantageandachallenge.

Self-reflectiontakesplaceafteradecision,inpeaceandwithoutanytimepressure.Periodsforreflectionshouldbedefined;mutualcriticismwithintheteamacceptedandsupportshouldbeused.

TheimpactmodelofhumanperformanceunderextremeconditionsinFigure9exhibitsdiverseinfluenc-ingfactors.Italsoshowsthatchangesinexternalinfluencingfactorscanleadtochangesintheresultofthedecisionandthusinfluenceseffectivedecision-making(/46/).

Theimpactmodelhighlightsfactorsthatinfluencethedecision-makingprocessandactionsunderextremeconditions:

• Humancapabilities(e.g.availabilityofskills,individualandcollectivestressmanagement)

• Provisionofthenecessaryinfrastructure(takingintoaccounthumanfactoraspects):technicalsystems,workaids,tools,procedures,informationetc.)

• Organisationalaspects(responsibilities,roles,cooperationandcoordination,communication,tasksandworkflows,organisationalculture).

Ifattentionispaidtothereinforcingfactors(Figure9showningreen),itbecomesobviousthatpeoplewhomakedecisionscanhavecertainprerequisitesthatcanbepositivelyinfluencedbypersonnelselection,suitablestaffingandtraining(personalandprofessionaldevelopment).Asupportiveorganisationalenviron-mentplaysanequallyimportantrole.Inthisrespect,thereisnosimplerecipeforbecomingagooddeci-sion-maker.Essentialistheinteractionoforganisationalprocessesandthepracticedattitude,whichisreflectedintheorganisationalculture.Thesefactorsallowemployeestodeveloptheirabilitiestomakegooddecisionsinemergencysituations.

4.4 Impactmodelofhumanperformanceunder extremeconditions

• HFE1designforsystems&procedures

1HumanFactorsEngineering

• Limitedtime• Challengedsafetytargets

Human• Competences• Individual&collective

stresshandling

Technology/Infrastructure• Technicalsystem• Workaids/tools• Procedures• Informationaccess• Physicalenvironment

Organisation• Roles&responsibilities• Cooperation&coordination• Communication• Tasks&workorganisation• Organisationalculture

Effectivedecisions&actionsunder

extremeconditions

Factors(stressing/facilitating)

Reinforcingfactors

Figure9:Impactmodelofhumanperformanceunderextremeconditions(basedon/46/)

• Selection• Staffing• Training

• Dailyexperience(normalconditions)

• Organisationaldesign• Flowdefinition• Management

Leadership

Thetopicofdecision-makingisincludedintheover-sightoftheHOFSectioninavarietyofways.Indoingso,thefocusofoversightisprimarilyonthebehaviourofactorsinthe«work-as-done»visibleindifferentcontexts,andontheconditionscreatedandprovidedbytheorganisation,instrumentsandguidelinesforthedecision-makingbytheplayers.Theassessmentofthepersonality-relatedaspectsofsuccessfuldecision-mak-ersaredifficulttomeasuredirectly,thusnotinthefocusofoversight.

Decision-makingandtakingresponsibilitygohandinhand.Responsibilityintheareaofnuclearsafetyliesinthefirstinstancewiththeoperatorofanuclearinstalla-tionandthelicenceholderrespectively(Art.22para.1NEA/36/)(seesection2.2.1).Inthelicenceholder’sorganisation,decisionsarestructurallyanchoredatvariouslevelsoftheorganisationandareimplementedintheprocessorganisation.Decisionsarevisiblyanchoredinprocesssequencesinwhichresponsiblefunctionownersareappointed.GuidelineENSI-G07(/9/)specifiesthelegalrequirements.

Thesupervisoryauthorityreviewstheformalrequire-mentsspecifiedbythelicenceholder’sorganisation.Thisreviewnormallytakesplaceaspartofaninspec-tionofaspecificobject.Referencestodecision-makingprocessescanbefoundindocuments,suchasdeci-sion-makingrecords,reviewsignaturesorthelike.

Inspecialistdiscussions(seesection1.2),theauthorityaddressesspecifictopics,includingdecision-makingprocessesandtheinfluencesthereon.

Inemergencyexercisesobservedbytheauthorities,especiallyinrespectoftheworkoftheemergencyteam,aswellasinthepracticallicencingexamsontheplantsimulator,theobservationofdecision-makingisoneevaluatedcategoryamongstothers.

Inthehumanandorganisationalfactorsarea,permitapplicationsfornuclearinstallationbackfitprojectsrequireaprogrammetotakeaccountofhumanandorganisationalfactors(HOFprogramme).Theprocessstepsdescribedandtheiterativeprocedureinthevariousphasesofbackfitprojectsprovideinformationontheexperiencedprocessofdecision-makingintheday-to-dayprojectroutineofthesupervisedparties.Somethinganchoredinday-to-dayroutinecansubse-quentlybemoreeasilyaccessedunderemergencyconditions.

Whereeventsoccur,thetopicofdecision-makingis,ifnecessary,retrospectivelyanalysedandevaluatedbytheoperatingorganisation.Here,thefeedbackoffindingstotheorganisationisofcentralimportance.Knowledgegainedfromeventsoutsidetheorganisation(evaluationofexternaloperatingexperience)isalsoanimportantsourceofimprovement(/9/).

4.5 Oversightrelatingtothetopicof decision-making

Thefoundationforgooddecisionscanbelaidwithstructureddecision-makingprocesses,trainingcoursesandanopenattitudetoinformation.Ifextremeemergenciesoccur,purelyorganisationalmeasuresintheformofstandardsandrulesnolongersuffice.Ifextremeemergenciesoccur,decision-makersarecharacterisedbyanawarenessofthemselvesandtheirownlimitssothattheycandealwithitmindfully.Anadditionalnecessaryboundaryconditionisthepossibil-ityofrelyingonateaminwhichmutualtrustprevailsandwhichimplementscleardirectivesinatargetedmannerandreactsflexiblytonewturnsofevents(seealsosection3.1).

Theoversightmustfocusprimarilyontheobservableorinferableexpressionofthesecharacteristicsofeffectivedecision-makinginthemannerofbehaviour,processes,specifications,andproducts.Invariedways,thiswasandisthecaseintheoversightoftheHOFSection.Forthisreason,noadditionalspecificregulatorymeasureshavebeenderived.

4.6 Conclusion

Aresilientorganisationstrivesforalertnessandflexibili-tysothatitcanadaptatanytimetotheprevailingsituationandisthereforepreparedforunexpectedsituations.Ontheonehand,thefollowingdigressiononcivilaviationshowshowtheskillsandabilitiesofcabincrewmembersofanairlinearetrainedsothatthecrewispreparedfortheunexpected.Ontheotherhand,raisingofawarenessoftheunexpectedintheday-to-dayroutineisdescribed.

HowErikHollnagel'sfourpotentialsforresilience(/29/,seesection3.1)takeeffectandfromwhichaspectsofcivilaviationsafetymanagementnuclearoversightcanlearn,arepresentedattheendofthisdigressiononresilience.

5 Adigressionconcerningresilience: aninputfromcivilaviation

57A digression concerning resilience: an input from civil aviation

Inthefieldofcivilaviation,theone-monthemergencytrainingincludes,amongotherthings,topicssuchastechnicalandmedicalaspects,emergencyequipment,procedures,evacuationmethodsandcrewresourcemanagementCRM(situationawareness,communica-tion,decision-making,adaptabilityandflexibility,leadershipandassertiveness).Furtherthree-dayaircraft-specifictrainingcourses,atwo-month«on-the-job»inductionperiod,annualtwo-dayrecurrenttrainingcoursesandtraininginthesimulatorcontri-butetopractisingexistingproceduresandovercomingfears,increasingperceptionandpositivelysupportingandstrengtheningcreativityandflexibility.Thesimula-tionsfocusonsituationsthatrequireprocessadapta-tions,improvisationandquickdecision-making.

Anexampleofafirefightingtrainingsequenceillu-strateshowtheseskillsarepractisedincivilaviation.Inatrainingbuilding,varioussituationsaresimulatedwithdifferentsmokesourcesandtypesoffire,whicharefacedbycrewmembersfromdifferentoccupa-tions:sometimesalone,sometimesinpairs,theyhave

toextinguishfiresandlookforandidentifysourcesofsmoke.Dependentonthescenario,thefamiliaremergencyequipmentfromtheaircraftisavailabletosolvethetask.Tobeabletoinstilacapabilityforimprovisation,theemergencyequipmentisonlypartiallyavailableorfunctional.Inthiswayforex-ample,theimproviseduseofuniformjackets,blankets,newspapers,liquids,etc.,ispractisedforthepurposeoffire-fighting.Moreover,intheaircraftsimulator,thecrewmembersarealsoconfrontedwithscenariosinwhich,forexample,smokedevelopsinthecabin–thesituationthenrequiresanemergencylandingwithsubsequentevacuationundercomplicatedconditions.

5.1 Developmentandtraining:processadaptation, improvisationanddecisions

Gatheringinformation:Goodflightpreparationbeginswitheachindividualstillathome.Alongsidepreparationsthataffecttheflightitselfandthecrew,informationisobtainedfromtheintranetandInternetaboutthedestination.Thisinformationextendsfromorientationonthepoliticalsituationthroughbehaviourrecommendationsandinfectiousdiseasesanduptoemergencytelephonenumbersontheground.

Exchanging,learningandconsiderationofinformation:A30-minutebriefingtakesplacebeforeeveryflight.Itallowsthecrewtobrieflyintroducethemselves,toassigntasksandpositions,andtoexchangeinformationaboutthepassengers,crewmembersandtheflight.Thereisalsoatopicfordiscussionwithreferencetosafety.

Duringtheroundofintroductions,informationaboutspecialtraining,capabilitiesandacquiredskillsthatmayberelevanttosafetyisalsoexchanged:informationsuchasmembershipofalocalfirebrigade,asecondjobasaparamedic,basicpsychologicaltrainingorspeciallanguageskillsthatarerelevantforcolleaguessothattheyknowwhatskillstheycandrawuponinanunexpectedsituation.

Informationaboutpassengers(suchasdisabilities,animalssuchasguidedogs,childrentravellingalone,peoplewhoarebeingdeportedordeniedentry,flightmarshalswhoareaccompanyingtheflightundercover)helpsthecrewtogetanideaoftherisksandresourcespresentonboardandtodefinetheresponsibilitiesofthecrewmembers.

Informationabouttheareasbeingcrossed,suchaswater,mountains,desertorjungle,makescrewmembersawareofwhattheymightencounterinanintermediateoremergencylanding.

Thesafety-relatedtopicthatisalsodiscussedduringthebriefing,canbespecifictotheupcomingflight,orfocusonanemergencyprocedure,oranexperienceofacrewmember:e.g.theprotectionfactorsidentifiedduringasuccessfulparticipationinanemergencylanding,thereactiontoamedicalincidentorwhatemergencyequipmentisimportantintheeventofditching.Thediscussionofasafety-relevanttopicapplicabletoday-to-dayworkisabeneficiallearningopportunityforthecrewmembersthathaspracticalrelevance.Atthesametime,theacquiredknowledge,proceduresandhandlingofequipmentarerepeated.

Resourcesforsafetychecks:Eachcrewmemberusesachecklisttochecktheirstationtogetherwithitsemergencyequipment:Forexample,doesthemega-phonework?Isthereanaxewithfiregloves?Ifequip-mentismissingormalfunctioning,maintenanceiscontacted.Thesafetycheckgivescrewmembersanoverviewoftheequipmenttheyhaveandwhereitisstoredintheparticularaircrafttype,sothattheycanactquicklyintheeventofanincident.

Screening:Boarding,includingwelcomingpassengersandassistancewithfindingaseatandluggagestorage,isalsoanopportunitytomonitorthebehaviourofpassengers.Intheeventofpeculiarities,anattempttoinitiateadialogueismadeinordertoidentifypossibledifficultiessuchasfearofflight,amedicalproblemorastronginfluenceofalcohol,andtoprovidesupportorhelpifnecessary.

5.2 Fromflightpreparationtofinaldestination:raising awarenessoftheunexpectedintheday-to-dayroutine

«Oneminuteofsilence»:Immediatelybeforetake-offandlanding,thecrewmembersreceiveasignfromthecockpitfor«oneminuteofsilence»:Beforethemostdelicatephaseofanyflight,crewmembersruntheproceduresthroughtheirheadsincaseany-thingunusualweretohappen(forexample,intheeventofadifficultabortedtake-offorenginedamage).Herethefollowingconsiderationsarefocussedon:

• IsmyseatpositioncorrectsothatIamprotectedintheeventofanabortedtake-off?

• Whatisthesurroundingarealike?Arewelandingorstartingoverwater?

• Whataretheevacuationordersforditching?

• Whichpassengersnearmecanassistmeifneces-sary?

• Whatisthenameofanycolleaguesinmyvicinity?

• Whatcommandsshouldbeshoutedintothecabinifthedoorsticks?

• WhatemergencyequipmentdoItakewithme?

• Whereareunaccompaniedchildren,passengerswithdisabilities,etc.sitting?

Safetyawarenessandcommunication:Duringtheflight,peculiaritiessuchasstrangeodoursandnoisesaswellasinformationfrompassengersisfollowedupandthecockpitisinformed.Toensurethepilotshaveanideaofthesituationintheaircraftcabin,goodcommunicationwiththecabincrewisveryimportantforsafety.

Safetyawareness,alltimesandeverywhere:Afterlanding,passengersfeeltheurgetoleavetheplaneasquicklyaspossible.However,duetothemanynearmissesandaccidentsthatoccurontheairportground,itisimportantthattheyremainseatedwiththeirseatbeltsfasteneduntiltheparkpositionisreached.Onlywhentheenginesareshutdownandastairwayorthepassengerboardingbridgeisdocked,maypilotsgivetheokaytoopenthedoors.Itisonlyjustpriortothisthatthecabincrewisaskedtodisarmtheevacuationslides.Onceagain,thisprocedurerequiresthefullattentionofthecrew.Openingthedoorspriortotheokayofthepilotscouldhavefatalconsequencesforthegroundpersonnelbecausetheslideswouldstillbearmedandwoulddeploy.Inspiteoftheexertionoftheflightandpossiblefatigue,safetyawarenessisrequiredrightuptotheendoftheflight.

Thefourpotentialsforresilience(seesection3.1)canbeexplainedbelowwithexamplesdrawnfromcivilaviation:

• The potential to RESPOND: «Knowingwhattodo»ispractisedintraining,simulationsandimprovisa-tionsandconsolidatedinday-to-daywork;dailybriefingscontributetobeingwellpreparedandfullyaware.

• The potential to MONITOR: «Knowingwhattolookfor»;theflightpreparation,entryintotheairportpremises,briefingroomandfinallytheaircraft–allensurecrewmembersaresensitisedtothesurroundings,events,people,soundsandsmells,theyconsciouslyperceivethemandtakereportedanomaliesseriously.Thissensitisedperceptionispractisedandinternalisedintrainingandinthesimulator.

• The potential to LEARN: «Knowingwhathashappened»;personalexperienceindailywork,theexchangeofpositiveandnegativeexperienceinbriefingsandannualtrainingsessions,inwhichnewfindingsareaddressed,implementedandacquired,aswellas,forexample,experiencesfromotherairlines.Allthisleadstobothsingleanddouble-looplearningandwillbeimplementedintheorganisation.

• The potential to ANTICIPATE: «Knowwhattoexpect»;withthelearnedprocedures,training,simulationsandimprovisations,flightpreparationandknowledgeoftheresourcesandchallengesofthecurrentsituation,asillustratedinthe«oneminuteofsilence»example,aswellasincreasedperceptionofexternalinfluences,crewmembersarepreparedtoreact,decide,actandimprovise.

5.3 Thefourpotentialsforresilience

Inadditiontothecooperationbetweenchangingcrewmembers,specialfeaturesofcivilaviationincludethevaryingdailyworkinghours,rotations,workingpositionsanddestinationswithconstantlychangingpassengers–allofwhichdemandahighdegreeofflexibilityandadaptability.Togettoknowtheteam,thecrewmembershaveasinglehalfhourbriefing.Techniquesandproceduresthatsupportsafetyareusedinanintuitivemanner,suchastheuseofthephoneticalphabet,thefour-eyesprinciple,cross-checks,STAR(«Stop–Think–Act–Review»),etc.Anever-changingteammake-upisalsoconducivetoidentifyingpersonalblindspots.Anotherfeaturethatcontributestosafetyisthebriefing,inwhichthecrewmembersexchangeideasaboutnegativeandpositive

TheoversightoftheHOFSectioncouldbenefitfromamorediverseteamcompositioninitsinspectionsandspecialistdiscussions,asisthecaseincivilaviation.Indoingso,itcouldbreakuporenrichanydeadlockedpatternsandpreventblindspots.Itisimportanttocon-tinuetosupportandstrengthentheinvolvementofinspectorsfromothersectionsintheoversightactivitiesoftheHOFSection.Varyinginterdisciplinarycoopera-tionnotonlyextendsthesection’sownhorizon,butalsopromotesanintegratedsystemview,takingintoaccountthesystemicapproach(seesection2.2).

Aswiththebriefingpriortoaflight,anincreasedemphasiscouldbeplacedonpositiveexamplesduringpreparatorydiscussionsandthedebriefingsfollowingthespecialistdiscussionsorinspectionsoftheHOFSection.ThiswouldbeinthecontextoflearningfromexperienceandtheSafety-llapproach(seesection3.2).

examplesfromday-to-daywork,gathernewinsightsandfocusnotonlyonthefactorsthatledtoanevent,butalsoontheprotectionfactors,thatguidedtheeventtowardsapositiveoutcome.Thesemaybetechnical,organisationaland/orhumanfactors.

Crewmembers,withtheirimplicitandexplicitknow-ledge,experience,training,alertness,situationalawareness,flexibilityandcreativity,theirdecisionsandtheinherentscopeofactiontheyneedinordertoadapttheiractionsandbehaviour,areconsideredassafetyfactorspreparedandqualifiedtorespondtounexpectedsituations.

Safety-llaspectscouldalsobeincreasinglyconsideredineventprocessingasisthecaseincivilaviationbriefings.Currently,processingfocusesonthecontri-butingfactorsthatledtoaneventandtheresultingactions.AccordingtoSafety-II,theprotectivefactorsthatpreventedaneventwithmoreseriousconse-quencesmustalsobeexamined,acknowledgedandstrengthened.Theseprotectivefactorscanbeofatechnical,organisationaland/orhumannature(seesection3.4.2).

Exchangeofexperience,andcooperationwiththesupervisoryauthoritiesandinstitutionsofothersafety-relatedindustriesstimulatesachangeofperspective,enableslearningfromtheexperiencesofothers,benefitsbothorganisationsandbooststheirresilience.Consolidationofthisexchangeshouldcontinue.

5.4 Reflection–learningfromthespecial featuresofcivilaviation

5.5 Reflection–conclusionsfortheoversight oftheHOFSection

Thisreportrepresentsbothan«output»andan«input»fortheHOFSection.Ontheonehand,itistheconclu-sionofthethree-partseriesofreportsonthehumanandorganisationalfactorsoftheFukushimaDaiichireactoraccident.ItcoverstheinsightsoftheHOFSectionsincetheaccidentinMarch2011andtheexperiencegainedforoversightinthehumanandorganisationalfactorsarea.Ontheotherhand,itisthestartingpointforfurtherreflectionandthedevelop-mentoftheoversightofthesectionagainstthebackgroundoftheseinsightsandthecurrentstateofthesafetysciences.

TheHOFSectionwilldevelopanactionplanfortheshort,mediumandlong-termimplementationofthetopics,methodsandapproachesforfutureoversightpresentedintheindividualsectionsofthereport.

ThederivedimplicationsfortheoversightoftheHOFSectionconcern,ontheonehand,topicsthataredealtwithintheframeworkofoversightandontheotherhand,oversightapproachesandmethodsthataretobeappliedintheoversight.Thesetopics,approachesandmethodsarebasedonthetwobasicconceptsofthesystemicapproachandtheSafetyIIapproachandresilience,whicharethemselvesanchoredandestab-lishedinthesafetysciences.OfficialinvestigationsintotheaccidentattheFukushimaDaiichinuclearpowerplantidentifiedtheseconceptsasthebasisforlessonsandrecommendationsforthefurtherdevelopmentofnuclearsafetyatnuclearinstallationsacrosstheworld.

Astheapproachesandmethodsbasedonthetradition-alSafety-Iapproachhavebeenprovedandestablishedovermanyyears,theyhavenotbeendiscussedinthisreport.Rather,theobjectofthisreportisthelesswell-establishedapproachesandmethodsforoversightbasedontheSafety-IIapproach.

Implicationsfortheapproachtooversightintheareaofhumanandorganisationalfactors

AgainstthebackgroundofthesystemicapproachandtheconceptsofresilienceandSafety-II,anumberofimplicationsfortheregulatoryapproachoftheHOFSectionhavebeenderived.Accordingly,astrongerfocusonperformance-orientedoversight,incontrasttopurelycompliance-orientedoversight,isprovingtobeeffective(seeinparticularsection2.2.1).Thefocusisondialoguebetweenthesupervisoryauthorityandthesupervisedorganisationsandthepromotionofself-reflectionandstrengtheningofdirectresponsibilityamongthesupervisedpartiesthroughappropriateregulatoryactivities.Furthermore,thefocusoftheoversightshouldbeonunderstandingthenormalfunctioningofthesupervisedorganisationandtheday-to-dayexecutionoftheworkandnotexclusivelyonthesearchfornegativeevents,deviationsfromtargetspecificationsandthenotionsofideal-typeworkandprocedures(seeinparticularsections3.3and3.4).

Nonetheless,itisimportanttobearinmindthatitisnotsensibletoapplyastandardisedandeverunchangingoversightstrategy.Thismeansthat,inthesenseofa«responsiveregulation»,differentregulatoryapproachesmustbeapplieddependingonthesituation,context,cultureorsafetyperformanceofasupervisedorganisation.Thesecanescalateoveracontinuumwhichextendsfromoversightbasedondialogue,conviction,andextensivedirectresponsibilityandself-regulationuptoincreasinglydemandingandprescriptiveinterventionsbythesupervisoryauthoritywhichculminateinstrictsanctions(seeinparticularsection2.2.1).

6 Closingwords

63 Closing words

Implicationsfortheoversightmethodology

OversightbasedonthesystemicapproachandSafety-IIrequiresmethodsbasedondialogueandreflection.Therefore,theHOFSectioncheckedwhetherandhowitcouldappropriatelydevelopfurtheritsoversightmethodsbasedondiscussions(seesection3.4.2).Thespecialistdiscussionpromotingadialogueonsafetycultureaswellasexploratoryspecialistdiscussionsshouldbeviewedasprototypediscussion-basedmethodsfortheSafety-IIapproach.Bycontrast,informationdiscussionsandinspectionsmustbeexplicitlysupplementedwithSafety-IIelements.Thisrequires,forexample,theformulationofquestionsanddiscussiontechniques,whicharesuitableforstrength-eningthe(self-)reflectionanddirectresponsibilityofthesupervisedparties.Safety-IIaspectscanalsobeusedtosupplementeventprocessing,forexample,bynotonlyfocusingtheanalysisonthecausesofanadverseevent,butalsohighlightingthefactorsthatpreventedaworsecourseofeventsorthefactorsthatcontributetothenormalsmoothrunningoftheaffectedprocess.Finally,aforumacrosspowerplantscouldstrengthendialogueandexchangebetweenthesupervisoryauthorityandthesupervisedpartiesaswellasbetweenthesupervisedpartiesthemselves.

Learningfromotherindustriesisimportantnotonlyfortheoperatorsofnuclearinstallations,butalsoforthesupervisoryauthorityitself.Forthisreason,thisreportlooksatmethodsforstrengtheningresilienceincivilaviationanddrawsconclusionsfromthemforover-sight,forexample,intermsofstrengtheninginterdisci-plinarycooperationandthesystemicapproachbymakingappropriatearrangementsforoversightteamsorbyorganisingbriefingsanddebriefingsthatpromotelearning(seesection5.4).

Identifiedoversightitemsforoversight

Basedonidentifiedtopicsusedtochecktheapplicationofthesystemicapproachinthecontextofthecontinu-ousimprovementofthemanagementsystem,over-sightitemshavebeenidentified,towhichtheHOFSectionwilldevotespecialattentionortowhichishasalreadydevotedspecialattentioninthepast(seesection2.2.2).Theseregulatoryitemsarelocatedatthestrategy,processorworkingleveloftheHTOsystemsunderconsiderationandrelatetotopicssuchasthepurpose,visionandstrategyofthesystem,thesystemboundariesandtheexternalcontextofthesystem,theprocessesandactivitiesforeffectiveandsafeoperation,theeffectivenessofmeasuresandthecontinuousimprovementofsystemrobustnessandresilience.

Anotheroversightitem,whichisdealtwithwithinthescopeofoversight,relatestodecision-makinginemergencysituations.Decision-makingisalreadythesubjectofnumerousoversightactivitiesoftheHOFSection.Furthertopicsmayarisefromoversightpractice(seesection4.5).

Acatalogueofquestionsisalsotobedrawnupasaworkingtooltosupporttheoversightwork.Thiswillcontainappropriatequestionsforthetopicscoveredinthisreport,butalso,whereapplicable,forotheroversightitemsintheareaofhumanandorganisa-tionalfactors,andwillbedrawnuponduringthepreparationforcorrespondingoversightactivities.

[1] Amann,E.G.(2015).Resilienz.Haufe,Freiburg.

[2] Braithwaite,J.(2002).RestorativeJustice&ResponsiveRegulation.Oxford:UniversityPress.

[3] Braun,W.(2010).Die(Psycho-)LogikdesEntscheidens.Fallstricke,StrategienundTechnikenim UmgangmitschwierigenSituationen.VerlagHansHuber,Bern.

[4] Comitéd’orientationsurlesfacteurssociaux,organisationnelsethumains(COFSOH),Groupede travailD(2019).Développerlasécurité(https://www.asn.fr/Informer/Actualites/Developper-la- securite).

[5] Croos-Müller,C.(2015).KRAFT.DerneueWegzuinnererStärke.EinResilienztraining.Kösel-Verlag, München.

[6] Dekker,S.(2011).DriftintoFailure–FromHuntingBrokenComponentstoUnderstandingComplex Systems.BocaRaton:CRCPress.

[7] Dörner,D.(2003)16.Auflage.DieLogikdesMisslingens.StrategischesDenkeninkomplexen Situationen.Reinbek:rororo.

[8] SwissFederalNuclearSafetyInspectorate(ENSI)(2010).GuidelineENSI-B10«Basictraining, recurrentTrainingandContinuingEducationofPersonnelinNuclearInstallations»,issuedOctober 2010.Brugg:ENSI.

[9] SwissFederalNuclearSafetyInspectorate(ENSI)(2013).GuidelineENSI-G07«TheOrganisationof Nuclearinstallations»,issuedJuly2013.Brugg:ENSI.

[10] SwissFederalNuclearSafetyInspectorate(ENSI)(2014).ENSIMissionStatement,February2014, ENSI-AN-8718.Brugg:ENSI(https://intranet.ensi.ch/Direktionsstab/DIREKTION/_layouts/15/ WopiFrame2.aspx?sourcedoc={7be26885-f83f-46b1-b799-9de398e8e18a}&action=default).

[11] EidgenössischesNuklearsicherheitsinspektorat(2015).FukushimaDaiichi,Menschlicheund organisatorischeFaktoren.Teil1:DieEreignissevonFukushimaDaiichiunddieanihrerBewältigung beteiligtenOrganisationen,ENSI-AN-9393.Brugg:ENSI(https://www.ensi.ch/de/dokumente/ fukushima-daiichi-menschliche-und-organisatorische-faktoren-teil-1/).

[12] SwissFederalNuclearSafetyInspectorate(ENSI)(2016a).OversightofSafetyCultureinNuclear Installations,2ndEdition,December2016,ENSIReportonOversightPractice,ENSI-AN-8980. Brugg:ENSI(https://www.ensi.ch/en/documents/oversight-of-safety-culture-in-nuclearinstallations/).

[13] SwissFederalNuclearSafetyInspectorate(ENSI)(2021).IntegratedOversight,EditionMay2021, ENSIReportonOversightPractice,ENSI-AN-8968.Brugg:ENSI(https://www.ensi.ch/en/documents/ integrated-oversight/).

7 References

[14] SwissFederalNuclearSafetyInspectorate(ENSI)(2016b).OversightCulture.ENSIReporton OversightPractice,ENSI-AN-8707.Brugg:ENSI(https://www.ensi.ch/en/documents/oversightculture-2015-ensi-report-on-oversight-practice/).

[15] EidgenössischesNuklearsicherheitsinspektorat(2018).FukushimaDaiichi,Menschlicheund organisatorischeFaktoren.Teil2:DerAblaufderEreignisseausSichtderbeteiligtenMenschenvor Ort,ENSI-AN-10426.Brugg:ENSI(https://www.ensi.ch/de/dokumente/fukushima-daiichi- menschliche-und-organisatorische-faktoren-teil-2/).

[16] Geeser,G.R.(2016).StandortbestimmungvonSafety-IIinderAufsichtspraxisderSektion«MEOS» desENSI.BachelorThesis.Bachelorstudiengang,6.Semester,HochschulefürAngewandte Psychologie,FachhochschuleNordwestschweiz,Olten(Vertraulich).

[17] Geoffroy,C.(2019).Larésilienceorganisationnelleencontexteextrême:L’équilibrecentralisation/ décentralisationdanslagestiondel’accidentdeFukushimaDaiichi.Gestionetmanagement. Conservatoirenationaldesartsetmétiers–CNAM,2019.Français.NNT:2019CNAM1245.

[18] Grote,G.(2004).Uncertaintymanagementatthecoreofsystemdesign.AnnualReviewsin Control,28,pp.267–274.

[19] Grote,G.(2009).ManagementofUncertainty–TheoryandApplicationintheDesignofSystems andOrganizations.Springer:London.

[20] Grote,G.(2012).Führung.InBadke-Schaub,P.,Hofinger,G.undLauche,K.(Hrsg.).HumanFactors, PsychologiesicherenHandelnsinRisikobranchen.BerlinHeidelberg:Springer-Verlag.

[21] Grote,G.(2019).LeadershipinResilientOrganizations.In:W.Wiig&B.Fahlbruch(Eds.),Exploring Resilience,SpringerBriefsinSafetyManagement,Chapter8,pp.59–67.

[22] Gulati,R.,Casto,C.&Krontiris,C.(2014),HowtheOtherFukushimaPlantSurvived,Harvard BusinessReview,Reihe:CrisisManagement,FromtheMagazine(July–August2014)(https://hbr. org/2014/07/how-the-other-fukushima-plant-survived).

[23] Harzer,Claudia(2012).Positivepsychologyatwork:theroleofcharacterstrengthsforpositive behaviorandpositiveexperiencesattheworkplace.UniversityofZurich,FacultyofArts.

[24] Healy,J.&Braithwaite,J.(2006).Designingsaferhealthcarethroughresponsiveregulation.The MedicalJournalofAustralia184(10),Supplement,S56–S59.

[25] Hofinger,G.(2013).EntscheideninkomplexenSituationen–AnforderungenundFehler.In Heimann,R.,Strohschneider,S.&Schaub,H.(Hrsg.).Entscheiden in kritischen Situationen: Neue Perspektiven und Erkenntnisse.FrankfurtamMain:VerlagfürPolizeiwissenschaft.

[26] Hollnagel,E.(2004).BarriersandAccidentPrevention.Farnham,UK&Burlington,USA:Ashgate.

[27] Hollnagel,E.(2012).FRAM:TheFunctionalResonanceAnalysisMethod.ModellingComplex Socio-TechnicalSystems.Farnham,UK&Burlington,USA:Ashgate.

[28] Hollnagel,E.(2014).Safety-IandSafety-II.ThePastandFutureofSafetyManagement.Farnham, UK&Burlington,USA:Farnham.

[29] Hollnagel,E.(2018a).Safety-IIinPractice.DevelopingtheResiliencePotentials.London&New York:Routledge.

[30] Hollnagel,E.(2018b).FRAMSYNT.TheFunctionalResonanceAnalysisMethod:https:// functionalresonance.com/onewebmedia/Manual%20ds%201.docx.pdf.

[31] InternationalAtomicEnergyAgency(2015).TheFukushimaDaiichiAccident.TechnicalVolume2, Chapter2.6.HumanandOrganizationalFactors,pp.121–147.Vienna:IAEA.

[32] InternationalAtomicEnergyAgency(2016).GSRPART2,LeadershipandManagementforSafety, Vienna:IAEA.

[33] Janis.I.(1972).Victimsofgroupthink.Boston:HoughtonMifflin.

[34] Jungermann,H,Pfister,H.R.&Fischer,K.(2010)(3.Auflage),DiePsychologiederEntscheidung. EineEinführung.Spektrum.

[35] Kabat-Zinn,J.(2011).GesunddurchMeditation.DasvollständigeGrundlagenwerkzuMBSR.O.W. Barth.

[36] NuclearEnergyActof21March2003(NEA),SR732.1(asof:1January2020).

[37] NuclearEnergyOrdinanceof10December2004(NEO),SR732.11.

[38] Kim,J.T.,ParkJ.,KimJ.&SeongP.H.(2018).Developmentofaquantitativeresiliencemodelfor nuclearpowerplants.AnnalsofNuclearEnergy122(2018)175–184.

[39] Kitamura,M.(2014).ResilienceEngineeringforSafetyofNuclearPowerPlantwithAccountability. InC.Nemeth&E.Hollnagel(eds.),BecomingResilient.ResilienceEngineeringinPractice,Volume2. Ashgate:Farnham,UK.

[40] LaPorte,T.R.&Consolini,P.M.(1991).WorkinginPracticeButNotinTheory:TheoreticalChallenges of“High-ReliabilityOrganizations”.JournalofPublicAdministrationandTheory,J-PART,Vol.1, No.1.(Jan.,1991),pp.19–48.

[41] Leistikow,I,&Bal,R.(2020).Resilienceandregulation,anoddcouple?ConsequencesofSafety-II ongovernmentalregulationofhealthcarequality.BMJQualSaf2020;0:1–4.doi:10.1136/ bmjqs-2019-010610.

[42] Macrae,C.(2013).ReconcilingRegulationandResilienceinHealthCare.In:E.Hollnagel,J. Braithwaite&R.L.Wears(Eds.),ResilientHealthCare.Farnham,UK&Burlington,USA:Ashgate.

[43] Macrae,C.&Wiig,S.(2019).Resilience:FromPracticetoTheoryandBackAgain.In:S.Wiig&B. Fahlbruch(Eds.),ExploringResilience,SpringerBriefsinSafetyManagement,Chapter15, pp.121–126.

[44] Manser,T.(2012).Komplexitäthandhaben–Handelnvereinheitlichen–Organisationensicher gestalten.In:P.Badke-Schaub,G.Hofinger&K.Lauche(Hrsg.).HumanFactors–Psychologie sicherenHandelnsinRisikobranchen(2.Aufl.).Berlin,Heidelberg:Springer-Verlag.

[45] NationalDietofJapanFukushimaNuclearAccidentIndependentInvestigationCommission(NAIIC) (2012).TheOfficialReportoftheFukushimaNuclearAccidentIndependentInvestigation Commission,NationalDietofJapan,Tokyo.

[46] NuclearSafetyOECD/NEA/CSNI/R(2015)16,October2015.HumanPerformanceunderextreme conditionswithrespecttoaresilientorganisation.ProceedingsofaCSNIInternationalWorkshop. 24–26February2015,Brugg,Switzerland.

[47] ParkJ.,KimJ.,Lee,S.&Kim,J.(2018).ModelingSafety-IIbasedonunexpectedreactortrips.Annals ofNuclearEnergy115(2018)280–293.

[48] Peterson,C.,&Seligman,M.E.P.(2004).Characterstrengthsandvirtues:Ahandbookand classification.NewYork,NY:OxfordUniversityPress.

[49] Provan,D.J.,Woods,D.D.,Dekker,S.W.A.&RaeA.J.(2020).SafetyIIprofessionals:Howresilience engineeringcantransformsafetypractice.ReliabilityEngineeringandSystemSafety195(2020) 106740.

[50] RSKstatement(2016).488thMeetingoftheReactorSafetyCommission(RSK)on3November 2016,Monitoringofknow-howandmotivationlossandsuitablemeasuresforstrengthening motivationandmaintainingknow-howintheGermannuclearenergyindustry(http://www. rskonline.de/sites/default/files/reports/rskepanlage1rsk488homepageenrev.pdf).

[51] RSKrecommendation(2019).512thMeetingoftheReactorSafetyCommission(RSK)on22/23 October2019.Assessingtheeffectivenessofmeasurestopreventrecurrenceofevents(http:// www.rskonline.de/sites/default/files/reports/epanlage1_RSK512_hp_en.pdf).

[52] Rutz,S.(2017).PracticingReflexiveRegulation.Rotterdam:ErasmusUniversity.

[53] Sommerauer,K.&Meier,R.(2015).EinguterKapitänzeigtsichimSturm.Krisenkompetenzfür Führungskräfte.HogrefeVerlag,Bern.

[54] Strohschneider,S.&Weth,R.,v.d.(Hrsg.)(2002).Ja,machnureinenPlan.PannenundFehlschläge –Ursachen,Beispiele,Lösungen.Bern:VerlagHansHuber.

[55] VanAvermaet,E.(2003).SozialerEinflussinKleingruppen.InStroebe,W.,Jonas,K.,&Hewsone, M.(Hrsg.).Sozialpsychologie.BerlinHeidelbergNewYork:Springer-Verlag.

[56] Wäfler,T,Gugerli,R.&Nisoli,G.(2021).IntegratingSafety-IIintoSafetyManagement.Generalized GuidelinesforaSafety-II-basedTool:MeasureEvaluationandEffectivenessAssessment.Mensch- Technik-Organisation,Band50.Zürich:vdfHochschulverlagAGanderETHZürich.

[57] Weick,K.E.(1993).Collapseofsensemakinginorganizations:theMannGulchdisaster.Adm.Sci. Q.38(4),628–652(1993).

[58] Weick,K.E.&Sutcliffe,K.M.(2015).ManagingtheUnexpected–SustainedPerformanceina ComplexWorld,3rdEdition.Hoboken,NewJersey:Wiley.

[59] Wilpert,V.(2008).Regulatorystylesandtheirconsequencesforsafety.SafetyScience46(2008) 371–375.

[60] Wiig,S.,Aase,K.,&R.Bal(2019).ReflexiveSpaces:LeveragingResilienceIntoHealthcare RegulationandManagement.JournalofPatientSafety,January2020.

[61] Wiig,S.&Fahlbruch,B.(eds.)(2019).ExploringResilience.SpringerBriefsinSafetyManagement (https://link.springer.com/content/pdf/10.1007%2F978-3-030-03189-3.pdf).

[62] Wiig,S.&Fahlbruch,B.(2019).ExploringResilience–AnIntroduction.In:S.Wiig&B.Fahlbruch (Eds.),ExploringResilience,SpringerBriefsinSafetyManagement,Chapter1,pp.1–5.

[63] Wood,C.,Ivec,M.,Job,J.&Braithwaite,V.(2010).ApplicationsofResponsiveRegulationTheoryin AustraliaandOverseas.RegulatoryInstitutionsNetwork.

[64] Yun,S.,Faraj,S.,&Sims,H.P.,Jr.(2005).ContingentLeadershipandEffectivenessofTrauma ResuscitationTeams.JournalofAppliedPsychology,90(6),1288–1296.

[65] Zolli,A.&Healy,A.M.(2012).Resilience.London:HeadlinePublishingGroup.

i «TheaccidentattheFukushimaDaiichiNPPwasasurpriseoutsidetheboundariesofthebasicassumptionofthekeystakeholders,meaningthestakeholdershadnotbeenabletoimaginethatsuchanaccidentcouldoccur.Fromthis,thelessonlearnedfortheinternationalnuclearcommunityisthatthepossibilityoftheunexpectedneedstobeintegratedintotheexistingworldwideapproachtonuclearsafety»([31],p.146).

ii «NISA’soversightandregulatoryactivitieswereoftenbasedoncompartmentalizedthinking,i.e.itdidnotsufficientlyaddressissuesinabroad,systemicmanner,consideringallaspectsrelevanttosafety(…).Particularemphasiswasplacedontechnicalissues,comparedwithoperationalaspectsandhumanandorganizationalfactors(…)»([31],p.130).«Inaddition,theregulatorybodieswerelessdisposedtolearningfrominternationalexperience(…)showingacleartendencyforisolation(…),frequentlyarguingthatlessonslearnedandapproachesfromothercountrieswerenotapplicabletoJapan»([31],p.130).

iii «Asystemicapproachtosafetyneedstobeimplementedbyallparticipantsandinalltypesofactivitieswithinthenuclearpowerprogrammeandthroughouttheentirelifecycleofnuclearinstallations,includingreviewservicesofferedbyinternationalorganizations.Aswasshownbytheanalysis,inJapan,nuclearinstallations,TEPCOandNISAprimarilyfocusedonthetechnicalaspectsofnuclearsafety.Asystemicapproachtosafetyimpliesthatallstakeholders,besidesthetechnicalfactors,takecomprehensivelyintoaccountthehumanandorganizationalfactors,includingsafetyculture,tobuildresilientcapabilities»([31],p.144).

iv «Thebasicideaofresponsiveregulationisthatgovernmentsshouldberesponsivetotheconductofthosetheyseektoregulateindecidingwhetheramoreorlessinterventionistresponseisneeded»([2],p.29).

v «…withregardtonuclearemergencypreparedness,itwasnotnecessarytoanticipateanaccidentthatwouldreleaseenoughradioactivematerialastoactuallyrequireprotectiveactions,since(theybelieved)rigorousnuclearsafetyregulations,includingsafetyinspectionsandoperationmanagement,wereinplaceinJapan»([45],p.137).

vi «Resilienceisanexpressionofhowpeople,aloneortogether,copewitheverydaysituations–largeorsmall–byadjustingtheirperformancetotheconditions.Anorganisation’sperformanceisresilientifitcanfunctionasrequiredunderexpectedandunexpectedconditionsalike(changes/disturbances/opportunities)»([29],p.14f.).

vii «Resiliencecompetenciesandresourceshavetobedevelopedwellinadvancewithinorganizationstohelppersonneltoquicklyandflexiblyadapttonewsituations,todevelopnewsolutionsforblindspots–inotherwords:toberesilientinunexpectedsituations»([31],p.146).

viii «Thesignatureofahighreliabilityorganization(HRO)isnotthatitiserror-free,butthaterrorsdon’tdisableit»([58],p.95).

ix «Knowingwhattodoorbeingabletorespondtoregularandirregularchanges,disturbancesandopportunitiesbyactivatingpreparedactions,byadjustingthecurrentmodeoffunctioning,orbyinventingorcreatingnewwaysofdoingthings»([29],p.26).

x «Knowingwhattolookfororbeingabletomonitorthatwhichaffectsorcouldaffectanorganisation’sperformanceinthenearterm–positivelyornegatively.(Inpractice,thismeanswithinthetimeframeofongoingoperations,suchasthedurationofaflightorthecurrentsegmentofaprocedure.)Themonitoringmustcoveranorganisation’sownperformanceaswellaswhathappensintheoperatingenvironment»(/29/,p.27).

8 Endnotes

xi «Knowingwhathashappenedorbeingabletolearnfromexperience,inparticulartolearntherightlessonsfromtherightexperiences.Thisincludesbothsingle-looplearningfromspecificexperiencesandthedouble-looplearningthatisusedtomodifythegoalsorobjectives.Italsoincludeschangingthevaluesorcriteriausedtotailorworktoasituation»([29],p.27).

xii «Knowingwhattoexpectorbeingabletoanticipatedevelopmentsfurtherintothefuture,suchaspotentialdisruptions,noveldemandsorconstraints,newopportunitiesorchangingoperatingconditions»([29],p.27).

xiii «Anintegrativeframeworkshouldalsoaccommodatethepositive,aswellasthe‘negative’,aspectsofresilience:theprocessesofimprovement,adaptationandinnovationasmuchasthemanagementoftheadverseimpactsandcrisesthatareoftenviewedastheprimetriggerofresilience»([43],p.127).

xiv «Itisnotjustaboutbeingabletorecoverfromthreatsandstresses,butratheraboutbeingabletoperformasneededunderavarietyofconditions–andtorespondappropriatelytobothdisturbancesandopportunities»([29],p.15).

xv «Ingeneral,Safety-IIisaboutlearningfromthingsthatgorightandimprovingresilience,whereSafety-Iisaboutlearningfromthingsthatgowrongandimprovingcompliance»([41],p.1).

xvi ComparisonofthecharacteristicsofSafety-IandSafety-II(/28/,p.147)

Safety-I Safety-II

Definitionofsafety Asfewthingsaspossiblegowrong. Asmanythingsaspossiblegoright.

Safetymanagementprinciple

Reactive,respondwhensomethinghappens,oriscategorisedasanunacceptablerisk.

Proactive,continuouslytryingtoanticipatedevelopmentsandevents.

Explanationofaccidents Accidentsarecausedbyfailuresandmalfunctions.Thepurposeofaninvestigationistoidentifycausesandcontributoryfactors.

Thingsbasicallyhappeninthesameway,regardlessoftheoutcome.Thepurposeofaninvestigationistounderstandhowthingsusuallygorightasabasisforexplaininghowthingsoccasionallygowrong.

Attitudetothehumanfactor

Humansarepredominantlyseenasaliabilityorahazard.

Humansareseenasaresourcenecessaryforsystemflexibilityandresilience.

Roleofperformancevariability

Harmful,shouldbepreventedasfaraspossible. Inevitablebutalsouseful.Shouldbemonitoredandmanaged.

xvii «Thecentralthemeofcentralizedcontrolis‘planandconform’,whilethecentralthemeofguidedadaptabilityis‘planandrevise’»([49],p.11).

xviii «Managers,safetyprofessionalsandfrontlineworkersneedtodeterminewhen,foragivencontext,thesafecourseofactionistocomplywithstandardizedpractices,andwhenthesafecourseofactionistoadapt»([49],p.11).

xix «Poorlydesignedandimplementedregulationcanthereforedramaticallyreducetheattentionalresources,localauthorityandcapacityforflexibilityonthefrontlineofhealthcareorganisations.Thatis,poorregulationcanreduceorganizationalcapacitiesforresilience»([42],p.116).

xx «Regulatorytechnologiesthataimtosupportcentralizedandstandardizedcontrolofbehaviorappearimmediatelyatoddswiththeemphasisthatmostmodelsofresilienceplaceonlocalinnovations,flexibility,improvisation,adaptability,problemsolving,vigilanceandtrial-and-errorlearning»([42],p.115).

xxi «Withthismuchridingoncompliance,organisationscanbecomeoverlyfocusedonmeetingregulatoryrequirementsmerelytomanagetherisksofregulatorysanctions(…),attheexpenseofactuallymanagingtheunderlyingriskstoqualityandsafetythattheregulationsareintendedtoaddress–socalled‘secondaryriskmanagement’»([42]p.116).

xxii «ButtheconceptsofregulationandSafety-IIareactuallyquitesimilar;bothareaboutmakingsenseofsituationsinthecontextoftheirsocialdynamics»([41],p.2).

xxiii «Onecouldcallthisamovefromregulatoryoversighttoregulatoryinsight»([41],p.4).

xxiv «Weconceptualizereflexivespacesasphysicalorvirtualplatformsinwhichreflexivedialogicalpracticeoccursbetweenpeople.Thereflexivedialogicalpracticeiskeyinlearningprocesses,becauseitbridgestacitandexplicitknowledge.Reflexivespacescanbringpeopletogethertoreflectoncurrentchallenges,adaptations,andneedsindailyworkpractice.Reflexivespacesareforumsinvitingaccountabilityandfeedbackonconcretepracticesandtheeffectstheygenerate.Theyarecollectiveinthesensethattheymobilizeexperiencesofrelevantactorswithinandoutsidehealthcarepractices.Accountabilitywithinsuchspacesisgenerativeinthesensethatitaddstolearningratherthancurbingit»([60],p.2).

xxv «Thegoalofthisapproachistoleavetheresponsibilityforsafetyasmuchaspossiblewiththeorganizationandmanagementitself,whilecheckingthecapabilityandwillingnessoftheorganizationstomanage.‘Trust,butassesstrustworthiness’iskeyandtheestablishedreflexivespacesdependonthesecharacteristicsoftrust,responsibility,andengagementtoleverageresilienceintoregulationandmanagement»([60],p.2).

xxvi «Onlyifanopendialoguebetweenoperatorandregulatorisestablished,cantheoperationalflexibilitywhichliesattheheartofresiliencebeeffectivelyrealized»([21],p.65).

xxvii «Thetaskoftheregulatorybodyishighlydemandingandentailsthedutyofcontinuouslychallengingandquestioningthebasicassumptionheldbytheindustryitregulatesandbyitself.Thisimplieshighdemandsontheregulator’sself-reflectingcapabilitytoputitsownroleanditsimpactonnuclearsafetyandonthecollectiveperceptionofnuclearsafetyunderconstantself-scrutiny»([31],p.144).

Impressum

IssuedbyENSISwissFederalNuclearSafetyInspectorateENSIIndustriestrasse19CH-5201BruggPhone+41(0)564608400Fax+41(0)564608499info@ensi.chwww.ensi.ch

ENSI-AN-11071

Issued byENSISwiss Federal Nuclear Safety Inspectorate ENSIIndustriestrasse 19CH-5201 BruggPhone +41 (0)56 460 84 00Fax +41 (0)56 460 84 99info@ensi.chwww.ensi.ch

ENSI-AN-11071March 2021

Fukushima Daiichi Human and Organisational Factors

Documents

Lessons of Fukushima-Daiichi NPP's Accidents for ...2005/08/02 · Fukushima Daiichi Fukushima Daini Onagawa Tohkai Daini Flood Flood Flood Rushed Rushed Rushed 2012 INTERNATIONAL

Fukushima Daiichi-Anatomy of a Tragedy

Improvements in EPR arrangements after Fukushima Daiichi

L'accident de Fukushima Daiichi

Fukushima Daiichi

Fukushima Daiichi Nuclear Power Plant

Facts and Tasks at Fukushima Daiichi

DailyReport Fukushima Daiichi 2011/05/12

MEGHÍVÓ FUKUSHIMA DAIICHI: Atomerőműi földrengés-katasztrófa Japánban

BRAZILIAN REGULATORY ACTIONS AFTER FUKUSHIMA DAIICHI

Fukushima Daiichi Power Plant Disaster

Argument for Normal Accident Theory Fukushima Daiichi

Stato attuale nella centrale di Fukushima Daiichi

Fukushima Daiichi Full Report UITM

Fukushima-daiichi akcidentnuklearno-drustvo.hr/attachments/article/117/Fukushima-daiichi accident.pdf · pitanju nuklearne nesreće: • Elektrana je automatski zaustavljena kad je

Reviewing Fukushima Daiichi nuclear plant crisis

The Fukushima Daiichi accident Technical Volume 5

Der Reaktorunfall in Fukushima Daiichi - Folge fehlerhafter

Reviewing Fukushima Daiichi Decommissioning Plans

Current status of Fukushima Daiichi NPS