© A. Helminen and N. Girault, Published by EDP Sciences, 2025

1. Introduction

The BESEP and R2CA projects aimed to support the safety margin determination of NPPs by respectively developing best practices for safety requirements verification and safety margin determination against external hazards and best estimate calculation methodologies for radiological consequence evaluations of accidental scenarios caused by internal and external hazards. They explored different practices used in safety analyses such as in Deterministic Safety Analyses (for R2CA and BESEP), in Probabilistic Safety Analyses (for BESEP) and in Human Factors Engineering (for BESEP). Both projects stem more or less directly from the 2011 Fukushima nuclear accident that led to more stringent safety requirements for NPPs in many EU countries. The more stringent safety requirements require the development or extension of existing safety analysis methods (i.e. considering in NPP designs accidental scenarios more severe than the design basis accidents) as well as the optimization of accident management or mitigation strategies. These activities were covered by the BESEP and R2CA projects, each of them exploring different aspects and covering different aspects of safety analyses.

Main objectives for the BESEP and R2CA projects, exploring respectively external and internal hazards were:

• the creation of a graded approach for accident scenario analyses with respect to their risk significance and potential consequences, integrating hierarchically and iteratively, throughout the process, deterministic and probabilistic safety analyses as well as human actions.

• The development of more realistic calculation methodologies of DBA and DEC-A transients (through improvements in tools and coupled calculations chains simulating the fuel behavior and fission product transport up to the environment) leading in most of the accidental transients studied in the reduction of their radiological consequences.

In the end, both projects were expected to help the implementation of more stringent safety requirements by creating robust practices and enhanced accident analyses methodologies for the existing and future NPP designs. The two projects, their main objectives and key outcomes are successively detailed in Sections 2 and 3 together with their education and dissemination activities.

2. R2CA project

2.1. Project presentation and main objectives

The R2CA project (Reduction of Radiological Consequences of Accidents, 2019–2023) was focused on the improvements to be included in existing deterministic calculations for a more realistic evaluation of radiological source terms of accidents in the Design Basis and Design Extension Condition domains (respectively DBA & DEC-A) [1]. It mainly raised from the Fukushima Daichii Accident (FDA) and the following considerable R&D effort performed in modelling and source term evaluations, which highlighted respectively the need to include in NPP designs the DEC-A accidental scenarios and the overly conservative risk assessments of DBAs.

It was restricted to Loss-Of-Coolant (LOCA) and Steam Generator Tube Rupture (SGTR) scenarios, which are among the most penalizing in terms of environmental radionuclide releases. The main goals were to:

• to provide a more realistic evaluation of the safety margins improving the simulations of the involved phenomena and their coupling (including model refinement, simulation tool capabilities enhancement and calculation scheme upgrade).

• To optimize Emergency Operating/Accidental Management Procedures (EOP/AMP) using the improved calculation methodologies.

• To explore innovative methods (based on artificial intelligence) to support early diagnosis of accidental situations.

To do so, the approach was based on three pillars that included:

• reviews of existing methodologies, simulation tools and experimental data [2] to identify some key improvements to be made and gaps to be overcome.

• Model refinement, simulation tool capabilities enhancement and calculation scheme upgrade as well as the provision of new data through well-targeted experiments.

• Verification/validation of updated calculation tools and application to accidental reactor cases.

2.2. LOCA Source Term evaluations

The review of existing methodologies for LOCA DBA & DEC-A source term evaluations carried out at the start of the project highlighted that various degree of conservatisms/empiricisms and decoupling factors are often used to compensate the lack/uncertainties of models/data. For instance, the failed rod ratio in the core during the LOCA sequence, directly impacting the radiological source, was often assumed but greatly varied (from 10 to 100%). That is why, though only the gap content of failed fuel rods is likely to be released (i.e. small fraction of the rod total fission product inventory), for a better assessment of safety margins, evaluate this ratio more accurately was needed. A large part of the project activities was then devoted to this task, although significant improvements were also made regarding FP behavior in both fuel performance codes and FP behavior codes (i.e. for transient FP release from fuel) and their coupling [3]. In this way, main advances that have benefited radiological source term reassessments concerned fuel rod thermo-mechanics and core modelling.

Regarding fuel rod thermo-mechanics, from both legacy experimental datasets, previous burst criteria established and detailed investigation of ballooned and burst cladding samples, new burst limits were established to improve the accuracy of the cladding burst occurrence models (focusing on burst time and temperature) [4] as:

• improved envelopes on engineering burst hoop stress (i.e. including minimum, mean and maximum),

• a temperature criterion depending on clad heating rate and engineering stress.

As the newly burst temperatures of other burst tests calculated with different tools were either in a better agreement or slightly conservative compared to experimental ones, it was concluded that these new criteria could be advantageously used in best-estimate approaches to calculate the radiological source term of LOCA DBA and DEC-A transients.

In parallel, advanced core modelling with coupled 3D thermohydraulic and thermomechanical fuel rod models were developed in two integral tools with different modelling approaches [5]. Compared to current approaches, where a system thermal-hydraulic code is chained to a fuel performance code, both allowed feedback from fuel rod responses on in-core flow (as the impact of fuel rod deformation on flow section and wall-to-fluid heat exchanges). Also, each fuel assembly considered several lumped fuel rods and is modelled with averaged thermal hydraulics resolved in 3D core model. The main differences linked to code and CPU capabilities were related to:

• the levels of details used to describe the heterogenous characteristics of the fuel rods (i.e. power, burn-up, location, internal pressure…) potentially impacting their thermomechanical behavior (Fig. 1).

• The 3D domain extension (i.e. only core or full RPV) where the full 3D RPV modelling, leading to an asymmetric location of the burst rods in the core (Fig. 2), pointed out the impact of complex 3D flow distribution (due to loop behavior asymmetry) on rod responses.

Fig. 1. Calculated margin to burst criteria at transient end function of equivalent rod power (DRACCAR 3D core modelling) [5].

Fig. 2. Calculated cladding temperature distribution within the core 20 seconds after transient onset (ATHLET-CD 3D RPV) [5].

The insights provided led to the formulation of recommendations and paved the way for future improvements towards a best estimate evaluation of the failed fuel rod fraction. As it will necessarily imply a full 3D RPV modelling, an increased number of lumped fuel rods per fuel assembly and their characteristics differentiation together with the management of the various uncertainties (i.e. on burst criteria and thermal-hydraulics prediction), the computational cost will have to be reduced.

Both DBA & DEC-A scenarios were calculated for several reactor concepts (VVERs, PWRs, BWR) using detailed thermal-hydraulics system codes chained to fuel performance codes or integral tools [6]. Initiating events were generally a double-ended break in cold leg and a single additional failure for DBA transients. For DEC-A, one additional failure was generally considered, except in two cases where different scenarios were calculated. Due to modelling improvements, mainly in fuel rod burst, the number of burst fuel rods in the core was generally reduced for all reactor concepts. Only few exceptions were observed: one case in DBA (due to a more stringent cladding failure criterion) (Fig. 3) and one case for DEC-A where the 3D core modelling with a better differentiation of the fuel assembly characteristics (burn-up, location, etc.) also led to a slight increase of the failed rod number. The re-assessed source term evaluations were accordingly in most cases 15–100% lower compared to initial calculations.

Fig. 3. Calculated rod burst ratio in LOCA DBA: initial vs improved calculations [1].

2.3. SGTR Source Term evaluations

Contrarily to LOCA, SGTR was not considered as an important event at the time of the Gen II PWR design (70’ies, 80’ies), but gained consideration with the reactor operating feedback (number of fuel defective rod detected), such as significantly influencing the PWR's new designs like Gen III EPR. In existing methodologies various degree of conservatisms and empiricisms are often used in source term evaluations of SGTR sequences to compensate the lack/uncertainties of models/data (i.e. regarding primary coolant activity during normal and transient conditions, iodine speciation and transfer…). The radiological consequence analysis of such transient where the containment is potentially by-passed, is very specific and can be complex, depending on whether the break is flooded or not. The project was focused on the main modelling improvements required for a better estimation of the gaseous source term, then mostly on scenarios with non-flooded breaks. Main advances concerned an improved modelling of the iodine spiking released activity from defective fuel rod gaps due to power/pressure variations in RCS and a better consideration/modelling of iodine distribution between the SG liquid and gas phase due to iodine partitioning or flashing where the iodine speciation, except in one case, was often imposed.

Both DBA & DEC-A scenarios were calculated for several reactor concepts (VVERs, PWRs, BWR) using detailed thermal-hydraulics system codes or integral tools [6]. Initiating events were break of one (DBAs) or several (DEC-A) tubes with various potential locations (preferentially uncovered) plus SG cover lift-up (for VVERs). Re-assessed source term evaluations were in most cases (except one) reduced (i.e. Fig. 4 for DBA). The 20–100% source term reduction compared to initial calculations explained for some cases by refined RCS activity contamination and an improved thermal-hydraulic modelling of the SG valves. The increased source term predicted in one case was mainly explained by differences in the modelling of FP transport in RCS/SG and the calculation of iodine speciation within primary circuit conditions. This had an impact respectively, in RCS, on the normal/spiking contamination and, in failed SG, on liquid/gas activity distribution and iodine flashing rate.

Fig. 4. Environmental activity releases during SGTR DBA sequences [1].

From the performed Sensitivity Analyses and Uncertainty Quantification, key parameters were identified and some recommendations formulated. To further progress to best-estimate evaluations additional improvements would still be needed at different levels (i.e. use of more mechanistic models for informing iodine-spike correlations in thermal-hydraulics codes, retention in SG upper part….).

Not all the numerous model improvements made during the project have been embedded in tools used to re-evaluate the LOCA and SGTR source terms. These include development/improvement of models for:

• clad secondary hydriding of leaking rods in normal operation conditions from water ingress to blister formation potentially impacting the clad integrity.

• Enhanced FP releases from fuel due to power/stress variations, fuel oxidation, fuel fragmentation (i.e. in High burn-up zones) impacting the gap inventory and rod internal pressure.

• Axial FP gas communication in fuel rod free volumes.

It also includes an enhanced coupling of some Fuel Performance Codes with detailed tools for FP behavior in fuel (transport/thermochemistry) and the extension of some tool capabilities to Accident Tolerant fuels.

2.4. Accident management and prevention

Various studies were performed to cope with the potentially high radiological consequences of SGTR accidents due to containment bypass and direct release of radioactive coolant in environment. The first kind dealt with the development of new and optimized automatic safeguards algorithms [7]. It mainly consisted in refinement of the earlier applied Downhill Simplex method which was applied to find the optimum timing of operator actions during a SGTR scenario for environmental iodine release reduction.

In the second kind, for indication of defective fuel rods in a NPP core, several Artificial Intelligence methods (data-driven based) were tested as anomaly detectors [8]. Indeed, since the occurrence of a fuel rod defect leads to a primary activity change, the efficiency of autoencoders shaped as Recurrent Neural Networks (RNN), Gated Recurrent Units (GRU) networks, or Long Short-Term Memory networks (LSTM) were tested.

Because of the lack of measurements in reactor conditions, it was first necessary to generate a computational database. To do so, a two-step approach was followed that includes:

• the development of a physical model (restricted to I131 decay chain) for generation of activity data due to defects. It was used to produce the database by varying its most influential parameters (i.e. power, temperature, primary circuit inlet and outlet flow rates…) and tested upon fault detector efficiency.

• The derivation of surrogate models, more suitable to provide the huge amount of data needed to feed the training recurrent networks and achieve the required precision.

• The generation of activity sequences (∼50 000). The number of sequences was then increased considering different time steps per sequence and various sequence duration.

This led to 30 models of defect detection (GRU, RNN, LSTM). 100% accuracy was achieved by all methods applied to all time steps/sequence durations (Fig. 5).

Fig. 5. Confusion matrix for LSTM, with 1 hour time step and 3-time steps per sequence [8].

2.5. Education and dissemination activities

Regarding education activities, apart from master training there have been two PhD theses, and one postdoc performed within the project covering various key research topics beneficial for R2CA:

• iodine spiking and AMP optimization for environmental iodine release reduction.

• Gaseous and volatile FP behavior in LWR fuel in transient conditions.

• Primary circuit contamination in normal operation conditions.

Within the mobility program, 5 other students (PhD or postdoc) were involved in the project activities which promoted the exchanges of knowledge and experience between R2CA Partners.

In addition, 4 training courses have been organized on dedicated simulation tools used in R2CA. Finally, in collaboration with the European Nuclear Education Network (ENEN), 50 students and young researchers participated in the R2CA summer school organized in July 2023 in Bologna targeting both fundamental knowledge, current nuclear safety best practices and innovation.

Regarding dissemination activities, apart from newsletters, contributions in international scientific conferences (NENE, NURETH, TOPFUEL…) and the organization of a final open workshop, 16 public deliverables were archived in a dedicated Zenodo repository and papers on various R2CA related topics were published in peer reviewed journals. A dedicated special issue was also organized in the Annals of Nuclear Energy Journal where 18 open-access articles were collected (https://www.sciencedirect.com/journal/annals-of-nuclear-energy/special-issue/105M36PSDR6).

3. BESEP project

3.1. Project objective

The objective of the BESEP project (Benchmark Exercise on Safety Engineering Practices, 2020–2024) is to support safety margins determination by developing best practices for safety requirements verification against external hazards, using efficient and integrated set of Safety Engineering practices and probabilistic safety assessment. The expected key results of the project are:

• best practices for the verification of evolving and stringent safety requirements against external hazards.

• Guidance on the closer connection of deterministic safety analysis (DSA), probabilistic safety analysis (PSA) and human factors engineering (HFE) for determination and realistic quantification of safety margins.

• Guidance on creation of a graded approach for deployment of more sophisticated safety analysis methods, such as upgrades of simulation tools, while maintaining the plant level risk balance originating from different external hazards.

The outcomes help streamline the licensing process of nuclear power plant new builds and upgrades. Use of best practices will give maximum output for the amount of analysis work invested to the safety margins determination and safety requirements verification. At the same time, the amount of analysis work is optimised for a specific plant design and the plant level risk is balanced against different external hazards.

3.2. Safety design and safety engineering process

During the project, a three-tiered approach to efficiently manage the plant's safety design was identified (depicted in Fig. 6). The approach is based on a structured and integrated interplay of three methodologies: systems engineering, safety engineering, and safety assessments.

Fig. 6. Three-tiered approach to the plant's safety design.

On the top level, there is systems engineering methodology, which is a holistic, interdisciplinary, and cooperative approach used for large systems over their entire life cycles, which is increasingly considered by many industrial sectors. Systems engineering defines the common process framework applicable to different engineering domains. There generally exists several international standards describing the main components needed to develop and perform a well-structured systems engineering. Different systems engineering processes are described e.g., in ISO/IEC/IEEE 15 288 Systems and software engineering – System life cycle processes [9].

On the bottom level, there is the safety assessment, which includes the conduct of different safety analyses. There is a great variety of plant and system-level analyses needed during the life cycle of the plant, including deterministic (DSA) and probabilistic (PSA) safety analysis and human factors engineering (HFE). Generally, nuclear safety analyses are rather specific to the nuclear domain, for example, seismic analyses, level 1 PSA, level 2 PSA, etc., and are well-known only to the domain experts. An example on the safety assessment process for nuclear facilities can be found in IAEA Safety Standard GSR Part 4 – Safety Assessment for Facilities and Activities [10].

What can be seen as currently lacking structure and guidance, or even missing, is the middle level, which is the connecting element between the whole plant engineering level and the safety assessments. In BESEP, we call this layer the safety engineering level, as it plays an integrating role between the plant design, safety requirements, and safety assessments. It helps the organization to carry out rigorous and comprehensive safety engineering. It can include, for example, a life cycle model [11], a description of safety engineering processes (e.g., requirement management, configuration management, and system analysis), the organizational model, and a selection of tools to implement the safety design principles in practice. Through these topics safety engineering layer will help to plan and manage the different safety analysis disciplines (i.e. DSA, PSA, and HFE), their interactions, and the interplay between safety requirements and plant design.

Traditionally, the nuclear industry has an extensive collection of safety analysis methods to take care of the safety requirements and analyze, evaluate, and justify the safety of the plant. The safety authority will review and assess the design basis for the safety in the plant's licensing process. The licensing process is endorsed by a safety engineering process that connects the main elements of safety design: safety requirements, safety analyses and plant design. In case there is a change in one of the main elements the change should be reflected in the two other elements. This is usually for the safety engineering process to take care of.

During the lifecycle of a plant, there can be various changes to the main elements of safety design. The need for change can be subtle, giving time for the safety engineering process to adjust the changes to the other main elements. Or the need for change can be abrupt, putting extra stress on the performance of the safety engineering process. There are two typical stress situations. The first is the case of sudden, unexpected operational experience, for example on an internal or external hazard. The second is the case of licensing of new nuclear power plant when the timetables create constraints to the safety engineering process. Both situations are challenging and the best way to answer to the challenge is to create robust practices to support the safety engineering process. The main elements of safety design and potential reasons to their changes are illustrated in Figure 7.

Fig. 7. Main elements of nuclear safety design.

3.3. Benchmark exercise

In BESEP project, a benchmark exercise was carried out between several participants from different EU countries. The exercise was based on relevant case studies previously performed by the participants. The benchmarked case studies have been subject to consecutive comparisons, evaluations, and improvements to reach a consensus on what the participants consider an efficient and integrated safety engineering process. The case studies included a variety of topics which were grouped according to safety requirements to be met, safety analyses performed, and similarities in external hazards or structures, systems and components (SSCs). Details of the benchmark process and example of a case study can be found in the BESEP papers in ESREL 2022 and PSA 2023 conferences [12, 13].

In the benchmark exercise. the case studies were first compared within each of the groups to evaluate e.g., verification of safety requirements, assessment of safety margins as well as the role and interactions of safety analyses. Safety engineering approaches of the cases were also studied to identify success factors of integrated and efficient safety engineering processes. After the first comparison, the case studies in each of the groups were merged into a single representative case. The representative cases were further analyzed with probabilistic risk assessment methods to evaluate the balance between the spent efforts in safety verification, and the risk significance of the case study. Another aspect of the analyses was the quality of HFE contribution, including identification and treatment of human actions and tasks, dialogue of human reliability analyses and human factors engineering, and the evaluation of procedures. Together these comparisons provided answers for the three main topics of BESEP project: the integrated safety engineering process; closer connection of the PSA, DSA, and HFE; and the creation of the graded approach.

3.4. Main results of project

Safety engineering management plan

The concept of Safety Engineering Management Plan (SaEMP) was introduced in the BESEP project. SaEMP is a common planning and management document to guide and bring structure and integration to the safety engineering process. The diagrams and tools to support the efficient and integrated safety engineering process are presented in SaEMP. These can be, for example, accident sequence presentations, linking the accident sequences to safety analyses, V-model presentation, flow of information chart, etc. The diagrams help visualize interconnections between safety analyses, and how the analyses contribute to the overall safety assessment and to the verification of safety requirements. A detailed presentation to the SaEMP concept can be found from the BESEP paper in the ESREL 2023 conference [14].

Efficient and integrated safety engineering process

Based on the learnings from the benchmark exercise and to endorse the SaEMP concept, an example diagram of an efficient and integrated safety engineering process was proposed. The purposed example diagram, and the safety engineering process in general, is not to replace the standard procedure of conducting the safety assessment of a nuclear power plant, but to support and complement the safety assessment. The safety assessments can be seen as the core technical activities performed within the safety engineering process to help to assess plants’ safety level, decide on the need for modifications and/or corrective actions, as well as to assess the effectiveness of the implemented safety measures. The proposed diagram is presented in Figure 8. Details on the steps of the diagram can be found in the BESEP paper in the ESREL 2024 conference [15].

Fig. 8. Example diagram of an efficient and integrated safety engineering process.

Closer connection of deterministic and probabilistic safety analysis and human factors engineering

The role and the expected interactions of DSA, PSA and HFE should be defined at an early stage of the overall safety engineering process. Multi-disciplinary team on the safety analysis disciplines participating to the safety assessment should be defined early enough to allow efficient resource usage already at the planning phase. SaEMP reflects these aspects, and the necessary interactions are ensured throughout the process. Additionally, guidelines for conducting a complex assessment involving different safety analysis disciplines could be defined within SaEMP.

To further support and endorse the closer connection of safety analyses, it might be a good idea to introduce novel safety margin concepts to the field of nuclear safety. Typical safety margins of a nuclear power plant are, for example, the reactor power level and the pressure of reactor coolant boundary. However, in modern accident scenarios human involvement has typically strong presence. The management of design basis events is included in the plant's safety design. Often these design basis events are controlled by automated systems without direct human intervention. For the beyond design-basis events the situation is more complex. Since it is difficult to create automated systems against most of these events, human participation is inevitable. Therefore, one step towards improving the integration of human actions in the plant's safety design would be to create novel safety margin concepts.

Creation of graded approach

One lesson learned in BESEP was that the approach for grading the amount of effort to be spent on analyzing accident scenarios should be structured and rigorous enough. In the beginning, some preparatory tasks have to be conducted. First, relevant criteria have to be selected for grading. In addition to expected safety significance, the selection of the level of analysis could be based on criteria such as novelty, complexity, and uncertainty. Second, we have to specify the number of grading levels. Regarding risk significance, the levels are associated with the potential consequences of the risks. The number of levels should be quite small; typically, three levels are a good choice. The third task is to determine analysis activities for each significance level.

The main idea is to apply a graded approach hierarchically and iteratively. Two levels of iterations are typically at least required: first, an overall level for control efforts is determined on the basis of risk significance; second, a more detailed assessment is conducted in which several other factors such as novelty, complexity, and uncertainty are considered. If several criteria are used, ratings based on the criteria are combined to specify the overall risk significance level of the scenario.

Dissemination, education and training activities

The project and project results have been disseminated actively including active participation to conferences and relevant international meetings, as well as organization of BESEP specific workshops and training events to the industry and students. Several scientific papers and five theses were produced on BESEP topics during the project. Publications and project news were also disseminated through the project website.

An important education event was the organization of BESEP summer school on safety engineering practices to the junior experts of nuclear safety. The summer school included lecture modules providing an introduction to DSA, PSA and HFE, and examples how to use them in an efficient and integrated manner in safety engineering processes. The lessons learned from the lecture modules were practiced in lab modules.

In the lab modules, the summer school participants were divided into groups. The groups were assigned an accident analysis exercise based on four play parts. The different play parts together created a comprehensive accident situation in a fictional nuclear power plant, see Figures 9–10. The groups provided their accident analysis by answering predefined questions.

Fig. 9. Example on one of the BESEP summer school plays.

Fig. 10. BESEP summer school group work.

Finally, the answers provided by the groups were compared to the answers provided by artificial intelligence with the same play scripts of the accident situation. ChatGPT produced good answers in some aspects but could not provide correct solutions.

3.5. General conclusion

The focuses and interaction areas of R2CA and BESEP projects in the safety assessments of internal and external hazards are illustrated in Figure 11. A project's logo is shown in the assessment methodology boxes for the methodologies that have been in the project's focus. R2CA logo in the lower left and BESEP logo in the lower right corner. As can be seen from the figure, the two projects cover a wide range of assessment methodologies in nuclear safety. In addition, the two projects complement each other in the different assessment methodology areas of deterministic and probabilistic analysis and human factors engineering.

Fig. 11. Diagram on the focuses and interaction areas of R2CA and BESEP projects in safety assessments of internal and external hazards.

The projects prove that the European research and development framework is the convenient environment for the improvement of safety assessment methodologies. The stringent safety requirements call for proven and justified safety assessment methodologies to be applied in the European nuclear industry. The European research and development programs bring together the different sides of nuclear industry, i.e. utilities, vendors, national safety authorities and technical support organisations, and benefits from their know-how and expertise. The projects like R2CA and BESEP help foster new experts for the industry, who eventually take the responsibility of continuous development in nuclear safety.

Funding

The R2CA and BESEP projects have been co-funded by the European Commission and performed as part of the EURATOM Horizon 2020 Programmes respectively, under contract 847656 (R2CA) and 945138 (BESEP).

Conflicts of interest

The authors declare that they have no competing interests to report.

Data availability statement

There are no special data nor any repository apart from what is provided on the projects or EU website.

Author contribution statement

This paper is an attempt to summarize the main elements regarding the two targeted projects, each author having contributed on behalf of his/her project consortium.

References

All Figures

	Fig. 1. Calculated margin to burst criteria at transient end function of equivalent rod power (DRACCAR 3D core modelling) [5].
In the text

	Fig. 2. Calculated cladding temperature distribution within the core 20 seconds after transient onset (ATHLET-CD 3D RPV) [5].
In the text

	Fig. 3. Calculated rod burst ratio in LOCA DBA: initial vs improved calculations [1].
In the text

	Fig. 4. Environmental activity releases during SGTR DBA sequences [1].
In the text

	Fig. 5. Confusion matrix for LSTM, with 1 hour time step and 3-time steps per sequence [8].
In the text

	Fig. 6. Three-tiered approach to the plant's safety design.
In the text

	Fig. 7. Main elements of nuclear safety design.
In the text

	Fig. 8. Example diagram of an efficient and integrated safety engineering process.
In the text

	Fig. 9. Example on one of the BESEP summer school plays.
In the text

	Fig. 10. BESEP summer school group work.
In the text

	Fig. 11. Diagram on the focuses and interaction areas of R2CA and BESEP projects in safety assessments of internal and external hazards.
In the text