The defence in depth concept remains valid, but implementation of the concept needs to be strengthened at all levels by adequate independence, redundancy, diversity and protection against internal and external hazards. There is a need to focus not only on accident prevention, but also on improving mitigation measures.

The flooding resulting from the tsunami simultaneously challenged the first three protective levels of defence in depth, resulting in common cause failures of equipment and systems. Even when faced with this situation, operators were able to apply effective, albeit delayed, mitigation strategies. All layers of defence in depth associated with both prevention and mitigation of accidents should be strengthened by adequate independence, redundancy, diversity and protection so that they are not simultaneously challenged by an external or internal hazard and are not prone to common cause failure. The application of the defence in depth concept needs to be periodically re-examined over the lifetime of an NPP to ensure that any change in vulnerability to external events is understood and that appropriate changes to the design are made and implemented. There is a need for extreme external hazards to be addressed in periodic safety reviews, because such hazards can result in common cause failures that may simultaneously jeopardize several levels of defence in depth.