Hierarchical Structure of Safety Goals for Nuclear Installations