CNSC Fukushima Task Force Report

INFO-0824

October 2011

CNSC Fukushima Task Force Report© Minister of Public Works and Government Services Canada 2011
Catalogue number CC172-77/2011E-PDF
ISBN 978-1-100-19497-4
Published by the Canadian Nuclear Safety Commission (CNSC)
Catalogue number INFO-0824
Extracts from this document may be reproduced for individual use without permission
provided the source is fully acknowledged. However, reproduction in whole or in part forother purposes requires prior written permission from the Canadian Nuclear Safety
Commission.
Également publié en français sous le titre de : Rapport du Groupe de travail de la CCSN
sur Fukushima
Document availability
This document can be viewed on the CNSC Web site at nuclearsafety.gc.ca. To order aprinted copy of the document in English or French, please contact:
Canadian Nuclear Safety Commission
280 Slater Street
P.O. Box 1046, Station B
Ottawa, Ontario K1P 5S9
CANADA
Tel.: 613-995-5894 or 1-800-668-5284 (in Canada only)
Facsimile: 613-995-5086
E-mail: info@cnsc-ccsn.gc.ca
Web site: nuclearsafety.gc.ca

CNSC Fukushima Task Force Report
INFO-0824

October 2011

CNSC Fukushima Task Force Report

Preface
The CNSC Fukushima Task Force was established under the authority of the Executive Vice-President
and Chief Regulatory Operations Officer, Ramzi Jammal, to evaluate operational, technical andregulatory implications on Canadian nuclear power plants (NPPs) from the 2011 nuclear event inFukushima, Japan.
The work of the Task Force was led by Dr. Greg Rzentkowski, Director General of the Directorate ofPower Reactor Regulation, who is responsible for implementing regulatory actions, including policy
decisions, regulatory requirements and recommendations for safety upgrades at Canadian NPPs.

i

CNSC Fukushima Task Force Report

Acknowledgements
The CNSC Fukushima Task Force was made up of the following members, supported by many other
CNSC staff in a wide range of disciplines.
Chair:
Greg Rzentkowski

Director General, Directorate of Power Reactor RegulationVice-Chair:
Gerry FrappierDirector General, Directorate of Assessment and Analysis

Technical Leads:
Tom Schaubel
Phil Webster
Pat Hawley

Director, Directorate of Power Reactor Regulation
Director, Directorate of Power Reactor Regulation
Director, Directorate of Assessment and Analysis

Scientific Secretary:
Hatem Khouaja

Technical Advisor, Directorate of Power Reactor Regulation

Project Management:
Albert Thibert

Senior Regulatory Program Officer, Directorate of Power Reactor Regulation

Technical Specialists:
Sanja SimicDavid Newland
Chantal Morin
Chris Harwood
Luc Sigouin

Technical Specialist, Directorate of Assessment and Analysis (severe
accidents)
Director, Directorate of Regulatory Improvement and Major Projects(requirements for new builds)
Technical Specialist, Directorate of Assessment and Analysis (probabilistic
safety assessment)
Technical Specialist, Directorate of Assessment and Analysis (deterministic
safety analysis)
Director, Directorate of Security and Safeguards (emergency response)

The CNSC Task Force wishes to thank the numerous CNSC staff members who provided expert advice
and timely assistance to the Task Force members.

ii

CNSC Fukushima Task Force Report

Executive Summary
On March 11, 2011, a magnitude 9.0 earthquake, followed by a devastating tsunami, struck Japan. It
left an estimated 25,000 people dead or missing, about half a million homes destroyed or damaged, and560 square kilometres inundated.
The combined impact of the earthquake and tsunami on the Fukushima Daiichi nuclear power plant(NPP) caused one of the world’s worst-ever nuclear accidents. In the hours and days that followed, threeof the plant’s six reactors overheated and suffered damage. Workers battled extraordinary conditions toprevent or delay radioactive releases over the surrounding region and into the sea. It is a tribute to theirefforts that releases were delayed sufficiently to enable the nearby population to be evacuated despitewidespread damage to the local infrastructure.
As the accident unfolded, the evacuation zone was expanded and people in a wider area were asked toshelter indoors. Widespread radiation monitoring and control of food production and distribution were
implemented. The Japanese government has indicated that some areas may remain uninhabitable formany years. Similarly, monitoring and control of food and water supplies will need to be maintained,
perhaps for many years. The emergency response measures currently in place have prevented fatalities
from radioactive releases and should ensure that any long-term health effects for the Japanese public are
negligible.

Immediate actions taken by the Canadian Nuclear Safety Commission
While major accidents such as this happen very infrequently, it is vitally important that all nuclear facility
designers and operators, nuclear regulators, and emergency response organizations learn every possible
lesson. The Canadian Nuclear Safety Commission (CNSC) has always endeavoured to continuously
improve both itself and the safety performance of the nuclear industry that it regulates. It is in this spiritthat the CNSC responded immediately to the accident at Fukushima Daiichi with the following actions:• activated its Emergency Operations Centre in Ottawa and staffed it 24/7 to monitor the
emergency, assess early reports and provide timely, accurate information to Canadians and toother Canadian government departments and agencies• requested licensees of Canadian Class I nuclear facilities 1 , under section 12(2) of the General
Nuclear Safety and Control Regulations, to review the lessons learned from the Fukushima
Daiichi accident• performed inspections of all NPPs and other nuclear facilities in Canada to assess the readiness of
mitigating systems – these inspections covered seismic preparedness, firefighting capability,
backup power sources, hydrogen mitigation and irradiated fuel bay cooling• established a Task Force to evaluate the operational, technical and regulatory implications of theaccident and the adequacy of emergency preparedness for NPPs
The CNSC Fukushima Task Force was created with the objective of reviewing the capability of NPPs in
Canada to withstand conditions similar to those that triggered the Fukushima accident. Specifically, the
CNSC Task Force examined the response of NPPs to external events of higher magnitude than havepreviously been considered. It also examined the licensees’ capability to respond to such events. The
focus was on the need to “anticipate the unexpected”: events such as earthquakes, tornadoes or hurricanesthat may cause a prolonged loss of electrical power, resulting in operators not being able to continue
cooling the reactors. The focus was also on the need for an integrated response capability.

1

Class I nuclear facilities are defined in the Class I Nuclear Facilities Regulations and include nuclear power plants,
research reactors and fuel fabrication facilities.

iii

CNSC Fukushima Task Force Report

Safety review criteria
The scope of the review, documented in Nuclear Power Plant Safety Review Criteria, was consistent withthe defence-in-depth approach underlying the NPP design, namely:• identification and magnitudes of external events• adequacy of design-basis-accident analysis• consideration of beyond-design-basis accidents• implementation of severe accident management• licensees’ emergency response plans• nuclear emergency management in Canada• CNSC regulatory framework and processes
The defence-in-depth strategy assures prevention and control of events and accidents at several
engineering and procedural levels in order to ensure the effectiveness of the protection of physicalbarriers against the release of radioactive materials. In principle, if a failure were to occur, it would be
detected and compensated for, or corrected, by appropriate measures to maintain protection of the public.
The Nuclear Power Plant Safety Review Criteria generally exceed the requirements and expectations of
the current CNSC regulatory framework. The CNSC Task Force review findings relate exclusively to thelessons learned from the Fukushima accident.
In the process of formulating the safety review criteria, the CNSC Task Force considered all theapplicable lessons learned to date from the Fukushima accident and reviewed selected international
reports to ensure that all aspects relevant to Canada were addressed. Effectively, the CNSC Task Forcehas subjected the Canadian NPPs, the existing emergency response measures, and the regulatory
framework and supporting processes to a systematic and comprehensive “stress test” to evaluate means tofurther protect the health and safety of Canadians and the environment. The post-Fukushima review has
examined events more severe than those that have historically been regarded as credible and their impact
on the NPPs. The CNSC Task Force has proposed changes to designs or procedures, wherever gaps were
found, in order to minimize or eliminate their impact.

Strengthening reactor defence in depth
Based on the post-Fukushima review, the CNSC Task Force confirms that the Canadian NPPs are robust
and have a strong design relying on multiple layers of defence. The design ensures that there will be no
impact on the public from external events that are regarded as credible. The design also offers protection
against more severe external events that are much less likely to occur.
Nevertheless, the CNSC Task Force has a number of recommendations for strengthening each layer ofdefence built into the Canadian NPP design and licensing philosophy. In particular, the CNSC Task Forcerecommends that certain design enhancements for severe accident management – such as containment
performance to prevent unfiltered releases of radioactive products, control capabilities for hydrogen andother combustible gases, and adequacy and survivability of equipment and instrumentation – should be
evaluated and implemented wherever practicable. Some of these enhancements have already been
implemented and others should be implemented as rapidly as practicable.

Enhancing emergency response
The CNSC Task Force also confirms that the current status of emergency preparedness and response
measures in Canada, specifically the onsite and offsite preparedness and response, is adequate. The CNSC
Task Force has verified that there are no significant gaps in emergency planning at Canadian NPPs. The
licensees maintain and operate comprehensive and well-documented emergency plans which are regularly
tested through self-audited drills and exercises. The CNSC Task Force has also verified that there are noiv

CNSC Fukushima Task Force Reportsignificant gaps in nuclear emergency planning at provincial and federal levels. The existing provincial
and federal emergency plans are well documented and effectively integrated with onsite emergency
preparedness and response measures.
Notwithstanding these measures, their effectiveness can be further improved through upgrading onsite
emergency facilities and equipment, in particular through formalizing all arrangements and agreements
for external support and installing automated real-time station boundary radiation monitoring systems
with appropriate backup power. Federal and provincial nuclear emergency planning could be
strengthened through establishing a formal, transparent, national-level oversight process for offsite
nuclear emergency plans, programs and performance, and through scheduling of regularly planned fullscale exercises.

Improving regulatory framework and licensing
The CNSC Task Force has performed a detailed review of the CNSC regulatory framework andprocesses, and concludes that the Nuclear Safety and Control Act does not need revision and that there isno need to revisit the structure of the regulatory framework as a result of the lessons learned from the
Fukushima Daiichi accident. The Canadian regulatory framework is strong and comprehensive and iseffectively applied for the whole range of plant conditions, including severe accidents. In particular, the
CNSC Task Force notes that the Act authorizes the Commission to establish classes of licences and that
the CNSC has the authority and flexibility to rapidly amend licences to impose additional requirements inorder to continuously improve the safety performance of the nuclear industry. This is regarded as astrength of the Canadian system.
Nevertheless, to widen the range of instruments allowing for an effective application of the Act, the
CNSC Task Force recommends that the Class I Nuclear Facilities Regulations be amended to require
licensees to submit offsite emergency plans. It also recommends that the Radiation Protection
Regulations be amended to be more consistent with international guidance and to describe the regulatory
requirements needed to address radiological hazards during the phases of an emergency in greater detail.
Furthermore, the CNSC Task Force recommends enhancing the oversight of NPPs by implementing aperiodic safety review process.
The regulatory document framework should be enhanced by updating selected requirements andexpectations for design-basis and beyond-design-basis accidents. These updates will ensure that lessons
learned are built into the regulatory oversight program for existing reactors and new builds.

Overall conclusion
The CNSC Task Force concludes that Canadian NPPs are safe and that the risk posed to the health andsafety of Canadians or to the environment is small. The CNSC staff have also verified that all Canadian
NPPs are located far from tectonic plate boundaries and that the threat of a major earthquake at a
Canadian NPP is negligible. The CNSC Task Force is confident that the improvements recommended inthis report will further enhance the safety of nuclear power in Canada and will reduce the associated risk
to as low as reasonably practicable.
Under the oversight of the CNSC and its staff, Canadian NPPs have been operating safely for over 40
years. As has always been the case, they will only be licensed if the CNSC is satisfied that they willcontinue to be operated safely.

v

CNSC Fukushima Task Force Report

Table of Contents
Preface.....................................................................................................................................................i

Acknowledgements.......................................................................................................................................ii
Executive Summary .....................................................................................................................................iii
1

Background................................................................................................................................... 1

2
2.1
2.2
2.3

Summary of the Accident ............................................................................................................. 2
Operating units .......................................................................................................................... 3
Spent fuel storage ...................................................................................................................... 6
Offsite consequences................................................................................................................. 6

3.1
3.2
3.3
3.4

Initial CNSC Response................................................................................................................. 9
Activation of the CNSC Emergency Operations Centre ........................................................... 9
Regulatory request to licensees ............................................................................................... 10
CNSC inspections of Canadian nuclear power plants ............................................................. 10
The CNSC Task Force ............................................................................................................ 11

4.1
4.2

International Response ............................................................................................................... 12
Review of terms of reference of international task forces....................................................... 12
Early results of other international task forces ........................................................................ 13

5.1
5.2
5.3

Comparison of Canadian and Japanese External Hazards.......................................................... 17
Canadian tsunami hazard profile ............................................................................................. 17
Canadian seismic hazard map ................................................................................................. 19
Other external hazards............................................................................................................. 20

6.1
6.2
6.3
6.4
6.5

Safety Review of Canadian Nuclear Power Plants..................................................................... 20
External hazards ...................................................................................................................... 21
Design-basis accidents ............................................................................................................ 23
Beyond-design-basis accidents................................................................................................ 25
Severe accident management .................................................................................................. 30
Emergency response................................................................................................................ 35

7.1
7.2
7.3
7.4
7.5

Nuclear Emergency Management in Canada ............................................................................. 40
Nuclear power plant licensees ................................................................................................. 41
Government of Canada............................................................................................................ 42
Provincial governments........................................................................................................... 44
International stakeholders........................................................................................................ 50
Review findings for nuclear emergency management in Canada ........................................... 52

8.1
8.2
8.3
8.4
8.5
8.6
8.7

The CNSC Regulatory Framework and Processes ..................................................................... 53
Act and regulations.................................................................................................................. 53
Licences, licence conditions and orders .................................................................................. 54
Regulatory and guidance documents....................................................................................... 55
Other parts of the regulatory framework ................................................................................. 56
Compliance.............................................................................................................................. 56
Processes ................................................................................................................................. 56
Review findings for the regulatory framework and processes ................................................ 56

3

4

5

6

7

8

9

Implications for New Builds....................................................................................................... 57

10
10.1

Conclusions and Recommendations........................................................................................... 59
Strengthening reactor defence in depth ................................................................................... 60vi

CNSC Fukushima Task Force Report
10.2
10.3

Enhancing emergency response .............................................................................................. 61
Improving regulatory framework and processes ..................................................................... 61

Glossary. ................................................................................................................................................. 63

References................................................................................................................................................... 68
Appendix A

CANDU Overview ........................................................................................................... 71

Appendix B
Progression of a Loss of Heat Sink Accident ................................................................... 81
B.1
Secondary boil-down............................................................................................................... 81
B.2
Primary boil-down................................................................................................................... 81
B.3
Moderator boil-down............................................................................................................... 82
B.4
Shield tank / calandria vault boil-down................................................................................... 82
B.5
Shield tank / calandria vault failure......................................................................................... 82
Appendix C
CNSC Emergency Operations Centre Lessons Learned................................................... 83
C.1
Background ............................................................................................................................. 83
C.2
Methodology ........................................................................................................................... 83
C.3
Key observations ..................................................................................................................... 84
C.4
Conclusion............................................................................................................................... 84
Appendix D

Correspondence of Report Recommendations to Detailed Findings ................................ 85vii

CNSC Fukushima Task Force Report

1

Background
On March 11, a magnitude 9.0 earthquake 2 struck off the northeast coast of Japan’s main island. A
devastating tsunami followed. The earthquake and tsunami left an estimated 25,000 people dead or
missing, about half a million homes destroyed or damaged and 560 square kilometres of land
inundated.
The combined impact of the earthquake and tsunami on the Fukushima Daiichi nuclear power plant(NPP) caused one of the worst-ever nuclear accidents. In the hours and days that followed, the coresof three of the six reactors at the site melted down and released radioactive material over thesurrounding region and to the sea.
The Japanese authorities initially rated the nuclear accident at level 4 on the INES 3 scale(International Scale of Nuclear Incidents). They subsequently increased the level to 7, the highest on
the scale. A final assessment of the severity and causes of the incident will come only after theconclusion of full investigations, expected to take several years. Nevertheless, enough information isavailable to begin the lessons-learned process.
One of several actions that the Canadian Nuclear Safety Commission (CNSC) took in response to theaccident was to set up a Task Force to investigate the lessons learned from the Fukushima Daiichi
accident and their implications for Canada. This report documents the findings and recommendationsof the CNSC Fukushima Task Force.
The report provides relevant background information in the following areas:• a summary of the accident (section 2)• Canadian and international actions in response to the accident (sections 3 and 4)• a comparison of Japanese seismic and flooding hazards to Canadian hazards (section 5)
The report summarizes the detailed CNSC Task Force reviews in three main areas:• capability of Canadian NPPs to withstand extreme external events, including a review oflicensees’ responses to the CNSC’s request for information concerning lessons learned(section 6)• adequacy of Canada’s measures to respond to a major nuclear emergency (section 7)• adequacy of the Canadian regulatory framework and processes, including findings involving
changes to regulatory requirements (section 8)
The implications of the CNSC Task Force findings on potential new reactors in Canada are discussed
in section 9. The conclusions and recommendations arising from the review are given in section 10.
Appendix A provides an overview of CANDU (Canadian Deuterium-Uranium) reactors with anemphasis on features important to accidents with loss of electrical power.

2

Earthquake magnitudes are measured on the moment magnitude scale (values are very similar to the earlier
Richter scale). The scale is based on energy released by the earthquake. An increase in 1 on the scale represents
a 32 times increase in energy released.
3
The INES was developed by the International Atomic Energy Agency. More information is available atiaea.org/Publications/Factsheets/English/ines.pdf.

1

CNSC Fukushima Task Force Report2

Summary of the Accident
On March 11, 2011, at 2:46 p.m. local time, a magnitude 9.0 earthquake struck off the northeastern
coast of Japan approximately 175 km from the Fukushima Daiichi plant. This was one of the largest
earthquakes in recorded history, moving parts of Japan 3 m east and slightly changing the speed ofrotation of the earth. The maximum ground acceleration 4 at Fukushima Daiichi was 0.56 g, recorded
in unit 2, about 25 percent greater than the plant design basis (meaning 25 percent greater than the
ground acceleration that the plant was designed to withstand). Figure 2.1 shows the locations of theearthquake epicentre and the NPPs. The Tokyo Electric Power Company (TEPCO) operates the
Fukushima Daiichi plant.
Although other reactors on the east coast of Japan were affected by the earthquake and tsunami, only
Fukushima Daiichi units 1 to 4 suffered serious damage. This report considers only those units, since
sufficient cooling was maintained at all other units.
Figure 2.1

Earthquake Shakemap Showing Nuclear Power Plant Locations

Units 1, 2 and 3 were operating at full power, and units 4, 5 and 6 were already shut down inscheduled maintenance outages. The operating units shut down automatically, as designed, at the timeof the earthquake. At the same time, all offsite power was lost; however, emergency diesel generators
started automatically as designed and supplied essential electrical equipment.

4

Ground acceleration is a measure of the strength of ground motion in an earthquake and is important inunderstanding the effects on building structures. It is normally given in multiples of the acceleration due togravity, g. The ground acceleration at a location depends on the magnitude of the earthquake and the distancefrom the epicentre.

2

CNSC Fukushima Task Force Report
Beginning 41 minutes after the earthquake, a series of tsunami waves hit the station. The tsunami wasmuch higher than had been considered in the plant design and it overwhelmed much of the low-lying
equipment. The original station design assumed a maximum tsunami height of 3.1 m, later upgradedto 5.6 m. The highest of the tsunami waves that struck the Fukushima stations was estimated at 14 to
15 m on land. It is important to distinguish between the wave height at sea and the wave height due torun-up on land. The run-up height can be significantly higher than the wave height at sea and is afunction of land topography.
Within 54 minutes after the earthquake, the tsunami had stopped all the emergency diesel generatorsand flooded the electrical switchgear. Units 1 to 4 had two air-cooled emergency diesel generatorsthat escaped the flooding. It is not known if they were operable, but they could not have been usedanyway because the electrical switchgear had been flooded. As a result, units 1 to 4 were left with
only battery power.

2.1 Operating units
Figure 2.2 shows the general arrangement of a boiling-water reactor of the type used at Fukushima
Daiichi.
Figure 2.2

Cutaway View of Boiling-water Reactor Type 1 Containment

Each unit contains one reactor. The reactor fuel elements are made up of uranium dioxide pellets in azircaloy tube, about 4 m in length. The fuel elements are arranged in 8×8 bundles and positioned
vertically in the reactor core. The reactor core is located low down in the reactor pressure vessel. The

3

CNSC Fukushima Task Force Report
reactor pressure vessel 5 is inside the steel primary containment which comprises a drywell (inside theyellow boundary shown on the figure) and a suppression pool or wetwell. The wetwell is partly filledwith cold water and is used to condense steam from the reactor when it can no longer be sent to theturbine (e.g., after an accident).
Spent fuel from the reactor is stored in the spent fuel pool located at a high elevation inside thesecondary containment. The secondary containment does not have pressure retaining capability.
The following description applies generically to each of units 1, 2 and 3 which were operating at thetime of the earthquake. The timing of events varied from unit to unit, but the broad progression of
events was similar.
After the loss of alternating current (AC) electrical power, pumps driven by steam turbines were usedin units 2 and 3 to maintain cooling. These pumps use steam from the reactor as a power source andreject heat to the suppression pool. Continuous cooling of a reactor core must be maintained evenafter shutdown because the fuel continues to generate heat, known as decay heat 6 . After several hours
the batteries were exhausted (or cooling pumps had failed) and all reactor cooling was lost. Unit 1
was a slightly older design and did not have steam-driven pumps. Unit 1 lost cooling almost
immediately after the tsunami.
Without adequate cooling, pressure began to rise in each reactor and the reactor pressure vessel relief
valves opened to vent 7 excess steam into the suppression pool located in the containment wetwell.
Because steam was being removed from the reactor pressure vessel and not replaced, the reactor
began to boil dry.
At some point, the core began to uncover and fuel began to rapidly overheat. As fuel temperaturesrose, fuel failures began, first releasing gaseous fission products and progressively the less volatile
fission products. When fuel sheath temperatures exceeded 1,200°C, the zircaloy sheath material
reaction with steam accelerated significantly to produce zirconium oxide and hydrogen and a large
amount of heat. The core began to lose structural strength and melt down 8 .
The atmosphere in the reactor pressure vessel was a mixture of steam, hydrogen and fission products.
This mixture was vented to the suppression pool and from there to the primary containment. Because
the primary containment was, by design, filled with nitrogen, the hydrogen could not ignite or
explode due to lack of oxygen.
The cold water in the suppression pool absorbed the energy of the steam being discharged from thereactor and kept primary containment pressure under control during the initial hours of the accident.
But, with no heat removal from primary containment, the suppression pool heated up, becoming
progressively less effective. Pressure in the primary containment began to rise. Due to the pressurebuildup, the primary containment was at risk of failing and causing an uncontrolled release ofradioactive substances. To avoid containment failure, the operator opened valves to vent the primarycontainment. Hydrogen in the vented gases mixed with air in the secondary containment to form an

5

The reactor pressure vessel is a large steel vessel containing the reactor core and filled with reactor coolant.
Decay heat is produced by the decay of radioactive material in the fuel. For a typical reactor, decay heat falls
from about 7 percent immediately after shutdown of the fission reaction to 1 percent after about 5 hours and 0.5
percent after a day.
7
Venting is the process of removing unwanted or excess gas from a closed system, either automatically throughrelief valves or manually through vent valves opened by the operator.
8
Zircaloy fuel sheaths melt at about 1,760°C. Fuel pellets melt at about 2,760°C.
64

CNSC Fukushima Task Force Report
explosive mixture, leading to explosions that damaged the secondary containment buildings andpossibly other equipment.
Approximate timings of the significant parts of the accident sequence are given in table 2.1.
Table 2.1 Approximate Event Timings (hours)
Event

Unit 1

Unit 2

Unit 3

Notes

Earthquake

0.0

0.0

0.0

Reactors all shut down and stable

Tsunami and loss of AC
power

0.9

0.9

0.9

Diesel generators incapacitated bytsunamiLoss of core cooling/makeup

~1.9

70.7

36.0

Units 1 and 3, loss of batteries
Unit 2, pump failure

Increase in radiation
reading

3.1

Top of core uncovered

~2.5

~75

~40

From calculations after accident

Fuel melt

~4.5

~77

~42

From calculations after accident

Reactor pressure vessel
failure

~10

~109

~66

From calculations after accident

Start of containment
venting

~20.0

~44.2

41.9

Data uncertain – conflicting reports

Injection of water begun

24.1

73.8

42.7

Fresh and/or seawater injected toreactor pressure vessels to restore lost
inventory

Hydrogen explosion

24.8

87.4

68.3

Units 1 and 3 at reactor service floor
Unit 2 inside secondary containment

Possible start of core overheating

The above data is based on information from the Report of the Japanese Government to the IAEA
Ministerial Conference on Nuclear Safety [1] and augmented by other sources. Timings are given inhours from the time of the earthquake. Timings of some events are uncertain; however, this sequenceof events is thought to be broadly correct.
The time of the start of core damage is quite uncertain. However, the large-scale production ofhydrogen clearly indicates that core dryout and subsequent damage on unit 1 occurred within 24
hours of the earthquake. The start of core damage for units 2 and 3 appears to have been considerably
later. Efforts to restore cooling with seawater likely were partially successful in delaying and reducing
the extent of core damage and reactor pressure vessel failure.
Approximately 48 hours after the earthquake, high radiation readings forced the operating staff toevacuate from the main control room. Thereafter, they were able to enter the control room for only
short periods.
After the initial days of the accident, in which the damage escalated and the utility struggled to regain
control, a long period of gradual recovery followed. Electrical and water supplies were slowly
restored. However, high radiation levels and widespread damage impeded work. Venting of gases
continued periodically to prevent containment from overpressurizing. Highly radioactive water
accumulated in low-lying rooms and leaked, or was discharged into the Pacific Ocean.
5

CNSC Fukushima Task Force Report
The damaged reactors are now being cooled by injections of water recovered from the containment orbuilding basements. The water is cooled and passed through cleanup equipment which is gradually
removing radioactive materials and salt. This recovery work will continue for many months according
to the TEPCO recovery plan [2].

2.2 Spent fuel storage
Spent fuel discharged from a Fukushima-type reactor is initially stored in the spent fuel poolassociated with that unit. The spent fuel pool is at the top of the secondary containment and is outside
the primary containment (see figure 2.2). Spent fuel is cooled in the spent fuel pool for at least 18
months and can then be moved to the common spent fuel storage pool.
The common spent fuel storage pool held 6,375 fuel assemblies at the time of the accident. Although
the central fuel storage pool was without active cooling for 13 days, the temperature rose only a few
degrees and did not give rise to any safety concerns. Normal cooling was then resumed.
After at least five years in the central fuel storage pool, the assemblies can be transferred to dry
storage. At the site, 408 assemblies were in dry cask storage and were unaffected by the earthquake
and tsunami.
Table 2.2 shows the inventory of fuel assemblies in the spent fuel pools in units 1 to 4.
Table 2.2 Spent Fuel Pool Inventories (fuel assemblies)
Unit

Fuel inreactorSpent fuelin pool

New fuelin pool

#1

400

292

100

#2

548

587

28

#3

548

514

52

#4

0

1,331

204

Fuel in the individual reactor spent fuel pools was a concern after the accident as active cooling waslost. However, in the absence of leakage, there was sufficient water to maintain fuel cooling for a few
days. The heat load in unit 4 was high because the entire core had been unloaded into it recently.
After the explosion in unit 4 on March 15, Japanese authorities were concerned that the pool could beleaking, leading to the fuel uncovering, overheating and generating hydrogen. However, they now
believe that the explosion was caused by hydrogen leaking through the containment vent lines fromunit 3. The presence of fission products in the unit 4 spent fuel pool indicates that some fuel failures
may have occurred but the majority of fuel assemblies are undamaged.
In May, the Japanese authorities became concerned that the earthquake, repeated aftershocks and the
explosion in unit 4 may have weakened the concrete structure of the building supporting the spent
fuel pool. To address this concern, a steel and concrete support structure was built below the unit 4
spent fuel pool.

2.3 Offsite consequences
Significant releases of radioactive material to the atmosphere began when the reactor containments
were vented, beginning at about 20 hours after the earthquake for unit 1 and over 40 hours after the6

CNSC Fukushima Task Force Reportearthquake for units 2 and 3. Major releases began on March 15 (4 days after the earthquake). An
evacuation zone of 20 km had already been established. Figure 2.3 shows radiation readings taken atvarious locations within Fukushima Prefecture. For comparison, the United Nations ScientificCommittee on the Effects of Atomic Radiation (UNSCEAR) [3] states that natural backgroundradiation around the world typically ranges between 1 and 13 mSv/year (0.1 to 1.5 μSv/hr.), with anaverage of 2.4 mSv/year (about 0.3 μSv/hr.). The figure shows that the radiation levels are fallingback towards normal background levels, although they are still higher than before the accident.
Figure 2.3

Radiation Readings in Fukushima Prefecture

The Japanese authorities expanded the protective measures around Fukushima Daiichi as the accident
progressed and the releases of radioactive materials increased. In the first few days and weeks after an
accident, the most significant risk is from radioactive iodine-131 (half-life of 8 days). On March 11(day 1), at 9:23 p.m. local time (6.6 hours after the earthquake), the authorities established anevacuation area with a radius of 3 km and a sheltering area with a radius of 10 km. The following

7

CNSC Fukushima Task Force Reportday, they extended the evacuation zone to 20 km and on March 15 (day 5) to 30 km. Preparations for
distributing stable iodine 9 tablets began on March 12 (day 2).
Figure 2.4 shows the estimated external doses that would be received in the first year in the absenceof evacuation.
Figure 2.4

Estimated First-year Doses

9

Stable iodine in the form of potassium iodide (KI) is used to saturate the body with non-radioactive iodine sothat radioactive isotopes of iodine are not taken up by the body. Iodine-131 is a particular hazard in the earlydays of an accident. Iodine concentrates in the thyroid gland and iodine-131 exposure can lead to increased riskof thyroid cancer later in life.

8

CNSC Fukushima Task Force Report
Figure 2.4 was developed by the French Institut de Radioprotection et de Sûreté Nucléaire (IRSN) [4]using data published by the Japanese Ministry of Education, Culture, Sports, Science and Technology(MEXT) and shows only external doses. Additional doses due to internal exposures, such as throughinhaling contaminated air, ingesting contaminated foodstuffs and drinking water, would be in excessof this. The long-term external dose is dominated by the isotopes cesium-137 (half-life of 30 years)
and cesium-134 (half-life of 2 years) which were deposited following releases from the damaged
reactors.
Health Canada’s Canadian Guidelines for Intervention During a Nuclear Emergency [5] recommend
evacuation of the population if the projected whole-body dose 10 exceeds 50 mSv in 7 days. The
International Commission on Radiological Protection (ICRP) publications 103 [6] and 109 [7]recommend protective measures (such as evacuation) if the projected dose is between 20 and 100
mSv/year, with the responsible authority establishing the desired level of protection. Although forradiation protection purposes we assume that all radiation exposures present a health risk, in practice,no adverse health effects have been observed at doses below about 100 mSv.
On April 22, an irregular evacuation zone was established to move people from the northwest area
where higher activity had been measured. Some areas may remain uninhabitable for many years.
With the evacuation zones in place, it seems unlikely that members of the public will be exposed toexternal doses greater than 20 mSv/year. Monitoring and control of food and water supplies havebeen established over a wide area. These controls will need to be maintained, perhaps for many years.

3

Initial CNSC Response
Immediately after the incident, the CNSC took the following actions:• activated the CNSC Emergency Operations Centre (EOC) and staffed it 24/7 to monitor the
emergency, assess early reports and provide timely, accurate information to Canadians• requested Canadian licensees of Class I nuclear facilities, uranium mines and mills to review
the lessons learned• performed inspections and walkdowns at nuclear facilities to assess system readiness of
mitigating systems• convened a Task Force to evaluate the operational, technical and regulatory implications of
the accident for NPPs
These actions are discussed in the subsections below.

3.1 Activation of the CNSC Emergency Operations Centre
Following notification of the Fukushima Daiichi accident, by midday, March 11, the CNSC EOC was
activated at its headquarters, in accordance with the CNSC Emergency Response Plan CAN – 2.1 [8].
Staff from the CNSC Nuclear Emergency Organization (NEO) assembled in the EOC to assess thesituation in Japan and develop the strategy for the Canadian response. For 23 days, CNSC NEO staff
worked in the EOC on a 24/7 basis to monitor and assess the situation in Japan. CNSC specialists
provided expertise in the fields of reactor technology, accident progression and radiation protection.

10

Projected dose is the dose that would be received in the absence of protective measures.

9

CNSC Fukushima Task Force Report
The CNSC NEO monitored the situation in Japan in close collaboration with other Government of
Canada departments and agencies, nuclear regulators from the United States, United Kingdom andFrance, as well as with the International Atomic Energy Agency (IAEA). The CNSC NEO supported
the Department of Foreign Affairs and International Trade Japan Crisis Team on a daily basis byproviding timely and accurate information and advice to Canadians in Japan and in particular to the
Canadian ambassador and his staff in Japan. Information was posted on the CNSC Web site toprovide a consistent, objective and credible source of information for the Canadian public, CNSC
staff and other government departments.
Following the deactivation of the EOC on April 4, 2011, CNSC staff undertook a formal lessonslearned process to capture the important operational experience. An after-action report and an
improvement plan were approved by the CNSC Management Committee. These reports are
summarized in Appendix C.

3.2

Regulatory request to licensees

Subsection 12(2) of the General Nuclear Safety and Control Regulations [9] places an obligation on
licensees to respond to a request from the Commission, or a person who is authorized by theCommission, to “conduct a test, analysis, inventory or inspection in respect of the licensed activity or
to review or to modify a design, to modify equipment, to modify procedures, or to install a new
system or new equipment”. In accordance with this provision, the CNSC Executive Vice-President
and Chief Regulatory Operations Officer wrote to all Class I nuclear facilities on March 17 requestingthat licensees:••“review initial lessons learned from the earthquake in Japan and re-examine the safety casesof nuclear power plants, in particular the underlying defence-in-depth concept, with focus on:• external hazards such as seismic, flooding, fire and extreme weather events;• measures for the prevention and mitigation of severe accidents;• emergency preparedness; andreport on implementation plans for short-term and long-term measures to address any
significant gaps.”

Letters similar to the “12(2) letters” described above were sent to the operators of uranium mines andmills licensed by the CNSC. The Fukushima accident has the greatest relevance to NPPs and the
CNSC has addressed it first through the work of the CNSC Task Force reported here. CNSC staff will
use the results of the Task Force investigations of NPPs to drive continuous improvement at otherfacilities.

3.3 CNSC inspections of Canadian nuclear power plants
Immediately after the Fukushima event, CNSC site staff performed walkdowns at Canadian NPPs toverify the licensees’ emergency preparedness for external hazards and severe accidents so that the
CNSC could reassure the Commission and Canadian public that certain aspects that had contributed
to the events in Japan had been specifically verified. These aspects included:• seismic:• readiness of secondary control room and seismic route• availability of manuals and procedures

10

CNSC Fukushima Task Force Report•fire:• confirmation of minimum shift complement 11 monitoring• arrangements for offsite support•

backup power availability and condition•hydrogen igniters:• routine testing to confirm availability•

irradiated fuel bays (IFBs):• readiness of components and equipment• provision/availability of make-up water and heat sinks 12• verification of alarms on flow, temperature, and stack release

This information was reported to the Commission on March 30, 2011, in CMD 11-M15, CNSC Staff
Presentation on Fukushima Event [10]. There were no significant findings and no actions wereplaced on the licensees as a result of these inspections.
CNSC staff also verified the following activities taken by the licensees:• capability of installed equipment and associated procedures to mitigate conditions that result
from beyond-design-basis accidents• capability of provisions to mitigate station blackout 13 conditions, including robustness of
backup power and the emergency power supply systems• capability to mitigate consequences of external events that may lead to beyond-design-basis
accidents• identification of important equipment needed to mitigate consequences of external events• identification of any potential scenarios that could compromise the equipment’s function
during seismic events• ability of units to rapidly reduce reactor power to match the station power demand following
a loss of offsite power, the duration of battery backup, and fuel supply to emergency
generators
As reported to the Commission on June 8, 2011, in CMD 11-M30, Status Report on Power Reactors[11], CNSC staff are satisfied with short-term actions taken by licensees.

3.4 The CNSC Task ForceThe CNSC Fukushima Task Force [12] was set up to evaluate operational, technical and regulatory
implications of the 2011 Fukushima Daiichi accident on Canadian NPPs. It was also tasked withreviewing NPP licensees’ responses to the 12(2) letters. The Task Force Chair was tasked with
reporting the results of the Task Force review to the Executive Vice-President and Chief Regulatory
Operations Officer of the CNSC.

11

The minimum shift complement is the minimum number of qualified staff required to be present to ensurethat the licensed activity can be carried out safely.
12
A heat sink is a place to reject excess heat. It includes the equipment and fluids needed to transport the heatfrom the source (e.g., nuclear fuel) to the sink (e.g., the atmosphere or a large body of water).
13
Station blackout formally refers to the loss of normal and backup AC power but not loss of emergency power.
In this report, loss of emergency power is also considered. Normal AC power is supplied from the electrical gridand from the station’s own main turbine generators. Backup power is supplied by multiple standby generators.
Emergency power is supplied by independent generators.

11

CNSC Fukushima Task Force Report
The mandate of the CNSC Task Force was to:• review submissions from licensees who had been directed under 12(2) letters to re-examine
the safety cases of their respective NPPs; underlying defence in depth against external
hazards; severe accidents; and emergency preparedness• assess available technical and operational information from the events at the Fukushima
Daiichi NPP and identify a high-level set of lessons learned• develop recommendations for short-term and long-term measures to address any
shortcomings at CANDU reactors, and recommend whether design or operational
modifications, including supporting research, are needed• determine priorities for implementation of corrective actions from lessons learned and theneed for further examination• develop recommendations, as appropriate, for potential changes to CNSC regulatory
requirements, inspection programs and policies for existing CANDU reactors and new builds
The CNSC Task Force prepared the Nuclear Power Plant Safety Review Criteria [13] to define
measurable criteria for each area of the assessment.
The CNSC Task Force met with licensees on a number of occasions to clarify CNSC expectations.

4International Response
The worldwide response of nuclear organizations, operators and regulators has been to attempt tolearn all the salient lessons from the events at Fukushima. The CNSC Task Force has communicatedregularly with other regulatory bodies and followed the work of the international community to date.
CNSC staff will continue to review the findings of other organizations as they become available.

4.1 Review of terms of reference of international task forces
Members of the CNSC Task Force have monitored the approaches of selected international task
forces. The terms of reference of selected task forces have been reviewed to help validate the CNSC’s
approach. The selected international task forces were from the United States Nuclear Regulatory
Commission (U.S. NRC) [14] and the Western European Nuclear Regulators’ Association (WENRA)[15].
The CNSC Task Force found that the three task forces have broadly similar terms of reference. The
WENRA approach has provided the basis for many of the reviews currently being performed aroundthe world.
WENRA has developed an approach based on design and safety analysis techniques. The approach
places particularly strong emphasis on giving a detailed and systematic evaluation of accident
progression that considers successive failures of the mitigating measures and identifies key timings
and potential cliff edges 14 .

14

A cliff edge is a large increase in the severity of an event caused by a small change of conditions. Cliff edges
can be caused by changes in the magnitude of the event or changes in the plant response. For example, a smallchange in wave height leads to a large change in conditions if the wave goes over the shore defences (e.g., aseawall).

12

CNSC Fukushima Task Force ReportWENRA explicitly mentions consideration of accidents at multiple reactors on a site but gives littleemphasis to this aspect. The CNSC Task Force placed more emphasis on multi-unit events since themulti-unit reactors in Canada share parts of containment.
The U.S. NRC review was focused on the adequacy of its own specific regulatory requirements anddid not include (at this stage) input from licensees.
After the above comparison was completed, the European Nuclear Safety Regulators Group(ENSREG) released its “stress test” specification [16]. The specification was based closely on the
WENRA stress test and does not change the CNSC Task Force review findings.
The CNSC Task Force found that the CNSC terms of reference and Nuclear Power Plant Safety
Review Criteria are consistent in general terms with the approaches seen in the other international
task forces and include the specific areas of emphasis identified above.

4.2 Early results of other international task forces
Most nuclear regulators and organizations have prepared, or are preparing, lessons-learned reports.
Selected reports that were available in time to be considered here have been reviewed and theirfindings evaluated to help ensure that the CNSC Task Force assessment is comprehensive. Note thatmany other reports will become available later. CNSC staff will review them, but not in the context ofthe present report.
One of the earliest and most comprehensive reports is Japan’s report to the IAEA Ministerial
Conference on Nuclear Safety [1]. The CNSC Task Force has used this report extensively to help it
understand the accident and Japan’s response to it. Lessons identified by other members of theinternational community are also considered in the discussion below.
The most important lessons learned and their importance from a Canadian perspective are discussed
below. Cross-references are provided to the section of this report where each lesson is addressed.

4.2.1

Identification and magnitude of external hazards

The Japanese government considers that the fundamental cause of the accident at Fukushima Daiichi
was a failure to identify the appropriate magnitude of the tsunami hazard.
All external events (not just seismic and tsunami) relevant to Canadian NPPs must be identified andthe selection of appropriate magnitude for the events must be verified. External events are assessed in
section 6.1.

4.2.2

Diverse power supplies

Fukushima Daiichi units 1 to 4 lost connections to the grid, and the emergency diesel generators were
flooded. The units still had air-cooled emergency diesel generators that were probably functional but
could not use them as the switchgear had been flooded. It is not enough to have available power
supplies; the full train of heat removal equipment from the reactor or spent fuel pool to the ultimate
heat sink must be operable.
Existing Canadian NPPs and most of the proposed designs for new reactors rely on active safetysystems to sustain core cooling in the long term. These require electrical power to function.

13

CNSC Fukushima Task Force Report
The consequences of the loss of power supplies and the timescales available for their restoration areassessed in section 6.3.

4.2.3

Diverse means of cooling fuelFukushima Daiichi unit 1 was able to maintain core cooling for only about 1.6 hours after the loss of
all electrical power. Units 2 and 3 had steam-driven coolant make-up capability (with no electricallydriven pumps) and maintained core cooling for 70 and 36 hours respectively, but were still not able toprevent core damage.
Existing Canadian NPPs and most of the proposed designs for new NPPs rely on active 15 cooling forreactors, containment and irradiated fuel bays (spent fuel pools). All designs have some degree of
passive cooling capability. The effective duration for the various passive heat sinks varies with thedesign.
Loss of cooling of the irradiated fuel bays is generally a lesser concern than loss of core cooling as
much more time is available before fuel overheats. However, irradiated fuel bays generally havefewer alternative cooling options than the core; therefore the issue is still important.
The cooling function, the consequences of its loss and the timescales available for restoration areassessed in section 6.3.

4.2.4

Prevention of hydrogen explosions

Adequate mitigation is needed wherever hydrogen can accumulate, in order to prevent explosions.
The Fukushima Daiichi design anticipated hydrogen production in severe accidents by filling the
primary containment with nitrogen so that there was no oxygen available for hydrogen combustion.
However, hydrogen produced by the damaged cores either leaked from the primary containment orfrom the containment vent system ducts and accumulated in the secondary containment. There were
no provisions for hydrogen mitigation in the secondary containment. In the secondary containment,
the hydrogen mixed with air to produce an explosive mixture which subsequently ignited, adding to
the damage.
CANDU reactors have some installed capability to compensate for their large inventory of zirconium
compared to other reactor designs. Provisions for mitigation of hydrogen are assessed in section 6.3
and 6.4.

4.2.5

Containment venting

The Fukushima Daiichi reactors had a venting system to protect the containment from overpressure.
The loss of electrical power caused difficulties in operation, and some periods of overpressure werereported. However, the system appears to have been successful in preventing gross containment
failure due to overpressure. Leakage from the venting system (perhaps caused by the earthquake)likely contributed to the hydrogen leakage that led to explosions in the secondary containment.
Controlled containment venting can protect containment from overpressurization during beyonddesign-basis accidents. Filtering of fission products to the extent practicable is important in reducing
radiation exposure to the public.

15

Active cooling relies on equipment with external input, such as electricity. Passive cooling relies on naturalforces, such as gravity.

14

CNSC Fukushima Task Force Report
Multi-unit CANDU reactors have a “negative pressure design” achieved by the provision of a large
vacuum building supported in the long term by a filtered venting system. This type of design can beeffective in limiting the release of radioactive material in design-basis accidents as any leakage is into
the containment. However, these systems are not designed to handle the large gas volumes that asevere accident may generate. Moreover, electrical power is required for controlled venting of thecontainment to maintain a negative pressure.
Provisions for containment venting and their operability are assessed in sections 6.3 and 6.4.

4.2.6

Protection of essential equipment

At the Fukushima Daiichi plant, safety-related equipment – particularly electrical supplies – was lostin the tsunami.
Essential services can be protected from external hazards and internal events by the separation of
redundant equipment (including vertical separation), by physical protection (e.g., fire barriers or
waterproof rooms) or by hardening 16 (e.g., environmental qualification).
Mitigation of beyond-design-basis accidents and severe accident management are assessed in sections
6.3 and 6.4.

4.2.7

Challenges to multi-unit nuclear power plants

The Fukushima accident emphasized that multi-unit NPPs face unique challenges, and that commoncause failures should be particularly considered for multi-unit sites.
Events involving multi-unit CANDU reactors can be complex and challenging. Containment integrity
for multi-unit severe accidents should be assured by adequate venting. The risks and implications ofhydrogen explosions should be particularly considered for multi-unit sites and necessary mitigating
systems should be properly located and implemented.
Other important considerations for multi-unit NPPs are:• availability of staff and resources to address a severe accident impacting several units
simultaneously, and overall effectiveness of severe accident management guidelines (SAMG)• shared equipment• calculation and control of potential source terms 17• impact on nuclear emergency plans
Challenges arising from multi-unit NPPs are assessed in sections 6.3 to 6.5.

16Equipment can be “hardened” to withstand harsh conditions by using suitable materials and conservative
design.
17
The source term is the amount and isotopic composition of material released (or postulated to be released)from a facility.

15

CNSC Fukushima Task Force Report

4.2.8

Effective severe accident management

Accident management measures were available at the Fukushima Daiichi plant, but were only
partially successful due to many factors, mostly related to the extent of the damage.
Challenges in executing severe accident management actions are likely to occur after any major
external event due to consequential damage onsite and/or loss of critical infrastructure offsite.
Specific challenges will depend on the nature of the event.
There may be additional challenges specific to multi-unit sites where one or more units are damaged.
This situation can lead to difficulties of access and additional strains on staff.
Effective accident management requires availability of equipment, either pre-installed, available
onsite or available offsite, as appropriate. The equipment should be maintained and tested sufficiently
to give reasonable confidence that it will function when required. Accident management guidelines
must be prepared and staff trained in their use. There must be sufficient staff to execute theguidelines. Verification of the guidelines should consider the likely environment in which theoperators must work (e.g., radiation fields, damaged plant systems) and provide options wherepracticable (e.g., alternative water injection points or electrical connections). Survivability of essential
instrumentation should be assessed to provide reasonable assurance that the essential instrumentation
will be available to guide operator actions.
Severe accident management is assessed in section 6.4.

4.2.9

Emergency response

The earthquake, tsunami and subsequent nuclear accident placed enormous strains on the emergency
response capability of Japan, the Fukushima prefecture and the NPP operator.
Major earthquakes and tsunamis are not credible threats at Canadian NPPs. Nevertheless, somehazards can lead to widespread disruption (e.g., ice storm or heavy snowfall). Others can be very
damaging in a local area (e.g., explosion, tornado). Emergency measures must be capable of reacting
to all credible events.
Effective emergency response relies on defined roles and responsibilities and clear lines ofcommunication. Timely information must be available to those who need it, both in terms of theaccident consequences and clear guidelines for protective actions. Communication must be
considered for all stakeholders: local, national and international.
Emergency response is assessed in section 6.5 (for licensees’ responsibilities) and section 7 (forfederal, provincial and municipal responsibilities).

4.2.10Legal and regulatory infrastructure

The Japanese government considered that the Fukushima accident revealed weaknesses in the legal
and regulatory infrastructure and regulatory framework in Japan. This, the Japanese government
holds, led to the establishment of a new regulatory body independent of the Ministry of the Economy,
Trade and Industry. In some areas, regulatory requirements did not exist or were not mandatory.
Some parts of the safety case for the NPPs were identified as having received scant attention.
Canada’s regulatory framework and processes are assessed in section 8.

16

CNSC Fukushima Task Force Report5Comparison of Canadian and Japanese External Hazards
Canada’s risks from external hazards are different from Japan’s. The tsunami generated from themagnitude 9.0 earthquake was the direct cause of the severe accident at Fukushima. The sections
below were produced in collaboration with staff of the Geological Survey of Canada and discuss theseismic and tsunami hazards for Canada. Other specific hazards taken into account in the NPP
designs are discussed in section 6.1 of this report.

5.1 Canadian tsunami hazard profile
A large underwater earthquake may displace the ocean floor, producing a tsunami that propagates
outward from the source, as shown in figure 5.1. Destructive earthquake-induced tsunamis are rare in
Canada. In Canada, the Pacific Coast (west coast) is at greatest risk from tsunamis because of the highincidence of earthquakes in that region.
Figure 5.1

Generation of a Tsunami

Most often, tsunamis, including the recent ones in Japan, are generated by subduction 18 earthquakes.
The Pacific Coast is exposed to the hazard from both local and distant subduction zones. The
distribution of earthquakes greater than magnitude 5.0 in Canada is shown in figure 5.2. Note that thefigure shows the 18th century Cascadia earthquake along the Pacific Coast, which was estimated to
be about magnitude 9.0. Other data is more recent.

18

Subduction is the movement of one of the tectonic plates making up the earth’s crust under another.
Subduction zones are associated with high seismic and volcanic activity.

17

CNSC Fukushima Task Force Report
Figure 5.2

Earthquakes Greater Than Magnitude 5.0

The risk of tsunamis at each of the Canadian NPPs is discussed below.

5.1.1

Bruce, Darlington and Pickering

Bruce, Darlington and Pickering are located in the Great Lakes region of Canada. The tsunami risk
along the Great Lakes is very low. The Great Lakes are on the edge of the Canadian Shield, ageologically stable, mid-continental region where the rate of occurrence of earthquakes large enoughto generate tsunamis is negligible.

5.1.2

Gentilly-2

The Gentilly-2 facility is located in the St. Lawrence River Valley. There is no evidence of ahistorical tsunami in this region. An earthquake-generated tsunami event has been considered (andmodelled) by scientists (for different purposes) for the St. Lawrence estuary [17]. A magnitude 7.0
earthquake could cause a land shift and surface that would generate a very local tsunami with a heightof roughly 2 to 4 metres. However, Gentilly-2 is at some distance from historically large, damaging
events (more than 100 km from the active regions of western Quebec and Charlevoix). The
Charlevoix seismic zone is the most likely source to generate magnitude 7.0 earthquakes that have thepotential to create small tsunamis in the St. Lawrence, and the possibility that a tsunami from there
would reach Gentilly-2 is very low.

5.1.3

Point Lepreau

Point Lepreau is located in Atlantic Canada on the Bay of Fundy. There are several sources ofpotential tsunamis for this site. First, trans-Atlantic tsunamis are a possibility. The 1755 great Lisbon
earthquake generated destructive waves, but these waves were not large by the time they reached
North America’s eastern seaboard. There is also the possibility of local earthquakes in the Bay of
Fundy and Passamaquoddy Bay generating tsunamis. There is, however, no known evidence of suchan event; the probability of a large earthquake in this region generating a local tsunami is consideredvery low. In addition, the province of Nova Scotia provides some protection from an Atlantic tsunami
hitting Point Lepreau because its geographic location acts as a partial buffer.

18

CNSC Fukushima Task Force Report

5.2 Canadian seismic hazard map
The following simplified seismic hazard map for Canada illustrates qualitative seismic hazards
everywhere in Canada. The hazard for each NPP is discussed below.
Figure 5.3

5.2.1

Canadian Seismic Hazard Map

Pickering

Pickering is in a region of low to moderate seismic hazard.
The Pickering facility is located in the southern Great Lakes seismic region. Over the past 25 years,on average, five to six magnitude 2.5 or larger earthquakes have been recorded in the region eachyear. Three moderate-sized (magnitude 5.0) events have occurred in the region in the last 250 years,
all of them in the adjacent northern United States. All three of these earthquakes were widely felt insouthern Ontario but caused no major structural damage in Ontario.
In the Pickering region, a possible active fault was investigated by drilling and found to be the resultof glacial action. The feature poses no additional seismic threat.

5.2.2

Darlington

Darlington is in a region of low to moderate seismic hazard. Details are the same as for Pickering.

19

CNSC Fukushima Task Force Report

5.2.3

Bruce

Bruce is in a region of low seismic hazard.
Over the past 25 years, only 3 magnitude 2.5 or larger earthquakes have occurred within 100 km of
the plant. Moderate-sized (magnitude 5.0 to 6.0) earthquakes have occurred at greater distances (morethan 300 km) in the northern United States and western Quebec. None of these events generated
significant shaking at the Bruce site.

5.2.4

Gentilly-2

The Gentilly-2 facility in Bécancour, Quebec, is in a region of moderate seismic hazard.
The facility is in the St. Lawrence Valley, within a region of moderate seismic activity. Historical
records for earthquakes in eastern Canada show that most earthquakes have occurred east of Québec
City and near Montreal, and that less activity has occurred between these two places. Past work by the
Geological Survey of Canada shows that despite this historical record, a possibility of a significant
earthquake in the vicinity of Gentilly-2 still exists because:• the fault systems along the St. Lawrence River are the same throughout• small earthquakes appear to concentrate on these faults
Evaluation studies of the geology of the site have shown that no tectonic fault lies under the site.

5.2.5

Point Lepreau

Point Lepreau is in a region of low to moderate seismic hazard.
The Point Lepreau facility is located in the Northern Appalachians Seismic Zone, which includes
most of New Brunswick and extends into New England down to Boston. A series of significant
earthquakes occurred in 1982 (largest magnitude 5.6, in the Miramichi Highlands, 200 km north of
the facility) and was followed by numerous aftershocks. The zone also witnesses a continuing low
level of seismic activity, including many larger historic earthquakes in New Brunswick. The closest
source of seismic activity is located in Passamaquoddy Bay, 50 km west of Point Lepreau. A series ofmoderate earthquakes occurred here in the 19th and early 20th century. The largest recorded event
had a magnitude of 5.7 in 1904.

5.3 Other external hazards
Canadian NPPs are considered capable of withstanding a large number of external hazards specific toeach site. These hazards include flooding, extreme winds, extreme weather including snow and ice
storms, and transportation hazards, among others. These types of hazards and NPP assessments are
discussed in section 6.1 of the report.

6

Safety Review of Canadian Nuclear Power Plants
The CNSC licenses each Canadian NPP on the basis of comprehensive safety reports andsupplementary analyses which demonstrate that the facility design meets regulatory requirements andexpectations. The licensing process also ensures that appropriate safety management systems, plansand programs for safe and secure operation are established. Any new analyses, such as those
supporting modifications or new research findings, are incorporated into the safety reports and

20

CNSC Fukushima Task Force Report
supporting analyses. To ensure this, the NPP licences require the licensees to update safety reports
every three years and submit them for regulatory review. In addition, the CNSC requires eachlicensee to conduct an integrated safety review (ISR), including a comparison against modern
standards), to establish the scope of refurbishment activities.
The safety reports include the evaluation of the underlying defence-in-depth concept for the effective
implementation of safety functions in the facility design. There are five levels to the defence-in-depth
approach:• prevention of abnormal operation and failures• control of abnormal operation and detection of failures• control of accidents within the design basis• control of severe plant conditions, including prevention of accident progression andmitigation of the consequences of severe accidents• mitigation of radiological consequences of significant releases of radioactive materials
The defence-in-depth concept is supported by emphasis on the inherent safety characteristics of thereactor, and on insights from deterministic and probabilistic safety analyses to evaluate and optimize
the overall plant design. In principle, application of the defence-in-depth concept assures theprevention and control of incidents and accidents at several engineering and procedural levels in orderto ensure the effectiveness of the protection of physical barriers against the release of radioactive
material.
In response to the Fukushima Daiichi accident, the Canadian nuclear industry and regulator sought toensure that the safety basis discussed above remained valid in the light of lessons learned. As reported
in section 3.1, CNSC staff sent a written request on March 17 to licensees, under paragraph 12(2) of
the General Nuclear Safety and Control Regulations, to review initial lessons learned from theearthquake in Japan.
This section of the CNSC Task Force Report provides an assessment of the NPP licensees’ responses
to the 12(2) letters. The responses are evaluated against the applicable Nuclear Power Plant Safety
Review Criteria [13] issued by the CNSC Task Force in June 2011. These criteria generally exceed
requirements and expectations of the current CNSC regulatory framework. The CNSC Task Forcereview findings in this section relate exclusively to the lessons learned from the Fukushima accident.
Each subsection below provides specific review findings. In section 10 of this report, these review
findings are integrated to provide a concise overview of the areas of potential improvement identified
by the CNSC Task Force.

6.1 External hazards
The safety review ensures that external hazards are accounted for in the reactor safety cases. The
events considered are specific to each site and include seismic, fire, flood, extreme weather eventsand events caused by human activities (such as an explosion). The CNSC Task Force assessed themagnitudes that had been considered in the design-basis and beyond-design-basis analyses of external
hazards. In many cases, the rationale for the magnitude selected for beyond-design-basis hazards was
not documented by the licensees. This is further discussed below.

21

CNSC Fukushima Task Force Report
Consequential events must be considered and include external events (such as a cooling water intake
blockage caused by severe weather) and internal events (such as a fire or small-break loss-of-coolant
accident 19 caused by an earthquake).

6.1.1

Original design basis

All Canadian NPPs use CANDU reactors. The current CANDU fleet was designed and constructedfrom the 1960s to 1980s. The designs were based on standards available at that time. For the earlier
NPPs (Pickering A and Bruce A), the full scope of design-basis external events was not considered.
The design bases were embedded in design guides and engineering judgment.
For some plants that were designed in the later part of this period (Pickering B, Darlington, Bruce B,
Gentilly-2, and Point Lepreau) design-basis external events were considered. Such events haveincluded design-basis earthquakes (usually based on a recurrence frequency of 1,000 years), floods(design-basis rainfall or water levels, usually based on a recurrence frequency of 100 years or thehighest historical numbers) and high winds. The scopes, however, have been limited. The magnitudesof the external events taken into account for the design are in compliance with the standards
applicable at the time of original licensing but below modern international best practice. The
integrated safety review performed before an NPP is refurbished ensures that the NPP is assessedagainst modern standards. Upgrades are performed where reasonably practicable. Nevertheless, the
CNSC Task Force finds that licensees should identify the gap between the original design basis andassociated magnitudes for external hazards and modern best practices and demonstrate how the gap isbeing addressed.
As discussed in section 5, the CANDU fleet is located well within the North America tectonic plateand no NPPs are located near a subduction tectonic plate boundary as is the case in Japan. The closest
tectonic plate boundary is the Mid-Atlantic Ridge. Canadian NPPs are located in areas of much lower
seismic hazard risk than Fukushima.
All Canadian NPPs except Point Lepreau are located beside lakes and rivers and are not subject to thehazard of a tsunami. Based on a scientific assessment of the tsunami hazard, NB Power concluded
that the maximum credible tsunami is smaller than the storm surge created by a hurricane. This storm
surge, combined with a high tide and waves generated by the high winds, does not reach the plant.
CNSC staff accept this assessment.
As a prerequisite to refurbishment, ISRs have been completed for Point Lepreau, Gentilly-2 andBruce A, with similar reviews performed for Pickering. Some of the NPPs were reassessed forexternal hazards, especially for seismic hazards. Seismic margin assessments (SMAs) (or SMAs
based on probabilistic safety assessments) were conducted to assess the safety margin based onearthquakes with a 10,000-year return frequency. Other external hazards, including floods and highwinds, were also assessed and some enhancements have been implemented. The NPPs that werereassessed as part of refurbishment activities were reviewed for external hazards, and their designbases are, to the extent practicable, in line with modern standards and practices.

19

A loss-of-coolant accident (LOCA) takes place when a break in the primary pipework of the reactor allows
reactor coolant to escape into containment.

22

CNSC Fukushima Task Force Report

6.1.2

Probabilistic safety assessment

Currently all NPP licensees are required to perform a site-specific Level 2 PSA 20 to meet CNSC
regulatory standard S-294, Probabilistic Safety Assessment (PSA) for Nuclear Power Plants [18].
This standard requires consideration of all internal events and external hazards in the PSA. Licensees
are required to perform a fire, flood and seismic PSA with a methodology that is acceptable to the
CNSC staff. Licensees also have to perform a site-specific external hazards screening to identify otherhazards that may require a PSA or a bounding analysis 21 . So far, all NPP licensees have submitted
their methodologies on external hazards screening and bounding analysis. Some analyses have been
completed and it is expected that the remaining analyses will be completed by the end of 2013. This
time scale is acceptable to the CNSC Task Force and will provide a consistent and up-to-date review
of all external hazards for all NPPs.

6.1.3

Review findings for external hazards

While the CNSC Task Force has not identified external hazards severe enough to need immediate
actions from industry or the CNSC, some of the findings identified opportunities for improvements in
the industry’s approach as well as in the CNSC’s approach. These review findings are summarized
below.
Review findings concerning licensees:
1. The original magnitudes considered for the design-basis and beyond-design-basis assessments ofexternal hazards were developed for the original licensing of the facilities. Although in general a
lot of conservatism was included in the original designs, some design bases are not consistent
with modern best practices.
2. The assessment for the design-basis and beyond-design-basis tornado hazard was found to be
weak at some NPPs.
3. External hazards screening and bounding analysis are in different states of development for each
NPP. Consequently, analysis of all external hazards is not complete at all NPPs.
Review findings concerning the CNSC:
4. The requirements and expectations for defining magnitudes to be used for design-basis andbeyond-design-basis hazards have not been reviewed since original NPP licensing. The
methodologies used to establish the criteria for these hazards are not consistent with modern bestpractices.

6.2 Design-basis accidents
Design-basis accidents, including those that may occur at onsite irradiated fuel storage, were not amajor focus area for the CNSC Task Force. As stated in the Nuclear Power Plant Safety Review
Criteria [13], they have been extensively studied by the industry and the regulator for many years.
Nevertheless, design-basis accidents were reviewed to ensure that plant safety is adequate.

20

Probabilistic safety assessments may be performed at 3 levels. Level 1 PSA calculates core damage
frequency. Level 2 calculates large- and small-release frequencies and Level 3 (rarely performed) calculates
offsite health effects.
21
A bounding analysis uses conservative assumptions and/or modelling to ensure that the results are more
severe than would occur in an actual event.

23

CNSC Fukushima Task Force Report

6.2.1

Regulatory requirements

Early Canadian NPPs were originally licensed based on the Atomic Energy Control Board (AECB –predecessor to the CNSC) Reactor Siting and Design Guide [19] which defined the single/dual failure
approach. Dose limits were set for a single failure – the failure of process equipment. Dose limits
were also set for dual failures – failure of process equipment and simultaneous failure of protective
equipment, now referred to as safety systems. External events were not analyzed explicitly. Their
effects were implicitly assumed to be covered by the failures of process and protective equipment
described above. Darlington was originally licensed based on trial use of the AECB consultative
document C6 Rev 0, Requirements for the Safety Analysis of CANDU Nuclear Power Plants [20].
Dose limits were set for five event classes, with more restrictive limits for more frequent events.
Design-basis earthquakes and tornadoes were explicitly considered in that AECB document.
Darlington was also designed to withstand a major explosion.
After original licensing, the importance of external hazards was recognized, and assessments of theability of NPPs to withstand hazards such as earthquakes and fires were performed, for example using
seismic margin assessment 22 and fire safe shutdown analysis 23 methods.
More recently, the CNSC issued RD-310, Safety Analysis for Nuclear Power Plants [21] andRD-337, Design of New Nuclear Power Plants [22]. These two regulatory documents are in line withcurrent international practice and set the dose acceptance criteria for anticipated operational
occurrences and design-basis accidents. Safety goals are also set for beyond-design-basis accidents.
RD-310 and RD-337 use the term “design-basis accident” to mean an accident with a frequency ofoccurrence between 10-2 and 10-5 per year (between 1 in 100 and 1 in 100,000 years).

6.2.2

Results of review of design-basis accidents

The CNSC Task Force has confirmed that the safety analysis of each NPP adequately considers
design-basis accidents by analyzing credible failures in process and safety systems. These failures canresult in challenges to fuel cooling in the reactor core and spent fuel bays. The predictedconsequences for these accidents (with conservative safety analysis assumptions) provide bounding
estimates for the consequences of the external hazard accident scenarios within the design basis. The
safety report of each NPP shows that the predicted consequences for each design-basis accident meets
the CNSC’s prescribed acceptance criteria.
From the review of design-basis accidents in light of the Fukushima Daiichi accident, the CNSC Task
Force finds that two safety aspects merit further attention:• External hazards can result in accidents lasting for several days. Current safety analysis tends
to show that a stable state is reached after a design-basis accident, but not that it can be
maintained long term. Safety analysis should demonstrate that adequate design provisions
and operating procedures are in place to ensure the key safety functions of “control, cool andcontain” are maintained throughout the accident duration.
• Disruptions to fuel cooling in a shutdown reactor for an extended duration, while the heattransport system is maintained at elevated pressure and temperature conditions, may lead tofuel damage. This has the potential to transition from a design-basis accident to a beyonddesign-basis accident, potentially resulting in severe core damage. Safety analysis of such
22

A seismic margin assessment is a formal method for evaluating the capability of structures and equipment towithstand earthquakes. It was developed by the Electric Power Research Institute.
23
A fire safe shutdown analysis is a formal method for evaluating the capability to safely shut down and cool areactor core in the event of a fire.

24

CNSC Fukushima Task Force Reportdesign-basis accidents should demonstrate that adequate provisions are in place to ensure
successful transition of the reactor from a hot pressurized shutdown state to a cold
depressurized shutdown state.
Current safety reports do not adequately address the above two safety aspects. This deficiency is
considered to be a documentation issue; operating procedures and equipment are in place in all
CANDU reactors to ensure that the key safety functions are carried out for extended durations, and tobring the reactor to the cold depressurized shutdown state if required following an accident. The
CNSC Task Force finds that future safety report updates should ensure that these issues are addressedmore thoroughly.
RD-310 provides a modern, comprehensive treatment of external and internal events and accidents.
However, RD-310 has not yet been fully implemented at existing NPPs. The CNSC and licensees areworking towards full implementation.
Until full implementation of RD-310-based safety analysis, some lack of consistency in the analysis
and reporting of design-basis accidents and events will remain. This arises largely from thedifferences between licensing requirements when the original licence was issued and the changes
applied over the years.

6.2.3

Review findings for design-basis accidents

The CNSC Task Force has verified that, despite some lack of consistency, existing safety reports,
supplemented by hazards assessments, show that the NPPs meet or exceed the original design intent.
Adequacy of safety analysis is assessed and reported to the Commission during the relicensing
process for each NPP.
This review identified the following findings, all of minor concern:
1. Implementation of a safety analysis framework based on RD-310, Safety Analysis of Nuclear
Power Plants, is incomplete.
2. Safety analyses have demonstrated that equipment and procedures are adequate to ensure that,for all design-basis accidents where core cooling is lost when a shutdown reactor is hot andpressurized, the reactor can be taken to a stable state. However, analysis to show that the NPP
can be taken to a cold, depressurized state is incomplete.
3. Safety analyses have not demonstrated that, for all design-basis accidents, equipment andprocedures used to take the reactor to a cold, depressurized state can maintain that state for a
prolonged period.

6.3 Beyond-design-basis accidents
A major class of beyond-design-basis accidents are those involving a loss of all heat sinks. The mostchallenging of these are caused by loss of electrical power. The Fukushima Daiichi accident was ofthis type and is the focus of this section of the CNSC Task Force Report.
Beyond-design-basis accidents are analyzed to:• identify possible recovery actions• demonstrate that there is sufficient time to perform recovery actions• assess the consequences of failure of recovery actions

25

CNSC Fukushima Task Force Report
The information submitted by licensees in response to the CNSC request for information about
beyond-design-basis accidents is summarized below. The topics address the beyond-design-basis
accident criteria given in section 2.3 of the CNSC Task Force Nuclear Power Plant Safety Review
Criteria [13].

6.3.1Progression and timing of beyond-design-basis accidents

As requested by the CNSC, licensees have performed assessments of beyond-design-basis accidents.
Licensees have presented a sequence based on a prolonged loss of electrical power, leading to a lossof all heat sinks. For the purposes of the review of the accident sequence, it is not necessary to
postulate any particular external event. It is simply assumed that electrical supplies to power primaryand secondary heat sinks are not available.
The accident scenario includes assuming progressive failure of all mitigating measures. While theresulting scenario has an extremely low probability, it provides a means of identifying possible
mitigating strategies at each stage of the accident and the time available to implement them.
The accident progression is presented in detail in Appendix B. Potential intervention points where theaccident progression could be halted or delayed are noted.
All licensees provided an assessment that was adequate for the CNSC Task Force to perform its
review. The event progression described by licensees is in agreement with the CNSC’s understanding,
except for the timing. The CNSC Task Force assessment of the time available before pressure tube
failure indicates that it may be approximately 1 hour shorter than that given by industry. There may
be less available recovery time than currently expected. The CNSC Task Force finds that thepredictions of the timing of pressure tube failure in CANDU reactors should be verified.
The Fukushima Daiichi accident demonstrated the destructive power of hydrogen explosions. All
licensees have plans to install (or have installed) passive autocatalytic recombiners 24 to improve
mitigation of the risk from hydrogen explosions. The CNSC Task Force finds that, where not alreadydone, these plans should be accelerated.

6.3.2

Duration of backup services

As discussed in Appendix A, Canadian NPPs have large inventories of water that can be used as
passive heat sinks in the event of a loss of electrical power. The duration of these passive heat sinks isdifferent for each NPP and is discussed in more detail in Appendix B. No fuel damage will occur if
AC power is restored within 1 hour (and within a much longer period of time for some NPPs). If
simple operator actions to enable gravity feed to the boilers are executed promptly within this 1-hourtime frame, this time can be increased significantly, and release of radioactive material would notoccur before at least 17 hours after the accident 25 . Again, operator actions can significantly extend
this period to over a day, even in the absence of normal power supplies.
Although the focus of this section of the CNSC Task Force report is on loss of all electrical power, amuch more likely outcome for Canadian NPPs would be that either the normal backup (standby
generators) or the emergency backup (emergency power supply) would function and no such loss of24

Passive autocatalytic recombiners (PARs) comprise a catalyst-coated metal surface. The catalyst promotes
combination of hydrogen and oxygen in the containment atmosphere to produce water. With a sufficient
reaction area, PARs can prevent the hydrogen concentration from rising to combustible or explosive levels.
25
This time is a conservative estimate, and the actual time is likely to be longer.

26

CNSC Fukushima Task Force Report
all electrical power would occur. Staff confirmed that many days’ supply of fuel is immediately
available to these generators, typically sufficient for three to four days (for each standby generator
with no outside supply if operated at full design power).
Following a loss of all electrical power, batteries support essential services until normal or backup
power is available. CANDU reactors have the guaranteed capability to support all essential electricalequipment for 40 minutes, although the batteries may last significantly longer. This duration is shortcompared to other essential supply capabilities. Moreover, once batteries are exhausted, the control
and instrumentation functions are lost. Operators must take special measures (such as using selfpower instruments) to obtain information on which to base recovery actions. The CNSC Task Forcefinds that licensees should explore options to extend the duration of power supplies to instrumentationand control equipment that may be needed to mitigate beyond-design-basis accidents, including
severe accidents.

6.3.3

Margin to failure of mitigating equipment

The assessment of beyond-design-basis accident progression assumed progressive failure of all
mitigating measures, leading inevitably to core meltdown. For this reason this sequence does notprovide margin-to-failure information – the information about how close the equipment is to failure.
However, the following instances were noted where it may be worthwhile performing additional
assessments and/or design changes.
The CNSC Task Force notes that the instrumentation needed to guide accident management actions
may not survive the harsh conditions of beyond-design-basis accidents. The CNSC Task Force findsthat licensees should assess equipment survivability (not full environmental qualification 26 ) to
provide reasonable assurance that adequate information will be available to the operator.
Class I/II batteries are not formally qualified for external hazards (except at Pickering A stations
where Class I batteries are seismically qualified). Licensees should determine the minimum design
requirements for qualification of Class I/II equipment to mitigate beyond-design-basis accidents
involving loss of all AC power and verify that the equipment can survive the accident conditions.
As noted above, CANDU reactors have large inventories of water in the calandria vessel and theshield tank that can provide passive heat sinks in beyond-design-basis accidents. However, theequipment was not designed for this purpose. The following paragraphs describe issues that may
prevent these heat sinks from meeting their full potential.
After a loss of all heat sinks, and assuming no recovery action by the operator, secondary water
inventory boils away, leading to heatup and boiling of the primary coolant. Steam is vented throughrelief valves into the degasser (or bleed) condenser 27 . The degasser condenser pressurizes and its
relief valves open to vent steam into containment. Based on analysis of the licensees’ submissions,the degasser condenser relief valve capacity may not be adequate in this beyond-design-basis
accident. Inadequate relief capacity would lead to earlier failure of pressure tubes and shorter
available recovery times than would be the case if relief capacity was adequate. The CNSC Task
Force finds that licensees should perform tests to verify the capacity of the degasser (or bleed)
condenser relief valves to respond to a complete loss of heat sinks.

26

Environmental qualification is a formal process for ensuring that equipment will function in a harshenvironment, for example high temperature, pressure and humidity resulting from an accident.
27
The degasser (or bleed) condenser is a vessel in the pressure and inventory control system. One of its mainfunctions is to act as a buffer volume to accept steam and water discharged from the primary relief valves.

27

CNSC Fukushima Task Force Report
Further in the accident sequence, after the onset of severe core damage, the core debris falls
progressively to the bottom of the calandria vessel. Heat is transferred through the calandria vessel
wall into the shield tank (or calandria vault on some designs). The steam generated by boiling in theshield tank would cause the tank to pressurize. The shield tank relief valves may not have sufficient
capacity in this beyond-design-basis accident. The shield tank would fail due to overpressure and, if
the rupture is low in the vessel, most or all of the available water would be lost, leading to an earlier
failure of the calandria vessel than would be the case if adequate relief was available. This reduces thetime available for mitigating action and for offsite emergency measures. The CNSC Task Force findsthat licensees should verify that there is adequate pressure relief for severe accidents.

6.3.4

Re-evaluation of consequential events

Consequential events (such as a tsunami caused by an earthquake) are considered in NPP
probabilistic safety assessments. Selected cases are reported in the NPP safety reports. The CNSC
reviews these assessments as they are submitted and has not re-evaluated them for this report.
The key difference for events with a consequential loss of primary coolant would be to reduce thetime until core overheating. The timings of the remainder of the analyzed cases would not besignificantly changed. However, mitigation by make-up 28 to the boilers would not be effective in thecase of significant primary leakage. Given the low likelihood of significant damage to the primarypressure boundary and the limited additional impact of the consequential failure, the CNSC Task
Force considers that no additional work is necessary in this area.

6.3.5

Multi-unit considerations

Analysis performed for multi-unit NPPs (Pickering A and B, Bruce A and B, and Darlington) was
based on a computer model that represents only a single unit. The effect of a severe accident
simultaneously in four units is approximated by modelling the shared part of the containment as one
quarter of its true size.
This approach is accepted to give broadly representative results of the accident source term but would
not be capable of calculating, for example, the effects of different times of core meltdown in the
different units. In some effects, the current modelling may be conservative. For example, all four
units would be very unlikely to experience identical failures, such as vessel failure, at the same
moment, thus the corresponding containment pressure increases may be over-predicted. Other effects
may not be captured, such as higher than average local hydrogen concentrations.
The CNSC Task Force finds that licensees should develop the capability to model severe accidents in
multi-unit NPPs. The current models are adequate for single-unit NPPs.

6.3.6

Irradiated fuel bay

The irradiated fuel bays (IFBs) (spent fuel pools) at most NPPs were not designed to accommodate
boiling in the pool; therefore a loss of cooling can be tolerated for about 16 hours before the structuraldesign temperature is reached. Above this temperature there is an increasing risk of structural
cracking which could lead to leakage from the bay. Any leakage will shorten the time to fueluncovering. The Darlington IFB was designed to accommodate boiling and this finding does not
apply to Darlington.

28

Make-up is the provision of water to replace coolant inventory lost due to leaks or boil-off.

28

CNSC Fukushima Task Force Report
The CNSC Task Force recommends that licensees develop a strategy to mitigate these concerns bydemonstrating that procedures and equipment are in place to provide make-up water that willcompensate for possible leakage, and that manual actions can be performed in any high radiation
fields that may arise from a low water level. The CNSC Task Force notes that upgrades to provide anenhanced make-up capability are already being considered. These upgrades should consider possible
leakage arising from structural failures that may occur when the temperature limits are exceeded.
The licensees’ submissions do not generally discuss the need for hydrogen mitigation in the IFB area.
In their July 28, 2011, submission, licensees conclude that, as long as water inventory is maintained
and the fuel remains submerged, hydrogen generation is not an issue. Nonetheless, the CNSC Task
Force finds that the need for hydrogen mitigation in the IFB area should be evaluated.

6.3.7

Licensees’ plans for design changes or further assessments

Since original construction, licensees have made many safety improvements to NPPs based on CNSC
requirements, industry research, national and international operational experience and generally risingpublic expectations. In particular, licensees of those stations that have undergone refurbishment have
performed a systematic review against modern standards and made modifications that reduce thelikelihood and consequences of severe core damage and a large release of radioactive materials.
Notwithstanding the above, licensees have performed assessments against the lessons learned fromthe Fukushima accident and have proposed, or are evaluating, a number of further safetyenhancements, such as additional coolant injection points, additional hydrogen mitigation, andadditional onsite and offsite power supplies and pumps. The CNSC Task Force agrees that theseenhancements have the potential to improve safety at the plants. More detailed plans and schedules
were submitted by licensees in September 2011.
While accepting that the risk from Canadian NPPs is low, the CNSC Task Force identified some
additional potential improvements or confirmatory assessments that could further reduce the risk or
improve confidence in the ability of reactors to survive beyond-design-basis accidents. These arelisted in section 6.3.8.

6.3.8

Review findings for beyond-design-basis accidents

The CNSC Task Force finds that the risk to the public from beyond-design-basis accidents and events
at CANDU NPPs is very low. CANDU reactors have a large inventory of water available for passive
cooling in the secondary cooling system, the primary cooling system, the moderator and the calandria
vault / shield tank.
CANDU reactors have independent and diverse backup power supplies, and thus provide highconfidence that power can be restored to vital equipment. With many days’ supply of fuel for
emergency power generators available onsite, adequate time is available to take long-term mitigating
action.
While accepting that the risk from beyond-design-basis accidents at Canadian NPPs is very low, the
CNSC Task Force identified a number of areas where additional improvements or confirmatory
assessments would further enhance safety:
1. Not all licensees have completed the installation of passive autocatalytic recombiners. Most
licensees have taken action to accelerate the installation.
2. Results of studies of the duration of primary boiloff before pressure tube failure are notconsistent. The progression of a sustained loss-of-heat-sinks event described by licensees is in

29

CNSC Fukushima Task Force Reportbroad agreement with the CNSC’s understanding. However, the CNSC Task Force assessment of
the time available before pressure tube failure is shorter than that given by industry.
3. In the event of a loss of all normal, backup and emergency AC power, the guaranteed capabilityof Class I batteries to support all essential electrical equipment is 40 minutes (although it isrecognized that some services will last much longer). This duration is short compared to otheressential supply capabilities and gives little time to restore AC power. Once batteries are
exhausted, most control and instrumentation functions are lost.
4. While key instrumentation is fully qualified for design-basis accidents, survivability in beyonddesign-basis accident conditions has not always been demonstrated.
5. Degasser (bleed) condenser relief valves have been tested to ensure that they are capable ofproviding sufficient relief flow for worst-case design-basis accidents. However, they have notbeen tested at extreme conditions that may arise in beyond-design-basis accidents. In these cases,
relief valve capacity may not be adequate in a sustained loss of all heat sinks, reducing the time
before pressure tubes fail. The CNSC previously evaluated this issue and accepted the current
design, although the margin to failure was small.
6. Shield tank relief and calandria vault relief have not been verified to be adequate for beyonddesign-basis accidents. A large inventory of water surrounds the core of a CANDU reactor – oneof the strengths of its design. Nonetheless, if relief valves do not have sufficient capacity in asustained loss of heat sinks, the shield tank could fail due to overpressure and much of theavailable water may be lost, leading to an earlier failure of the calandria vessel than would be thecase if adequate relief was available.
7. The minimum Class I/II equipment that is needed to mitigate beyond-design-basis accidents
involving loss of all AC power has not been systematically identified.
8. Modelling of severe accidents performed for multi-unit NPPs was based on a computer modelthat represents only a single unit. The modelling approach is accepted as adequately giving
broadly representative results but would not be capable of calculating, for example, the effects ofdifferent times of core meltdown in the different units.
9. The irradiated fuel bays (spent fuel pools) at most NPPs have temperature limits that lead torelatively short times (16 hours) for which a loss of cooling can be tolerated before the structuraldesign temperature is reached. Above this temperature, an increasing risk of structural cracking
could lead to leakage from the bay, thereby shortening the time to fuel uncovering. Additionally,
with a low water level, it may not be possible to perform manual actions in elevated radiation
fields.
10. The need for hydrogen mitigation in the irradiated fuel bay area has not been adequately
evaluated.

6.4 Severe accident management
A severe accident is a beyond-design-basis accident that involves significant core degradation. Severe
accident management (SAM) is one of the components of defence in depth used in the overall safetyassurance framework. SAM provides for the management of risks posed by unlikely events leading tosevere accidents in an NPP. The CNSC’s expectations for SAM are given in G-306, Severe AccidentManagement Programs for Nuclear Reactors [23], published in 2006.
The CNSC Task Force reviewed the licensees’ provisions for using existing plant capabilities,
complementary design features (such as passive autocatalytic recombiners, emergency containment
filtered venting system, and calandria vault make-up) and emergency mitigating equipment 29 in the

29

Emergency mitigating equipment includes portable equipment that may be available onsite or delivered to thesite for the purpose of preventing and mitigating severe accidents.

30

CNSC Fukushima Task Force Reportmanagement of a severe accident. The focus of accident management is on halting or delaying the
progression of an accident leading to eventual calandria and/or containment failure. Plant monitoringand instrumentation survivability in severe accident conditions were also evaluated. Where additional
equipment or design modifications were found to be necessary, the licensees’ plans and schedules for
implementation were assessed.
Severe accident management includes the development of guidance and procedures for use by plant
personnel. The CNSC Task Force verified the status of severe accident management guidelines(SAMG) at Canadian NPPs. Where SAMG have not been fully implemented, the review focused on
the licensees’ plans and schedules for completion.
The CNSC Task Force also considered plans for the use of external resources, such as equipment,
fuel and people, in mitigating severe accidents. Formal plans for inter-utility cooperation in matterssuch as availability of skilled personnel, provision of technical support and the sharing of equipment
were included in this consideration.
All licensees provided their responses to the CNSC request for information pursuant to subsection
12(2) of the General Nuclear Safety and Control Regulations. This summary addresses the following
topics in each of the licensees’ submissions:• status of SAMG implementation• plant design capabilities for severe accident management• assessments of severe accidents• use of external resources• irradiated fuel bays
• multi-unit considerations
Further elaboration is provided in sections 6.4.1 to 6.4.6.

6.4.1

Status of severe accident management guidelines

All Canadian NPPs have a comprehensive set of documentation covering normal plant operation,
minor upsets, and accident conditions. As part of the SAMG development and implementation, the setof operating documentation is prepared to explicitly cover severe accidents. The SAMG suite
includes a number of procedures and supporting documents, with the fundamental goals of:• maintaining or restoring fuel cooling• maintaining the integrity of the containment envelope• minimizing releases of radioactive products to the environment
SAMG were developed by building both on the existing structure of emergency operating procedures
and on international experience. A symptom-based approach is used to allow the plant personnel toidentify suitable actions to bring the plant under a stable and controlled state.
The CNSC Task Force finds that the SAMG that the CANDU licensees are implementing are
generally adequate, but need to be supplemented by explicit considerations of specifics for the multiunit stations, events affecting spent fuel bays and severe accidents triggered by extreme external
events.

6.4.2

Plant design capabilities for severe accident management

Plant design capabilities for severe accident management can be strengthened with complementary
design features. A complementary design feature is a physical design feature added to the design as a

31

CNSC Fukushima Task Force Report
standalone structure, system or component (SSC) or added to an existing SSC to cope with plantconditions arising from selected beyond-design-basis accidents, including severe accidents.
Complementary design features include, for example:• emergency containment filtered ventilation• passive autocatalytic recombiners (PARs)• make-up provisions for various water reservoirs, and other areas needing coolant
Emergency mitigating equipment may be employed and includes portable equipment either available
on site or to be delivered from an offsite location. Additional, ad hoc means may be used tosupplement the existing capabilities to address severe accidents.
6.4.2.1

Containment venting

All NPPs have the means to vent the containment to protect containment structural integrity.
However, not all NPPs can filter the vented gases in severe accidents. Emergency containment
filtered ventilation (ECFV) is a complementary design feature intended to protect the containment
envelope if the internal containment pressure approaches the containment strength limit and to
remove radioactive materials from any gases vented from the containment in a severe accident. Sucha system has been installed, for example, at Point Lepreau; it is manually actuated, does not require
an external source of power and is used to relieve containment pressure for the conditions that could
be present in a severe accident. ECFV uses a high-efficiency scrubber and filtration unit to filter out
the vast majority of fission products so radiation exposure to the public would be limited toacceptable levels in the event of a release. Similar venting provisions need to be considered for allother Canadian NPPs to provide a means to minimize the release of radioactivity while protecting thecontainment integrity.
6.4.2.2

Hydrogen management

Hydrogen combustion is a concern with respect to the integrity of the containment. Hydrogen can beproduced in certain phases of severe accident progression. To deal with the hazard of large quantities
of hydrogen being produced in a severe accident and causing hydrogen explosions, most CANDU
plants are equipped with AC-powered igniters, which are intended to control hydrogen concentrationsin the containment atmosphere by initiating limited “burns” before a potentially explosive
concentration is reached. Recently, NPP licensees have initiated installation of passive autocatalytic
recombiners (PARs). These are devices intended to passively (without the need of external power)
remove hydrogen from the containment atmosphere. All Canadian NPPs have either installed PARsor are in the process of installation. The CNSC Task Force expects that all NPP licensees will provide
confirmatory assessments demonstrating adequacy of PARs for severe accidents, and consider
installation of PARs in the spent fuel bay areas.
6.4.2.3

Coolant make-up provisions

Make-up provisions (such as dedicated lines intended to replenish water inventory in important plantsystems) are an important line of defence against accidents progressing to severe core damage. Water
can be added to a variety of systems to prevent, slow down or terminate the core fuel degradation
process. These systems include steam generators, calandria, shield tank, calandria vault and the spent
fuel bay. Water is typically provided either by in-containment reserves (such as a dousing tank) or by
an external connection to the reactor building. Keeping in mind that effective make-up for lost
coolant may prevent core damage, the CNSC Task Force requests all licensees to perform asystematic assessment of all existing and potential means to provide make-up coolant to various

32

CNSC Fukushima Task Force Report
reactor systems. The potential for creating a path for unfiltered releases (containment bypass) througha make-up line needs to be critically assessed.
6.4.2.4

Plant monitoring and instrumentation

The existing plant monitoring and control instrumentation has been designed and maintained toensure correct functional performance under the conditions assumed in the station design basis.
Correct performance of key instrumentation is essential in diagnosing the plant state and emerging
safety challenges, such as containment pressure buildup or hydrogen and fission productaccumulation. Because beyond-design-basis and severe accident conditions are more severe,functioning of the existing instrumentation is not assured. Assessments of existing instrument
survivability or of needs for installing hardened 30 instrumentation should be performed.

6.4.3

Assessments of severe accidents

Explicit assessment of severe accident progression is required to develop an understanding of likely
challenges to key defence-in-depth systems (calandria, containment), timing of events, required
coolant make-up capability, extent of fuel damage and the probable source term. Integral mechanistic
models are available to simulate accident progression. All licensees either completed or are in theprocess of performing Level 2 PSAs as required by regulatory standard S-294, Probabilistic Safety
Assessment (PSA) for Nuclear Power Plants [18], which involve deterministic analysis of credible
severe accident scenarios. However, the existing modelling capabilities may not be adequate toconsider events affecting multiple reactors on the same site (multi-unit events), accidents with spent
fuel, or releases of radioactive products from a degraded reactor core into water. The assessments ofsevere accidents should be periodically updated, similar to the existing practice used for safety
reports.
A focused review of beyond-design-basis accidents is given in section 6.3.

6.4.4

Use of external resources

External resources can be brought in to supplement or replace the onsite resources and may include
fuel, water, electric power or equipment such as pumps or generators. The resources currently
available to the licensees on site are adequate to cope with design-basis accidents and many beyonddesign-basis events. In case of an external event affecting the whole site, or a severe accident, which
will progress over several days, it would be necessary to bring in offsite resources. Explicit
arrangements should be in place to facilitate access to additional resources.

6.4.5

Irradiated fuel bays

Fuel bays contain significant quantities of irradiated fuel. Because of decay, fission productinventories in the spent fuel decrease over time. Nevertheless, the long-lived radioactive materials
could pose a significant threat if the spent fuel is uncovered and subsequently overheats. To mitigate
this threat, provisions are taken to ensure reliable cooling of the spent fuel bays and to maintain theirstructural integrity in credible external events, such as earthquakes. The CNSC Task Force expects all
Canadian NPP licensees to perform comprehensive deterministic and probabilistic analyses of events

30

Hardened instrumentation is capable of surviving the harsh conditions of a severe accident.

33

CNSC Fukushima Task Force Reportaffecting irradiated fuel bays, in order to demonstrate that the mitigation is sufficient for events as
discussed in section 6.3.6.

6.4.6

Multi-unit considerations

As events at the Fukushima plant have demonstrated, the multi-unit plants face unique challenges.
Specifically, events affecting more than one unit at a time need to be considered; such events would
exacerbate challenges that the plant personnel would face in time of an accident. The events andconsequences of an accident at one unit may affect the accident progression or hamper accident
management activities at the neighbouring unit; available resources (personnel, equipment and fuel)would need to be shared among several units. Explicit plans should be in place to address thesechallenges.

6.4.7

Review findings for severe accident management

All NPP licensees undertook a review of the existing procedural guidance and design capabilities ofoperating NPPs to cope with accidents involving significant core damage. The soundness of theprovisions in place has been confirmed. At the same time, several possibilities for further
enhancements have also been identified.
In particular, the CNSC Task Force is satisfied that:• Severe accident management guidance has been, or will shortly be, fully implemented at allplants. This includes development of procedural guidance to the operating staff and technicalsupport groups, specific training and appropriate drills.
•

In addition to original design capabilities, which already catered to mitigation of some beyonddesign-basis accidents, further design improvements have either been implemented or are being
planned. Notably, a filtered venting system for containment, qualified for severe accident
conditions, can prevent challenges to containment integrity and minimize the release ofradioactive materials. Diversifying the coolant make-up capabilities will further increase thecapacity of available heat sinks and thus delay any reactor core degradation. Another positive
development is the acceleration of installation of the hydrogen passive autocatalytic recombiners.

•

All NPP licensees have completed or are working on analyses of severe accidents, as part of theeffort to comply with regulatory standard S-294, Probabilistic Safety Assessment (PSA) for
Nuclear Power Plants.

•

The NPP licensees are cooperating in establishing formal agreements and designating or buildinga regional warehouse to provide necessary equipment and resources in case of emergency.

The CNSC Task Force also appreciates that all utilities have clear guidance in place that assigns
responsibility for decisions regarding containment venting to the plant operator.
Based on the reviews of the submitted information, the CNSC Task Force has identified several
findings, most of which are common to all licensees. These review findings identify a need either for
additional information on the already ongoing activities, or for licensees to consider further
enhancements to the capability of power plants to cope with severe accidents.
The CNSC Task Force finds that:
1. Current assessments do not adequately consider events affecting multiple reactors on the site,
events at spent fuel bays, as well as events triggered by extreme external hazards. Having
detailed assessments of the severe accident management procedural guidance and design

34

CNSC Fukushima Task Force Report

2.

3.

4.

5.

capabilities to cater to beyond-design-basis and severe accidents were shown to be of highpriority during the Fukushima event.
Plant design capabilities for severe accident management, such as containment venting,hydrogen mitigation, coolant make-up provisions, instrumentation, and the control areas havenot been fully evaluated and documented. Such design capabilities would allow minimization of
the consequences of a severe accident, should one occur.
The scope of analyses of severe accidents does not fully cover accidents triggered by extreme
external events, multi-unit events, and spent fuel bay accidents. The modelling capabilities for
multi-unit events are not fully adequate. Improvements would also give a better estimation of thesource terms of radioactivity and combustible gases.
Licensees’ emergency response organizations do not have access to a regional warehouse that
could make available offsite equipment and resources that may be needed in case of a severe
accident. Availability of emergency equipment was shown to be crucial during the Fukushima
event and could allow terminating a severe accident early enough to prevent any radioactive
releases to the environment.
Severe accident analyses and assessments of external hazards are not systematically produced
and periodically updated. This aspect of the plant safety case has not received much attention in
the past and was shown to be important in understanding the site-specific challenges andpossible progression of a severe accident.

The CNSC Task Force also finds that, in relation to the regulatory framework in the areas related toplant design for severe accidents, as well as to the management of accidents:
6. Current power reactor operating licences do not have specific licence conditions requiring
implementation of accident management provisions, including those for severe accidents.
7. Relevant sections in the existing and planned regulatory documents, such as G-306, Severe
Accident Management Programs for Nuclear Reactors; RD-310, Safety Analysis for Nuclear
Power Plants; and RD-337, Design of New Nuclear Power Plants, have not been re-evaluatedand revised to account for the lessons learned following the Fukushima accident. There iscurrently no regulatory document giving specific requirements for accident management.

6.5 Emergency response
This section of the review addresses the licensees’ responsibilities for emergency response. Section 7of this report deals with the current status of emergency preparedness and response measures in
Canada.
The CNSC Task Force reviewed the NPP licensees’ submissions against its Nuclear Power Plant
Safety Review Criteria for emergency response, and:• the Nuclear Safety and Control Act• section 6(k) of the Class I Nuclear Facilities Regulations• applicable site-specific licences• CNSC guidance document G-225, Emergency Planning at Class I Nuclear Facilities andUranium Mines and Mills (based on IAEA standard GS-G-2.1, Arrangements for
Preparedness for a Nuclear or Radiological Emergency [24]• regulatory document RD-353, Testing the Implementation of Emergency Measures [25]In addition, all licensees’ nuclear emergency preparedness programs and plans were reviewed against
the requirements of their respective provincial offsite emergency response plans.
As required by the CNSC Nuclear Safety and Control Act and CNSC Regulations, all licensees ofClass I nuclear facilities must provide information pertaining to their proposed emergency measures

35

CNSC Fukushima Task Force Reportand must include them in their respective licence applications. The information included in theapplications describes the proposed facility, activities, substances and circumstances to which theiremergency plans apply. The emergency plans should also be commensurate with the complexity of
the associated undertakings, and the probability and potential severity of the emergency scenarios
associated with the operation of these facilities. Therefore, these emergency plans must contain adescription of the proposed measures to prevent or mitigate the effects of accidental releases ofnuclear and/or hazardous substances on the environment, the health and safety of persons, and themaintenance of security, including measures to notify and assist offsite authorities and test theimplementation of these measures.
Licensees regularly review their emergency plans and revise them to address changes in theiroperational activities as well as to take into account other relevant factors and circumstances such as
operating experience. A licensee’s emergency plan must be accepted by the CNSC in order for an
NPP to be licensed.
Each licensee’s emergency plan is specific to its particular site and organization; however, they all
typically cover the following topics:• documentation of the emergency plan
• basis for emergency planning• personnel selection and qualification• emergency preparedness and response organizations• staffing levels• emergency training, drills and exercises• emergency facilities and equipment• emergency procedures• assessment of emergency response capability• assessment of accidents• activation and termination of emergency responses• protection of facility personnel and equipment• interface arrangements with offsite organizations• arrangements with other agencies or parties for assistance• recovery program• public information program• public education programFor more detailed information about the contents of emergency plans for Class I nuclear facilities,
refer to the CNSC regulatory guidance document G-225, Emergency Planning at Class I Nuclear
Facilities and Uranium Mines and Mills [26].

6.5.1

Adequacy of emergency plans for beyond-design-basis or multi-unit accidents

The current emergency plans for all NPPs in Canada exceed the requirements for design-basis
accidents for emergency planning; this means that design-basis accidents would not cause offsite dose
consequences. However, all licensees routinely conduct exercises to simulate scenarios with offsite
effects that would subsequently require the provinces to activate their provincial plans and implement
local area evacuations. The emergency scenarios needed to trigger this degree of response are in factbeyond-design-basis types. Therefore, they demonstrate that the licensees’ emergency response
programs are capable of dealing with a beyond-design-basis accident.

36

CNSC Fukushima Task Force Report
The CNSC Task Force is confident that the licensees’ emergency response organizations are capableof responding to beyond-design-basis events provided they are single-unit accidents only. None of themulti-unit station licensees, however, have explicitly considered multi-unit accident scenarios indevelopment of their emergency plans.

6.5.2

Integration of SAMG in emergency response organizations

The integration of SAMG into emergency plans, for those licensees who have implemented SAMG,
is effective. In practice, this integration offers enhanced technical support to the emergency responseorganizations, and the additional staff are integrated into the existing structure.

6.5.3

Alternate emergency facilities

All licensees have stated that they have alternate locations identified for their emergency centres.
However, this is not always documented in their emergency plans and procedures. Although somelicensees indicated their primary emergency facilities are designed to withstand design-basis external
hazards and/or meet the relevant commercial or industrial building code, none provided information
regarding the robustness of their alternate facilities.
The CNSC Task Force finds that, in some cases, information is lacking about the robustness oflicensees’ primary facilities, and that none of the licensees have robustness criteria for their alternate
facilities.

6.5.4

Availability of support and supplies

In all cases, the licensees have indicated that they have agreements in place with their respective
stakeholders for support and supplies. However, with few exceptions, arrangements for supplies orservices have not been consistently formalized or documented in their emergency plans andprocedures. All licensees mentioned in their submissions that they are working together, through a
CANDU Owners Group working group, to develop and formalize an industry-wide “mutual
assistance” agreement.

6.5.5

Capability without external powerNot all licensees’ emergency facilities and equipment have backup power available in the event of aloss of external power. Those licensees that do have them, however, know and understand thelimitations of their backup power supplies and are now evaluating and investigating their ability tomaintain backup power for extended outages. Those that do not have backup power for theiremergency facilities and/or equipment are aware of this weakness and are working towards correcting
this shortcoming. Also, in some cases, the information regarding backup power for all emergency
centres and/or equipment is not fully documented in their emergency plans and procedures. The
licensees need to include this information to ensure that response personnel know the limitations of
their facilities and what arrangements are in place to replenish fuel for generators.
Emergency facilities and equipment that are designated as essential for emergency response must
always be available, accessible and ready to operate. Therefore, the absence of reliable and backup
sources of power from any emergency facilities or equipment is a weakness that must be corrected.
The CNSC Task Force acknowledges that those licensees who have identified weaknesses in this area
are in the process of assessing their needs and options.

37

CNSC Fukushima Task Force Report

6.5.6

Source term estimation

Post-accident source term estimation is a method that can be used to quantify a potential release ofradioactive material before it occurs. Both Bruce Power (BP) and Ontario Power Generation (OPG)
use software and in-plant gamma survey measurements to perform post-accident source term
estimations; however, these are designed for an accident in only one unit. Hydro-Québec and New
Brunswick Power (NB Power) do not perform source term estimation in support of offsite emergency
response. Source term estimation is a “best practice” and it would be beneficial if all licensees wereable to provide source term information to offsite authorities in emergency situations.

6.5.7

Plume dispersion and dose modelling

All licensees have plume modelling capability that can be used to guide field survey teams and to
inform offsite authorities about the area that radiation releases may spread to in the event of an
accident.
The approach to dose modelling is different across all licensees. BP and OPG perform dose modellingbased on source term estimates, the monitoring of venting radiation, and field surveys. Hydro-Québec
performs dose modelling based on the monitoring of venting radiation, fixed radiation surveillance
station data and field surveys. NB Power does not perform dose modelling.
The multi-unit site licensees have indicated that their software is capable of providing plumemodelling for multi-unit events as plume modelling is independent of the source term. However, dosemodelling is directly affected by the source term and, therefore, dose modelling for multi-unit
scenarios will need to be re-assessed to ensure accuracy.
The CNSC Task Force finds that all licensees have plume modelling capability. In regard to dosemodelling to support offsite authorities, Hydro-Québec should ensure that source term estimates areincluded in dose modelling, and NB Power should develop comprehensive dose modelling.

6.5.8

Station boundary and field radiation monitoring

All Canadian NPP licensees perform field radiation monitoring by dispatching dedicated monitoring
teams to designated locations, both onsite and offsite, to collect measurements using gamma dose rate
meters and air samplers as determined by the plume modelling results. Only one licensee, HydroQuébec, has an automated system that provides real-time field monitoring data in addition to theresults collected by its field monitoring teams. In all cases, field radiation monitoring results arerelayed to the provincial authorities, as well as the CNSC, to be used by the offsite authorities toassess and to determine what protective actions should be recommended for the public. Some otherlicensees have identified the use of automated boundary monitoring and are assessing the potential
benefits of installing such instrumentation.
The CNSC Task Force considers that all licensees have satisfactory arrangements in place to perform
field radiation monitoring. However, for most licensees, the current method depends on station staff
physically going into the field to collect samples and take readings. The use of automated real-timefield monitoring at a station boundary is seen as a best-practice approach that allows critical data to beavailable sooner to appropriate authorities.

38

CNSC Fukushima Task Force Report

6.5.9

Containment venting process

There are two containment venting strategies: nominal containment venting, which keeps
containment pressure below its structural limit, and alternate containment venting, which is acoordinated process involving offsite stakeholders to determine the optimal venting strategy to protect
the public and the environment.
In all cases, the senior authorized person on shift (e.g., shift manager, shift supervisor, chef de quart)
is fully authorized to perform nominal venting. If nominal venting is not required, NPP staff
coordinate with offsite authorities before venting. The CNSC Task Force is satisfied that thecontainment venting decision process and authority is effective and is appropriately documented by
the licensees.

6.5.10

Coordination of communications

Communications protocols between the licensees and the offsite response organizations, including
provinces, municipalities and the CNSC, are well documented in both the licensees’ emergency
response plans and procedures, and those of the offsite organizations. During the planning andpreparedness phases of emergency management, all licensees work closely with their respective
offsite emergency response stakeholders to maintain good working relationships. In addition, theprovinces, the Government of Canada and the licensees work cooperatively through joint emergency
information centres to provide the public and the media with information about the status of the crisisand other relevant information.
The CNSC Task Force finds that the current coordination of communications between licensees andoffsite authorities, related to decision making and public/media affairs, is well established andfunctions efficiently, as has been observed during coordinated exercises between licensees and theirrespective offsite organizations.

6.5.11

Review findings for emergency response

The CNSC Task Force has verified that that there are no significant gaps in emergency planning at
Canadian NPPs. Overall, the licensees maintain and operate comprehensive and well-documented
emergency plans, and these plans and their elements are regularly tested through self-audited drills
and exercises. The CNSC also conducts inspections of these exercises and verifies that both the onsite
and the offsite support components of the licensees’ emergency response plans have been adequately
implemented.
Although a number of opportunities for further enhancement are listed below, the emergency
response program documentation, plans and procedures for all NPPs in Canada are meeting the
expectations and intent of CNSC guidance and regulatory expectations, as well as their site-specificlicences and the requirements of their respective provincial offsite emergency response plans. There
are no emergency response issues that require immediate action.
The CNSC Task Force finds that:
1. Emergency response organizations are capable of responding to single-unit, beyond-design-basis
events. Evaluation and revision of emergency plans in regard to multi-unit accidents and severe
external events, including an assessment of the minimum complement requirements, have notbeen performed. As a result, it has not been conclusively demonstrated that emergency responseorganizations will be capable of responding effectively in a severe event and/or multi-unit
accident.

39

CNSC Fukushima Task Force Report
2.

3.

4.

5.
6.

The performance of the emergency response organization under severe event and/or multi-unit
accident conditions has not been challenged by designing and conducting exercises that are
based on such conditions.
Automated real-time station boundary radiation monitoring systems with appropriate backup
power and communications systems are seen as a best practice approach and allow critical data
to be available rapidly. However, such systems are not available at all sites.
Not all licensees’ emergency facilities and equipment have backup power available in the eventof a loss of external power. Backup power sources for primary and alternate emergency
facilities, and all emergency response equipment that require electrical power to operate (e.g.,
electronic dosimeters, two-way radios), have not been systematically identified. The applicableemergency plans and procedures do not, in all cases, adequately document the requirements andlimitations.
Arrangements and agreements for external support are not always formalized and not always
documented in the applicable emergency plans and procedures.
Hydro-Québec does not currently have source term estimation capability included in its dosemodelling tools. NB Power does not currently have source term and dose modelling tools.

As a result of this assessment of licensees’ emergency preparedness and response programs, it has
become apparent that the main cross-cutting issue for this focused report is in the regulatory
framework area. Each licensee has its own means and methods of meeting the emergency
preparedness and response expectations, and there is no regulatory requirement or standard to ensure
consistency among the licensees. This is a common theme in many emergency preparedness areas
since the current CNSC emergency preparedness criteria are based on a CNSC guidance document:
G-225, Emergency Planning at Class I Nuclear Facilities and Uranium Mines and Mills. Converting
the CNSC “guidance” document to a CNSC “regulatory” document, and adding more detailed andspecific requirements, could be the basis for strengthening and standardizing emergency preparedness
and response at NPPs in Canada.
In addition, whereas a licensee’s onsite emergency plans are submitted to the CNSC as part of thelicence application and renewal process, there is no formal requirement for the CNSC to review theoffsite plans. Although the CNSC has always considered the preparedness of the offsite authorities
when reviewing a licence application, the requirement is not explicit and poses a potential gap.
As a result, the CNSC Task Force also finds that:
7. The suite of emergency preparedness regulatory requirement documents, currently comprising
guidance document G-225, Emergency Planning at Class I Nuclear Facilities and Uranium
Mines and Mills, and regulatory document RD-353, Testing the Implementation of Emergency
Measures, are lacking detailed and specific requirements needed to strengthen and standardize
emergency preparedness and response in Canada.

7

Nuclear Emergency Management in CanadaThis section of the review addresses the current status of emergency preparedness and response
measures in Canada, specifically the offsite preparedness and response. The Nuclear Power Plant
Safety Review Criteria generally exceed the applicable requirements and expectations of the current
CNSC regulatory framework. The CNSC Task Force review findings in this section relate exclusively
to the lessons learned from the Fukushima accident. The licensees’ onsite preparedness and response
is addressed in section 6.5.
The management of a nuclear emergency in Canada involves overlapping municipal, provincial andfederal jurisdictions. The CNSC Task Force reviewed the plans and capabilities of lead provincial and40

CNSC Fukushima Task Force Reportfederal agencies to identify any outstanding issues related to coordinated nuclear emergency
management. The review included ensuring that agencies’ responsibilities and communications
channels have been defined and that information needs are well established. Review findings related
to further improvements are given, where applicable.
In addition, the review of international lessons learned has identified the following topics related toemergency response:• enhancement of coordination between federal, provincial and municipal authorities• international considerations in an emergency
Figure 7.1 shows the stakeholders involved in managing a nuclear emergency and their linkages. In
simple terms:• Onsite preparedness and response is the responsibility of the NPP licensee.
• Offsite preparedness and response is the responsibility of the province, in coordination withmunicipalities, where the NPP is located.
• At the request of the province, the Government of Canada will provide support to theprovince via the resources of multiple federal agencies.
• The CNSC continues to have regulatory oversight of the licensee during an emergency.
Figure 7.1

Nuclear Emergency Management Stakeholders

Other Federal
Departments

Public Safety
CanadaHealth Canada
Bordering
StatesInternational
Authorities

CNSC
FederalNuclear
Regulator

US NRC and Other
International Regulators

Province

Licensee

Municipality/
Region7.1 Nuclear power plant licensees
The Nuclear Safety and Control Act empowers the CNSC to establish a comprehensive licensing andcompliance system to assure health, safety, security and protection of the environment. It also
requires the nuclear industry to protect its workers and the public from unacceptable levels ofradiation.
In particular, the Class I Nuclear Facilities Regulations require NPP licensees to maintain onsite
emergency plans and a response capability. In addition, licensees must also provide support to offsite
authorities in their planning and response to a nuclear emergency with offsite consequences.

41

CNSC Fukushima Task Force Report
Emergency plans and programs are reviewed by the CNSC. They become binding upon the licensee,
as a condition in the operating licences, and are subject to the CNSC’s licensing and complianceoversight processes.

7.2 Government of Canada
The following federal departments play a major role in managing a nuclear emergency.

7.2.1

Health Canada

Health Canada (HC) is designated as the lead agency for federal nuclear emergency preparedness. In
this context, Health Canada’s Radiation Protection Bureau is specifically resourced for this
responsibility and the department maintains and administers the Federal Nuclear Emergency Plan(FNEP) [27]. It should be noted that Health Canada was assigned this responsibility prior to theintroduction of the Emergency Management Act [28] and prior to the creation of Public Safety
Canada as a federal department for coordinating the federal whole-of-government approach to
emergency management.
The FNEP is intended to complement the relevant nuclear emergency plans of other jurisdictions
inside or outside of Canada. It describes the measures federal departments and agencies should follow
to manage and coordinate the federal response to a nuclear emergency. The FNEP can be activated if
federal support to a Canadian province or territory is required, as a consequence of any domestic,trans-boundary or international incident.
The FNEP describes the roles and responsibilities of federal departments and agencies. The FNEP
primarily addresses preparedness and response. It does not address the recovery phase. In addition,
annexes to the FNEP describe interfaces between the Government of Canada and the provincial
emergency management organizations in the provinces that host NPPs (Quebec, Ontario and New
Brunswick). The FNEP has not been tested in a full-scale national exercise since 1999.
The FNEP was last updated in 2002. Accordingly, it does not reflect the introduction of theEmergency Management Act and the role of Public Safety Canada as the lead federal department
responsible for coordinating federal response to an emergency. Similarly the Federal Emergency
Response Plan (FERP), administered by Public Safety Canada, does not refer to the FNEP. A
memorandum of understanding between Health Canada and Public Safety Canada on the use of the
FNEP was put in place as a temporary measure.
Health Canada began a process to update the FNEP in 2011. There is ongoing effort and consultation
between Health Canada, Public Safety Canada and other federal departments to review and update the
FNEP and to align it with Public Safety Canada plans and responsibilities.
In addition to managing the FNEP, Health Canada is responsible for operating various radiologicalmonitoring networks: the Fixed Point Surveillance Network, the Canadian Radiation Monitoring
Network and the Canadian Comprehensive Test-Ban Treaty (CTBT) Radiation Monitoring Network.
7.2.1.1

Fixed Point Surveillance Network

The Fixed Point Surveillance Network is the result of a project to build a real-time radiation detection
system across Canada. This network monitors public doses from radioactive materials in the air andwould also help make Canada better prepared in case of nuclear or radiological incidents.

42

CNSC Fukushima Task Force Report
The network consists of radiation detection equipment located at 77 locations across the country and asingle data centre that collects, analyzes and stores the data measured at each of these monitoring
stations. This data centre is located at Health Canada’s Radiation Protection Bureau in Ottawa andcommunicates with the stations on a daily or as-needed basis. Currently, the network includes
monitoring stations installed by Health Canada plus several stations that are owned and operated byindustrial partners who share their data with Health Canada.
7.2.1.2

Canadian Radiation Monitoring Network

The Canadian Radiation Monitoring Network is a national network of monitoring stations thatroutinely collect air, precipitation, drinking water, atmospheric water vapour, and milk forradioactivity analysis and measure external gamma dose. This network was initiated in 1959 tomonitor environmental releases of radioactivity from atmospheric nuclear weapons testing andaccidental releases from nuclear facilities.
Currently, the network provides information on natural background radiation levels, and provides amechanism for measuring routine or accidental releases of radioactivity in the environment. There are
26 environmental monitoring stations, plus additional sites in the vicinity of nuclear reactors.
7.2.1.3

Comprehensive Test-Ban Treaty Radiation Monitoring Network

Since 1998, Health Canada has been contributing to the International Monitoring System, an elementof the Verification Regime overseen by the Comprehensive Nuclear Test-Ban Treaty Organization(CTBTO). This compliance treaty seeks a universal ban on all nuclear detonation as an effectivemeans to stop further development of nuclear weapons.
Canada is responsible for the installation and operation of four CTBTO radiation monitoring stations
across the country as well as a radionuclide laboratory. Health Canada’s Radiation Protection Bureau
is responsible for the radionuclide laboratory and monitoring stations at St. John’s, NL; Yellowknife,
NT; Vancouver, BC; and Resolute, NU. These installations collect and transmit monitoring data to
the CTBTO to monitor for evidence of any nuclear explosion. However, the data can also be used fora national response to nuclear emergencies.

7.2.2

Public Safety Canada

Under the Emergency Management Act, the Minister of Public Safety is responsible for coordinating
the Government of Canada’s response to an emergency. The Federal Emergency Response Plan
(FERP) [29] outlines the processes and mechanisms to facilitate an integrated Government of Canada
response to an emergency and to eliminate the need for federal government institutions to coordinate
a wider whole-of-government response.
The FERP is designed to harmonize federal emergency response efforts with those of the provinces
and territorial governments, non-government organizations and the private sector.
In addition, the Minister of Public Safety is responsible for promoting and coordinating emergency
management plans of federal departments and agencies. All federal ministers are responsible fordeveloping emergency management plans in relation to risks in their areas of accountability.
Individual departmental activities and plans that directly or indirectly support the FERP’s strategic
objectives contribute to the integrated Government of Canada response.
As previously stated, the FNEP (led by Health Canada) and the FERP (led by Public Safety Canada)
are not completely integrated, and a memorandum of understanding between Health Canada and43

CNSC Fukushima Task Force Report
Public Safety Canada on the use of the FNEP was put in place as temporary measure. There is an
ongoing effort and consultation between Health Canada and Public Safety Canada to address theintegration of both plans.

7.2.3

Other federal stakeholders

There are 19 federal departments and agencies involved under the FNEP. The roles of two of them,
Health Canada and Public Safety Canada, are described above. In keeping with the FNEP, federal
policies and legislation, the remaining 17 federal departments and agencies listed in the FNEP are
also responsible for independently developing, maintaining and implementing their own nuclear
emergency response plans.
Several federal departments and agencies have designated responsibilities under the Federal Nuclear
Emergency Plan.

7.2.4
•
•
•
•

Summary – Government of Canada
A comprehensive federal nuclear emergency plan (FNEP) is in place to address preparedness
and response.
The FNEP has not been updated since 2002 and does not reflect the changes in
responsibilities associated with the creation of Public Safety Canada and the Emergency
Management Act.
The effectiveness of the FNEP has not been tested in a full-scale national exercise since 1999.
The federal nuclear emergency management plans, procedures and arrangements primarily
address preparedness and response. There are no guidelines and plans for the recovery phase.

7.3 Provincial governments
The provincial governments are responsible for overseeing the health, safety and welfare of their
inhabitants and the protection of the environment. Accordingly, they assume lead responsibility forthe arrangements necessary to respond to the offsite effects of a nuclear emergency by enacting
legislation, maintaining emergency plans and procedures, and providing direction to themunicipalities. In addition, the provincial governments coordinate support from the licensees andfrom the Government of Canada during the preparedness activities as well as during the response.
The provinces, in cooperation with the local jurisdictions, have established procedures to deal withany significant offsite nuclear impacts, primarily related to providing for urgent protective action.
These procedures include:• limiting access to the affected zone(s)• providing temporary shelter to the affected population• evacuating buildings or premises in areas near the NPP• blocking thyroid uptake of radiation• implementing ingestion control measures such as quarantining farm animals, banning the saleof affected foodstuff, and restricting the use of affected drinking water• establishing emergency worker centres and reception centres

44

CNSC Fukushima Task Force Report

7.3.1

Ontario

The Province of Ontario’s Emergency Management and Civil Protection Act [30] governs emergency
preparedness and response in Ontario. This legislation requires the government to formulate an
emergency plan for emergencies arising in connection with NPPs. Emergency Management Ontario(EMO) is the lead organization for coordinating all the aspects of nuclear emergency management.
7.3.1.1

Plans

Ontario’s nuclear emergency plans are structured as a Provincial Nuclear Emergency Response Plan
(PNERP) Master Plan [31] with NPP-specific implementing plans. The PNERP Master Plan is theoverarching plan giving the general principles, concepts and organization for the nuclear emergency
management. The PNERP implementing plans for Pickering, Darlington and Bruce address sitespecific aspects. PNERP planning, however, is based on a single-unit accident and does not explicitly
consider multi-unit accidents.
EMO chairs the Nuclear Emergency Management Coordinating Committee (NEMCC), which
comprises members from the NPPs, designated municipalities/region, ministries and federal
departments and agencies such as the CNSC, Health Canada and Public Services Canada. This
committee meets quarterly to discuss issues of mutual interest pertaining to nuclear emergency
management in Ontario.
The PNERP Master Plan and the implementing plans for Pickering, Darlington and Bruce NPPs werelast updated and approved by the Ontario Cabinet in 2009.
7.3.1.2

Planning zones

The planning zones used by the Province of Ontario are each generically described as being a certain
radial distance from the NPP, but in practice they are defined in a geographically logical manner. For
NPPs in Ontario, the following planning zones are used:• Contiguous zone is the offsite area immediately surrounding the nuclear facility where an
increased level of preparedness and response is required (nominally 3 km).
• Primary zone is the area around the nuclear facility where exposure control measures may
be required (nominally 10 km). The approximate population is 7,500 in the Bruce primaryzone, 122,000 in the Darlington primary zone and 261,000 in the Pickering primary zone.
• Secondary zone is the area where ingestion control measures may be required (50 km).
7.3.1.3

Event assessment

The NPP licensee is required to communicate the following information to the Provincial Emergency
Operations Centre, initially, and then on an hourly basis:• categorization of the accident• status of safety systems and containment• repressurization estimates or reactor/vacuum building pressures• source term estimates• field monitoring data
• weather data (current and forecast)
The Scientific Section at the Provincial Emergency Operations Centre has the required expertise andthe required software to use data provided by the NPP licensee to perform plume modelling andprojection of the likely offsite effects. This provides a valuable assessment of an event on an ongoing

45

CNSC Fukushima Task Force Reportbasis and helps the Provincial Emergency Operations Centre to decide on the appropriate protective
measures. Health Canada, the CNSC and the provincial ministries of Labour and the Environment arealso represented at the Scientific Section. This enables the section to also incorporate the technicaladvice and data coming from these organizations.
7.3.1.4

Public alerting

A 2009 update to the PNERP now requires that the entire primary zone population must be able toreceive alerts within 15 minutes. As per the provincial standards defined in the PNERP, thepopulation within the 3 km radius requires a very stringent notification due to proximity to the hazard– the capability to alert practically 100 percent of the population both indoors and outdoors at any
time of the day or year. The population within the remainder of the primary zone (3–10 km) must be
notified on an area-wide basis – the signal will cover that geographical area, but does not presume
notification of practically 100 percent of the population. The new requirements for indoor publicalerting in Durham region are not yet being met.
7.3.1.5

Protective measures

The PNERP addresses exposure control measures to protect against external irradiation and inhalationof radioactive material. Measures include evacuation, sheltering, and thyroid blocking with stableiodine in potassium iodide pills (KI pills). The PNERP also addresses ingestion control measures,such as protecting the food chain from radioactive material and preventing the ingestion ofcontaminated food and water.
In particular, the PNERP requires designated municipalities (Durham Region, City of Toronto andMunicipality of Kincardine) to facilitate the availability of KI pills for the primary zone institutions,emergency centres and for any member of the zone population who wishes to possess a supply.
However, the mode of distribution is left to the designated municipalities to determine.
In all cases in Ontario, the designated communities have stocked the pills for the general public at
central locations (pharmacies in Durham, reception centre in Kincardine) and have pre-distributed thepills to locations such as schools and long-term care facilities. The KI pills are not pre-distributed tohouseholds, although the general public can obtain them from pharmacies at any time.
The decision to implement the administration of KI would be taken by the Chief Medical Officer of
Health for Ontario. The directive to obtain and ingest would then be issued through the Provincial
Emergency Operations Centre’s emergency bulletin and emergency information systems.
7.3.1.6
•
•
•
•
•

•

Summary – Ontario
Ontario has a comprehensive and up-to-date nuclear emergency response plan.
Ontario’s PNERP is well integrated with NPP emergency plans.
Ontario has set the most stringent requirements for public alerting among the provinces with
NPPs.
The requirements for indoor public alerting in Durham region are not being met. In addition,
the implementation of the new 10 km public alerting requirement has just recently begun.
Ontario has a Nuclear Emergency Management Coordinating Committee (NEMCC)
comprising all municipal/regional, provincial and federal stakeholders. This forum provides
an opportunity to discuss issues pertaining to the nuclear emergency management on aquarterly basis.
The last full-scale nuclear exercise in Ontario was in 2007.

46

CNSC Fukushima Task Force Report
•
•

7.3.2

Ontario is the only province in which KI pills are not pre-distributed to households in thedesignated planning zones.
PNERP planning is based on a single-unit accident and does not explicitly consider multi-unit
accidents.

QuebecIn the Province of Quebec, the Plan national de sécurité civile du Québec [32], in accordance with
the Quebec provincial Loi sur la sécurité civile [33], provides the terms of reference for all
emergencies. The Organisation de la sécurité civile du Québec (OSCQ) is responsible for emergency
planning and the government response to all hazards.
The provincial nuclear emergency plan, Plan des mesures d’urgence nucléaire externe à la centrale
nucléaire Gentilly-2 (PMUNE-G2), addresses the specifics of planning and response for a nuclear
emergency.
The last full-scale nuclear exercise in Quebec was in 2005.
7.3.2.1

Plans

The provincial PMUNE-G2 addresses the specifics of planning and response for a nuclear
emergency. It is composed of a master plan (plan directeur) and sub-plans (lignes directrices).
The PMUNE-G2 defines the government ministries and agencies that have responsibilities in a
nuclear emergency at the Gentilly-2 NPP. It describes the objectives of minimizing the consequences,protecting the public and providing support to the municipalities. At the regional level, the Direction
générale de la sécurité civile et de la sécurité incendie is responsible for preparing and maintaining
the PMUNE-G2. The coordination for the health portfolio is carried out by the Agence de la santé etdes services sociaux de la Mauricie et du Centre-du-Québec. Its mission is to offer the necessary
health services to protect the lives and the health of individuals who are facing the crisis.
Under the PMUNE-G2, the OSCQ would open the government operations centre in Québec City tocoordinate the actions of the various government organizations in the province to maintain a link withthe federal departments and agencies. A regional response centre located in Trois-Rivières would be
open by the Organisation régionale de sécurité civile (ORSC) to coordinate local responses andprovide support to the affected municipalities.
The original PMUNE-G2 master plan was released in 1996. A revision process was started in 2005. A
revised plan is under review and expected to be formally approved by the end of 2011.
7.3.2.2

Planning zones

The planning zones used by the Province of Quebec are each generically described as being a certain
radial distance from the NPP, but in practice they are defined in a geographically logical manner. The
planning zones defined by the provincial plan (PMUNE-G2) are as follows:• Plume exposure planning zone (Zone de planification d’urgence pour l’exposition au
panache: ZPU-P) is an area around the NPP where the emphasis is on exposure control
measures (nominally 8 km). The approximate population in the G2 ZPU-P is 10,000.
• Ingestion planning zone (Zone de planification d’urgence pour l’exposition par ingestion:
ZPU-I) is an area around the NPP where the emphasis is on the ingestion control measures(nominally 70 km).

47

CNSC Fukushima Task Force Report
7.3.2.3

Accident/event assessment

The ORSC has the capability to run plume modelling through software and predict the offsite effects.
As per the PMUNE-G2, the ORSC recommends the protective actions for the public and theenvironment.
These calculations and recommendations are done by the ORSC’s radiological risk assessment team(or Équipe d’evaluation du risque radiologique) in the ORSC headquarters in Trois-Rivières. Theyuse real-time plant measurements to predict the offsite effects.
7.3.2.4

Public alerting

Public alerting is the responsibility of the municipalities. The municipalities perform alerts byorganizing first responders to go door to door and by issuing media notifications. There is noprovincially mandated time requirement, although the PMUNE-G2 indicates it should be done asquickly as possible.
The Municipality of Bécancour, with assistance from Hydro-Québec, is investigating the use of an
automated system to alert the residents living in the 8 km zone.
7.3.2.5

Protective measures

The PMUNE-G2 lists exposure control measures, such as evacuation, sheltering, and thyroid blocking(KI pills), to protect the public against external irradiation and inhalation of radioactive material. The
PMUNE-G2 also addresses ingestion control measures, such as protecting the food chain fromradioactive material and preventing the ingestion of contaminated food and water. As per the Loi surla sécurité civile, it is the responsibility of the municipalities of Quebec to develop and maintain aplan which contains protective measures to take when faced with an emergency.
In particular, stable iodine tablets (KI) are pre-distributed to the residents within the plume exposureplanning zone (8 km), and a comprehensive public information program for KI and other protective
measures is in place. In addition, KI pills are stocked in locations such as daycare centres, schools andprovincial and municipal centres. The decision to recommend the use of tablets by the population ismade by the Regional Director of public health. The provincial Service Québec department and themunicipalities are responsible for retransmitting this directive to the public through first responders(police, firefighters) and the media (radio, TV).
7.3.2.6
•
•
•
•
•
•

Summary – Quebec
Quebec has a comprehensive nuclear emergency response plan. A revision is expected to beapproved later this year.
The planning basis adopted by Quebec is in depth and recent.
Quebec’s PMUNE-G2 is well integrated with Hydro-Québec-G2’s emergency plan.
There is no provincially set requirement for public alerting in Quebec.
Currently, the municipality of Bécancour relies on using first responders going door to door
and on issuing notifications through the media to alert the public. The municipality isinvestigating use of an automated system.
The last full-scale nuclear exercise in Quebec was in 2005.

48

CNSC Fukushima Task Force Report

7.3.3

New Brunswick

The primary agencies for emergency management and public security in the Province of New
Brunswick are the New Brunswick Emergency Measures Organization (NB EMO) and the New
Brunswick Security and Emergencies Directorate (NB SED). NB EMO is the provincial lead agency
for emergency management and business continuity, including radiological and nuclear emergencies.
The NB SED is the provincial lead agency for security and the protection of critical infrastructure.
These two agencies consolidate their efforts under the mandate of the New Brunswick Department of
Public Safety.
The last full-scale nuclear exercise in New Brunswick was held in 2006.
7.3.3.1

Plans

Under the provincial Emergency Measures Act [34], NB EMO has the lead responsibility fordeveloping provincial emergency plans and coordinating all aspects of an emergency. The New
Brunswick Point Lepreau Nuclear Off-site Emergency Plan, [35] Volume 1 Policy and Volume II
Procedures are in draft form and meant to be regularly updated.
The plan defines specific responsibilities of the Department of Public Safety and the supporting rolesof some 20 organizations. Representatives from these organizations make up the Provincial
Emergency Action Committee (PEAC) which directs, controls and coordinates emergency operations,as well as assisting and supporting municipalities as required.
7.3.3.2

Planning zones

The New Brunswick Nuclear Emergency Plan uses a nominal 20 km zone for planning purposes. The
approximate population in the zone is 3,000.
Of note, NB Power at Point Lepreau uses three planning zones. NB EMO has indicated that theprovincial plans will incorporate these zones shortly. These zones are described as:• Precautionary protective action zone (4 km)• Urgent protective action zone (12 km)• Long-term protective action zone (20 km)
7.3.3.3

Accident/event assessment

Currently, NB EMO does not have a capability to run plume and dose modelling to predict the offsite
effects making it difficult to make proactive rather than reactive decisions on protective measures.
However, there is a provision for the province to consider pre-emptive, planned evacuation (before
the situation deteriorates) in scenarios of fuel damage, potential fuel damage or plant instability.
However, this provision depends on the qualitative assessment of NB Power. Following a release, NB
EMO would use radiation survey data collected by NB Power to decide on protective measures suchas sheltering, evacuation or KI.
7.3.3.4

Public alerting

A telephone-based, auto-dial system is used for alerting the public in the 20 km zone. Members of the
public can opt to be texted or have their cell or home phones dialled. The system also notifies all
businesses and institutions, such as schools, within the emergency planning zone. A provincial

49

CNSC Fukushima Task Force Reportwarden service is also used to provide assistance in the event of a nuclear incident at the NPP, andcould be used for door-to-door alerting.
7.3.3.5

Protective measures

The NB plan lists exposure control measures to protect against external irradiation and inhalation ofradioactive material. Measures include evacuation, sheltering, thyroid blocking (KI pills). The planalso addresses ingestion control measures, such as protecting the food chain from radioactive material
and preventing the ingestion of contaminated food and water.
Under the NB plan, KI pills are pre-distributed to all the residences within the 20 km zone. The pills
are also stocked at other locations such as long-term health facilities, hospitals and RCMP posts. The
Department of Heath and Wellness, in consultation with the PEAC, makes decisions on
recommending administration of the KI pills to the public. Notification to the public is carried out by
the NB EMO community notification system and followed by wardens, media or public safety
announcements and Web bulletins.
7.3.3.6
•
•
•
•
•
•

Summary – New Brunswick
NB has a basic provincial plan in draft form. An update is in progress and is expected to be
published in the fall of 2011.
Point Lepreau NPP and NB EMO plans are integrated, but there appears to be a disconnect
relating to emergency planning zones (4, 12, 20 km).
NB has no event assessment/modelling capability.
There is no provincially set requirement for public alerting in New Brunswick.
An effective automated public alerting system is in place, with backup plans using area
wardens.
The last full-scale nuclear exercise in New Brunswick was held in 2006.

7.4 International stakeholders
7.4.1

Bordering states

U.S. states and Canadian provinces that share borders have mechanisms in place to communicate andwork together in the event of any emergency affecting the population on both sides of the border. The
states have direct links to liaise and communicate with the provinces. In case of a nuclear emergency,
protocols are in place to exchange information between them.
Public Safety Canada (formerly Emergency Preparedness Canada) has signed a memorandum of
understanding with the U.S. Federal Emergency Management Agency. Under the umbrella of theAgreement Between the Government of Canada and the Government of the United States of America
on Cooperation in Comprehensive Civil Emergency Planning and Management, the Canada–UnitedStates Joint Radiological Emergency Response Plan was established in 1996. The plan establishes thebasis for cooperative measures to effectively deal with a potential or actual peacetime radiologicalevent involving Canada, the United States, or both countries. It is designed to alert the appropriate
federal authorities within each country of the existence of a threat from a potential or actual
radiological event in order to facilitate cooperation between organizations of the federal governmentof each country in providing support to states and provinces affected by the radiological event.

50

CNSC Fukushima Task Force Report

7.4.2

International Atomic Energy Agency

Canada is a signatory of the IAEA’s Convention on Early Notification of a Nuclear Accident (1986),
which establishes a notification system for nuclear accidents that have the potential for internationaltrans-boundary release that could be of radiological safety significance for another country. The
accident’s time, location, radiation releases, and other data essential for assessing the situation must
be reported, both directly to the IAEA and to other countries either directly or through the IAEA.
Canada is also a signatory of the IAEA’s Convention on Assistance in the Case of a Nuclear Accident
or Radiological Emergency (1986), which sets out an international framework for cooperation
between countries and with the IAEA to facilitate prompt assistance and support in the event of
nuclear accidents or radiological emergencies. It requires countries to notify the IAEA of theiravailable experts, equipment, or other materials they could offer in assistance. In case of a request forassistance from an affected country, each country decides whether it can offer the requested
assistance. The IAEA, in particular the Incident and Emergency Centre, serves as the focal point forsuch cooperation by channelling information, supporting efforts, and providing its available services.
Protocols and plans are in place to ensure that the CNSC will be in close communication with the
IAEA for any domestic nuclear emergency.

7.4.3

International regulators

During international and domestic nuclear emergencies, the CNSC will need to be in direct or indirectcommunication with the international regulators.
7.4.3.1

United States Nuclear Regulatory Commission

There is a memorandum of understanding (MoU) between the United States Nuclear Regulatory
Commission (U.S. NRC) and the CNSC. As per this MoU, the two sister organizations agree toexchange information. During the Fukushima nuclear emergency, exchange of information between
the U.S. NRC and CNSC was very useful.
7.4.3.2

Regulators regulating CANDU reactors

As per the lessons learned from Fukushima Daiichi nuclear emergency, any domestic or international
emergency involving CANDU reactors will require the CNSC to communicate with the international
regulators regulating the CANDU reactors. Canada chairs the annual CANDU Senior Regulators’Meeting, facilitated by the IAEA and attended by high-ranking regulatory staff in all countries withCANDU reactors. Specific MoUs are in place with most of these regulatory agencies.

7.4.4
•
•
•

Summary – international stakeholders
The CNSC has MoUs in place with most international stakeholders.
U.S. states and Canadian provinces have arrangements in place for emergencies.
The United States and Canada have an arrangement in place specifically for nuclear
emergencies.

51

CNSC Fukushima Task Force Report

7.5 Review findings for nuclear emergency management in Canada
The CNSC Task Force has verified that there are no significant gaps in nuclear emergency planningat the provincial and federal levels. Although some opportunities for improvement were identified,
overall each province has developed well-documented emergency plans, and these plans and theirelements are well integrated in the NPP’s onsite emergency plans. At the federal level, Health
Canada’s FNEP is a mature and comprehensive plan, but it has not been kept up to date. In addition,
Public Safety Canada’s FERP does not explicitly integrate the FNEP in the overall federal emergency
planning and preparedness scheme.
Review findings concerning the CNSC:
1. The Class I Nuclear Facilities Regulations do not currently require submission of offsite
emergency plans with an NPP operating licence application. Whereas an NPP licensee’s onsite
emergency plans are submitted to the CNSC as part of the licence application and renewal
process, there is no formal requirement for the offsite plans to be submitted to the CNSC.
2. The memoranda of understanding with regulatory counterparts in countries with CANDU
reactors have not been reviewed to identify what support, if any, they would require from the
CNSC during a nuclear emergency.
Review findings concerning multiple or other jurisdictions:
3. Federal and provincial nuclear emergency planning authorities are not making regularly planned
full-scale NPP-focused exercises a priority. It was generally observed at the provincial andfederal level that there has been a reduction in the frequency of full-scale NPP-focused exercises.
Although all provincial and federal plans reviewed appear to be satisfactory, the implementation,and thus the capability to respond, has generally not been tested in an exercise for several years.
4. Federal and provincial nuclear emergency planning authorities do not fully address recovery
phase guidelines and procedures in their emergency plans, as they primarily address only
preparedness and response.
5. Federal and provincial nuclear emergency planning authorities have not yet undertaken a formal
lessons-learned process to gain knowledge from offsite management of the Fukushima nuclear
emergency and update plans accordingly.
6. There is no formal, transparent, national-level oversight process for offsite nuclear emergency
plans, programs and performance. Whereas NPP licensees’ onsite emergency plans, programs
and performance are included in the CNSC regulatory oversight process, there is no similarsystem of oversight for offsite emergency plans.
7. There is no established national guidance or standard for offsite nuclear emergency planning.
Whereas NPP licensees are provided with CNSC guidance on emergency planning, there is no
Canadian guidance for offsite nuclear emergency plans.
8. The Health Canada Federal Nuclear Emergency Plan (FNEP) has not been updated since 2002
and is not formally integrated with the Public Safety Canada Federal Emergency Response Plan
(FERP). The FNEP and FERP integration has not been validated in a full-scale, NPP-focused
exercise.
9. The Province of Ontario planning basis for the current nuclear emergency plans and offsite
arrangements is a single-unit accident scenario and does not explicitly consider a multi-unit
accident scenario.
10. There are ongoing public alerting issues in the 3 km zone around the Pickering NPP. Also, thenew 10 km public alerting requirement has not been fully implemented.
11. The potassium iodide (KI) pills for residents of the planning zone in Ontario are stocked at local
pharmacies in the Durham region or the reception centre in Kincardine. The effectiveness of thisapproach, as opposed to pre-distribution to all households, has not been confirmed.
12. There is no automated public alerting system around the Gentilly-2 NPP.

52

CNSC Fukushima Task Force Report
13. The Province of Quebec has not recently updated its nuclear emergency plan.
14. The Province of New Brunswick does not have the capability for predicting offsite effects.
15. The Province of New Brunswick has not recently updated its nuclear emergency plan.

8

The CNSC Regulatory Framework and Processes
The CNSC Task Force has undertaken a preliminary review of the regulatory framework for existingand potential new build NPPs in Canada. The Nuclear Power Plant Safety Review Criteria generally
exceed the applicable requirements and expectations of the current CNSC regulatory framework. The
CNSC Task Force review findings in this section relate exclusively to the lessons learned from the
Fukushima accident.
The CNSC regulatory framework consists of a series of requirements and guidance and is illustrated
in figure 8.1. Requirements are set out in legislation, regulations, licences and regulatory documents.
Guidance on how applicants and licensees can meet regulatory requirements is provided in guidance
documents. Info-documents provide more general information on the regulatory regime and processes
for the broader public.
Figure 8.1

Elements of the Regulatory Framework

8.1 Act and regulations
The legislation consists of the Nuclear Safety and Control Act (NSCA) [36] and its Regulations.
These have been reviewed. The NSCA is a robust piece of enabling legislation that sets out the legal
framework for regulating the Canadian nuclear industry. All persons wishing to carry out nuclear
related activities in Canada are required, by law, to have a licence from the Commission. The
Commission is also authorized to make regulations.
Class I nuclear facilities are defined in the Class I Nuclear Facilities Regulations [37] and, in
addition to NPPs, cover facilities such as small reactors, fuel processing plants and nuclear waste
facilities. The CNSC Task Force finds that consideration should be given to modifying the Class I
Nuclear Facilities Regulations to require submission of offsite emergency plans with an application
for a licence to construct or to operate a NPP.

53

CNSC Fukushima Task Force Report
A Commission Member Document (CMD) on Implementation of Periodic Safety Reviews forLicensing of Nuclear Power Plants is being prepared. This seeks the Commission’s approval toincorporate the periodic safety review (PSR) approach by developing a regulatory document that will
be implemented by introducing a licence condition when each power reactor operating licence(PROL) is next renewed. A PSR consists of a systematic and comprehensive comparison against
modern standards and technological developments that assures continued plant safety and viability of
the licensing basis. In view of the importance of periodically reviewing plant safety against modern
standards, the CNSC Task Force finds that consideration should be given to introducing therequirement to perform a PSR in the Class I Nuclear Facilities Regulations.
Other regulations made under the NSCA that apply to NPPs include the General Nuclear Safety andControl Regulations [9] and the Radiation Protection Regulations [38]. No changes to the General
Nuclear Safety and Control Regulations have been identified as a result of this review. However, the
CNSC Task Force finds that section 15 of the Radiation Protection Regulations should be reviewed
for potential revisions to ensure consistency with international guidance.
Overall, the CNSC Task Force finds that the Act and Regulations are sound. This finding is consistent
with a finding by the IAEA International Regulatory Review Service mission to Canada in 2009 [39],that stated “The Canadian legislative and regulatory framework is comprehensive, with an appropriate
range of instruments allowing for an effective application of the legal regime.”

8.2 Licences, licence conditions and orders
The NSCA authorizes the Commission to establish classes of licences and, therefore, the CNSC has
the authority and flexibility to rapidly amend licences to impose additional requirements in order tocontinuously improve the safety performance of the nuclear industry. This is regarded as a strength of
the Canadian system.
The licences that apply to NPPs are power reactor operating licences (PROLs). The CNSC iscurrently in the process of revising the format of the PROLs to more comprehensively cover thesafety and control areas that describe how the NPPs are operated safely. The CNSC is also revising
the content of the PROLs to minimize the number of administrative amendments. In parallel with this,each PROL is to be supported by a licence condition handbook (LCH) that describes the complianceverification criteria that will be used to confirm safe operation. Generic templates for both the PROL
and NPP LCH have been approved for use.
The CNSC Task Force has reviewed the PROL and NPP LCH templates and finds that some
additional requirements and compliance verification criteria should be inserted when the documents
are next revised. The licences could be converted to the new format either when they are next
renewed, which will take until October 30, 2014, for all licensees. Alternatively, all PROLs could be
amended simultaneously when the handbooks are revised and subsequently approved. Given that theindustry is already moving to implement the programs needed to meet the new requirements and,given the considerable effort that is required to prepare or revise the LCH for each PROL, the CNSC
Task Force finds that the PROLs and LCHs should be amended to the new format when the licences
are next renewed.
The CNSC Task Force finds that two new safety requirements should be added to the PROL template.
The first is a requirement that the licensees implement and maintain an accident management
program. The second is a requirement that the licensees implement and maintain a severe accident
management program. The CNSC Task Force also finds that a new licence condition should be addedthat requires the licensee to implement and maintain a public information program that includes a54

CNSC Fukushima Task Force Reportproactive disclosure protocol. Similar additions should be made to the NPP LCH template to include
compliance verification criteria for the same.
The CNSC Task Force has considered the need for an order to be issued to the industry to implement
lessons learned from the Fukushima event. Given that the industry has responded appropriately andvoluntarily and is implementing various improvements, the CNSC Task Force finds that no order isrequired. Instead, CNSC staff will perform regulatory oversight of licensee actions, as per establishedprocesses, and verify compliance with the evolving regulatory requirements.

8.3 Regulatory and guidance documents
The CNSC Task Force has reviewed the regulatory and guidance documents published by the CNSC
that are referenced in the PROL or LCH.
Specific review findings related to the CNSC regulatory documents by the CNSC Task Force are
given in the supporting document on the CNSC regulatory framework [40]. This document should be
used by the CNSC Regulatory Framework Steering Committee in prioritizing document reviews andby the document review teams in revising specific regulatory documents.
The overall finding is that there is no overall need for the regulatory framework to be revisited inorder to identify the minimum, necessary and sufficient number of regulatory and guidance
documents (RDs and GDs) to support the power reactor regulatory program. Should the framework
be revisited by the Regulatory Framework Steering Committee in the future, the Task Force finds that
the PROL and NPP templates should be used as the basis for identifying needs for RDs or GDs. The
PROLs and LCHs currently contain some regulatory requirements or expectations that are not foundin RDs or GDs; when the framework is revised, the opportunity should be taken to remedy this.
The CNSC Task Force finds that certain documents should be updated. Examples include RD-337,
Design of New Nuclear Power Plants; RD-310, Safety Analysis for Nuclear Power Plants; S-294,
Probabilistic Safety Assessment (PSA) for Nuclear Power Plants; G-306, Severe AccidentManagement Programs for Nuclear Reactors; G-225, Emergency Planning at Class I Nuclear
Facilities and Uranium Mines and Mills; and RD-353, Testing the Implementation of Emergency
Measures. Other regulatory documents should be updated during their next scheduled revision.
The CNSC Task Force finds that the Commission should approve for publication RD-99.3,
Requirements for Public Information and Disclosure [41] and GD-99.3, Guide to the Requirements
for Public Information and Disclosure. GD-99.3 will supersede G-217, Licensee Public Information
Programs [42], while RD-99.3 will detail the requirements for public information programs andpublic disclosure as part of that program. The information to be disclosed under these documents
includes the impact of natural events such as earthquakes, routine and non-routine releases ofradiological and hazardous materials to the environment and unplanned events, including thoseexceeding regulatory limits. This therefore covers severe accidents such as Fukushima.
In recent years, as some of the older reactors approach the end of their designed life, licensees haveapplied for life extension for their NPPs. As a prerequisite to the life extension, licensees are required
by RD-360, Life Extension of Nuclear Power Plants [43] to conduct an integrated safety review 31(ISR). As part of the ISR, licensees perform a review of NPPs against modern standards and31

An integrated safety review is effectively a single application of a periodic safety review as described in
IAEA safety guide NS-G-2.10, Periodic Safety Review of Nuclear Power Plants.

55

CNSC Fukushima Task Force Reportpractices. Identified gaps are reviewed and practicable upgrades are incorporated into the integrated
improvement plan. Licensees are expected to fill the gaps as far as reasonably practicable.
The ISR provides an opportunity to re-evaluate the entire safety case for an NPP. The CNSC Task
Force considers that such reviews should be done on a regular basis by means of periodic safety
reviews. A 10-year frequency, in line with international practice, is judged reasonable and could be
integrated into the licensing process.

8.4 Other parts of the regulatory framework
This review addresses other requirements or expectations contained in the PROLs and LCHs,
principally standards issued by the Canadian Standards Association or requirements or guides issued
by the International Atomic Energy Agency. Time has not permitted a review of these otherstandards, but the CNSC Task Force finds that they should be examined in due course, once thechanges needed to the other elements of the regulatory framework have been identified.

8.5 Compliance
A primary activity of CNSC staff is to verify compliance by licensees with regulatory requirements.
CNSC staff conduct inspections, reviews, performance assessments and event follow-up to verify
compliance. The CNSC Task Force finds that CNSC staff should review the compliance program forneeded improvements once the identified changes to the regulatory framework have been
implemented. This review will include, but not be limited to, updating the baseline complianceprogram, under which satisfactory performance of all safety and control areas is verified on a regularbasis. In particular, enhanced focus on the following areas is anticipated:• licensees’ accident management programs and provisions, as discussed under section 8.2,
including station accident manuals and procedures• “operational” aspects of nuclear safety, to maintain regulatory overview of the design
capabilities to provide fundamental safety functions such as control of fission reaction,
cooling of fuel (including in the irradiated fuel bays) and confinement of radioactivity• holistic evaluation of the overall station safety case against modern standards and bestpractices

8.6 Processes
In parallel with the review findings aimed at improvements to the various parts of the regulatory
framework, the processes for licensing and compliance should also be revisited.
In the broader scope, it may be useful for the environmental assessment process to include
consideration of severe accidents, should this be regarded as responsive to public concerns.

8.7 Review findings for the regulatory framework and processes
The CNSC Task Force has performed a review of the CNSC regulatory framework and processes.
The review included the Nuclear Safety and Control Act and associated Regulations, the CNSC’s
regulatory documents, power reactor operating licences and their licence condition handbooks, andkey regulatory processes. The CNSC Task Force finds that the NSCA does not need revision andthere is no need to revisit the structure of the regulatory framework as a result of the lessons learned

56

CNSC Fukushima Task Force Reportfrom the Fukushima Daiichi accident. The Canadian regulatory framework is strong andcomprehensive and is effectively applied even in the case of severe accidents.
Key review findings related to improving the CNSC regulatory framework are:
1. The Class I Nuclear Facilities Regulations do not have explicit requirements for submission ofoffsite emergency plans.
2. The Radiation Protection Regulations are not fully consistent with international guidance and do
not fully describe the regulatory requirements needed to address radiological hazards during thevarious phases of an emergency.
3. Canada does not have a formal periodic safety review process. As demonstrated by international
practice, regulatory oversight of nuclear power plants may be further enhanced throughimplementation of a periodic safety review process.
4. Existing licence conditions in power reactor operating licences do not explicitly address accident
management, severe accident management and public information.
5. RD-99.3, Requirements for Public Information and Disclosure, and its guide, GD-99.3, Guide to
the Requirements for Public Information and Disclosure, have not been approved for
publication, leaving a potential gap in regulatory requirements and guidance for licensees’ public
information programs.
6. The three-year regulatory framework plan does not currently accommodate the CNSC Task
Force review findings.
7. A small number of regulatory documents (RDs) or guidance documents (GDs) are lacking
requirements or guidance needed to address the lessons learned.
8. The lessons learned are not yet fully considered for the next revision of other NPP-related RDs
or GDs.
9. The lessons learned are not yet fully considered as part of the preparation of new RDs or GDs.
10. Canadian Standards Association standards that apply to NPPs have not been reviewed by the
CNSC staff as a result of lessons learned.
The key review finding for the CNSC-managed processes is:
11. Licence condition handbooks are lacking requirements and guidance needed to address lessons
learned.

9

Implications for New Builds
Section 8 provides an overall assessment of the CNSC’s processes related to the licensing andcompliance of nuclear facilities and gives related review findings. This section considers more
specific review findings related to the design and analysis of new NPPs and related factors. The
lessons learned presented in this section are preliminary and are drawn largely from the assessments
performed either by, or on behalf of, the CNSC Task Force for existing reactors (i.e., CANDU
technology). In preparation for a formal update to RD-337, Design of New Nuclear Power Plants,
CNSC staff are undertaking a more comprehensive review of the technology-neutral requirements for
new builds. As part of this review, CNSC staff will take into account all lessons learned to date from
Fukushima to revise RD-337.
Below, the CNSC Task Force identifies overall review findings. These are followed by specificfindings for staff follow-up on particular aspects of design and analysis.
The overall finding is that, to date, there are no lessons learned from Fukushima that challenge thefundamental approach to reactor safety and regulation (i.e., application of the defence-in-depth
approach together with multiple physical barriers) for new NPPs in Canada. Nevertheless, it is57

CNSC Fukushima Task Force Reportimportant to learn from all events that occur, especially those that have significant consequences for
public safety and the environment. The CNSC will change its requirements for new NPPs in response.
The overall review finding is that, while recognizing that the fundamental approach is sound, CNSC
staff should reconsider the detailed requirements for the design and analysis of new NPPs in the lightof the events of Fukushima to ensure that these are adequate and consistent with best international
practices. Staff can undertake this activity during the formal review of RD-337.
The underlying basis and principles by which reactors are designed and regulated is robust – the“extended” defence-in-depth approach together with the application of multiple barriers to the releaseof radioactivity and radioactive substances is fundamentally sound. The extended approach requiresthat the design of new NPPs include specific provisions to reduce the probability and mitigate theconsequences of severe accidents. This overall approach is applied in international standards such as
those of the IAEA, and in Canada is documented in more detail in RD-337, published in 2008. These
regulatory requirements for new NPPs represent modern-day practices. Since the publication of
RD-337, the CNSC has been participating in international forums and learning from international
experience, as well as contributing to the preparation of new standards. Therefore, the CNSC is in theprocess of updating RD-337 and developing and writing a sister guide, GD-337.
The Fukushima event highlighted the importance of many aspects related to plant design robustness,severe accident phenomena, the management of severe accidents and more generally emergencies, theneed for, and adequacy of, complementary design features, and the robustness of the plant to
unexpected circumstances including severe external events. Below are specific review findings by the
CNSC Task Force for CNSC staff relating to the design and analysis of new NPPs. Many of thesefindings address issues identified in section 6 for current NPPs. In the former context they point to theneed for consideration of improvements or confirmatory assessment. In this context, they point to theneed to consider the issues through suitable regulatory requirements for new builds.
1. The safety goals in RD-337, Design of New Nuclear Power Plants, are based on single-unit
events. Site-based safety goals or other safety criteria that take into account the sitecharacteristics (including population distribution) and the possibility of multiple-unit accidents
are not explicitly considered.
2. Although RD-337 already has explicit requirements for the design of complementary design
features consistent with international practice, these may not be complete. In addition, there are
no explicit requirements for such features for irradiated fuel bays, including combustible gas
management.
3. Whereas the safety goals are likely adequate for the design of individual units, these may not be
sufficient for a robust demonstration of the offsite response. A separate, more demanding,release value would result in more challenging evaluations of the offsite response.
4. The Fukushima event highlighted the difficulties that can arise when an NPP relies solely on
active engineered systems. The need for specific regulatory requirements for passive safety
features has not been assessed.
5. The requirements in RD-337 for the design, placement and engineering robustness of irradiatedfuel bays is not complete for the entire spectrum of beyond-design-basis scenarios.
6. The CNSC has not documented an overall, systematic approach to the evaluation of all types ofexternal events that could occur in Canada. A systematic approach would encompass bothdesign-basis events and beyond-design-basis events.
7. The Fukushima event highlighted the need for margins to cliff-edges to be understood,
particularly when exceeding such cliff-edges may have catastrophic consequences. CNSC
currently has no explicit requirements for the assessment of such margins for new nuclear power
plants.

58

CNSC Fukushima Task Force Report
8.
9.

10.
11.

12.

13.
14.
15.
16.

10

The CNSC has no requirements for the analysis of multi-unit accidents, particularly those that
could arise from common-cause events.
The CNSC requirements for the design that would facilitate accident management and severe
accident management are incomplete. For example, there are no explicit provisions for the use of
portable equipment and the availability of connections for temporary supplies of electrical power
and water.
The CNSC does not have explicit requirements for complementary design features that could becalled upon to protect the containment. One such feature is filtered containment venting.
The CNSC does not have comprehensive requirements for minimum times before significant
operator interventions are required. Such requirements would be commensurate with the type ofintervention, for example, the need for offsite portable equipment to be brought onsite.
Previous accidents have identified the importance of operators having access to reliable plant
information. The CNSC currently does not have explicit requirements for “hardened” plantmonitoring features and instrumentation that would function reliably under severe accident
conditions, and for the control room equipment expected to be available.
The CNSC does not have design requirements for automated real-time onsite field radiation
monitoring.
The CNSC does not have explicit requirements for the emergency heat removal system forbeyond-design-basis conditions, including the mission time during which it must be available.
The CNSC does not have a full set of requirements for plant and site layout that would facilitate
protection against external hazards.
CNSC requirements for operational limits and conditions do not integrate into one structure thecommand and control needs during normal operation, the emergency operating procedures andsevere accident management guidelines. Furthermore, there is currently no requirement for
further guidance similar to the “extensive damage mitigation guidelines” used in the UnitedStates, which can be used when extensive damage has occurred across a site.

Conclusions and Recommendations
The CNSC Task Force confirms that the CANDU units are robust and have a strong design relying on
multiple layers of defence. The design ensures that there will be no impact on the public fromexternal events that have been regarded as credible during the lifetime of the station. The design alsooffers protection against external events that have a very low probability of occurring. However, thedesign basis for certain external events at certain stations may now need to be updated.
The post-Fukushima review has examined events more severe than those that have historically been
regarded as credible and their impact on the NPPs. The CNSC Task Force has proposed changes todesign or procedures wherever gaps were found in order to minimize or eliminate their impact.
The actions taken by the industry and proposed for the future will ensure that the impact on the public
is as low as reasonably practicable for extreme events, so as not to add to the consequences to society
beyond those caused directly by the events themselves.
The CNSC Task Force has made a number of detailed review findings that relate exclusively to thelessons learned from the Fukushima accident; all of these findings are listed in sections 6 to 9 of thereport. The review findings have been determined through comparison with the Nuclear Power Plant
Safety Review Criteria. These criteria generally exceed the applicable requirements and expectationsof the current CNSC regulatory framework.
Overall, the CNSC Task Force concludes that Canadian NPPs are safe and pose a very small risk to
the health and safety of Canadians or to the environment. The CNSC Task Force is confident that the59

CNSC Fukushima Task Force Report
recommendations in this report will further enhance the safety of nuclear power in Canada and will
reduce the associated risk to as low as reasonably practicable.
Under the oversight of the CNSC and its staff, Canadian nuclear power plants have been runningsafely for over 40 years. As has always been the case, they will only be licensed if the CNSC issatisfied that they will continue to be operated safely.
The CNSC Task Force recommendations below apply to currently operating reactors and must be
considered for new builds. The recommendations below are based on the findings given in sections 6
to 9 of the report. Appendix D summarizes how the findings correspond to the recommendations.

10.1 Strengthening reactor defence in depth
1.

Licensees should systematically verify the effectiveness of, and supplement where appropriate,
the existing plant design capabilities in beyond-design-basis accident conditions, including:a) overpressure response of the main systems and componentsb) containment performance to prevent unfiltered releases of radioactive productsc) control capabilities for hydrogen and other combustible gases:i
accelerate installation of the hydrogen management capability and sampling provisions
ii include spent fuel bays and any other areas where hydrogen accumulation cannot be
precludedd) make-up capabilities for the steam generators, primary heat transport system and connected
systems, moderator, shield tank, and spent fuel bayse) design requirements for the self-sufficiency of a plant site such as availability andsurvivability of equipment and instrumentation following a sustained loss of power andcapacity to remove heat from a reactorf) control facilities 32 for personnel involved in management of the accidentg) emergency mitigating equipment and resources that could be stored offsite and brought
onsite if needed2.

Licensees should conduct more comprehensive assessments of site-specific external hazards todemonstrate that:a) considerations of magnitudes of design-basis and beyond-design-basis external hazards are
consistent with current best international practicesb) consequences of events triggered by external hazards are within applicable limits
Such assessments should be updated periodically to reflect gained knowledge and modern
requirements.

3.

Licensees should enhance their modelling capabilities and conduct systematic analyses ofbeyond-design-basis accidents to include analyses of:a) multi-unit eventsb) accidents triggered by extreme external eventsc) spent fuel bay accidents
The analyses should include estimation of releases, into the atmosphere and water, of fission
products, aerosols and combustible gases.

32

Control facilities are the locations where control of the reactor and accident mitigation measures can beundertaken; for example, main control room, secondary control areas and emergency centres.

60

CNSC Fukushima Task Force Report

10.2 Enhancing emergency response
4.

5.

6.

Licensees should assess emergency plans to ensure emergency response organizations will becapable of responding effectively in a severe event and/or multi-unit accident, and conduct
sufficiently challenging emergency exercises based on them.
Licensees should review and update their emergency facilities and equipment, in particular:a) ensure operability of primary and backup emergency facilities and of all emergency
response equipment that require electrical power and waterb) formalize all arrangements and agreements for external support and document these in theapplicable emergency plans and proceduresc) verify or develop tools to provide offsite authorities with an estimate of the amount ofradioactive material that may be released and the dose consequences, including the
installation of automated real-time station boundary radiation monitoring systems withappropriate backup powerFederal and provincial nuclear emergency planning authorities should undertake a review of
their plans and supporting programs, such as:a) ensuring plan revision activities are expedited and making regular full-scale exercises apriorityb) establishing a formal, transparent, national-level oversight process for offsite nuclear
emergency plans, programs and performancec) reviewing the planning basis of offsite arrangements in view of multi-unit accident
scenariosd) reviewing arrangements for protective action including resolving the issues pertaining to
public alerting, validating the effectiveness of potassium iodide (KI) pill-stocking anddistribution strategies and verifying, or developing the capability for predicting, offsite
effects

10.3 Improving regulatory framework and processes
7.

8.

9.

The CNSC should initiate a formal process to amend the Class I Nuclear Facilities Regulations
to require NPP licensees to submit offsite emergency plans with an application to construct oroperate a nuclear power plant.
The CNSC should amend the Radiation Protection Regulations to be more consistent with thecurrent international guidance and to describe in greater detail the regulatory requirements
needed to address radiological hazards during the various phases of an emergency.
The CNSC should update the regulatory document framework through:a) updating selected design-basis and beyond-design-basis requirements and expectations,
including those for:iexternal hazards and the associated methodologies for assessment of magnitudes
ii probabilistic safety goalsiii complementary design features for both severe accident prevention and mitigation
iv passive safety features
v fuel transfer and storage
vi design features that would facilitate accident managementb) developing a dedicated regulatory document on accident managementc) strengthening the suite of emergency preparedness regulatory documentsd) reviewing applicable Canadian Standards Association standards

61

CNSC Fukushima Task Force Report
10. The CNSC should amend all power reactor operating licences to include specific licenceconditions, requiring implementation of accident management provisions, severe accident
management and public information.
11. The CNSC should further enhance the regulatory oversight of nuclear power plants throughimplementation of a periodic safety review process.
12. The CNSC should review memoranda of understanding with regulatory counterparts in countries
with CANDU reactors to outline what support, if any, they would require from the CNSC during
a nuclear emergency.
13. The CNSC should enhance cooperation with other nuclear regulators in addressing the lessons
learned from the Fukushima accident and thus further strengthen the capability to respondefficiently to any nuclear emergency.

62

CNSC Fukushima Task Force Report

Glossary .
accident
Any unintended event (including operating errors, equipment failures or other mishaps), theconsequences or potential consequences of which are not negligible from the point of view ofprotection or safety.
For the purposes of this document, accidents include design-basis accidents and beyond-design-basis
accidents. Accidents exclude anticipated operational occurrences, which have negligible
consequences from the perspective of protection or safety.
anticipated operational occurrence
An operational process deviating from normal operation which is expected to occur at least once
during the operating lifetime of a reactor facility but which, in view of the appropriate design
provisions, does not cause any significant damage to items important to safety or lead to accident
conditions.
beyond-design-basis accident
Accident conditions less frequent and more severe than a design-basis accident. A beyond-designbasis accident may or may not involve core degradation.
Class I nuclear facility
A Class I nuclear facility refers to a Class IA and a Class IB nuclear facility as described in the ClassI Nuclear Facilities Regulations.
common-cause event
An event that leads to common-cause failures.
common-cause failure
A concurrent failure of two or more structures, systems or components due to a single specific eventor cause such as natural phenomena (such as earthquakes, tornadoes or floods), design deficiency,
manufacturing flaws, operation and maintenance errors, human-induced destructive events and others.
complementary design feature
A design feature from the design-basis envelope that can be used to cope with beyond-design-basis
accidents, including severe accidents.
conservatism
Use of assumptions, based on experience or indirect information, about a phenomenon or behaviourof a system being at or near the limit of expectation, which increases safety margins or makes
predictions regarding consequences more severe than if best-estimate assumptions had been made.
containment
A method or physical structure designed to prevent the release of radioactive substances. This term istypically used in power reactors.
core damage
Core degradation resulting from event sequences more severe than design-basis accidents.

63

CNSC Fukushima Task Force Reportcore damage frequency
An expression of the likelihood that, given the way a reactor is designed and operated, an accident
could cause the fuel in the reactor to be damaged.
creditingAssuming the correct operation of a structure, system or component or correct operator action, as partof an analysis.
defence in depth
A hierarchical deployment of different levels of diverse equipment and procedures to prevent theescalation of anticipated operational occurrences and to maintain the effectiveness of physical barriers
placed between a radiation source or radioactive material and workers, members of the public or theenvironment, in operational states and, for some barriers, in accident conditions.
design basis
The range of conditions and events taken into account in the design of structures, systems andcomponents of a nuclear facility, according to established criteria, such that the facility can withstandthem without exceeding authorized limits by the planned operation of safety systems.
design-basis accident
Accident conditions for which a reactor facility is designed according to established design criteria,
and for which damage to the fuel and the release of radioactive material are kept within regulated
limits.
deterministic safety analysis
An analysis of reactor facility responses to an event performed using predetermined rules andassumptions (e.g., those concerning the initial facility operational state, availability and performanceof the facility systems and operator actions). Deterministic safety analysis can use either conservative
or best-estimate methods.
diversity
The presence of two or more redundant systems or components to perform an identified function,
where the different systems or components have different attributes so as to reduce the possibility ofcommon-cause failure.
emergency exercise
Simulation of emergency events in order to test the integrated performance of an emergency response
scenario.
emergency drill
Testing of a procedure or other specific aspect of an emergency response.
emergency response
The integrated set of infrastructural elements necessary to provide the capability for performing a
specified function or task required in order to prevent, mitigate or control the effects of an accidental
release.
emergency response organization
Group of inter-related responders whose function is to mitigate the consequences of an emergency.
An emergency response organization involves predefined coordination of roles and responsibilities.

64

CNSC Fukushima Task Force Report
external event
Any event that proceeds from the environment external to a reactor facility and that can cause failureof structures, systems and/or components. External events include, but are not limited to, earthquakes,
floods and hurricanes.
external hazard
An event of natural or human-induced origin that originates outside the site and whose effects on thereactor facility should be considered as potentially hazardous.
fail-safe design
Design whose most probable failure modes do not result in a reduction of safety.
heat sink
A system or component that provides a path for heat transfer from a source, such as heat generated in
the fuel, to a large heat-absorbing medium, such as water.
independent system
A system whose ability to perform its required function is unaffected by the operation or failure ofanother system.
internal event
An event internal to the reactor facility that results from human error or failure in a structure, systemor component.
malevolent act
An illegal action or an action that is committed with the intent of causing wrongful harm.
mission time
The duration within which a system or component is required to operate or be available to operate andfulfill its function following an event.
mitigation
Measures aimed at limiting the scale of core damage, preventing interaction of the molten material
with containment structures, maintaining containment integrity, and minimizing offsite releases, inthe event of an accident.
normal operation
Operation of a reactor facility within specified operational limits and conditions including startup,
power operation, shutdown, maintenance, testing and refuelling.
postulated initiating event
An event identified in the design (e.g., of a reactor) as leading to either an anticipated operational
occurrence or accident conditions. This means that a postulated initiating event is not necessarily an
accident itself; rather it is the event that initiates a sequence that may lead to an anticipatedoperational occurrence, a design-basis accident, or a beyond-design-basis accident, depending on the
additional failures that occur.
practicable
Technically feasible and justifiable while taking cost-benefit considerations into account.

65

CNSC Fukushima Task Force Reportpressure boundary
A boundary of any pressure-retaining vessel, system or component of a nuclear or non-nuclear
system.
prevention
In the context of severe accident management, measures aimed at averting or delaying the onset of asevere accident.
probabilistic safety assessment (PSA)
A comprehensive and integrated assessment of the safety of a reactor facility. The safety assessment
considers the probability, progression and consequences of equipment failures or transient conditions
to derive numerical estimates that provide a consistent measure of the safety of the reactor facility, as
follows:• A Level 1 PSA identifies and quantifies the sequences of events that may lead to the loss ofcore structural integrity and massive fuel failures.
• A Level 2 PSA starts from the Level 1 results and analyzes the containment behaviour,
evaluates the radionuclides released from the failed fuel and quantifies the releases to theenvironment.
• A Level 3 PSA starts from the Level 2 results, analyzes the distribution of radionuclides inthe environment, and evaluates the resulting effect on public health.
process system
A system whose primary function is to support (or contribute to) the production of steam orelectricity.
safety analysis
Analysis by means of appropriate analytical tools that establishes and confirms the design basis forthe items important to safety, and ensures that the overall reactor facility design is capable of meetingthe acceptance criteria for each reactor state.
safety case
An integrated collection of arguments and evidence to demonstrate the safety of a facility. A safetycase will normally include a safety assessment, but could also typically include information(including supporting evidence and reasoning) on the robustness and reliability of the safetyassessment and the assumptions made therein.
safety function
A specific purpose that must be accomplished for safety.
safety margin
A margin to a value of safety variable for a barrier or a system at which damage or loss would occur.
Safety margins are considered for those systems and barriers whose failure could potentiallycontribute to radiological releases.
safety system
A system provided to ensure the safe shutdown of a reactor or the residual heat removal from thecore, or to limit the consequences of anticipated operational occurrences and design-basis accidents.
severe accident
A beyond-design-basis accident that involves significant core degradation.

66

CNSC Fukushima Task Force Report
severe accident management (SAM) program
A program that establishes both of the following:
1. the actions to be taken to prevent severe damage to the reactor core, to mitigate theconsequences of the core damage should it occur, and to achieve a safe, stable state of thereactor over the long term
2. the preparatory measures necessary for implementation of such actions
shutdown state
A subcritical reactor state with a defined margin to prevent a return to criticality without external
actions.
structures, systems and components
A general term encompassing all of the elements, except human factors, of a facility or activity that
contribute to protection and safety.
Structures are the passive elements, such as buildings, vessels and shielding. A system comprises
several components, assembled in such a way as to perform a specific (active) function. Components
are the discrete elements of a system, such as wires, transistors, integrated circuits, motors, relays,solenoids, pipes, fittings, pumps, tanks and valves.

67

CNSC Fukushima Task Force Report

References
1

Report of the Japanese Government to the IAEA Ministerial Conference on Nuclear Safety –Accident at TEPCO’s Fukushima Nuclear Power Stations, Government of Japan, 2011-06-18

2

Roadmap towards Restoration from the Accident at Fukushima Daiichi Nuclear Power Station- Update, Tokyo Electric Power Company, 2011-09-20

3

Sources and Effects of Ionizing Radiation, Volume 1, UNSCEAR, 2008

4

DRPH-2011-010, Assessment on the 66th Day of Projected External Doses for Populations
Living in the North-West Fallout Zone of the Fukushima Nuclear Accident, IRSN, 2011-05-23

5

Canadian Guidelines for Intervention During a Nuclear Emergency, Health Canada, 2002-11

6

ICRP Publication 103, The 2007 Recommendations of the International Commission on
Radiological Protection, Ann. ICRP 37 (2-4), 2007

7

ICRP Publication 109, Application of the Commission’s Recommendations for the Protectionof People in Emergency Exposure Situations, Ann. ICRP 39 (1), 20098

CNSC Emergency Response Plan CAN – 2.1, Revision 6, CNSC, 2010-12

9General Nuclear Safety and Control Regulations, S.O.R./2000-202

10

CMD 11-M15, CNSC Staff Presentation on Fukushima Event, CNSC, 2011-03-30

11

CMD 11-M30, Status Report on Power Reactors / Rapport d’étape sur les centrales
nucléaires, CNSC, 2011-06-02

12

Terms of Reference, CNSC Task Force on Review of Japan Nuclear Event: Implications on
Canadian Nuclear Power Plants, CNSC, 2011-04-14

13

CNSC Fukushima Task Force: Nuclear Power Plant Safety Review Criteria, CNSC, 2011-0707

14

Charter for the Nuclear Regulatory Commission Task Force to Conduct a Near-term
Evaluation of the Need for Agency Actions Following the Events in Japan, US-NRC,
ML110910479, 2011-04-01

15“Stress Tests” Specifications: Proposal by the WENRA Task Force, WENRA, 2011-04-12

16

Declaration of ENSREG, EU “Stress Test” Specifications, 2011-05-13

17

El-Sabh, M.I., Murty, T.S., and Dumais, J.-F., 1988, Tsunami Hazards in the St. Lawrence
Estuary, Canada, in: El-Sabh, M.I., and Murty, T.S. (eds.), Natural and Man-Made Hazards,
D. Reidel Publishing, Dordrecht, the Netherlands, p. 201-213

18

S-294, Probabilistic Safety Assessment (PSA) for Nuclear Power Plants, CNSC, 2005-04

19

Reactor Siting and Design Guide, AECB, 1964-11

20

C6 Rev 0, Requirements for the Safety Analysis of CANDU Nuclear Power Plants, AECB,
1980-0621

RD-310, Safety Analysis for Nuclear Power Plants, CNSC, 2008-11

22

RD-337, Design of New Nuclear Power Plants, CNSC, 2008-11

23

G-306, Severe Accident Management Programs for Nuclear Reactors, CNSC, 2006-05

68

CNSC Fukushima Task Force Report

24

GS-G-2.1, Arrangements for Preparedness for a Nuclear or Radiological Emergency, IAEA,
2007-03-23

25

RD-353, Testing the Implementation of Emergency Measures, CNSC, 2008-10

26

G-225, Emergency Planning at Class I Nuclear Facilities and Uranium Mines and Mills,
CNSC, 2001-08

27

Federal Nuclear Emergency Plan Part 1: Master Plan, Health Canada, 2002

28

Emergency Management Act, (S.C. 2007, c. 15), Public Safety Canada, 200729

Federal Emergency Response Plan, Public Safety Canada, 201130

Emergency Management and Civil Protection Act, R.S.O. 1990, Ontario, 1990

31

Provincial Nuclear Emergency Response Plan, Ontario, 200932

Plan national de sécurité civile, Sécurité publique Québec, 201033

Loi sur la sécurité civile, LRQ, c. S-2.3, Sécurité publique Québec, 201134

Emergency Measures Act, c. E-7.1, New Brunswick Department of Public Safety, 1978

35

Point Lepreau Nuclear Generating Station Off-site Emergency Plan, New Brunswick.
Emergency Measures Organization, 1982

36

Nuclear Safety and Control Act, S.C. 1997, c. 937Class I Nuclear Facilities Regulations, S.O.R./2000-204

38

Radiation Protection Regulations, S.O.R./2000-203

39International Regulatory Review Service (IRRS) Report to the Government of Canada, Ottawa,
Canada, 31 May to 12 June 200940

CNSC Fukushima Task Force Review Report – Focus Area: Regulatory Framework, CNSC,
2011-08-19

41

RD-99.3, Requirements for Public Information and Disclosure, CNSC, 2010-11

42

GD-99.3, Guide to the Requirements for Public Information and Disclosure, CNSC, 2010-11

43

RD-360, Life Extension of Nuclear Power Plants, CNSC, 2008-02

69

CNSC Fukushima Task Force Report

Appendix A CANDU Overview
All Fukushima Daiichi reactor units are boiling-water reactors (BWRs) designed by General Electric
about 40 years ago. A BWR is a light-water reactor (LWR) in which light water 33 serves both as thereactor coolant and the moderator 34 . The fuel is arranged in long vertical assemblies located inside thereactor pressure vessel.
All currently operating Canadian nuclear power plant (NPP) reactor units are CANDU (Canadian
Deuterium-Uranium) reactors. The CANDU reactor is a heavy-water moderated, natural uranium
fuelled reactor with pressure tubes. The core consists of an array of horizontal pressure tubes locatedinside a large, horizontally mounted cylindrical vessel, the calandria. The pressure tubes contain thefuel (figure A.1) and coolant. The calandria contains the heavy-water moderator, besides the pressure
tubes.
Figure A.1

Arrangement of Fuel Bundles in a CANDU Calandria

Pressurized heavy water coolant is pumped through the pressure tubes, cooling the fuel and carrying
heat from the fuel to the outlet header and to the steam generators (figure A.2).
Each pressure tube is isolated and insulated from the heavy water moderator by a concentric calandria
tube (figure A.3).

33

Light water is normal water composed of one oxygen and two hydrogen atoms (H2O). In heavy water, thehydrogen atoms are replaced by deuterium atoms (D2O). Deuterium is a heavy isotope of hydrogen with one
proton and one neutron in the nucleus, compared to normal hydrogen which has only a single proton.
34
The moderator in a nuclear reactor is the material used to slow down neutrons emitted in the fission process.

71

CNSC Fukushima Task Force Report
Figure A.2

Figure A.3

Simplified Schematic and Location of Major Systems

Arrangement of Fuel Elements, Pressure and Calandria Tubes

The annular space between the pressure and calandria tubes is filled with carbon dioxide gas. In
CANDU reactors, the moderator system is separated from the high-temperature, high-pressure

72

CNSC Fukushima Task Force Reportcoolant in the pressure tubes. Therefore, the CANDU reactors are based on a pressure-tube design,
not on a pressure-vessel design. The pressurized portion of the reactor is limited to the fuel channels,
which are of relatively small diameter, while the calandria (figure A.4) operates at nearly atmosphericpressure. Pressure tube leaks can be readily detected by monitoring the moisture content and pressurein the annular, gas-filled space between the pressure tube and calandria tube.
Figure A.4

Calandria Assembly

Due to this physical separation from the coolant, the moderator operates at low temperature (60°–70°C) and low (atmospheric) pressure. This allows the moderator to act as an emergency heat sinkcapable of removing decay heat even if normal and emergency cooling fail. Also, since the moderator
is cool, it cannot add any significant amount of energy to the containment system under accident
conditions, such as might occur if a pressure tube ruptured. In CANDU designs, the calandria issurrounded either by a light-water-filled steel shield tank (used for biological and thermal shielding)or by a steel-lined concrete vault called a “calandria” vault. In all stations with calandria vaults,
except Pickering A, the vault is filled with light water and can also act as an additional heat sink in73

CNSC Fukushima Task Force Report
severe accident scenarios. Figure A.5 shows the approximate inventory 35 of heavy and light water in
the CANDU 6 reactor, which surrounds the fuel and calandria vessel.
Figure A.5

Schematic of a CANDU 6 Reactor Core~520 Mg light water inreactor vault~230 Mg heavy
water in calandria
vessel~120 Mg heavy
water in heattransport system

In CANDU designs, the moderator provides a low-pressure environment for the reactivity control
devices (such as control rods) located or introduced into guide tubes positioned interstitially between
rows of calandria tubes. In addition, the location of neutronics measurement devices in the moderator
avoids subjecting this equipment to a hot, pressurized environment.
CANDU reactors incorporate two 36 diverse, fail-safe and passive shutdown systems (Shutdown
System No. 1 and Shutdown System No. 2) which are independent of each other and from the reactor
regulating system. The first shutdown system consists of shutoff rods which are vertically oriented
above the reactor core and are gravity-driven with spring assistance.
The second shutdown system uses high-pressure liquid poison 37 injected into the moderator. Injectionis accomplished by opening fast-acting valves between a high-pressure helium tank and the poisontanks. When the valves open, the liquid poison is injected into the reactor moderator through35

The inventory is given in megagrams (Mg). 1 Mg = 1 tonne or metric ton.
Pickering A Shutdown System 2 is not based on the liquid poison injection, but on the moderator dump
system. Since Pickering A has a moderator dump system, a spray cooling system is provided to cool thecalandria tubes.
37
Liquid poison (usually boron or gadolinium) is a strong absorber of neutrons and quickly stops (or “poisons”)
the nuclear reaction.
36

74

CNSC Fukushima Task Force Reporthorizontally oriented nozzles that span the core. The nozzles are designed to inject the poison in four
different directions in the form of a large number of individual jets. This disperses the poison rapidly
throughout a large fraction of the core. Neither Shutdown System No. 1 nor Shutdown System No. 2
requires an electrical trigger. Both shutdown systems are fail-safe – they operate automatically if theelectricity is turned off – with the poison being injected by compressed helium and, with the rods,
hung above the core with electromagnets, being drawn down by gravity.
Because of the use of natural uranium as fuel, any significant alteration of the CANDU reactor’s
original fuel channel geometry (e.g., increase or decrease of spacing in the CANDU core’s lattice
pitch arrangement) decreases the probability of sustaining a chain reaction. In addition, criticality 38 of
CANDU fuel bundles in light water is impossible. Since most of the water inside containment is lightwater, criticality is not a concern in severe accidents.
In CANDU reactors, a large number of horizontal pressure-tube fuel channels are connected byindividual feeder pipes to horizontal headers. The headers are connected to pumps and steam
generators. The headers and steam generators are located above the core. The positioning of the steam
generators above the core promotes natural circulation flow called thermosyphoning (i.e., movement
due to the coolant’s own density differences), which can remove decay heat if shutdown cooling islost. Thermosyphoning is illustrated in figure A.6. When electrical power is lost to a heat transport
pump motor, the pump continues to spin down under inertia, assisted by a large flywheel integral tothe pump. This ensures that flow drops more slowly than power (falling rapidly due to reactor trip) sothat fuel is adequately cooled. It also establishes forward flow through the fuel channels initially. As
the coolant (heavy water) passes over the fuel in the fuel channels, it is heated and decreases indensity. It flows out of the channel and up to the boilers. In the boilers, heat is transferred to thesecondary side so the coolant gets cooled and its density increases. It flows back to the fuel channels
and “pushes” out the less dense hotter water in the channel. Thus, as with other designs, the CANDU
reactors have the capability of passively removing decay heat provided that water can be injected tothe boilers and that there is no significant leakage of primary coolant.

38

A reactor is “critical” when the fission chain reaction is self-sustaining. The number of neutrons created in thecore is balanced by the number lost when reactor materials absorb them or when they pass outside the core.
When the reactor is “subcritical”, the fission chain reaction quickly drops to a very low value.

75

CNSC Fukushima Task Force Report
Figure A.6

Simplified Schematic of Thermosyphoning

A complete station blackout occurred in a pressurized heavy-water reactor similar to a CANDU(Douglas Point design) in March 1993 at the Narora Atomic Power Station in India. Decay heatremoval during the blackout was mainly due to the flow coastdown followed by thermosyphoning.
During the accident, caused by a fire in the Turbine Building, the emergency crew was able tomanually open the valves allowing injection of fire water to the steam generators. Five hours into theaccident, when entry in the primary containment was deemed safe, fire water was connected to theshield cooling system. The reactor was maintained in a safe shutdown condition, with adequate
subcriticality for 17 hours, until the shared emergency diesel generator was restarted and normal
shutdown cooling was started.
Similarly, during the August 14, 2003, blackout of southern Ontario and the northeastern UnitedStates, the fuel in the Pickering B reactors was cooled by thermosyphoning for up to nine hours.
According to Ontario Power Generation’s (OPG) estimates, thermosyphoning would have continued
to be an effective heat sink for many more hours if restoration of offsite power had been delayed.

76

CNSC Fukushima Task Force Report
In most CANDU designs, the subdivision of the reactor core into two loops, each supplying coolant
to half the core, provides that in a loss-of-coolant accident (LOCA), the break affects half the core. In
addition, there are two core-passes per loop (as shown in figure A.7), which means that only a quarterof the core would likely suffer a major mismatch between heat generation and removal under the
LOCA conditions. CANDU reactors have emergency core cooling systems to provide core cooling in
the event of a LOCA in one unit. The systems are designed to prevent severe core damage for all
break sizes up to the diameter of the largest pipe in the heat transport system.
Figure A.7

Heat Transport System, CANDU 6With the pressure-tube concept, on-power refuelling becomes possible, since, with an appropriate
design, fuel channels can be “opened” individually and at full power to replace some of the fuel. Onpower refuelling was therefore adopted for the CANDU design.
A fundamental principle in CANDU reactor design, and a regulatory requirement, is the separation ofprocess systems – the systems for power production – from safety systems. The objective is to reduce
the likelihood of common-cause events which could initiate an operating upset and impair the
performance of safety systems in accident conditions. In addition to the requirement for the separationof process and safety systems, the systems which perform safety functions are divided into twogroups. The two groups are physically separated so that, within the limits of design, no directional or
localized common-cause event (such as a tornado) can disable more than one group.
Normal practice in CANDU systems is to triplicate the instrumentation and equipment associatedwith important process and special safety systems, such as the reactor regulating system or shutdown
systems. The instrumentation wiring of triplicated shutdown systems is physically separated into
three channels. Separation or distance requirements exist to keep each channel and each piece of
redundant equipment away from its counterpart, so that a common-cause event (such as

77

CNSC Fukushima Task Force Reportelectromagnetic interference, a fire or a flood) does not affect both pieces of redundant equipment
simultaneously.
CANDU fuel channels are housed in a cylindrical calandria vessel containing the heavy watermoderator, which is itself surrounded by a large shield tank filled with light water. These threecomponents represent main sources of cooling and can act as barriers to accident progression. They
can be defended by actions taken as part of severe accident management, another component ofdefence in depth in CANDU reactors.
CANDU reactors have the following major electrical power systems, listed in ascending order ofreliability:• Class IV, which supplies AC power to all essential and non-essential loads during normal
plant operation: Class IV power is supplied from the reactor’s own turbine generator and also
from the electrical grid.
• Class III, which supplies AC power to the essential loads required to bring the plant to a safe
shutdown state and maintain the reactor in a shutdown condition: Class III loads are normally
supplied from Class IV but, in the event that Class IV power is lost, it is supplied by standby
generators which are automatically started and loaded.
• Class II, which supplies uninterruptible AC power to the essential auxiliary services: Class II
power is normally supplied from Class I (batteries) through inverters to ensure there is nointerruption to Class II loads.
• Class I, which supplies uninterruptible DC power to the essential auxiliary services: Class I
power is normally supplied from Class III power through rectifiers and is backed up by
batteries to ensure uninterruptible supply to Class I loads.
• Emergency power system (EPS), which supplies AC power to essential systems (known asgroup 2 systems), required for reactor safe shutdown and decay heat removal underconditions where all other power supplies (i.e., Class I to IV) are not available: The EPS isindependent of the other power supplies.
The most challenging technical issues for severe accident management in CANDU reactors arehydrogen management; containment venting; and, where applicable, the response of the multi-unit,
negative pressure containments. Relative to LWRs of comparable output, CANDU reactor corescontain a large mass of zirconium and its alloys, of the order of 50 Mg, used to fabricate the fuelelements, fuel bundles, pressure tubes and calandria tubes. Oxidation of a large fraction of zirconium
inventory in a severe accident, should it occur, has the potential to result in significant concentrationsof hydrogen in the containment atmosphere. For multi-unit stations, the actual concentrations would
depend not only on how much oxidation takes place but also on how hydrogen is distributed
throughout the reactor units, pressure relief duct, vacuum building and the fuelling machine duct
(figure A.8). All multi-unit CANDU plants are currently equipped with hydrogen ignition systems.
Some operators had either installed or were actively pursuing the provision of additional hydrogen
mitigation by installing passive autocatalytic recombiners, (PARs) prior to the Fukushima Daiichi
accident. In view of the Fukushima accident, the PARs installation across the CANDU fleet is
expected to be expedited.

78

CNSC Fukushima Task Force Report
Figure A.8

Outline of a Multi-unit Containment Envelope

In a multi-unit station, all the reactor vaults are connected together by the fuelling machine duct andpressure relief duct. This shared containment volume is isolated from the vacuum building bypressure relief valves. During normal operation there is vacuum in the vacuum building and a slightly
sub-atmospheric pressure in the ducts and reactor vaults. An accident, such as a loss-of-coolant
accident, in one of the reactor vaults causes the pressure in the shared containment volume to rise.
The pressure difference between the reactor vault and the vacuum building automatically opens therelief valves, connecting the reactor vaults and ducts to the vacuum building. Steam and gases
released in the accident are swept into the vacuum building. In the vacuum building, the rise inpressure releases a large spray of cold water from a dousing tank in the vacuum building roof. The
cold water condenses the steam and absorbs the energy released by the accident. The pressure in thereactor vaults, ducts and vacuum building remain below atmospheric pressure for many hours,
ensuring there can be no leakage of radioactive material to the environment.
All multi-unit CANDU containments have an emergency filtered air discharge system (EFADS)
which can be used to vent the containment atmosphere following an accident such as loss of coolant.
The challenge facing this design in severe accidents is that EFADS were not designed to operate insevere accident conditions over prolonged periods of time or under elevated pressure. Their filters
may be clogged by aerosols expected to be generated in large amounts in severe accidents. In
addition, EFADS are active systems that require AC power to function. Prior to the Fukushima
accident, the Point Lepreau station was undergoing refurbishment. As part of this refurbishment, thelicensee had installed an additional, external containment filtered venting system, which enhances theplant’s ability to response to severe accidents. Some multi-unit stations had been considering thesame type of design modification.
It should be recognized that every NPP design in the world has a set of challenges to contend with inmitigation of highly unlikely severe accidents. CANDU reactors have many positive features but also
some areas where further improvement is possible. This report addresses possible enhancements
arising from the review of the lessons learned from the Fukushima Daiichi accident.

79

CNSC Fukushima Task Force Report
The irradiated (or spent) nuclear fuel removed from CANDU reactors is stored under water in
irradiated fuel bays (IFBs), equivalent to spent fuel pools in other reactor types. The water serves as ashield from radiation and also cools the used nuclear fuel. After about a day in the IFB, the usednuclear fuel generates less than 1 percent of the heat that it generated while in the core. This amountfurther decreases with time. The resulting cooling requirements are greatly reduced and, as a result,
there are significant safety margins when the used nuclear fuel is in the IFB. After about 6–10 years
in wet storage in the IFB, the used nuclear fuel can be safely transferred to dry storage in concrete
canisters, containers or silos. All used nuclear fuel in Canada is currently held onsite in interim
storage facilities, which are safe, secure and environmentally sound.
The IFBs are designed and sized to safely accommodate spent fuel produced at the site until it can betransferred to dry storage. The IFBs are the size of Olympic pools and about 10 metres deep. A
typical CANDU reactor IFB is shown in figure A.9. The walls and floor are constructed of carbonsteel-reinforced concrete approximately 2 metres thick. Inner walls and floors are lined with awatertight liner consisting of stainless steel, a fibreglass-reinforced epoxy compound, or a
combination of the two. The IFB structure is seismically qualified to maintain its safety function
during and following a design-basis event. The IFBs have several designed safety systems to ensurecooling requirements are met.
The IFBs are located outside of the reactor buildings to prevent additional, cascading failures fromevents or accidents should they occur in the containment. It is important to note that, while CANDUIFBs are generally located at ground level, those at Japan’s Fukushima Daiichi site (Mark I type
BWRs) are located at a higher elevation, as shown in figure 2.2. It thus follows that the BWR design
makes spent fuel pools more vulnerable to seismic events and accidents originating in the reactor
building.
Figure A.9

Typical CANDU Irradiated Fuel Bay

80

CNSC Fukushima Task Force Report

Appendix B Progression of a Loss of Heat Sink Accident
The focus of the evaluation of beyond-design-basis accidents is on a complete loss of heat sinks. Thisappendix provides a description of the various stages of the accident, identifying where the operator
could intervene to terminate or slow down the accident progression in a CANDU reactor. It assumes
progressive failure of all engineering and procedural safety features. As such, it is not a realistic
accident, but is nevertheless instructive in exploring levels 1 to 4 of defence in depth.
This description of the event sequence is thought to be broadly correct, particularly in the earlystages. The exact sequence, timing and consequences will vary between reactors. The description of
the later stages is particularly uncertain.

B.1 Secondary boil-down
At the start of the accident, all main feedwater and main heat transport pumps are lost due to anassumed loss of electrical power. The reactor trips immediately on loss of circulation of primarycoolant.
After the reactor trip, heat removal continues as the boilers still contain a lot of water. Conditions
remain stable for up to 5.5 hours (the exact time depends on the station), until the boilers finally boil
dry. Core cooling is adequate throughout this period.
Simple operator actions are also possible that will extend the period of secondary boil-down forseveral hours. Depressurizing the boilers (a simple control room action) allows gravity feed from thedeaerator tank 39 into the boilers. Point Lepreau and Gentilly-2 also have the option of gravity feedfrom the dousing tank, which would extend the secondary boil-down period to about four days.
Restoration of electrical power within the period of secondary boil-down would allow a complete
recovery with no fuel damage.

B.2 Primary boil-downAfter the boilers are dry, the primary coolant heats up and primary pressure rises. Relief valves open
and water is discharged into the bleed condenser 40 . Effectively, the primary water inventory is boiled
away, just as the secondary side had boiled away earlier.
About 4 hours after boiler dryout, the bleed condenser relief valves open, discharging primary coolant
into the containment. Restoration of electrical power before this time would allow a recovery withlimited or no core damage.
Reduction of primary water inventory eventually leads to a loss of coolant circulation and fuel begins
to heat up. The hot fuel heats the pressure tubes, one or two of which quickly fail, depressurizing thereactor into the moderator. The moderator pressure increases, breaking rupture disks at the top of thecalandria vessel; a fraction of the moderator and primary coolant is discharged into the containment.
In reactors with passive accumulators, following the depressurization of the primary heat transportsystem, emergency core cooling is injected which will cool the fuel for a while, but the accumulator
water is soon depleted.

39

The deaerator is a large tank of feedwater which removes dissolved or entrained air from feedwater. Its highelevation permits it to be used as a passive source of gravity feed, meaning that gravity moves the water down
to the boiler.
40
The degasser (or bleed) condenser is a vessel in the pressure and inventory control system. One of its mainfunctions is to act as a buffer volume to accept steam and water discharged from the primary relief valves.

81

CNSC Fukushima Task Force Report

B.3 Moderator boil-downAfter accumulator water is depleted, or immediately for reactors with pumped injection (Pickering A,
B and Darlington), the intact pressure tubes will soften, become deformed and come into contact withthe surrounding calandria tubes. This provides a path for heat from the core to be removed by themoderator. Without adding more water, the moderator can remove decay heat for a further 5.5 hours
after boiler dry-out (the exact time depends on the station). Restoration of moderator cooling early inthis period can prevent reactor meltdown. Bruce A units 1 and 2 already have the capability toprovide make-up water to the moderator. Other stations are evaluating options to provide a make-up
capability.
In the absence of make-up, the moderator continues to boil away. The level in the calandria vessel
falls, progressively uncovering the fuel channels which then begin to overheat. The core debris fromfailed high elevation channels can overload and fail lower elevation channels and this can lead to therelocation of a substantial amount of high temperature debris into the remaining moderator water.
Rapid generation of steam can lead to containment failure at this stage.
Substantial fuel overheating occurs and the reaction of zirconium in the fuel sheath with steam will
generate hydrogen. Fission products and hydrogen are released into the containment.

B.4 Shield tank / calandria vault boil-downAfter the moderator water is depleted, the core falls to the floor of the calandria vessel. The calandria
vessel is surrounded by a water-filled tank called the shield tank or calandria vault, depending on thestation. This water provides a further heat sink for the core debris. For some designs, the shield tankrelief is incapable of relieving the volume of steam generated and the shield tank will fail shortly after
boiling begins. This time is difficult to estimate. Reactors with a calandria vault can delay further
damage until the calandria vault water is depleted. NB Power has installed a calandria vault make-up
capability at the Point Lepreau facility which can delay calandria vault failure for four days, even if
all earlier heat sinks were ineffective.
As core damage and fuel debris temperature increase, additional fission products are released to thecontainment.

B.5 Shield tank / calandria vault failure
After failure of the shield tank / calandria vault, the core debris falls to the concrete floor beneath. If
the space is water filled, rapid generation of steam can lead to high pressure in the containment. In theabsence of water, or after the water has boiled away, the molten core material begins to attack theconcrete. Ablation (erosion) of concrete generates large quantities of heat and non-condensable gas,including hydrogen and carbon monoxide, which are flammable. The rate of generation of
combustible gas is beyond the capability of passive autocatalytic recombiners, and hydrogen
explosions cannot be precluded. It should be noted that the capacity of containment filtered venting
systems is not adequate to control pressure. If containment has not already failed, it will fail due tooverpressure or a hydrogen explosion at this stage. It is estimated that interaction between the coreand concrete would cease before the reactor building basemat 41 is penetrated.

41

The basemat is the thick concrete floor of the reactor building.

82

CNSC Fukushima Task Force Report

Appendix C CNSC Emergency Operations Centre Lessons Learned
This summary is based on the CNSC Reports Fukushima Nuclear Emergency EOC After Action
Report, CNSC, published on August 16, 2011, and Fukushima Nuclear Emergency EOC
Improvement Plan, CNSC, published on August 28, 2011.

C.1 BackgroundOn the morning of March 11, 2011, the Canadian Nuclear Safety Commission (CNSC) became awarethat natural disasters had adversely affected some of the nuclear power plants on the east coast ofJapan. By midday, after consulting with senior management, the CNSC Emergency Operations
Centre (EOC) was activated in accordance with the CNSC Emergency Response Plan CAN – 2.1.
Staff from the CNSC assembled to form the CNSC Nuclear Emergency Organization (NEO) andworked to assess the situation in Japan and develop the strategy for the Canadian response.
Until April 4, for a total of 23 days, approximately 150 staff worked in the EOC on a 24/7 basis tomonitor and assess the situation in Japan. CNSC specialists were able to provide expertise in thefields of reactor technology and radiation protection. The CNSC also reached out and cooperated with
the nuclear regulators in the United States, United Kingdom and France to exchange the latest
technical information.
Following the deactivation of the EOC and return to routine operations, the CNSC’s Emergency
Management Programs Division (EMPD) undertook a lessons-learned process to capture theimportant operational experience from the EOC activation and strengthen the CNSC Nuclear
Emergency Management Program. The process was focused on the activation, operations anddeactivation of the CNSC NEO, the EOC and the CNSC emergency response plans and procedures.

C.2 Methodology
The process of debriefing comprised four distinct activities encompassing all levels, positions andfunctions of the emergency management organization. The focus of these debriefing sessions was to
identify what went well and what could have been done better.
C.2.1
Lessons Learned email accountDuring the EOC activation period, an EOC Lessons Learned email account was created on the CNSC
network to enable NEO members to forward their comments and/or suggestions to identify theopportunities for improvement. Many comments were sent to this account.
C.2.2
NEO members debriefing session
On May 5, the EMPD held a debriefing session exclusively for the NEO members. The session was
primarily focused on the EOC as a facility and the NEO structure as an organization. A discussion
was also held on the specific roles and functional areas of the NEO. This session was attended byapproximately 50 NEO members representing all positions and functions.
C.2.3
Executive and Emergency Director debriefing session
The members of the CNSC’s Japan Executive Team (JET) and the directors general who performed
the duty of Emergency Director during the EOC activation were debriefed on May 11. Thisdebriefing session took into consideration the comments collected from the NEO members and thecomments and suggestions received via the EOC Lessons Learned email account. The focus of thissession was at a higher level (senior management) and on the products and tools required to improve
the CNSC emergency response.

83

CNSC Fukushima Task Force Report
C.2.4
EMPD staff debriefing session
A debriefing session was also held for EMPD staff on May 20. The focus of this session was on the
CNSC nuclear emergency response program, EOC organization, plans/procedures and the NEO
structure.

C.3 Key observations
1.

2.
3.

4.
5.
6.

7.

8.

9.

For an emergency occurring in a distant country, the activation of the CNSC NEO/EOC wastimely and appropriate. The CNSC nuclear emergency management system worked as designed
and planned. Overall the feedback received was positive, confirming the effectiveness andefficiency of the following.
The NEO concept of operations proved to be an effective as well as efficient organization. It
proved to be flexible as it could be expanded or contracted as per the situation.
The EOC used the 3rd floor conference room at CNSC Headquarters in Ottawa as its centre ofoperations. This location proved to be an adequate facility for the NEO with, generally, thenecessary tools and technology for staff to perform their functions. Availability of all meetingrooms on the 3rd floor ensured appropriate accommodation for all NEO functional teams.
The CNSC nuclear emergency response plans and procedures proved adequate and ensured
proper linkages with our internal and external stakeholders.
The role and direction of an ad-hoc executive team (JET) was essential in providing guidanceand strategic direction to the NEO.
The CNSC response to this emergency demonstrated an excellent coordination between all
branches at the CNSC. Staff from Corporate Services Branch, Regulatory Affairs Branch,Technical Support Branch and Regulatory Operations Branch worked closely and effectively
together. In particular, the coordination and integration between the Finance and Administration
Directorate and Directorate of Security and Safeguards were well executed throughout the
duration of the event, assuring the business continuity side of the emergency. The alternate site
for the EOC was in a state of readiness and available at the CNSC’s Telesat offices in Ottawa.
This site would have been used had there been a need to relocate due to an incident at
Headquarters.
Feedback obtained from the debriefing sessions indicated that on-the-job training of new NEO
members during the three weeks activation was useful. Because the event was in a distantcountry and the NEO/EOC was activated for a prolonged period of time, a conscious decision
was made to use this opportunity to train new NEO members. On-the-job training for theexperienced NEO members proved to be good refresher training. The participation of many new
NEO members is reflected in many of the comments sent to the EOC related to training.
No major changes to the EOC and its structure are required at this time. However, sometechnological improvements (hardware as well as software) are required in the EOC to enhancethe emergency response capability and capacity.
The activation, operations and deactivation of the NEO in the EOC were successful. However,
several opportunities for improvement were identified in the Fukushima Nuclear Emergency
EOC Improvement Plan.

C.4 Conclusion
A comprehensive after-action process was undertaken to capture the lessons learned from the CNSC’s
EOC activation for the Fukushima event. A final report with suggested improvement actions waspresented to the CNSC Management Committee on June 16. The CNSC Management Committee
reviewed the submission and approved 39 cross-cutting EOC improvement actions that are now
tracked in an EMPD-managed improvement plan.

84

CNSC Fukushima Task Force Report

Appendix D Correspondence of Report Recommendations to Detailed
Findings
The table below shows the relationship between the CNSC Fukushima Task Force recommendations
from section 10 and the detailed findings from sections 6 to 9.
10.1 Strengthening reactor defence in depth
Recommendation 1
1. Licensees should systematically verify theeffectiveness of, and supplement where appropriate, theexisting plant design capabilities in beyond-design-basis
accident and severe accident conditions, including:a)overpressure response of the main systems andcomponentsb)containment performance to prevent unfilteredreleases of radioactive productsc)control capabilities for hydrogen and othercombustible gases:i) accelerate installation of the hydrogen
management capability and sampling provisionsii) include spent fuel bays and any other areas wherehydrogen accumulation cannot be precludedd)make-up capabilities for the steam generators, primaryheat transport system and connected systems,
moderator, shield tank, and spent fuel bays

Review finding(s)Section 6.3.8 (#5)
Degasser (bleed) condenser relief valves have been tested
to ensure that they are capable of providing sufficientrelief flow for worst-case design-basis accidents.
However, they have not been tested at extreme conditions
that may arise in beyond-design-basis accidents. In thesecases, relief valve capacity may not be adequate in asustained loss of all heat sinks, reducing the time before
pressure tubes fail. The CNSC previously evaluated thisissue and accepted the current design, although themargin to failure was small.
Section 6.3.8 (#6)
Shield tank relief and calandria vault relief have not beenverified to be adequate for beyond-design-basis
accidents. A large inventory of water surrounds the coreof a CANDU reactor – one of the strengths of its design.
Nonetheless, if relief valves do not have sufficient
capacity in a sustained loss of heat sinks, the shield tankcould fail due to overpressure and much of the available
water may be lost, leading to an earlier failure of thecalandria vessel than would be the case if adequate relief
was available.
Section 6.4.7 (#2)
Plant design capabilities for severe accident management,such as containment venting, hydrogen mitigation,
coolant make-up provisions, instrumentation, and thecontrol areas have not been fully evaluated anddocumented. Such design capabilities would allow
minimization of the consequences of a severe accident,
should one occur.
Section 6.3.8 (#1)
Not all licensees have completed the installation ofpassive autocatalytic recombiners. Most licensees havetaken action to accelerate the installation.
Section 6.3.8 (#10)
The need for hydrogen mitigation in the irradiated fuelbay area has not been adequately evaluated.
Section 6.3.8 (#9)
The irradiated fuel bays (spent fuel pools) at most NPPs
have temperature limits that lead to relatively short times(16 hours) for which a loss of cooling can be tolerated
before the structural design temperature is reached.
Above this temperature, an increasing risk of structural
cracking could lead to leakage from the bay, thereby
shortening the time to fuel uncovering. Additionally, with85

CNSC Fukushima Task Force Report

10.1 Strengthening reactor defence in depthe)f)design requirements for the self-sufficiency of a plantsite such as availability and survivability of equipment
and instrumentation following a sustained loss of
power and capacity to remove heat from a reactor

control facilities for personnel involved inmanagement of the accident

a low water level, it may not be possible to perform
manual actions in elevated radiation fields.
Section 6.4.7 (#2)
Plant design capabilities for severe accident management,such as containment venting, hydrogen mitigation,
coolant make-up provisions, instrumentation, and thecontrol areas have not been fully evaluated anddocumented. Such design capabilities would allow
minimization of the consequences of a severe accident,
should one occur.
Section 6.2.3 (#2)
Safety analyses have demonstrated that equipment andprocedures are adequate to ensure that, for all designbasis accidents where core cooling is lost when ashutdown reactor is hot and pressurized, the reactor canbe taken to a stable state. However, analysis to show that
the NPP can be taken to a cold, depressurized state is
incomplete.
Section 6.2.3 (#3)
Safety analyses have not demonstrated that, for all
design-basis accidents, equipment and procedures used totake the reactor to a cold, depressurized state canmaintain that state for a prolonged period.
Section 6.3.8 (#3)
In the event of a loss of all normal, backup andemergency AC power, the guaranteed capability of ClassI batteries to support all essential electrical equipment is
40 minutes (although it is recognized that some services
will last much longer). This duration is short compared toother essential supply capabilities and gives little time torestore AC power. Once batteries are exhausted, mostcontrol and instrumentation functions are lost.
Section 6.3.8 (#4)
While key instrumentation is fully qualified for designbasis accidents, survivability in beyond-design-basis
accident conditions has not always been demonstrated.
Section 6.3.8 (#7)
The minimum Class I/II equipment that is needed tomitigate beyond-design-basis accidents involving loss of
all AC power has not been systematically identified.
Section 6.4.7 (#2)
Plant design capabilities for severe accident management,such as containment venting, hydrogen mitigation,
coolant make-up provisions, instrumentation, and thecontrol areas have not been fully evaluated anddocumented. Such design capabilities would allow
minimization of the consequences of a severe accident,
should one occur.

86

CNSC Fukushima Task Force Report

10.1 Strengthening reactor defence in depthg) emergency mitigating equipment and resources that
could be stored offsite and brought onsite if needed

Recommendation 2
2. Licensees should conduct more comprehensive
assessments of site-specific external hazards todemonstrate that:a)considerations of magnitudes of design-basis andbeyond-design-basis external hazards are consistent
with current best international practicesb)consequences of events triggered by external hazards
are within applicable limits

Section 6.4.7 (#4)
Licensees’ emergency response organizations do nothave access to a regional warehouse that could makeavailable offsite equipment and resources that may beneeded in case of a severe accident. Availability ofemergency equipment was shown to be crucial during the
Fukushima event and could allow terminating a severe
accident early enough to prevent any radioactive releases
to the environment.
Review finding(s)Section 6.1.3 (#1)
The original magnitudes considered for the design-basis
and beyond-design-basis assessments of external hazards
were developed for the original licensing of the facilities.
Although in general a lot of conservatism was included in
the original designs, some design bases are not consistent
with modern best practices.
Section 6.1.3 (#3)
External hazards screening and bounding analysis are indifferent states of development for each NPP.
Consequently, analysis of all external hazards is notcomplete at all NPPs.
Section 6.1.3 (#2)
The assessment for the design-basis and beyond-designbasis tornado hazard was found to be weak at some
NPPs.
Section 6.2.3 (#1)
Implementation of a safety analysis framework based on
RD-310, Safety Analysis of Nuclear Power Plants, isincomplete.
Section 6.4.7 (#5)
Severe accident analyses and assessments of external
hazards are not systematically produced and periodically
updated. This aspect of the plant safety case has notreceived much attention in the past and was shown to beimportant in understanding the site-specific challenges
and possible progression of a severe accident.

Such assessments should be updated periodically to reflect
gained knowledge and modern requirements.
Recommendation 3
3. Licensees should enhance their modelling capabilities
and conduct systematic analyses of beyond-design-basis
accidents to include analyses of:a)multi-unit events

Review finding(s)Section 6.4.7 (#1)
Current assessments do not adequately consider eventsaffecting multiple reactors on the site, events at spent fuelbays, as well as events triggered by extreme external
hazards. Having detailed assessments of the severe
accident management procedural guidance and design
capabilities to cater to beyond-design-basis and severe
accidents were shown to be of high priority during the
Fukushima event.

87

CNSC Fukushima Task Force Report

10.1 Strengthening reactor defence in depthb)

accidents triggered by extreme external eventsc)spent fuel bay accidents

Section 6.4.7 (#3)
The scope of analyses of severe accidents does not fully
cover accidents triggered by extreme external events,
multi-unit events, and spent fuel bay accidents. The
modelling capabilities for multi-unit events are not fully
adequate. Improvements would also give a better
estimation of the source terms of radioactivity andcombustible gases.
Section 6.3.8 (#8)
Modelling of severe accidents performed for multi-unit
NPPs was based on a computer model that represents
only a single unit. The modelling approach is accepted asadequately giving broadly representative results but
would not be capable of calculating, for example, theeffects of different times of core meltdown in the
different units.
Section 6.3.8 (#2)
Results of studies of the duration of primary boiloff
before pressure tube failure are not consistent. The
progression of a sustained loss-of-heat-sinks event
described by licensees is in broad agreement with the
CNSC’s understanding. However, the CNSC Task Forceassessment of the time available before pressure tube
failure is shorter than that given by industry.
Section 6.4.7 (#1)
Current assessments do not adequately consider eventsaffecting multiple reactors on the site, events at spent fuelbays, as well as events triggered by extreme external
hazards. Having detailed assessments of the severe
accident management procedural guidance and design
capabilities to cater to beyond-design-basis and severe
accidents were shown to be of high priority during the
Fukushima event.
Section 6.4.7 (#1)
Current assessments do not adequately consider eventsaffecting multiple reactors on the site, events at spent fuelbays, as well as events triggered by extreme external
hazards. Having detailed assessments of the severe
accident management procedural guidance and design
capabilities to cater to beyond-design-basis and severe
accidents were shown to be of high priority during the
Fukushima event.

The analyses should include estimation of releases, into
the atmosphere and water, of fission products, aerosols andcombustible gases.

88

CNSC Fukushima Task Force Report

10.2 Enhancing emergency response
Recommendation 4
4. Licensees should assess emergency plans to ensure
emergency response organizations will be capable ofresponding effectively in a severe event and/or multi-unit
accident, and conduct sufficiently challenging emergency
exercises based on them.

Recommendation 5
5. Licensees should review and update their emergency
facilities and equipment, in particular:a)ensure operability of primary and backup emergency
facilities and of all emergency response equipmentthat require electrical power and waterb)formalize all arrangements and agreements forexternal support and document these in the applicableemergency plans and proceduresc)verify or develop tools to provide offsite authorities
with an estimate of the amount of radioactive material
that may be released and the dose consequences,including the installation of automated real-timestation boundary radiation monitoring systems withappropriate backup power

Recommendation 6
6. Federal and provincial nuclear emergency planning
authorities should undertake a review of their plans andsupporting programs, such as:a)ensuring plan revision activities are expedited andmaking regular full-scale exercises a priority

Review finding(s)Section 6.5.11 (#1)
Emergency response organizations are capable ofresponding to single-unit, beyond-design-basis events.
Evaluation and revision of emergency plans in regard to
multi-unit accidents and severe external events, including
an assessment of the minimum complement requirements
have not been performed. As a result, it has not beenconclusively demonstrated that emergency responseorganizations will be capable of responding effectively ina severe event and/or multi-unit accident.
Section 6.5.11 (#2)
The performance of the emergency response organization
under severe event and/or multi-unit accident conditions
has not been challenged by designing and conducting
exercises that are based on such conditions.
Review finding(s)Section 6.5.11 (#4)
Not all licensees’ emergency facilities and equipment
have backup power available in the event of a loss ofexternal power. Backup power sources for primary andalternate emergency facilities, and all emergency
response equipment that require electrical power tooperate (e.g., electronic dosimeters, two-way radios),
have not been systematically identified. The applicableemergency plans and procedures do not, in all cases,
adequately document the requirements and limitations.
Section 6.5.11 (#5)
Arrangements and agreements for external support are
not always formalized and not always documented in theapplicable emergency plans and procedures.
Section 6.5.11 (#3)
Automated real-time station boundary radiation
monitoring systems with appropriate backup power andcommunications systems are seen as a best practice
approach and allow critical data to be available rapidly.
However, such systems are not available at all sites.
Section 6.5.11 (#6)
Hydro-Québec does not currently have source term
estimation capability included in its dose modelling tools.
NB Power does not currently have source term and dosemodelling tools.
Review finding(s)Section 7.5 (#5)
Federal and provincial nuclear emergency planning
authorities have not yet undertaken a formal lessonslearned process to gain knowledge from offsite
management of the Fukushima nuclear emergency andupdate plans accordingly.
Section 7.5 (#8)

89

CNSC Fukushima Task Force Report

10.2 Enhancing emergency response
The Health Canada Federal Nuclear Emergency Plan(FNEP) has not been updated since 2002 and is notformally integrated with the Public Safety Canada
Federal Emergency Response Plan (FERP). The FNEP
and FERP integration has not been validated in a fullscale, NPP-focused exercise.
Section 7.5 (#3)
Federal and provincial nuclear emergency planning
authorities are not making regularly planned full-scale
NPP-focused exercises a priority. It was generally
observed at the provincial and federal level that there has
been a reduction in the frequency of full-scale NPPfocused exercises. Although all provincial and federal
plans reviewed appear to be satisfactory, theimplementation, and thus the capability to respond, has
generally not been tested in an exercise for several years.
Section 7.5 (#13)
The Province of Quebec has not recently updated its
nuclear emergency plan.

b)establishing a formal, transparent, national-level
oversight process for offsite nuclear emergency plans,
programs and performancec)reviewing the planning basis of offsite arrangements
in view of multi-unit accident scenarios

Section 7.5 (#15)
The Province of New Brunswick has not recently
updated its nuclear emergency plan.
Section 7.5 (#4)
Federal and provincial nuclear emergency planning
authorities do not fully address recovery phase guidelines
and procedures in their emergency plans, as they
primarily address only preparedness and response.
Section 7.5 (#6)
There is no formal, transparent, national-level oversightprocess for offsite nuclear emergency plans, programs
and performance. Whereas NPP licensees’ onsite
emergency plans, programs and performance areincluded in the CNSC regulatory oversight process, there
is no similar system of oversight for offsite emergency
plans.
Section 7.5 (#7)
There is no established national guidance or standard foroffsite nuclear emergency planning. Whereas NPP
licensees are provided with CNSC guidance on
emergency planning, there is no Canadian guidance foroffsite nuclear emergency plans.
Section 7.5 (#9)
The Province of Ontario planning basis for the current
nuclear emergency plans and offsite arrangements is asingle-unit accident scenario and does not explicitly
consider a multi-unit accident scenario.

d)reviewing arrangements for protective action
including resolving the issues pertaining to publicalerting, validating the effectiveness of potassium
iodide (KI) pill-stocking and distribution strategies
and verifying, or developing the capability forpredicting, offsite effects

Section 7.5 (#10)
There are ongoing public alerting issues in the 3 km zone
around the Pickering NPP. Also, the new 10 km publicalerting requirement has not been fully implemented.

90

CNSC Fukushima Task Force Report

10.2 Enhancing emergency response
Section 7.5 (#11)
The potassium iodide (KI) pills for residents of theplanning zone in Ontario are stocked at local pharmacies
in the Durham region or the reception centre in
Kincardine. The effectiveness of this approach, as
opposed to pre-distribution to all households, has notbeen confirmed.
Section 7.5 (#12)
There is no automated public alerting system around theGentilly-2 NPP.
Section 7.5 (#14)
The Province of New Brunswick does not have thecapability for predicting offsite effects.
10.3 Improving regulatory framework and processes
Recommendation 7
7. The CNSC should initiate a formal process to amend
the Class I Nuclear Facilities Regulations to require NPP
licensees to submit offsite emergency plans with anapplication to construct or operate a nuclear power plant.

Review finding(s)Section 7.5 (#1)
The Class I Nuclear Facilities Regulations do notcurrently require submission of offsite emergency plans
with an NPP operating licence application. Whereas an
NPP licensee’s onsite emergency plans are submitted to
the CNSC as part of the licence application and renewal
process, there is no formal requirement for the offsite
plans to be submitted to the CNSC.
Section 8.7 (#1)
The Class I Nuclear Facilities Regulations do not have
explicit requirements for submission of offsite
emergency plans.

Recommendation 8
8. The CNSC should amend the Radiation Protection
Regulations to be more consistent with the current
international guidance and to describe in greater detail theregulatory requirements needed to address radiologicalhazards during the various phases of an emergency.

Review finding(s)Section 8.7 (#2)
The Radiation Protection Regulations are not fully
consistent with international guidance and do not fully
describe the regulatory requirements needed to address
radiological hazards during the various phases of an
emergency.

Recommendation 9
9. The CNSC should update the regulatory document
framework through:a) updating selected design-basis and beyond-designbasis requirements and expectations, including thosefor:i) external hazards and the associatedmethodologies for assessment of magnitudes

Review finding(s)Section 8.7 (#6)
The three-year regulatory framework plan does not
currently accommodate the CNSC Task Force review
findings.

Section 8.7 (#7)
A small number of regulatory documents (RDs) or
guidance documents (GDs) are lacking requirements or
guidance needed to address the lessons learned.
Section 8.7 (#8)
The lessons learned are not yet fully considered for the
next revision of other NPP-related RDs or GDs.

91

CNSC Fukushima Task Force Report

10.3 Improving regulatory framework and processesii) probabilistic safety goalsiii) complementary design features for both severe
accident prevention and mitigation

Section 8.7 (#9)
The lessons learned are not yet fully considered as part ofthe preparation of new RDs or GDs.
Section 9 (#8)
The CNSC has no requirements for the analysis of multiunit accidents, particularly those that could arise from
common-cause events.
Section 6.1.3 (#4)
The requirements and expectations for defining
magnitudes to be used for design-basis and beyonddesign-basis hazards have not been reviewed sinceoriginal NPP licensing. The methodologies used toestablish the criteria for these hazards are not consistent
with modern best practices.
Section 9 (#6)
The CNSC has not documented an overall, systematic
approach to the evaluation of all types of external events
that could occur in Canada. A systematic approach would
encompass both design-basis events and beyond-designbasis events.
Section 9 (#7)
The Fukushima event highlighted the need for margins tocliff-edges to be understood, particularly when exceeding
such cliff-edges may have catastrophic consequences.
CNSC currently has no explicit requirements for theassessment of such margins for new nuclear power
plants.
Section 9 (#15)
The CNSC does not have a full set of requirements forplant and site layout that would facilitate protection
against external hazards.
Section 9 (#1)
The safety goals in RD-337, Design of New Nuclear
Power Plants, are based on single-unit events. Site-based
safety goals or other safety criteria that take into accountthe site characteristics (including population distribution)and the possibility of multiple-unit accidents are notexplicitly considered.
Section 9 (#3)
Whereas the safety goals are likely adequate for thedesign of individual units, these may not be
sufficient for a robust demonstration of the offsite
response. A separate, more demanding, release value
would result in more challenging evaluations of theoffsite response.
Section 9 (#2)
Although RD-337 already has explicit requirements forthe design of complementary design features consistent
with international practice, these may not be complete. In
addition, there are no explicit requirements for suchfeatures for irradiated fuel bays, including combustible
gas management.

92

CNSC Fukushima Task Force Report

10.3 Improving regulatory framework and processesiv) passive safety featuresv)

fuel transfer and storagevi) design features that would facilitate accident
management

Section 9 (#10)
The CNSC does not have explicit requirements forcomplementary design features that could be called upon
to protect the containment. One such feature is filteredcontainment venting.
Section 9 (#14)
The CNSC does not have explicit requirements for the
emergency heat removal system for beyond-design-basis
conditions, including the mission time during which it
must be available.
Section 9 (#4)
The Fukushima event highlighted the difficulties that canarise when an NPP relies solely on active engineered
systems. The need for specific regulatory requirementsfor passive safety features has not been assessed.
Section 9 (#5)
The requirements in RD-337 for the design, placement
and engineering robustness of irradiated fuel bays is notcomplete for the entire spectrum of beyond-design-basis
scenarios.
Section 9 (#9)
The CNSC requirements for the design that would
facilitate accident management and severe accident
management are incomplete. For example, there are no
explicit provisions for the use of portable equipment andthe availability of connections for temporary supplies ofelectrical power and water.
Section 9 (#11)
The CNSC does not have comprehensive requirements
for minimum times before significant operator
interventions are required. Such requirements would becommensurate with the type of intervention, for example,
the need for offsite portable equipment to be brought
onsite.
Section 9 (#12)
Previous accidents have identified the importance of
operators having access to reliable plant information. The
CNSC currently does not have explicit requirements for“hardened” plant monitoring features and instrumentationthat would function reliably under severe accident
conditions, and for the control room equipment expected
to be available.
Section 9 (#13)
The CNSC does not have design requirements forautomated real-time onsite field radiation monitoring.

93

CNSC Fukushima Task Force Report

10.3 Improving regulatory framework and processesb) developing a dedicated regulatory document on
accident managementc)strengthening the suite of emergency preparedness
regulatory documentsd)reviewing applicable Canadian Standards Association
standards

Recommendation 10
10. The CNSC should amend all power reactor operating
licences to include specific licence conditions, requiring
implementation of accident management provisions,severe accident management and public information.

Section 6.4.7 (#7)
Relevant sections in the existing and planned regulatory
documents, such as G-306, Severe Accident Management
Programs for Nuclear Reactors; RD-310, Safety Analysis
for Nuclear Power Plants; and RD-337, Design of New
Nuclear Power Plants, have not been re-evaluated andrevised to account for the lessons learned following the
Fukushima accident. There is currently no regulatory
document giving specific requirements for accident
management.
Section 9 (#16)
CNSC requirements for operational limits and conditions
do not integrate into one structure the command andcontrol needs during normal operation, the emergency
operating procedures and severe accident management
guidelines. Furthermore, there is currently no
requirement for further guidance similar to the “extensive
damage mitigation guidelines” used in the United States,
which can be used when extensive damage has occurred
across a site.
Section 6.5.11 (#7)
The suite of emergency preparedness regulatory
requirement documents, currently comprising guidance
document G-225, Emergency Planning at Class I
Nuclear Facilities and Uranium Mines and Mills, andregulatory document RD-353, Testing the
Implementation of Emergency Measures, are lacking
detailed and specific requirements needed to strengthenand standardize emergency preparedness and response in
Canada.
Section 8.7 (#10)
Canadian Standards Association standards that apply to
NPPs have not been reviewed by the CNSC staff as aresult of lessons learned.
Review finding(s)Section 6.4.7 (#6)
Current power reactor operating licences do not havespecific licence conditions requiring implementation of
accident management provisions, including those forsevere accidents.
Section 8.7 (#4)
Existing licence conditions in power reactor operating
licences do not explicitly address accident management,
severe accident management and public information.
Section 8.7 (#5)
RD-99.3, Requirements for Public Information andDisclosure and its guide, GD-99.3, Guide to theRequirements for Public Information and Disclosure,
have not been approved for publication, leaving a
potential gap in regulatory requirements and guidance forlicensees’ public information programs.

94

CNSC Fukushima Task Force Report

10.3 Improving regulatory framework and processes

Recommendation 11
11. The CNSC should further enhance the regulatory
oversight of nuclear power plants through implementationof a periodic safety review process.

Section 8.7 (#11)
Licence condition handbooks are lacking requirements
and guidance needed to address lessons learned.
Review finding(s)Section 8.7(#3)
Canada does not have a formal periodic safety review
process. As demonstrated by international practice,
regulatory oversight of nuclear power plants may befurther enhanced through implementation of a periodic
safety review process.

Recommendation 12
12. The CNSC should review memoranda ofunderstanding with regulatory counterparts in countries
with CANDU reactors to outline what support, if any, theywould require from the CNSC during a nuclear
emergency.

Review finding(s)Section 7.5 (#2)
The memoranda of understanding with regulatory
counterparts in countries with CANDU reactors have notbeen reviewed to identify what support, if any, theywould require from the CNSC during a nuclear
emergency.

Recommendation 13
13. The CNSC should enhance cooperation with othernuclear regulators in addressing the lessons learned fromthe Fukushima accident and thus further strengthen thecapability to respond efficiently to any nuclear emergency.

Review finding(s)Section 7.5 (#2)
The memoranda of understanding with regulatory
counterparts in countries with CANDU reactors have notbeen reviewed to identify what support, if any, theywould require from the CNSC during a nuclear
emergency.

95