supplementary information oral presentation submission from
TRANSCRIPT
CMD 15-H2.2A
File / dossier : 6.01.07 Date: 2015-03-16 Edocs: 4696387
Supplementary Information Oral presentation Submission from Greenpeace Canada In the Matter of Bruce Power Inc.
Renseignement supplémentaires Exposé oral Mémoire de Greenpeace Canada À l’égard de Bruce Power Inc.
Application to renew the Power Reactor Operating licence for the Bruce A and B Nuclear Generating Stations
Demande concernant le renouvellement du permis d’exploitation pour les centrales nucléaires de Bruce A et B
Commission Public Hearing April 14-15-16, 2015
Audience publique de la Commission Les 14-15-16 avril 2015
1
Preventing Unreasonable Risk: Bruce Power’s Application to Continue Operating the
Bruce A and B nuclear stations Prepared by Shawn-Patrick Stensil
Senior Energy Analyst, Greenpeace Canada
March 16, 2014
2
Table of Contents
1. Summary
2. Bruce Power’s Increased Risk to Public Safety
3. Scale of Radioactive Releases
4. Timing of Radioactive Releases
5. Industry Lead Regulation
5.1 External Events
5.2. Emergency Mitigation Equipment (EMEs)
5.3 Site Wide Risk
6. Offsite Emergency Plans
7. Requirement for Objective Risk Information
8. Licence Compliance
9. Meeting the Commission’s Legal Obligations: Life-Extension
Oversight
Appendix
3
1. Summary
The chance of a major accident with offsite impacts has increased significantly according to Bruce
Power’s most recent risk assessments for the Bruce “A” and “B” nuclear stations. The timing, scale and
likelihood of accidents at the Bruce nuclear station contravene international and Canadian guidelines for
reactor design and offsite emergency planning.
The risk to public safety is dominated by containment by-pass accidents that lead to severe radiation
releases within the first twenty four hours. Specifically, Bruce Power’s risk assessments show that the
Bruce A reactors potential for a level 7 accident on the International Nuclear Event Scale (INES) is
realistic and credible according to the CNSC’s traditional approach to accident assessment.
In Greenpeace’s view, this makes the continued operation of the Bruce nuclear station an
“unreasonable risk” under the Nuclear Safety and Control Act (NSCA). This requires the Commission to
either eliminate or reduce the risk posed by the Bruce reactors to Canadian society.
Gaps and loopholes in the CNSC’s regulatory approach have allowed reactor operators in Canada,
including Bruce Power, to effectively self-regulate. These gaps and loopholes include:
• The CNSC’s decision to allow reactor operators to define the limits on risk their facilities impose
on the public.
• The failure of the CNSC to provide clear and consistent guidance on how external events – such
as tornadoes – are included in the risk assessments.
• The failure to establish clear limits on the risk posed by multi-unit nuclear stations.
• The lack of procedures requiring provincial authorities and the CNSC to verify the effectiveness
of offsite emergency measures against the risk posed by nuclear stations.
While Bruce Power is requesting an unprecedented five year licence for all eight reactors at the Bruce
nuclear site, Greenpeace believes the most recent risk studies make it necessary for the Commission to
eliminate or reduce risk from the station.
For this reason, Greenpeace recommends a one year licence for the Bruce A nuclear station. This will
allow Bruce Power to should submit a proposal on how it will upgrade the Bruce A nuclear station to
meet modern standards to public review and reduce risks to public safety before the life-extension
project can proceed.
2. Bruce Power’s Increased Risk to Public Safety
In November 2014, Bruce Power published a summary of its most recent risk assessments for the Bruce
A and B nuclear stations. It shows that the risk of significant accidental radioactive releases from the
Bruce station is much higher than previously thought.
The CNSC and reactor operators like Bruce Power have historically assessed the risk posed by nuclear
reactors through two metrics. The first is referred to as Core Damage Frequency (CDF). This is the
likelihood of damage to a reactor core or what is more popularly understood as core ‘melt’. Three Mile
Island is an example of a core damage accident. The other metric is Large Release Frequency (LRF). This
4
is the likelihood of a large accidental release of radiation that could lead to the abandonment of land.
Chernobyl and Fukushima are examples of large radiation release accidents.
Historically, reactor operators such as Bruce Power and OPG only calculated the likelihood of core
damage or accidental radiation release accidents caused by “internal events”. This refers to accidents
triggered by the failure reactors components or structures.
These risk limits are expressed as probabilities. Reactor operators such as OPG use a method called
Probabilistic Risk Assessment (PRA), which is also used by the aviation industry, to estimate the
frequency of core damage and large release accidents.
Table 1 shows the evolution of the Large Release Frequency (LRF) estimates for the Bruce A and B
nuclear stations for internal events. “1E-5” refers to accident events that are estimated to occur once
every 100,000 years of reactor operation. “1E-6” references accidents occurring once every 1,000,000
years of reactor operation.
Table 1 – Evolution of Large Release Frequency for Internal Events at Bruce Nuclear Station
Event Target Limit Bruce A 2014 Bruce A 2003 Bruce B 2014 Bruce B 1999
Large Release
Frequency 1.00E-06 1.00E-05 9.87E-06 1.30E-06 5.49E-06 3.70E-07
The risk of a large accidental radiation release from the Bruce A reactors has increased by a factor of 7.6
since 2005. The risk of a large accidental radiation release from the Bruce B reactors has increased by a
factor of 15.
These are increases are significant. The Bruce A reactors sit just below the traditional “limit” used to
determine tolerable risk. The risk level from the Bruce B reactors sits between the limit and the goal. In
Greenpeace’s view, this level of risk should trigger increased the regulatory oversight by the CNSC.
The above estimates are only for internal events. This allows for an “apples to apples” comparison of
the understood risk posed to the public by the Bruce nuclear station. As will be discussed, it is
increasingly, although reluctantly, acknowledged by the CNSC and operators that the historic
consideration of only accidents triggered by internal events provides significant underestimates of the
actual risk posed by nuclear stations.
Bruce Power has attempted to reduce LRF estimates by asserting that “Emergency Mitigating
Equipment” (EMEs) could reduce the likelihood of such accidents by up to a factor of ten. The use of
these analytical enhancements has yet to be rigorously reviewed. The credibility of EME effectiveness
should also be questioned. This will be discussed in section 5.2.
As will be discussed, even if the effectiveness of EME effectiveness is accepted as presented by Bruce
Power, the timing, scale and likelihood of accidents at the Bruce nuclear station still contravene
international and Canadian guidelines for reactor design and offsite emergency planning.
5
3. Scale of Radioactive Releases
The magnitude of accidental radioactive releases would be significantly higher at the Bruce site than
Ontario’s other nuclear stations according to historic and current risk assessments.
As noted, Large Release Frequency (LRF) is the main indicator used by the industry to estimate risk to
the public. A large release is typically defined by the amount of radioisotopes released to the
environment. The CNSC’s design guide for new reactors defines a large release as more than 1014
becquerels of cesium-137. Bruce Power’s probabilistic risk summary defined a large release as a release
of more than 1% of Cesium-137.1 Based on the core inventory of the Bruce reactors, these definitions
are effectively the same.2
The criterion for large release accidents is a lower threshold. As seen by Fukushima and Chernobyl,
releases can be significantly larger and have significantly higher impacts. Indeed, past risk assessments
for the Bruce A and B nuclear stations evaluated the likelihood of “severe releases.” A severe release
was defined as a release greater than 10 percent of the core inventory of cesium-137. According to
these PRAs, severe releases could lead to early fatalities. There is no mention of severe releases in Bruce
Power’s current risk assessment summary.
As noted, the 1999 Bruce B Risk Assessment found large release accidents had an estimated likelihood
of 3.7E-7. It also found severe releases had a likelihood of 1.2E-7.3 Otherwise put, approximately a
third of large release accidents were actually severe releases, leading to early fatalities. Similarly, the
2005 Bruce Risk assessment update found large release accidents had an estimated likelihood of 1.3E-6.
It also found severe releases had a likelihood of 4.1E-7. (See Table 2 in Appendix). Again approximately
a third of large release accidents are in fact severe release of more than 10 percent of the core
inventory.
To Greenpeace’s knowledge, estimates of severe releases have not been produced for the Pickering and
Darlington nuclear stations. Greenpeace asked Bruce Power for recent estimates of severe releases.
Bruce Power said it no longer produces such estimates. Past assessments, however, have indicated that
approximately a third of the station’s large release frequency involves severe releases. Based on Bruce
Power’s 2014 LRF estimates, severe accident frequency would have a likelihood of approximately 3.26E-
6.
Following the Chernobyl accident, the International Atomic Energy Agency (IAEA) created a
categorization system for accidents called the International Nuclear Event Scale (INES). The objective of
INES scale is “…to facilitate communication and understanding between the technical community, the
media and the public on the safety significance of events.”4 To do this, the INES scale associates
radioactive releases to possible offsite effects.
Table 3 in the Appendix provides the INES release criteria and description of offsite effects. In 2014, the
CNSC released an accident study assessing the impacts of a large release accident used in its regulatory
1 Brue Power, Summary of the Methodology and Results of the Bruce A and Bruce B Probabilistic Safety Assessments,
November 2014, P. 3 2 The core of a Bruce A reactor contains 4.52E+16 of Cesium-137. One percent of this is equivalent to 4.5E+14.
3 Ontario Power Generation, Bruce NGS B Risk Assessment Summary Report, November 1999, NK29-REP-03611-00001, p. 38
4 International Atomic Energy Agency, The International Nuclear Event and Radiological Event Scale User’s Manual, 2008, p. 8
6
guidance. On the INES scale a large release accident would be defined at a level 6 accident on the INES
scale. Based on the information available on Iodine-131 and Cesium-137 released for each of the large
release sequences identified in the risk assessments for the Bruce A and B nuclear stations, all of the
large release accidents at the Bruce nuclear station would be INES 7 accidents – the highest level on the
INES Scale. (See tables 4 and 5 in the Appendix).
Risk is a combination of both an event’s likelihood and its consequences. As discussed, the understood
likelihood of large release accidents at the Bruce nuclear station is much higher than previously thought.
What’s more, based on available information, the magnitude of radioactive releases from the Bruce
reactors is higher than other Ontario nuclear stations. All of the large release sequences identified
would be Level 7 accidents on the INES scale.
4. Timing of Radioactive Releases
The large release frequency of both the Bruce A and B nuclear stations is dominated by accident
sequences that lead to large and early radioactive releases. This contravenes modern reactor design
requirements and offsite emergency plans.
Two accident sequences dominate the overall large release frequency for both the Bruce A and B. The
Table 2 below shows these sequences contribute over 90% of both station’s overall Large Release
Frequency for internal events.
Table 6: Contribution of Early Release to Large Release Frequency
Bruce A Early Large Release Categories Bruce B Early Large Release Categories
Release
Category Description Frequency
Release
Category Description Frequency
RC0
Early very large
release - > ~3% core
inventory of I-131
occurring mainly
within 24 hours.
2.90E-06 RC0
Early very large release - >
~3% core inventory of 1-
131 occurring mainly after
24 hours.
4.71E-06
RC2
Early RD-152 Large
Release Mixture of
fission productions
contain > 1014
Bq of
Cs-137 but <~3% core
inventory of I-131
occurring mainly
within 24 hours.
6.72E-06 RC2
Early RD-152 Large
Release – Mixture of
fission products containing
> 1014
Bq of Cs-137 but <
~3% core inventory of I-
131 occurring mainly
within 24 hours
2.70E-07
Sum of RC0 and RC2 9.62E-06 Sum of RC0 and RC2 4.98E-06
Total LRF 9.87E-06 Total LRF 5.49E-06
Contribution of Early Release 97.47% Contribution of Early Release 90.71%
7
These early release accidents dominate the risk to the public and should trigger oversight and direction
by the Commission – not staff – under the Nuclear Safety and Control Act (NSCA). As reflected in
international and Canadian design guidance large early releases constitute an “unreasonable risk” under
the NSCA.
In response to the Fukushima disaster, the European Union issued a revised nuclear safety directive to
member states. The new directive adds a clause instructing member states to design nuclear safety
requirements to “prevent accidents” and “avoid” “early radioactive releases that would require off-site
emergency measures but with insufficient time to implement them”5
In Canada, regulatory guide RD-337 also states that reactors should be designed to allow for sufficient
time to implement measures offsite to protect the public. It states: “the containment boundary should
be capable of contributing to the reduction of radioactivity releases to allow sufficient time for the
implementation of off-site emergency procedures.” It also states containment should be able to
maintain “…its role as a leak-tight barrier for a period that allows sufficient time for the implementation
of off-site emergency procedures following the onset of core damage.”
RD-337 also states: “The design should be balanced such that no particular design feature or event
makes a dominant contribution to the frequency of severe accidents, taking uncertainties into account.”
In Greenpeace’s view, the dominant risk of containment by-pass accidents endangering public safety
reflects an unbalanced design. As will be discussed in Section 6, Ontario’s offsite emergency
protective measures were not designed to be implemented in the first twenty four hours.
In conclusion, the timing, scale and likelihood of accidents at the Bruce nuclear station contravene
international and Canadian guidelines for reactor design and offsite emergency planning. In
Greenpeace’s view, the continued operations of the Bruce reactors constitute an “unreasonable risk” to
Canadian society. The Commission has an obligation under the NSCA to eliminate or reduce this risk.
5. Industry Lead Regulation
Gaps and loopholes in the CNSC’s regulatory approach have allowed Canadian reactor operators to
effectively self-regulate for decades. For existing reactors both risk limits and what risk contributors
should be assessed were originally defined by Ontario Hydro (the predecessor to OPG and Bruce Power)
with no public consultation. In Greenpeace’s view, This industry lead regulatory approach has allowed
industry to avoid safety upgrades to cut costs.
In 2008, the CNSC consulted and established risk limits for new reactors. Section 4.2.2 of RD-337,
Design of New Nuclear Power Plants, states the following limit for large radioactive releases:
The sum of frequencies of all event sequences that can lead to a release to the environment of
more than 1014
becquerel of cesium-137 is less than 10-6
per reactor year. A greater release may
require long term relocation of the local population.6
5 See Article 8a, Clause 1 a at: http://eur-lex.europa.eu/legal-
content/EN/TXT/?uri=uriserv%3AOJ.L_.2014.219.01.0042.01.ENG 6 RD-337, RD-337: Design of New Nuclear Power Plants
8
Notably, this limit is one level of magnitude lower than the limits set by industry for existing reactors.
What’s more, the wording “all event sequences” requires reactor operators to consider accident
sequences triggered by more than component and structure failure (internal events). Specifically, this
means external events, such as earthquakes, tornados, floods and terrorism. Reactor operators have
historically ignored external events in their risk assessments policies.
In 2009, the CNSC attempted to establish clear and consistent regulatory guidance for existing reactors.
It published Regulatory Document 152 (RD-152), Guidance on the Use of Deterministic and Probabilistic
Criteria in Decision-making for Class I Nuclear Facilities, for consultation. RD-152 adopted the risk targets
and limits that were historically used by Ontario Hydro and OPG.7
However, RD-152 imitated RD-337 by requiring external events be included when considering whether
an operator is complying with risk limits. , RD-152 states:
“The safety goals include the contribution of facility-originated events (such as equipment
failure, operator errors, internal fire, and internal floods) and external events (such as
earthquakes, weather-originated events, and fire), but exclude malevolent act.”
This was a positive step toward addressing a significant gap in the safety assessment of existing reactors.
RD-152 was, however, never put into force by the CNSC.8 This means that risk limits are still
determined by licensees.
During the 2013 and 2014 Pickering hearings, Greenpeace’s intervention focused on how the CNSC’s
industry-lead regulatory approach for existing reactors allowed OPG to simply ignore the increasing risk
posed to public safety to reduce costs. First, Greenpeace highlighted how OPG was simply ignoring its
own risk assessment policy. Second, OPG’s risk policy simply ignored the contribution of external events
to risk as well as the increased hazard of having six operating reactors at a site.
If implemented, RD-152 would have required OPG to include external events in its risk estimates. As
will be discussed in Section 5.1, OPG and Bruce Power’s probabilistic risk assessment policies are silent
on the consideration of external events. Likewise, Section 5.2 shows how the Canadian industry and the
CNSC have simply ignored how multi-unit sites increase the hazard and risk to the public.
According to OPG’s policy establishing risk targets and limits, it must take action to reduce risks when a
limit for core damage or large radiation releases is reached. It also states that when CDF and LRF are
found to be between the limit and safety goal actions should still be taken to reduce risk. The
Commission affirmed this in its August 2013 decision, stating that if a risk assessment finds the station is
operating “…above acceptable limits then safety improvements would be mandatory” and that if the
finds “are between the limits and the targets, then safety improvements should be put in place if
practicable.” As a result, the Commission directed OPG to submit an “action plan to address any
identified issues should OPG exceed its targeted safety goals.”9 With no clear and consistent limits set
7 Canadian Nuclear Safety Commission, RD-152: Guidance on the Use of Deterministic and Probabilistic Criteria in
Decision-making for Class I Nuclear Facilities, May 2009, Appendix B, p. 2. 8 To Greenpeace’s knowledge, no justification has been given for not issuing RD-152 as official regulator guidance.
9 Recording of Proceeding in the matter of Ontario Power Generation’s application to Renew the Power Reactor Operating
Licence for the Pickering Nuclear Generating Station, August 9, 2013, pgs. 5 -6. See: http://nuclearsafety.gc.ca/eng/the-
commission/pdf/2013-05-29-Decision-OPG-Pickering-e-Edocs4177096.pdf
9
by the Commission, the Pickering relicensing highlights why the Commission should pay special
attention to licencee risk policy at relicensing.
Although OPG’s risk policy is referenced in its LCH, OPG and CNSC staff were effectively ignoring it until
Greenpeace alerted the Commission. In 2014, the CNSC published REGDOC-2.4.2, Safety Analysis:
Probabilistic Safety Assessment (PSA) for Nuclear Power Plants to replace S-294. It states that licencee
probabilistic risk policies should be referenced in the LCH to become part of a station’s licensing basis.
The licensing basis sets the legal “boundary conditions” for reactor operation.
Greenpeace asked Bruce Power to provide a list of documents referenced in its LCH related to
probabilistic risk policy. Bruce Power provided some information from its internal “proprietary”
probabilistic risk policy, but did not confirm if any such documents are listed in the LCH. A review of the
proposed LCH shows no references to any such policy.
Unlike OPG this suggests that there are no risk boundaries included in Bruce Power’s licensing basis. If
true, this means different levels of risk are permitted at different stations in Ontario. Indeed, Bruce
Power’s Frank Saunders told the Commission they have no policy like OPG that requires them to reduce
risk if they are between the limit and the safety goal.10
This shows how acceptable risk for existing reactors is based on a patchwork of licencee produced
guides and procedures that may, or may not, be available to the public. The fact that OPG must have an
“action plan” to reduce risk if its risk assessments find a reactor running between the limit and goal
while Bruce Power does not shows the CNSC permits a two-tiered approach safety in Ontario.
Gaps and loopholes in the CNSC’s regulatory approach have allowed reactor operators in Canada to
effectively self-regulate. The lack of clear and consistent risk limits for existing reactors has allowed
reactor operators to increase risk to the public to reduce the cost of their operations.
5.1 External Events
The Bruce A and B reactors either exceed or approach the traditional risk limits for reactor operation if
external events are included. This should trigger the Commission’s legal responsibility to limit risk to
Canadians by directing Bruce Power to propose risk reduction action plans, including upgrades to the
stations.
For example, Table 3 below compares the CDF for the Bruce A and B stations against the traditional limit
for core damage. Both Bruce A and B exceed the limit when external events are included in the overall
risk.
Table 7 - Bruce A and B Core Damage Frequency Including External Events
Event Category Bruce A CDF
(No EME Credit)
Bruce B CDF (No
EME Credit)
10
Transcripts, February 4 2014 hearing of the CNSC on the Bruce Power’s licence application, See pages 152 and 153,
http://nuclearsafety.gc.ca/eng/the-commission/pdf/2015-02-05-HearingTranscript-edocs4649351-e.pdf
10
At-Power
Internal Events 2.07E-05 1.48E-05
Outage Internal
Events 1.28E-05 8.30E-06
Internal Flood 5.20E-06 4.50E-06
Fire 8.72E-05 4.06E-05
Seismic 1.70E-05 7.20E-06
High Wind 6.66E-05 2.46E-05
Totals 2.10E-04 1.00E-04
CDF Limit 1.00E-04 1.00E-04
Although it is generally accepted that the contribution of external events should be included in a
station’s assessment of compliance against risk limits, the CNSC’s failure to implement RD-152 has
meant there are no clear requirements for existing reactors. Moreover, the Commission’s failure to
provide clear regulatory expectations for external events has meant staff have failed to develop an
acceptable agreement on how such a standard will be applied.
The danger of this gap in the CNSC’s regulatory approach was evident during the Pickering relicensing
hearings in 2013. While CNSC staff did sum external events in their submission to the Commission
before the May 2013 hearings, Greenpeace highlighted that two important risk contributors – high
winds and flooding – had been excluded from the overall large release estimates. Greenpeace noted
that if these risk contributors were included the station’s LRF would exceed limits and immediate
regulatory action would be required.
Faced with risk assessments showing the Pickering reactors were operating beyond safety limits, CNSC
staff equivocated. Safety limits that previously triggered regulatory action became mere “expectations”.
The conservatism embedded in risk assessments previously touted as a precautionary public protection
measure was now, once limits were exceeded, portrayed as gross exaggerations that render limits
meaningless. Despite having used simple summation in their submissions to the Commission in 2013,
staff told the Commission in 2014 that“…simple summation of internal events and external events
provide biased results due to the large uncertainties associated with external events…”11
In Greenpeace’s view, the cause of these erratic policies is the Commission’s failure to establish clear
risk limits and standards for existing plants. As noted, the policies cited in OPG’s LCH do not mention
external events. There are no formal bounds in OPG’s licensing basis. The same is apparently true for
Bruce Power.
The inclusion of external events in OPG’s risk assessments has proven inconvenient for licencees and
apparently CNSC staff. Their inclusion inevitably shows the risk posed by reactors is higher than
previously admitted and triggers requirements to reduce risk. In Greenpeace’s view, this is necessary
following the Fukushima.
11
Canadian Nuclear Safety Commission, Public Hearing Transcripts, May 7th
, 2014, p. 57
11
Although the CNSC has not established clear exceptions on how external events should be included in
probabilistic risk assessments, the results show the Bruce A and B stations approach or exceed
traditional risk limits if external events are only partially considered.
5.2 Emergency Mitigation Equipment (EMEs)
Greenpeace is concerned that Emergency Mitigation Equipment (EME) is hastily and inappropriately
being adopted to paper over the important weaknesses in the Bruce (and Pickering) designs.
Greenpeace asks the Commission to question their credibility in its deliberations.
The most recent risk assessments for the Pickering and Bruce nuclear stations have shown a significant
increase in the likelihood of major accidents. The estimates for just internal events have increased by
several levels of magnitude over the past decade, putting the stations above the safety goal for large
release frequency for the first time.
As discussed in Section 4, for example, the most recent risk assessments for the Bruce A and B reactors
show containment by-pass accidents leading to early and large radiation releases are significantly more
likely than previously thought. This is a weakness in the station’s design that should be properly
understood and addressed.
At the same time, it is generally accepted that external events should be considered in risk assessments.
As shown in Table 7 above, if external events are included the Bruce stations exceed traditional risk
limits. This was to be expected. Indeed, an expert report commissioned by the Senate of Canada in
2000 predicted similar results to OPG’s 2013 risk assessment for the Pickering station in 2000,
specifically citing external events.12
Again, these new risks should be understood and addressed.
However, when faced with similar evidence during the 2013 Pickering hearings, CNSC staff stated under
cross-examination that these results could be overlooked because the use of EMEs would reduce
accident risk by a factor of ten.13
Similar numbers have been applied to probabilistic risk results
published by Bruce Power.
Although not opposed to EMEs, Greenpeace is skeptical of their credibility and current application.
Take the example of external events. The CNSC first passed requirements for external events to be
assessed in 2005.14 It has taken approximately a decade for the industry to develop and gain
acceptance of external event methodologies and subsequently run the modelling. For EMEs, however,
industry and staff have managed to develop and come to a consensus on their application within about
two years.
12
Dr. Gordon Thompson, A Review of the Accident Risk Posed by the Pickering ‘A’ Nuclear Generating Station, A Report to the
Standing Committee on Energy, Environment and Natural Resources of the Canadian Senate, August 2000, p. 27. Available at:
http://www.irss-usa.org/pages/documents/CanSenReport08_00_000.pdf 13
Transcripts, CNSC hearing on the licence renewal application for the Pickering nuclear station, see pages 319 – 320. Available
at: https://nuclearsafety.gc.ca/eng/the-commission/pdf/2013-05-30-Transcription-Hearing-e.pdf 14
CNSC, Probabilistic Safety Assessment (PSA) for Nuclear Power Plants S-294, April 2005.
12
The application and effectiveness also seems to vary considerably in documents published by Bruce
Power. For example, the EMEs appear to reduce the large release frequency for the Bruce A reactors by
two orders of magnitude in Bruce Power’s risk summary report15
and by only one order of magnitude in
documents Bruce Power provided to Greenpeace.16
Bruce Power also did not carry out an uncertainty analysis on the ability of EMEs to reduce CDF or LRF
by the claimed amount.17
Meanwhile, CNSC staff appear to at least internally question the effectiveness
of EMEs in lowering accident frequency. In a February 2014 presentation to Management Committee,
CNSC staff provided estimates for EMEs being 50 and 90% efficient in reducing the likelihood of core
damage and releases to the environment.18
Please see Table 8 in the Appendix for the estimates
presented to Management Committee.
In Greenpeace’s view, EMEs are being hastily and inappropriately applied to recent risk assessments.
Their contribution to reducing accident frequency should be considered skeptically by the Commission.
5.3 Site Wide Risk
The risk limits and targets referenced by the CNSC and Bruce Power all underestimate the total site-wide
risk of multi-unit nuclear stations. This gross underestimation of risk needs to be taken into account by
the Commission in making its decision.
Since the Fukushima disaster began, Greenpeace has attempted to draw the Commission’s attention to
a regulatory loophole that allows Ontario’s multi-unit nuclear stations to impose significantly higher
levels of risk on surrounding communities than is allowed at the single unit Point Lepreau nuclear station
in New Brunswick. In response to a formal ruling request in 2013, the Commission acknowledged the
legitimacy of Greenpeace’s concern and instructed staff and OPG to begin developing safety goals for
sites with multiple reactors. However, the gap still exists in the CNSC’s regulatory approach.
With eight operating reactors, the Bruce site is the largest nuclear station in the world. For the first time,
Bruce Power is asking the Commission to give it one licence for all eight reactors. It is thus important for
the public and the Commission to understand the cumulative risk posed by the site. While Bruce Power
has provided separate estimates of the aggregate risk posed by each station, it has not provided an
estimate of the site-wide risk to the public.
In a February 4th
letter to the Commission19
Greenpeace provided Access to Information documentation
on the CNSC’s internal assessment of site-wide risk at the Pickering and Darlington nuclear stations. This
information can be found in Table 7 of the Appendix. Many of these estimates show the Pickering and
Darlington nuclear stations exceed the traditional risk for accidents leading to significant off-site
releases of radioactivity.
15
See page 14. Available at: http://www.brucepower.com/wp-content/uploads/2013/11/Microsoft-Word-Public-Website-
Whitepaper-R04.pdf 16
See Table 5: http://www.brucepower.com/wp-content/uploads/2015/01/GreenpeaceInfoRequest.pdf 17
Response to the New Clear Free Solutions Bruce Power Request for Information Available at:
http://www.brucepower.com/wp-content/uploads/2015/01/Response-to-the-New-Clear-Free-Solutions-Bruce-Power-Request-
for-Information.pdf 18
Acquired through Access to Information. Request # A-2014-00044 19
CMD-15-H2.2
13
Greenpeace requested equivalent information for the Bruce nuclear station, specifically “staff’s site-
wide estimates of Core Damage Frequency and Large Release Frequency for the Bruce site (all eight
reactors).” CNSC staff have not provided this information.
6. Offsite Emergency Plans
As discussed in Sections 2, 3 and 4, the scale, timing and likelihood of accidents at the Bruce nuclear
station contravene international and Canadian guidelines for reactor design and offsite emergency
planning.
For example, the current Provincial Bruce Nuclear Emergency Implementing Plan assumes there would
be two days to implement emergency measures. Section 2.6.1 (a) states “a minimum interval of 2 ½
days (between the occurrence of the accident and the commencement of an emission) can be used for
planning purposes.”20
According to Bruce Power’s most recent risk assessments, however, the stations’
risk to the public is dominated by large – and potentially severe - releases of radiation within the first
twenty four hours.
Ontario’s detailed offsite emergency plans were also not designed to address level 7 INES
accidents. At the request of the Ontario government in the 1990s, the Royal Society Canada and the
Canadian Academy of Engineering studied the risk from Canada’s reactors and recommended that
“detailed emergency planning should be done for accidents resulting from a credible series of events
which could occur with a probability of approximately 10-7
/reactor year.”21
Based on this probability cut-off for detailed emergency planning, the Royal Society of Canada report
used the 1995 Pickering A risk assessment to highlight what scale of accident pre-prepared protective
measures should be organized. Greenpeace has reviewed these accidents. None of them were level 7
INES accidents. Likewise none involved severe releases.22
Accidental radioactive releases on par with a level 7 INES accident are the dominant risk to the public
around the Bruce nuclear station. This risk is not addressed in Ontario’s detailed offsite nuclear
emergency plans.
If the Commission decides to renew the licences for the Bruce and B nuclear stations it should inform
the government of Ontario that protective measures should be prepared to address early and severe
radiation releases from the Bruce nuclear station.
20
See: Provincial Nuclear Emergency Response Plan Implementing Plan for Bruce Power, November 2009. See:
https://www.emergencymanagementontario.ca/english/beprepared/ontariohazards/nuclear/nuclear_plan_bruce.html 21
W.R. Bruce et al, Report to the Ministry of the Environment and Energy concerning two technical matters in the Provincial
Nuclear Emergency Plan, Royal Society of Canada & Canadian Academy of Engineering, November 1996, p. 33. 22
See: Comments on: Study of Consequences of a Hypothetical Severe Nuclear Accident and Effectiveness of Mitigation
Measures, Prepared by Shawn-Patrick Stensil, August 29, 2014.
14
7. Requirement for Objective Risk Information
Bruce Power’s most recent risk assessments show that Level 7 INES accidents are realistic at the Bruce
nuclear station. The CNSC, however, has never provided information to the public on the
environmental, health and social effects of such an accident.
In Greenpeace’s view, the CNSC must provide such information to comply with Section 9(b) of the NSCA.
It states the Commission has an obligation to: “to disseminate objective scientific, technical and
regulatory information to the public concerning the activities of the Commission and the effects, on the
environment and on the health and safety of persons.”
In light of the most recent risk information discussed in this submission, Greenpeace also feels the
Commission may have a responsibility to provide this under the Canadian Environmental Assessment Act
(CEAA). The findings of 2014 Bruce A probabilistic risk assessment shows the conclusions of the 2005
environment review of the Bruce A life-extension project are no longer validated by evidence. They
should be updated before the project can proceed.
The 2005 environmental review only assessed the consequences of accidents with an estimated
likelihood greater than one in a million per years or reactor operation (1E-6). This method ignored both
the potential contribution of external events to accident likelihood and was based on estimates for a
single reactor.
Based on this criteria, consequences of two accidents were assessed in the environmental review using
the finding of Bruce Power’s 2003 Risk assessment for the Bruce A nuclear station. Those accident
scenarios were EPRC7 and EPRC10. EPRC 7 had an estimated likelihood of 2.6E-5. It is described as a
“containment by-pass” accident. EPRC10 had an estimated likelihood 3E-5. It was described as a “Loss
of Coolant Accident with intact containment.”23
While it is not explicitly stated both of these “credible” accidents involved only minor releases of
radiation from containment. This informed the environmental review’s conclusion that the project
would have no significant environmental effects.
As discussed, the most recent Bruce A risk assessment shows that Release Categories 0 – 4 as meeting
release threshold of a level 7 INES accident. As shown in Table 6, Release Categories 0 and 2 would be
considered “credible” with estimated likelihoods of 2.9E-6 and 6.72E-6. Both of these are also a
significant concern from an emergency planning perspective because they would be level 7 INES
accidents occurring within the first twenty-four hours.
As discussed, Bruce Power has attempted to reduce the likelihood of Bruce A’s large release frequency
by asserting that Emergency Mitigating Equipment would reduce the probability of most Release
Categories by a factor of ten. The credibility and verifiability of these claimed reductions should be
questioned.
That said, when comparing the 2005 risk assessment to the current assessment Greenpeace contends
that it should be done on an apples to apples basis. In 2005, accidents were selected based on only
internal events. It was only in 2005 that the CNSC required external events be included in probabilistic
23
See: TABLE 3.5.11-5, Bruce A Refurbishment for Life Extension and Continued Operations Project, December 2005, p. 108
15
risk assessments of Canadian nuclear stations.24
Similar to EMEs, external events were not yet
considered in probabilistic risk assessments at Canadian nuclear stations.
In light of Bruce Power’s most recent risk assessments, Greenpeace believes that the Commission has a
responsibility to provide the public with information on the impacts of a level 7 INES accident at the
Bruce nuclear station.
8. Licence Compliance
On April 24 2014, the CNSC announced that it had extended the operating licence for the Bruce A and B
reactors for seven months. According to the CNSC’s record of decision Bruce Power requested the
extension “to provide a more fulsome public discussion.”25
The Funk and Wagnalls Canadian College
Dictionary defines fulsome as “distastefully excessive in an oily or insincere way: a fulsome compliment.”
As noted in correspondence submitted to the Commission for the day one hearing, Access to
Information documents suggest Bruce Power failed to fully comply with its licences to operate the Bruce
A and B nuclear stations. Greenpeace requested clarifications from CNSC staff on a number of issues
raised by these documents, but has received no response.
According to these Access to Information documents, Bruce Power’s licence control handbook stated
the company should complete all probabilistic risk assessments needed to comply with regulatory guide
S-294 (Probabilistic Safety Assessment (PSA) for Nuclear Power Plants ) by December 30, 2013.
Indeed, at the end of November 2013 CNSC staff informed Bruce Power it would “not be compliant with
the current LCHs” based on its plan to submit many of the detailed studies in July 2014.26
The original licence renewal hearings were scheduled for June and September 2014. Clearly this would
not have allowed for CNSC staff to assess whether the submitted studies were compliant with
requirements or whether the assessments identified the need for changes to Bruce Power’s licensing
requirements.
In Greenpeace’s view, internal correspondence acquired through Access to Information indicates that
the seven month licence extension was not initiated to allow for a meaningful public debate on Bruce
Power’s reactors, but to accommodate Bruce Power’s non-compliance with its licence. In this way, it
may have in fact been appropriate for the Commission to state that the licence extension was to allow
for a “fulsome public discussion.”
The ability of licencees to comply with their licence requirements should inform the evaluation of
licence applications, such as this one. In the future, Greenpeace urges CNSC staff to be forthright with
the Commission and the public about licence non-compliance.
24
CNSC, Probabilistic Safety Assessment (PSA) for Nuclear Power Plants S-294, April 2005. 25
Record of Proceeding, including Reasons for Decision, Application to Amend the Bruce Nuclear
Generating Stations A and B Power Reactor Operating Licences, April 24, 2014, e-Doc 4423908. Available at:
http://www.nuclearsafety.gc.ca/eng/the-commission/pdf/2014-04-24-Decision-BruceA&B-Amendment-Edocs4423908.pdf 26
R. Lojk to F. Saunders, “Bruce NGS A and B – Notification on Completeness of Licence Renewal Applications”, November 29,
2013.
16
9. Meeting the Commission’s Legal Obligations: Life-Extension Oversight
As discussed, the timing, scale and likelihood of accidents at the Bruce nuclear station contravene
international and Canadian guidelines for reactor design and offsite emergency planning. The
Commission – not staff- has a responsibility to either prevent or reduce this risk under the NCSA.
Bruce Power is asking for one five-year licence for all eight reactors at the Bruce site. This is
unprecedented.
Meanwhile, Ontario’s Long Term Electricity Plan (LTEP) indicates that Bruce Power will begin rebuilding
one of the Bruce A reactors in 2016. Bruce Power CEO Duncan Hawthorne, however, stated that the
company won’t present a safety review and a plan for the life-extension work until it signs a contract
with the province.27
Greenpeace believes that applications to rebuild and extend the lives of CANDU reactor should be
aligned with licence renewal hearings. This allows transparency and public scrutiny of the safety reviews
and upgrades proposed by the licencee.
In light of the findings of Bruce Power’s most recent risk assessments for the Bruce A nuclear station,
Greenpeace submits the Commission must ensure a transparent and public review of the station against
modern nuclear safety standards.
Specifically, Bruce Power needs to provide evidence and proposals on how it will meet the modern
standards laid out in RD-337, specifically that:
The sum of frequencies of all event sequences that can lead to a release to the environment of
more than 1014
becquerel of cesium-137 is less than 10-6
per reactor year. A greater release may
require long term relocation of the local population.28
Based on the evidence available and past practice, the operation of the Bruce A nuclear station is clearly
an “unreasonable risk” to Canadian society. It is thus incumbent on the Commission to eliminate this
risk or direct Bruce Power to reduce these risks.
Recommendation: Greenpeace requests a one year licence for the Bruce A nuclear station. At the next
licence renewal, Bruce Power should submit its proposal on how it will upgrade the Bruce A nuclear
station to meet modern standards for public review.
27
Transcripts, February 4th
Hearing on Bruce Power’s Licence Application for the Bruce A and B nuclear stations, pgs 48 – 48.
See: http://www.cnsc-ccsn.gc.ca/eng/the-commission/pdf/2015-02-05-HearingTranscript-edocs4649351-e.pdf 28
RD-337, RD-337: Design of New Nuclear Power Plants
17
Appendix
Table 1 – Evolution of Large Release Frequency for Internal Events at Bruce Nuclear Station
Event Target Limit Bruce A 2014 Bruce A 2003 Bruce B 2014 Bruce B 1999
Large Release
Frequency 1.00E-06 1.00E-05 9.87E-06 1.30E-06 5.49E-06 3.70E-07
Table 2 - The Bruce A Probablistic Risk Assessment 2005
Safety Goal Consequence
categories
contributing to
Safety Goal
Safety Limit (per
reactor year
unless otherwise
stated)
Calculated
frequency
(Notes 1)
Integrated
frequency of
contributors
(PRY)
Note 2
Comparison of
Integrated
Frequency with
limit
Severe Core
Damage (SCD)
FDC1-IC
FDC1-OC
FDC2-IC
FDC2-OC
1E-4 6.55E-8
1.16E-12
7.72E-5
3.64E-5
5.7E-5* Meets Limit
Early Fatality
(EF)
EPRC1
EPRC2
EPRC3
EPRC4
1E-5 per site
year
2.61E-8
8.60E-7
1.02E-8
4.97E-8
4.5E-7* Meets Goal
Delayed
Fatality (DF)
EPRC5
EPRC6
EPRC7
EPRC8
EPRC9
EPRC10
1E-4 per site
year
1.42E-9/1.85E-11
9.36E-7*/1.4E-7*
3.88E-5/1.15E-6
0.0
2.06E-5/2.7E-7
4E-5/7.4E-8
1.3E-6* Meets Limit
Large Release
(LR)
EPRC1
EPRC2
EPRC3
EPRC4
EPRC5
EPRC6
1E-5 2.61E-8
8.6E-7
1.02E-8
4.97E-8
1.42E-9
9.36E-7*
1.3E-6* Meets Limit
Severe Release
(SR)
EPRC1
EPRC2
EPRC3
EPRC5
1E-6 2.61E-8
8.6E-7
1.02E-8
1.42E-9
4.1E-7* Meets Limit
These results are from the Bruce A Nuclear Generating Station Probabilistic Risk Assessment, BAPRA Update Part 1 Summary
Report, P.A. Robinson, NSS Report 11575/TR/001 Issue 01, February 2005. Cited in Review of Bruce NGSA Against Modern
Safety Standards: Summary Report, March 2006, prepared by R.A. Brown & Associates Ltd., Acquired through Access to
Information.
*indicates that the frequency has removed double-accounting both within an individual consequence category and where
relevant between the contributors from different consequences categories. For the Delayed Fatality goal, as a conservative
simplification, the overall frequency presented is simply the sum of the risks from individual EPRC contributors.
18
Table 3 – International Nuclear Event Scale
INES Scale Description
Equivalent in
Iodine 131
Lower
Limit
Upper
Limit
7
Major Accident
Widespread health and
environmental effects. External
release of a significant fraction
of reactor core inventory. Long-
term environmental
consequences.
5*1016
-
6
Serious Accident
Likely that protective action such
as sheltering and evacuation will
be judged necessary to prevent
or limit health effects on
members of the public.
5*1015
5*1016
5 Accident with Wider
Consequences
Some protective action will
probably be required (e.g.
localized sheltering and/or
evacuation to prevent or
minimize the likelihood of health
effects).
5*1014
5*1015
4 Accident with Local
Consequences
Protective action will probably
not be required, other than local
food controls.
5*1013
5*1014
1-3 No limits
International Atomic Energy Agency, The International Nuclear and Radiological Event Scale: User’s
Manual, 2008 Edition.
Available at: http://www-pub.iaea.org/MTCD/publications/PDF/INES2009_web.pdf
19
Table 4 - Bruce A Large Release Categories on the INES Scale
Release
Category Frequency Description I-131 C-137
C-137 in I-
131
Equivalent
Total in
I-131
INES
Level
RC0 2.90E-06
Early very large release - >
~3% core inventory of I-
131 occurring mainly
within 24 hours.
8.52E+16
8.52E+16 7
RC1 2.45E-07
Late very large release - >
~3% core inventory of I-
131 occurring mainly after
24 hours.
8.52E+16
8.52E+16 7
RC2 6.72E-06
Early RD-152 Large
Release Mixture of fission
productions contain > 1014
Bq of Cs-137 but <~3%
core inventory of I-131
occurring mainly within 24
hours.
8.52E+16 1.00E+14 4.00E+15 8.92E+16 7
RC3 1.21E-12
Late RD-152 Large Release
– Mixture of fission
productions containing
>1014
Bq of Cs-137 but
<~3% core inventory of I-
131 occurring mainly after
24 hours.
8.52E+16 1.00E+14 4.00E+15 8.92E+16 7
20
Table 5 Bruce B Large Release Categories on the INES Scale
Release
Category Frequency Description I-131 C-137
C-137 in I-
131
Equivalent
Total in
1-131 INES
RC0 4.71E-06
Early very large
release - > ~3% core
inventory of 1-131
occurring mainly
after 24 hours.
8.88E+16
8.88E+16 7
RC1 4.96E-07
Late very large
release -> ~3% core
inventory of I-131
occurring mainly
after 24 hours.
8.88E+16 8.88E+16 7
RC2 2.70E-07
Early RD-152 Large
Release – Mixture of
fission products
containing > 10-14 Bq
of Cs-137 but < ~3%
core inventory of I-
131 occurring mainly
within 24 hours
8.88E+16 1.00E+14 4.00E+15 9.28E+16 7
RC3 1.43E-08
Late RD-152 Large
Release – Mixture
of fission products
containing > 10-14
Bq of Cs-137 but <
~3% core inventory
of I-131 occurring
mainly after 24
hours.
8.88E+16 1.00E+14 4.00E+15 9.28E+16 7
21
Table 6: Contribution of Early Release to Large Release Frequency
Bruce A Early Large Release Categories Bruce B Early Large Release Categories
Release
Category Description Frequency
Release
Category Description Frequency
RC0
Early very large
release - > ~3% core
inventory of I-131
occurring mainly
within 24 hours.
2.90E-06 RC0
Early very large release - >
~3% core inventory of 1-
131 occurring mainly after
24 hours.
4.71E-06
RC2
Early RD-152 Large
Release Mixture of
fission productions
contain > 1014
Bq of
Cs-137 but <~3% core
inventory of I-131
occurring mainly
within 24 hours.
6.72E-06 RC2
Early RD-152 Large
Release – Mixture of
fission products containing
> 1014
Bq of Cs-137 but <
~3% core inventory of I-
131 occurring mainly
within 24 hours
2.70E-07
Sum of RC0 and RC2 9.62E-06 Sum of RC0 and RC2 4.98E-06
Total LRF 9.87E-06 Total LRF 5.49E-06
Contribution of Early Release 97.47% Contribution of Early Release 90.71%
Table 7 - Bruce A and B Core Damage Frequency Including External Events
Event Category Bruce A CDF
(No EME Credit)
Bruce B CDF (No
EME Credit)
At-Power
Internal Events 2.07E-05 1.48E-05
Outage Internal
Events 1.28E-05 8.30E-06
Internal Flood 5.20E-06 4.50E-06
Fire 8.72E-05 4.06E-05
Seismic 1.70E-05 7.20E-06
High Wind 6.66E-05 2.46E-05
Totals 2.10E-04 1.00E-04
CDF Limit 1.00E-04 1.00E-04
22
Table 8
Response to the Greenpeace Bruce Power Request for Information
1. Uncertainty Analysis Request 1: Please provide the uncertainty estimated for the LRF and SRF for the Bruce A and B nuclear stations. If no such estimates have been done, please provide reasons. Response: Severe Release Frequency is no longer estimated as a Probabilistic Safety Assessment safety goal. The definition of Large Release Frequency and Severe Release Frequency events in the 1999 Bruce B Risk Assessment was release of greater than 1% and 10% respectively of the core inventory of Cs-137. Since that time, as part of the S-294 compliance work, Bruce Power has transitioned to determination of Large Release Frequency and Small Release Frequency (based on CNSC definitions of LRF and SRF). In the latest Bruce Power S-294 Level 2 Probabilistic Safety Assessment framework, these consist of the logical sums of Release Categories 0 to 3 inclusive for Large Release, and Release Categories 0 to 5 inclusive for Small Release.
Request 2: Please provide uncertainty estimates for the each of the Release Categories for the Bruce A and B nuclear stations provided in your February 13, 2015 letter. See Table 2-8 of the Bruce B Risk Assessment Summary Report for an example of such estimates. If no such estimates exist, please provide reasons. Response: Tables 1 and 2 below contain the Bruce A and Bruce B uncertainty estimates respectively for Level 2 Large Release Frequency and relevant Release Categories.
Table 1 - Bruce A Level 2 Uncertainty Estimates
Table 2 - Bruce B Level 2 Uncertainty Estimates
2. Core Inventory Request 3: Please provide the at power core inventory for the Bruce A and B reactor designs. Response:
The at-power core inventory for the Bruce A and B reactor designs is attached. This information has been extracted from the Bruce A and Bruce B Safety Reports. The Bruce B core inventory was used as the basis for the Level 2 PSA analysis for both Bruce A and Bruce B. This is conservative for Bruce A since the core inventory of Cs-137 for Bruce B is higher than for Bruce A.
Bruce A Core Inventory:
Bruce B Core Inventory:
3. Severe Release Frequency Request 4: Please provide estimates of Severe Release Frequency for the Bruce A and B nuclear stations from the most recent risk assessments. If no such estimates exist, please provide reasons. Response: Severe Release Frequency is no longer estimated as a Probabilistic Safety Assessment safety goal. The definition of Large Release Frequency and Severe Release Frequency events in the 1999 Bruce B Risk Assessment was release of greater than 1% and 10% respectively of the core inventory of Cs-137. Since that time, as part of the S-294 compliance work, Bruce Power has transitioned to determination of Large Release Frequency and Small Release Frequency (based on CNSC definitions of LRF and SRF). In the latest Bruce Power S-294 Level 2 Probabilistic Safety Assessment framework, these consist of the logical sums of Release Categories 0 to 3 inclusive for Large Release, and Release Categories 0 to 5 inclusive for Small Release. 4. Population Dose Request 5: Please provide the population dose for each Release Category provided in your February 13, 2015 letter. If no such estimates exist, please provide reasons. Response: Population dose estimates are not determined for S-294 purposes. Estimates of population dose are done as part of a Level 3 PSA, which includes analysis of the transport of radionuclides through the environment and the public health and economic consequences of potential accidents. Per CNSC S-294, Bruce Power performed Level 1 and Level 2 PSA, which includes analysis of accident sequences that could lead to fuel damage, and analysis of containment response to predict the inventories of radionuclides released to the environment (e.g., LRF).
5. Safety Goal Policy Request 6: Please provide policy documents related to probabilistic risk assessment listed in the Licence Control Handbooks for the Bruce A and B nuclear stations. Response: The procedure which details Bruce Power’s safety goals is a proprietary document and cannot be released in full, however we have provided the policy portions of this document: Section 4.0 and Appendix D below as requested. There is only one previous revision of this document. The information below is essentially the same in both documents since there have been no changes to the safety goals.
SECTION 4.0 PROCEDURE DESCRIPTION
1. PRA shall be used to assess the magnitude of risks to the public from nuclear safety related accidents due to the operations of Bruce Power nuclear power plants.
2. Performance standards, in the form of risk-based public safety goals (Table 1), shall be used as guidance in assessing the acceptability of public risk and, where appropriate, to derive suitable targets for system reliability, except where specific regulatory requirements for system unavailability exist. Risk shall be monitored and reviewed on an annual basis. There is no absolute limit for instantaneous risk. Instantaneous risks that exceed the threshold value shall comply with Section 4.0 (6).
3. PRA shall be used as an aid to judgment in the support of the conduct of engineering, maintenance, and operations at Bruce Power.
4. Proposed changes to plant operation, configuration, or procedures that may significantly affect risks identified in Section 4.0 (1) above shall be reviewed to quantify their impact on risk and to assess their acceptability. For cases where such changes would result in a reduction in risk, the costs and benefits shall be considered as part of the decision making process that looks at the impact of the risk.
5. A review shall be conducted for all cases that exceed the Review Threshold Value for Instantaneous Risk given in Table 1. The review shall take the form outlined in Appendix D.
Table 1 Bruce Power, Nuclear Public Safety Goals
Safety Goal (application)
Average Risk (per year) Review Threshold Value for
Instantaneous Risk (per year)
TARGET Limit
Individual Early Fatality (per site)
10-6 10-5 3 x 10-5
Individual Delayed Fatality (per site)
10-5 10-4 3 x 10-4
Large Release (per unit) 10-6 10-5 3 x 10-5
Severe Release (per unit) 10-7 10-6 3 x 10-6
Severe Core Damage (per unit)
10-5 10-4 3 x 10-4
6. A review shall be conducted for all cases where the Average Risk (per year),
exceeds the stated Limit for any Safety Goal given in Table 1, for a specific nuclear facility. The review shall take the form outlined in Appendix D.
7. Risk information used in nuclear safety related decision-making should be based to the extent possible on data and models that reflect the characteristics of the facility concerned. Generally best estimate methods and data should be used in any analysis. Where this is not practicable, reasonably conservative assumptions should be made, but the accumulation of pessimisms should be avoided.
8. A common approach to the conduct and use of PRA shall be applied across Bruce Power nuclear power plants.
9. Conduct of PRA shall be controlled by approved processes and procedures that are consistent with the Bruce Power Management System Manual.
10. Staff preparing, applying or otherwise interpreting risk models shall be appropriately qualified and experienced.
Probabilistic Risk Assessment Process
Probabilistic Risk Assessment (PRA) is a systematic process of hazard identification and risk estimation using quantitative methods. Implicit in the concept of risk as applied in PRA is an evaluation of a hazard both in terms of its frequency of occurrence and its associated consequence.
APPENDIX D: DECISION RULES FOR PRA WORK WHICH EXCEEDS A SAFETY GOAL
This appendix covers the reviews to be conducted should any PRA assessment, using the reference PRA model, result in any of the Safety Goals stated in Table 1 of this procedure being exceeded.
Average Risk Limit
If this Safety Goal is exceeded for any of the categories, a review shall be carried out. This review shall consist of a documented case being considered by a group known as the Plant Operational Review Committee (PORC). The PORC members consist of the Vice President Operations, Vice President Engineering, Authorized Duty Managers, Performance Engineering Manager, Plant Design Engineering Manager and the Reactor Safety Engineering Manager. The PORC will recommend a course of action, based on their consideration of the documented case, to the Executive Team of Bruce Power.
Instantaneous Risk
If this Safety Goal is exceeded for any of the categories, a review shall consist of a documented case being considered by the PORC. The PORC will recommend a course of action, based on their consideration of the documented case, to the Executive Vice President, Nuclear Operations. This consideration will take into account the following:
The amount by which the Safety Goal is exceeded.
The potential effect of better estimates of values used in the analysis that may be overly conservative.
The potential effect of additional procedural arrangements to mitigate the risk, and the practicality of such arrangements.
The potential effect of any proposed engineering modifications to mitigate the risk, and the practicality of such modifications.
The time over which the calculated risk would be present, until any proposed changes to the analysis, procedures, or plant are made.
Request 7: Please provide a list of changes to Bruce Power’s probabilistic risk assessment policy since it took over the Bruce A and B stations from OPG in 2000. Response: The Bruce Power procedure has only been revised once since the transition of the Bruce Site from OPG to Bruce Power. The document was updated to include additional detail on the Probabilistic Risk Assessment Process which Bruce Power uses in the development of the Probabilistic Safety Assessment.