Rev. 000 File# 2.01

E-Docs# 3234857 APPROVED FOR INTERNAL USE.

STAFF REVIEW PROCEDURE:

Proponent Environmental Impact Statement (EIS) For a New Nuclear Power Plant

SRP-2.01-EIS-11NNNN-013.2

Rev. 000

Conventional Accidents and Malfunctions

Directorate of Regulatory Improvement and Major Projects Management New Major Facilities Licensing Division

Preface

Staff Review Procedures have been developed by the CNSC staff, as internal working documents, to be used by CNSC staff to assist them in the conduct of regulatory reviews of a potential licensee’s (proponent) Environmental Impact Statement (EIS), as part of its licence application and environmental assessment process for a new nuclear power plant in Canada. They are not regulatory documents, although their respective topics of assessment and criteria are based on regulations under the Canadian Environmental Assessment Act. The initiative to develop Staff Review Procedures was undertaken in order to ensure a consistent application of the internal processes for the review of an EIS for a new nuclear power plant, and to improve the efficiency and effectiveness of such reviews. Staff Review Procedures are considered by CNSC staff to be “living documents”, which will evolve based on the experience gained from EIS reviews.

Context Environmental assessments (EAs) are carried out to meet the requirements of the Canadian Environmental Assessment Act (CEAA). EAs identify whether a specific project is likely to cause significant environmental effects, and determine whether those effects can be mitigated. For new nuclear power plants, the Canadian Nuclear Safety Commission initiates the EA process when a proponent applies under the Nuclear Safety and Control Act (NSCA) for a Licence to Prepare Site (Section 24(2) of NSCA) and submits a complete Project Description (as per Section 5 of CEAA). Before any licensing decision can be made, the EA must be completed.

An Environmental Impact Statement (EIS) is prepared by a proponent as part of the EA process and submitted pursuant to CEAA to support the site preparation, construction, operation, decommissioning and abandonment of a new nuclear power plant. An EIS will be reviewed against the “EIS Staff Review Procedures. The procedures represent CNSC expectations and guidance supporting the assessment of an EIS by CNSC staff, and are intended to augment and support EA recommendations by staff to the Commission tribunal.

Description of Revisions Made to Document Effective Date Rev.

# Section Changes Made

2008-10-24 000 All New Document issued under Document Change Package (DCP) 3309944

1. Area of Review 1.1. Topic and Area This Staff Review Procedure addresses staff reviews of Conventional Accidents and Malfunction submissions to the EIS. Conventional Accidents and Malfunctions are defined as potential events which result in the release of non-radiological hazardous substances or large releases of energy. The EIS is expected to identify and describe possible malfunctions or accidents associated with the project, their probability and potential adverse environmental effects of event sequence which result in hazardous substance releases or large releases of energy (such steam, electrical arcs, etc.) over the life cycle of the project. As applicable to the site, the review will focus on: • past abnormal plant operations, accidents and spills to the extent that they are relevant to

the EIS; • malfunction and accident events that have a reasonable probability of occurring during

the life of the project; • malfunctions and accident events involving the large release of energy with the potential

to create significant environmental impact; • the source, quantity, mechanism, rate, form and characteristics of contaminants and other

materials (physical, chemical, etc.) likely to be released to the surrounding environment during the postulated malfunctions and accidents;

• mitigation means and measures, including policy, procedures and plans to mitigate, prepare for, respond to, and recover from emergencies for accidents and malfunctions (including emergency response and preparedness);

• contingency, clean-up or restoration work in the surrounding environment (including long term monitoring if necessary) that would be required during, or immediately following, the postulated malfunction or accident;

• measures and provisions, including safeguards, to protect against the postulated accidents and malfunctions;

• accident and severe Accident Management policy and procedures; • supporting infrastructure external to the site (exclusion zone). The EIS demonstrates that the safety goals and functional requirements are met via high-level safety analysis supported by sufficient information to demonstrate that the behaviour of the various designs being proposed are understood, such that their consequences can be predicted with sufficient confidence.

Review of the supporting project description and postulated accidents & malfunctions in the EIS is not a comprehensive study of all aspects of conventional accidents, malfunctions, hazards or risks. Should the project proceed, detailed evaluations will be performed following receipt of application(s) to prepare the site, construct and to operate the NPP as part of the CNSC licensing process. At the environmental assessment stage, CNSC staff is verifying that the proponent has made a credible demonstration of the NPP’s ability to meet CNSC requirements related to releases caused by accidents and malfunctions. To this end, the proponent may rely on bounding assessments or accidents in their demonstration. 1.2. Information Requirements It is expected that general information identified in Section 1.1 and Appendix A of this Staff Review Procedure will be provided by the proponent in support of this EIS topic subject to the following general conditions: • information is provided, where applicable, regarding the project, in consideration of the

hazards, risks and events for the events or event sequence under consideration, • the postulated event(s) or event sequence may be representative of bounding or limiting

credible accidents and malfunctions, and • information requirements described in Appendix A are generic in nature and not all of the

identified elements may be required, depending on the postulated event(s) or event sequences postulated.

In addition, topic specific information as identified in Appendix ‘B’ through ‘I’ may be required depending on the nature of the bounding events and project details. The information provided should be sufficient in quantity and detail to allow the reviewer to make recommendations on the acceptability of the submission. 2. Criteria and Objectives

For Conventional Accidents and Malfunctions under the scope of this procedure, the submission for the life cycle of the project: • identifies and explains all credible accidents and malfunctions and their associated

potential adverse environmental effects, • identifies the proposed measures to mitigate the potential adverse effects that were

identified, • predicts whether there will be significant adverse environmental effects after mitigation

measures are implemented, and • for all of the above, adequately explains the rationale behind the analyses that led to the

conclusions in the submission.

The submission identifies potentially significant accident and malfunction issues raised during previous assessments of the design by international nuclear safety regulators, and provides clear explanations of how the issue(s) will be addressed.

Where the submission relies on codes, standards or methodologies which are not typically employed in Canada, (i.e., non-CSA standards, new or novel methodologies) the proponent provides supporting information demonstrating: • similarities and differences between the approaches typically employed in Canada (i.e., a

code gap analysis / assessment); • that their application are consistent with modern good practices; • that they will meet or exceed Canadian codes, standards or methodologies. The objective of the review is to provide a meaningful conclusion on meeting the acceptance criteria (i.e., Safety Goals, functional requirements, probability targets, etc.) and a recommendation on the acceptability of the EIS submission. Section 4 of this Staff Review Procedure provides recommended Staff concluding statements The following general review criteria and objectives will be utilized by the reviewer (note that subject specific guidance is provided in the appendices): • Completeness of information and level of detail in the description of the project,

technology, malfunctions and accidents postulated, general assumptions, and uncertainty. Completeness will be assessed against the information requirements and criteria outlined in the Section 1.1 & 1.2 of this Staff Review Procedure.

• Completeness of information on the type and amount of analyses, as well as on the analysis data, assumptions, models. Completeness will be assessed against the information requirements outlined in the Section 1.1 & 1.2 of this Staff Review Procedure.

• The level of detail of the information is consistent with the provisions in the Section 12.2 of [1] and in Section 1.1 & 1.2 of this Staff Review Procedure.

• The supporting analysis approaches and methodologies are consistent with the provisions in RD-337 [Ref. 3], RD-346 [Ref. 4], RD-294 [Ref. 14] for PSA analyses and RD-310 [Ref. 5] for safety analyses in the context of the postulated conventional accidents or malfunctions. It should be noted that typically hazard analysis (as detailed in RD-337) is employed, however, the applicant may include supporting information from PSA or Safety Analysis Reports.

• Computer codes, data, models, correlations and assumptions used in analyses should be technically sound and compatible with the specific characteristics of the proposed design.

2.1. Identification and Classification of Accidents The objectives contained in this part of the review assure Staff that the proponent has used a systematic process to identify sufficient event sequences that are expected to lead to an accident or malfunction. The identified sequences are used by the proponent to determine the bounding environmental impact. Events may include: • conventional accidents and spills; • seismic events; • natural biological events; • fires and explosions;

• internally and externally generated missiles; • human error; • equipment failure or malfunction; • pipe whip, jet impingement and pressurization of structures following failure of

pressurized components; • extreme weather conditions, such as, precipitation, extreme temperatures, high winds

(including tornados), lightning strikes; • transportation initiated or related events; • flooding, both internally and externally generated. CNSC staff will look for evidence that a systematic process has been used to identify and categorize events. Experience, both in Canada and internationally, of similar designs can provide supporting information. 2.2. Identification of Limiting Credible Accidents and Malfunctions

Staff will compare the list of limiting accidents and malfunctions with those derived for similar plants and those which, in staff’s experience, are likely to prove limiting for the proposed design(s). As a basis for the review, previous EA’s / EIS’s and existing safety analysis may be used to support staffs assessment. 2.3. Consequences Releases of hazardous substances or event products are expected to be calculated for a limited number of events representative of bounding or limiting credible accidents and malfunctions. Consequence analyses would be expected to be performed as part of demonstrating meeting the Safety Goals and functional acceptance criteria for the EIS. 2.4. Demonstration of Meeting the Safety Goals and Functional Acceptance Criteria Credible demonstration that the safety goals are met involves provision by the proponent of a high-level safety analysis supported by sufficient design information. The safety analysis demonstrates to staff that the accident behaviours of the various designs being proposed are understood such that their consequences can be predicted with sufficient confidence. Functional Acceptance criteria are the criteria staff utilizes in their evaluation to confirm the minimum high level attributes (such as the automatic starting of emergency power generators) required either by design or prescribed in applicable codes or standards will be provided for or achieved. 3. Review Process CNSC staff verifies that the information criteria is met, and is sufficient to identify project components likely to interact with the environment, and is sufficient to support the claims made in the EIS. CNSC staff also verifies that supporting assumptions are clearly indicated, and that adequate supporting information has been provided.

The review, documentation of assessment results and report approval will be conducted in accordance with the project-specific Assessment Plan. The Review Lead and contributors are identified in the project-specific Assessment Plan. Staff involved in assessing nuclear security should be consulted to confirm that the information is sufficient to support the assessment of both the Site Selection and Threat Risk Assessment (SSTRA) Report and the site preparation security program. Staff involved in assessing emergency management programs should be consulted to confirm that the information is sufficient to support the assessment of the applicant’s emergency programs with a particular focus on event response and site evacuation plans. Staff involved in environmental risk assessments should be consulted to confirm that effects of climate change on postulated fire events has been adequately addressed. Other government departments that may need to be consulted during the review include: • NRCan • Environment Canada • Transport Canada • Department of Fisheries and Oceans • CNSC • Fisheries and Oceans Canada • Transport Canada • Expert Federal Authorities including Environment Canada, Health Canada, Natural

Resources Canada and Parks Canada Results of the review will be presented in a Review Report template that is included in the project-specific Assessment Plan. The report is to be approved by the appropriate signing authorities. The approved report will be assigned an E-DOCS number under File 2.01 for the appropriate facility. 4. Evaluation Conclusions and Recommendations 4.1. Conclusions 1) Adequacy of the project description and supporting information

The results of the evaluation of the EIS and its supporting information should lead staff to one of the following conclusions: a) The description and supporting information is considered generally accurate,

adequate, complete and of sufficient detail to permit staff to conclude that the information provided in the submission is acceptable and forms a suitable basis for the EA determination; or

b) The description and supporting information is NOT considered acceptably accurate, adequate, and complete or of sufficient detail to permit staff to conclude that the information provided in the submission is acceptable and forms a suitable basis for the EA determination.

2) Adequacy of the submission’s description of Accidents and Malfunctions

The evaluation of the EIS with respect to Accidents and Malfunctions should lead Staff to one of the following conclusions: • Information provided in the EIS is sufficient to provide a credible demonstration that

limiting accidents have been identified, the releases from the limiting accidents are credible, and that the Safety Goals and functional attributes acceptance criteria can be met for the design or designs proposed for this project; or,

• Information presented in the EIS is insufficient to provide a credible demonstration that: o limiting accidents have been identified; o the releases from the limiting accidents are credible; o the Safety Goals and functional attributes acceptance criteria can be met for the

design or designs proposed for this project. 4.2. Recommendations Recommendations, clearly identifying the outcome of the review conclusions will be in the form of a report prepared in accordance with the project-specific Assessment Plan.

5. References Document all technical and/or basis documents used in the reviews by all participating divisions. Documents: 1. “Draft Environmental Impact Statement Guidelines - Bruce Power New Build - Bruce

Power”, E-Docs# 3107856. 2. “Assessment Report - Information Guidelines on Licensing of New Nuclear Power

Plants”, E-Docs# 3087683. 3. RD-337 “Design of New Nuclear Power Plants”. 4. RD-346 “Site Evaluation for Nuclear Power Plants”. 5. RD-310 “Safety Analysis for Nuclear Power Plants”. 6. RD-311 “Fire Protection for Nuclear Facilities”. 7. CSA N293 “Fire Protection for CANDU Nuclear Power Plants”. 8. National Building Code of Canada. 9. National Fire Code of Canada. 10. NFPA 804 “Standard for Fire Protection for Advanced Light Water Reactor Electric

Generating Plants”. 11. NFPA 805 “Performance-Based Standard for Fire Protection for Light Water Reactor

Electric Generating Plants”.

12. NFPA 806 “Performance Based Standard for Fire Protection for Advanced Nuclear Reactor Electric Generating Plants”.

13. NFPA 101 “Life Safety Code”. 14. S-294 “Probabilistic Safety Assessment (PSA) for Nuclear Power Plants”. List of Appendices: A - Information and Criteria for an Adequate Description of Accidents and Malfunctions B - External Natural Events C - Internal and External Non-Malevolent Events D - Internal and External Non-Malevolent Human Induced Events E - Process Initiated Events F - Non Process Initiated Events G - Fire and Explosion Events H - Transportation Events

APPENDIX A

Information and Criteria for an Adequate Description of Accidents and Malfunctions

1. The information submitted regarding conventional accidents and malfunctions should: • Document and describe the scientific, engineering and other knowledge methods

used to reach the EIS conclusions; • Clearly identify and justify all assumptions; • Document and describe data, models and studies such that the analyses are

transparent and reproducible; • Document and describe data collection methods; • Document and describe uncertainty, reliability and the sensitivity of models used

to reach conclusions; • Describe the existing environment and potential adverse environmental effects

predictions and assessment should be prepared using the best available information and methods, to the highest standards in the relevant subject area;

• Substantiate all conclusions. 2. Factors to be considered in the submission in order to adequately understand and assess

the potential effects of the project would include: • the environmental effects of conventional accidents and malfunctions that may

occur in connection with the project; • the significance of the effects referred to above; • measures that are technically and economically feasible and that would mitigate

any significant adverse environmental effects of the project. 3. For each accident and malfunction considered, the submission identifies the criteria used

to assign significance ratings to any predicted adverse effects. The submission contains detailed analysis of the significance of the potential residual adverse environmental effects it predicts. It should contain clear and sufficient information to enable a judgment of the significance of effects. The proponent should define the terms used to describe the level of significance.

The proponent should assess the significance of predicted effects according to the following categories: • magnitude of the effect; • geographic extent of the effect; • timing, duration and frequency of the effect; • degree to which effects are reversible or can be mitigated; • ecological and social/cultural context; • probability of occurrence.

4. The submission on conventional accidents and malfunctions should describe the potential effects that the environment may have on the project and pertain to the conventional accidents and malfunctions. For example, the assessment should take into account how local lake conditions and natural hazards, such as severe weather conditions and external events (e.g., flooding, tornado, fire and seismic events) that could adversely affect the project. Longer-term effects of climate change should also be discussed for the life cycle of the project right up to the projected abandonment phase of the project. Information from the EIS relating to the potential effects on the project provide supporting information for staff to evaluate postulated accidents and malfunctions, including their consequences. Input from other review topics and Staff Review Procedures will be required to assess the adequacy of the postulated event sequence, effectiveness of the mitigation measures and the EIS conclusions.

5. As part of consideration of mitigating measures for conventional accidents and

malfunctions, for all phases of the project, the EIS should describe the expected effects on transportation infrastructure in the regional study area. The discussion on the predicted effects (with rationale) to local and regional traffic volumes and road conditions, including provincial highways, arterial highways and on-site access roads, should be provided. Information on the potential effects on the areas, through which trucks will travel, such as residential or school areas, should also be included. The proposed methods for avoiding effects on the existing transportation infrastructure should be described.

6. The EIS should identify, describe and state probability of possible conventional accidents

and malfunctions associated with the project, including potential adverse environmental effects of events which result in hazardous substances releases that do not directly involve the reactor core. The proponent should provide, for all phases of the project, the following information on conventional accidents: • an identification and discussion of any past abnormal operations, malfunctions,

accidents or spills from power plants or other similar large industrial projects to the extent that they are relevant to the current assessment;

• a description of specific malfunction and accident events that have a reasonable probability of occurring during the life of the project, including an explanation of how these events were identified for the purpose of this environmental assessment;

• a description of the source, quantity, mechanism, rate, form and characteristics of contaminants, energy or other materials (such as physical, chemical, etc.) likely to be released to the surrounding environment during the postulated malfunctions and accidents, including a description of emissions originating from the operation of emergency back-up diesel generators during prolonged outages;

• a description of any contingency, clean-up or restoration work in the surrounding environment that would be required during, or immediately following, the postulated malfunction, accident and (out of reactor) criticality events.

The description should include the security and safeguards that have been established by the proponent to protect against such occurrences and the contingency procedures in place. Accident management typically relies heavily on the evacuation of personnel and

of the population, as required. The proponent should demonstrate that the requirements for adequate infrastructure external to the site and exclusion zone are met. The need for any necessary administrative measures should also be identified together with the responsibilities of organizations other than the proponent.

In addition, the submission provides the following: • evidence that the information and data presented has been subject to appropriate

quality assurance; • evidence that the uncertainty with assumptions or inferences based on these data

are characterized; • data analysis tools, assessment methods or logical processes and information

presentations have been used appropriately. Information requirements should be broken down, where possible, by project phase: • Site preparation; • Construction; • Operation and Maintenance; • Decommissioning and Abandonment.

Sufficient information should be provided to allow reviewing staff to judge if the proponent has provided a credible demonstration that the proposed design (or designs) of NPP would be able to meet the CNSC expectations if it were to be constructed at the proposed site.

7. Consequence analyses are needed to determine the releases of hazardous substances in

environment in accident conditions for the limiting credible accidents (see Section 2.2 of this Staff Review Procedure), and for the representative accident sequences in the supporting analyses (where applicable) as part of calculation of the Safety Goals: • Specific phenomena and processes (such as: steam explosions, core-concrete

interactions, the generation, transport and combustion of combustible gases) that are directly influencing the accident progression, including the timing of accident progression, and thus the amount and behaviour of hazardous products prior their release in environment.

• Ex-plant releases from containment through leaks, openings and/or filtered venting.

• Failure Criteria for relevant structures, systems and components. 8. Demonstration of meeting the Safety Goals criteria: For Accidents and Malfunctions, the

EIS demonstrates at a high level the proposed design will meet the Safety Goals using one or a combination of the following information: • Screening out event(s) or event sequence(s) based upon extreme improbability; • Probabilistic analyses (PSA) (system level is considered acceptable) or; • Consequence analyses for representative or bounding accident events, event

sequences or scenarios to demonstrate that the accidents contributing to the Safety Goals are properly identified.

APPENDIX B

External Natural Events

1. Evaluation of Natural External Events

As per RD-346, each external natural event is identified and assessed with the following considerations: i) The potential direct and indirect effects of the event on the proposed NPP systems,

structures, and components (SSCs), including those that could affect the safe operation of the NPP in both normal and abnormal operating states;

ii) The potential combined effects of external events with normal and accidental releases from the proposed NPP that would exceed environmental limits or cause a significant adverse effect to occur;

iii) Effects that would influence the ability to successfully implement emergency plans. Derivation of the hazards associated with external events includes consideration of the combined effects if these hazards with the ambient conditions (e.g., simultaneous aircraft crash and heavy snowstorm). Combined effects of external hazards can have significant effect areas such as the implementation of emergency plans, accident mitigation, and contaminant pathway models. The region assessed for each identified external event encompasses the environment that could be affected. The evaluation considers foreseeable changes in land use for the projected lifetime of the NPP to assess and plan for mitigation of new external hazards introduced by change in land-use.

Site-specific data is used to determine hazards, unless such data is unobtainable. In this case, data from similar regions that is sufficiently relevant to the region of interest, or data derived from appropriate and acceptable simulation techniques, may be used. Data from similar regions and simulated findings may also be used to augment site-specific data. Prehistoric, historic, and instrumentally-recorded information, and records of the identified external events and their severity, is collected for the region and analyzed for reliability, accuracy, and completeness. The site is also examined with respect to the risk from hazardous substances to the public and the environment, with the risks conforming to legal release limits and being kept as low as reasonably achievable (ALARA). This includes the effects of thermal pollution on surrounding bodies of water, and the effects of long-term on-site waste management. The synergy of multiple events and multiple effects of several different activities are considered, such as simultaneous oil spill and fire. To determine the potential contaminant impact on the environment, assessments of all releases are made under normal and abnormal conditions for all phases of the NPP life cycle. Bounding scenarios involving modeling of potential effects from maximal possible releases are completed to establish the outer boundaries or worst case scenarios for the NPP. These bounding scenarios also contribute to the scenarios for emergency planning. Assessment of releases or disturbances

associated with normal or routine operations are based on expected performance (e.g., average concentrations) and upper threshold bounding conditions, as well as possible pulse releases (high concentration short exposure period) from anticipated operational occurrences (AOOs). The locations of the NPP and of the subsidiary structures on the site are examined at a high level with the assistance of environmental modeling, and situated in a manner that minimizes potential impact on the public and on the environment. This includes emission or effluent release points and air or water intake structures. Natural fire hazards are assessed with respect to their potential risk to NPP safety, including site occupants and the safety of the facility. Natural fire hazards are assessed using the review guidance of Appendix G of this procedure. Since it is possible for more than one external hazard to apply simultaneously, and that even a single hazard may occur in conjunction with other loadings, the submission should address bounding combinations of external hazards and predict their consequences. Simultaneous application of two independent low probability of incredible magnitude is generally not postulated, i.e., two independent concurrent accidental fires at the facility is generally not considered reasonable. Exceptions occur where the hazards are not truly independent, for example where extreme wind may be associated with extreme flooding. The submission should describe and assess all reasonable combination of other relevant loads (including fault loads where appropriate) that are assumed to apply simultaneously with the hazard of interest. Sensitivity studies may also be necessary to ensure that the chosen values and combinations are conservative. Engineering judgment may be required as to whether a "normal" snow load should apply with an extreme wind loading or whether extreme wind is likely to remove all but the hardest snow crust. The basis for the load combinations should be reviewed in consideration of the guidance in the National Building Code of Canada and applicable CSA Nuclear standards. There may be a wide range of live and dead loadings which might apply at any single time, such as crane position or load etc., and in these the assumed combination should be such that all load combination cases are shown to be enveloped. Discretion may be applied to the application of normal wind load with design basis seismic load. The effects are likely to be additive over at least part of a structure, so consideration as to an appropriate wind load may be required. However, inclusion of multiple wind directions considerably increases the number of seismic load cases, and the combined results make comprehension of the seismic behaviour more obscure. The submission should also consider independent dynamic load cases, since their combined response will be derived on a time varying or statistical assumption.

APPENDIX C

Internal and External Non-Malevolent Events The proponent is expected to develop, document, and implement a systematic approach to identifying all external, non-malevolent, human-induced events. Such events should include, without being limited to: • Non-malevolent aircraft crash; • Other transportation related events (e.g., ship, train, truck); • Fires and explosion events; • Chemical and hazardous substances events; • Electromagnetic interference events. 1.1 Aircraft Crashes

The potential for accidental aircraft crashes on the site is assessed, taking into account the probable characteristics of future air traffic and aircraft development including size, weight (including fuel) and technology. If the assessment reveals a reasonable probability of an aircraft crash on the site, then an assessment of the associated hazards, including impact, fire, vibration and explosion, are expected to be documented and analyzed. The potential effects on the execution of emergency plans, including effects on evacuation routes are also considered. In general, if a probabilistic approach to screening out accidental aircraft crashes is employed, the submission demonstrates that the probability of crash at the site is less than 1 x 10-6 per year based upon previous EIS / EAs. 1.2 Other Transportation Hazards

The submission is expected to document and assess land and water transportation routes in the region and clearly indicate how they might interact with Project activities. (e.g., collisions with SSCs)

Interactions might include potential to: • cause or contribute to explosion events, • cause or contribute to chemical and hazardous substances events, and • cause or contribute to fires.

The submission is also expected to consider potential effects on emergency plan execution, including effects on evacuation routes.

1.3 Fires and Explosions

All potential fire and explosion events in the region that could affect the safe operation of the NPP are evaluated, including: • Direction and force of pressure waves and their effects on SSCs and personnel; • Temperature effects on SSCs and personnel; • Potential secondary fires and explosions generated by the primary explosion or fire; • Release of volatile gases, asphyxiates, or chemicals that could affect safe function of

SSCs or harm unprotected personnel; • Missiles generated by the fires or explosions that could affect the safe function of SSCs

or harm personnel; • Effects that could render offsite or onsite power supplies unavailable; • Potential effects on emergency plan execution. The potential effects on emergency plan

execution, including effects on evacuation routes or delayed emergency response are considered. Additional review guidance is developed in Appendix G of this procedure.

1.4 Chemical and Hazardous Substances All chemical and hazardous substance hazards in the region that could affect the safe operation of the NPP should be described and evaluated, with particular focus on: • Activities that involve the handling, processing, transport, and storage of materials with

the potential for explosions, or the production of hazardous substances / materials, volatile and reactive gases, or asphyxiates;

• Effects of the above on SSCs and unprotected personnel, including estimates of over-pressure, toxicity, and transport characteristics in air;

• Secondary chemical interactions on SSCs; • Potential effects on emergency plan execution. The potential effects on emergency plan

execution, including effects on evacuation routes or delayed emergency response are considered. Additional review guidance is developed in Appendix G of this procedure.

1.5 Electromagnetic Interference Hazards

Electromagnetic emitters in the region are described and evaluated during normal and abnormal operations with respect to their potential to affect the safe operation of the facility. Emitters include the following: • Military or civilian facilities such as radar installations, telecommunications installations

etc.; • Particle accelerators or other research facilities utilizing large electromagnetic fields; • High voltage transmission lines, including the effects of solar storms on transmission.

The submission demonstrates that the potential for Electromagnetic Magnetic Interference (EMI) to instrumentation and control equipment is addressed. The primary natural source is electrical storms. External man-made sources include radar and communication systems. Depending on whether the hazard can be adequately controlled, the submission may need to provide screening within building structures to protect equipment from electro-magnetic interference or install

instrumentation and control equipment of a proven electro-magnetic compatibility. The design also considers the effects of Solar flare which have been known to cause problems on long transmission lines at high latitudes. In general, it is not desirable to site a NPP in a high electromagnetic environment due to possible interference with legitimate signals and spurious actuation of devices, potentially leading to system failures. External and natural induced EMI is considered to be any disturbance induced into electrical circuit components and devices by electromagnetic radiation emitted from sources external to the future NPP. An EMI event can be triggered by natural sources including, but not limited to: radar sites, high power microwaves, aluminum smelters, ultra-wideband sources, lightning, and sun storms. The following information is to be submitted regarding EMI: • the process used to perform an electromagnetic radiation survey of the site and the region

immediately surrounding the site, including justification of the size of the survey area; • the results of an electromagnetic radiation survey; • analysis of the survey results and confirmation that adequate mitigation measures can be

implemented for any NPP design being proposed for the site. The information provided should be sufficient in quantity and detail to allow the reviewer to make recommendations on the acceptability of the submission. The objective of the assessment of EMI information is to determine if the electromagnetic radiation survey results are credible and sufficient in detail to determine severity of potential EMI related events. The results of the survey feed into the Conventional Accidents and Malfunctions section of the Environmental Impact Statement (EIS). The electromagnetic radiation survey meets or exceed IEEE Std. 473-1985 (Reaffirmed in 1991), IEEE Recommended Practice for an Electromagnetic Site Survey (10 kHz to 10 GHz). The submission should be assessed to determine if it demonstrates the following: • The analysis of the EMI survey adequately addresses potential effects on safety-related

equipment or instrumentation [1]. • The background levels of electromagnetic radiation at any proposed site should be

significantly lower than the recommended [2] electromagnetic operating envelopes for safety-related I&C systems in nuclear power plants with sufficient margin of safety; and

• The design demonstrates the acceptability of the site, adequate mitigation measures are employed or protected equipment can be installed such as to eliminate interference or spurious actuation according to the guides and standards referenced under [3].

References 1. IEEE Std. 473-1985 (Reaffirmed in 1991), IEEE Recommended Practice for an

Electromagnetic Site Survey (10 kHz to 10 GHz). 2. NUREG/CR--6431 Recommended electromagnetic operating envelopes for safety-related

I&C systems in nuclear power plants. 3. US NRC Regulatory Guide 1.180 Guidelines for evaluating Electromagnetic and Radio-

frequency Interference in safety-related I&C systems. a. IEC 61000-5-1 Electromagnetic compatibility (EMC) - Part 5: Installation and

mitigation guidelines - Section 1: General considerations - Basic EMC. b. IEC 61000-5-2 Electromagnetic compatibility (EMC) - Part 5: Installation and

mitigation guidelines - Section 2: Earthing and cabling. c. IEC 61000-5-5 Electromagnetic compatibility (EMC) - Part 5: Installation and

mitigation guidelines - Section 5: Specification of protective devices for HEMP conducted disturbance.

d. IEC 61000-5-6 Electromagnetic compatibility (EMC) - Part 5-6: Installation and mitigation guidelines - Mitigation of external EM influences.

e. IEC 61000-5-7 Electromagnetic compatibility (EMC) - Part 5-7: Installation and mitigation guidelines - Degrees of protection provided by enclosures against electromagnetic disturbances (EM code).

1.6 The submission should document and evaluate potential electrical disturbances, initiating

events, and grid protection schemes due to interconnection with the Grid. In addition, operational restrictions and grid connection agreements (possibly only in principal at this stage) are reviewed and evaluated for the purposes of assessing the description of the project and conclusions of the EIS. Guidance from RD-346 “Site Evaluation for Nuclear Power Plants” and the outcome of technical assessments involving CNSC staffs review of Accidents and Malfunctions from the Site Evaluation are used in support of the assessment of the EIS submission.

APPENDIX D

Internal and External Non-Malevolent Human Induced Events A systematic approach to identifying all internal and external accidents and malfunctions involving non-malevolent human initiated events is developed, documented, and implemented, including event sequences where human factors or performance form part of the event sequence. It is anticipated that this section will only apply to the commissioning, operating and decommissioning phases of the project. The event sequences and their consequences, including frequencies where known, are assessed in the submission for meeting regulatory dose or release limits (hazardous substance release limits) following Section 4 of this procedure and the regulatory documents listed below. This may be performed via bounding assessments. The submission, in the context of the EIS, addresses the following at a minimum: • the design, operation and supporting analysis is in accordance with modern human

factors standards, principles, and practices; • relevant and proven systematic analysis techniques were used to address human factors

issues within the design process; • the design and operation reduces the likelihood of human error as far as possible,

provides error recovery mechanisms, and mitigate the consequences of error in order of priority;

• the plant layout and procedures, maintenance, inspection, and training take into consideration human factors;

• working areas and working environments are consistent with ergonomic principles; • the design and operation provides for the systematic consideration of human factors and

the human-machine interface; • human-machine interfaces are designed to provide operators with necessary and

appropriate information in a usable format that is compatible with the necessary decision and action times;

• human factors verification and validation plans are or will be established for all appropriate stages of the design process to confirm that the design adequately accommodates all necessary operator actions;

• information display and controls are designed for dual operation of systems management (including accident management) and that of an equipment operation.

The following regulatory documents will form the basis of the review: • RD-204 “Certification of Persons Working at Nuclear Power Plants”; • G-323 “Ensuring the Presence of Sufficient Qualified Staff at Class I Nuclear Facilities –

Minimum Staff Complement; • G-278 “Human Factors Verification and Validation Plans; • G-276 “Human Factors Engineering Program Plans; • P-119 “Policy on Human Factors”.

APPENDIX E

Process Initiated Events during Construction, Operation and Decommissioning A systematic approach for identifying all process initiated accidents and malfunctions, not involving the reactor core, is developed, documented, and implemented by the proponent. The events described below are indicative of the types of events to be considered, and typically include: • Reactor Cooling System failures; • Secondary side heat transport system or steam system failures; • Structural integrity failures, including pressure retaining components, leading to process

upsets or the release of hazardous substances; • Process control failures of pressure retaining components leading to the release of

hazardous substances; • Spurious operation of overpressure protection devices; • Loss or disruption of power supplies; • Loss, disruption or malfunction related to instrumentation or control; • Malfunction or failure resulting in the large release of energy (stored energy, electrical

arc, etc.).

The submission identifies the hazards, frequency (where known) and consequences associated with the postulated events using a systematic approach, including underlying rationale and present the information in a transparent and auditable fashion. Each event and event sequence should be identified and assessed with the following considerations: • The potential direct and indirect effects of the event on the proposed NPP systems,

structures, and components (SSCs), including those that could affect the safe operation of the NPP in both normal and abnormal operating states;

• The potential for the combination of events with normal and accidental releases from the proposed NPP that would exceed environmental limits or cause a significant adverse effect to occur;

• Effects that would influence the ability to successfully implement emergency plans. Derivation of the hazards associated with the events should include the consideration of the combined effects if these hazards with the ambient conditions (e.g., simultaneous process piping failure and heavy snowstorm or rainstorm). The combined effect of hazards can have significant effect areas such as the implementation of emergency plans, accident mitigation, and contaminant pathway models.

The region assessed for each identified external event encompasses the environment that could be affected. The evaluation considers foreseeable changes in land use for the projected lifetime of the NPP to assess and plan for mitigation of new external hazards introduced by change in land-use.

Site-specific data is used to determine hazards, unless such data is unobtainable. In this case, data from similar regions that is sufficiently relevant to the region of interest, or data derived from

appropriate and acceptable simulation techniques, may be used. Data from similar regions and simulated findings may also be used to augment site-specific data. The facility is assessed with respect to the risk from hazardous substances to the public and the environment, with the risks being kept as low as reasonably achievable (ALARA). To determine the potential contaminant impact on the environment, assessments of all releases are made under normal and abnormal conditions for all phases of the NPP life cycle. Bounding scenarios involving modeling of potential effects from maximal possible releases are completed to establish the outer boundaries or worst case scenarios for the NPP. These bounding scenarios also contribute to the scenarios for emergency planning. Assessment of releases or disturbances associated with normal or routine operations are based on expected performance (e.g., average concentrations) and upper threshold bounding conditions, as well as possible pulse releases (high concentration short exposure period) from anticipated operational occurrences (AOOs). The locations of the NPP and of the subsidiary structures on the site are examined at a high level with the assistance of environmental modeling, and situated in a manner that minimizes potential impact on the public and on the environment. This includes emission or effluent release points and air or water intake structures.

APPENDIX F

Non Process Initiated Events A systematic approach for identifying all non-process initiated accidents and malfunctions, not involving the reactor core, is developed, documented, and implemented by the proponent for the entire life cycle of the project. The hazards described below are indicative of the types of events to be considered, and typically include: • Conventional accidents, such as dropped loads, falling objects, flooding, etc.; • Spills or loss of containment for hazardous substances in storage; • Structural collapse or failure of building elements; • Spurious operation of SSCs leading to an accident or malfunction; • Malfunction or failure resulting in the large release of energy (stored energy, electrical

arc, etc.).

The submission identifies the hazards, frequency (where known) and consequences associated with the postulated events using a systematic approach, including underlying rationale and present the information in a transparent and auditable fashion. Each event and event sequence should be identified and assessed with the following considerations: • The potential direct and indirect effects of the event on the Project activities including

proposed NPP systems, structures, and components (SSCs) and humans. Special attention should be applied to events that could affect the safe operation of the NPP in both normal and abnormal operating states;

• The potential for the combination of events with normal and accidental releases from the Project that would exceed environmental limits or cause a significant adverse effect to occur;

• Effects that would influence the ability to successfully implement emergency plans. Derivation of the hazards associated with the events should include the consideration of the combined effects if these hazards with the ambient conditions (e.g., failure of diesel fuel storage structures and a heavy rainstorm). The combined effect of hazards can have significant effect areas such as the implementation of emergency plans, accident mitigation, and contaminant pathway models. The region assessed for each identified external event encompasses the environment that could be affected. The evaluation considers foreseeable changes in land use for the projected lifetime of the NPP to assess and plan for mitigation of new external hazards introduced by change in land-use. Site-specific data is used to determine hazards, unless such data is unobtainable. In this case, data from similar regions that is sufficiently relevant to the region of interest, or data derived from appropriate and acceptable simulation techniques, may be used. Data from similar regions and simulated findings may also be used to augment site-specific data.

The facility should also be assessed with respect to the risk from hazardous substances to the public and the environment, with the risks meeting legal release requirements and being kept as low as reasonably achievable (ALARA). To determine the potential contaminant impact on the environment, assessments of all releases are made under normal and abnormal conditions for all phases of the NPP life cycle. Bounding scenarios involving modeling of potential effects from maximal possible releases are completed to establish the outer boundaries or worst case scenarios for the NPP. These bounding scenarios also contribute to the scenarios for emergency planning. Assessment of releases or disturbances associated with normal or routine operations are based on expected performance (e.g., average concentrations) and upper threshold bounding conditions, as well as possible pulse releases (high concentration short exposure period) from anticipated operational occurrences (AOOs). The locations of the NPP and of the subsidiary structures on the site are examined at a high level with the assistance of environmental modeling, and situated in a manner that minimizes potential impact on the public and on the environment. This includes emission or effluent release points and air or water intake structures.

APPENDIX G

Fires, Explosions, and Emergency Response 1. Information Requirements In addition to the information identified in Appendix A of this procedure, the submission clearly states the fire, explosion, life safety and emergency fire response goals and objectives of the facility. 2. Criteria and Objectives The submission identifies, in the context of the EA and consistent with the EIS guidelines, the safety goals and functional requirements for fire, explosion, life safety and emergency fire response elements of applicable regulatory documents such as: • RD-337 “Design of New Nuclear Power Plants”; • RD-346 “Site Evaluation for Nuclear Power Plants” ; • RD-310 “Safety Analysis for Nuclear Power Plants”.

In addition, meeting the requirements of both nuclear specific and conventional codes and standards such as: • CSA N293 “Fire Protection for CANDU Nuclear Power Plants”; • National Building Code of Canada; • National Fire Code of Canada. The use of other comparable recognized codes and standards such as: • NFPA 804 “Standard for Fire Protection for Advanced Light Water Reactor Electric

Generating Plants”, or; • NFPA 805 “Performance-Based Standard for Fire Protection for Light Water Reactor

Electric Generating Plants”, or; • NFPA 806: Performance Based Standard for Fire Protection for Advanced Nuclear

Reactor Electric Generating Plants; in conjunction with NFPA 101 “Life Safety Code” may be considered acceptable, subject to review and concurrence by CNSC staff that the “General Requirements” and “Fire Protection Concepts” of clauses 4 and 5 respectively of CSA N293-07 and Division A of the National Building and Fire Codes of Canada are achieved. The submission is expected to identify potentially significant fire, explosion, life safety and emergency fire response issues raised during previous assessments of the design by international nuclear safety regulators, and explanations of how their resolution has been or is to be achieved. The submission is expected to indicate how the fire, explosion, life safety and emergency fire response goals and functional requirements are achieved for the life of the facility.

Specific Evaluation Criteria from RD-337 that may be used as part of the assessment are:

Fire Safety (Section 7.9 in RD-337)

The plant, including external buildings and SSCs integral to the operation of the nuclear facility, shall be designed to meet the following requirements. General Provisions (Section 7.9.1 in RD-337) Suitable incorporation of operational procedures, redundant SSCs, physical barriers; spatial separation, fire protection systems, and design for fail safe operation shall be such that the following general objectives are achieved: 1. To prevent the initiation of fires; 2. To limit the propagation and effects of fires that do occur; 3. To quickly detect and suppress fires thereby limiting damage; 4. To confine the spread of fires and their by products which have not been extinguished; 5. To prevent loss of redundancy in safety and safety support systems, and to provide

assurance of safe shutdown; 6. To ensure the monitoring of critical safety parameters remains available; 7. To prevent exposure, uncontrolled release or unacceptable dispersion of hazardous

substances, nuclear material, or radioactive material, due to fires; 8. To prevent the detrimental effects of event mitigation efforts, both inside and outside of

containment; 9. To ensure structural sufficiency and stability from fires.

Buildings or structures shall be of non-combustible construction, using non-combustible or fire retardant and heat resistant material.

Fire suppression system pressure retaining components shall be designed to modern international standards and codes and registered with an Authorized Inspection Agency. Safety to Life (Section 7.9.2 in RD-337) The design shall protect workers and the public from fire or explosion initiated event sequences so that the following objectives are achieved: 1. Persons not intimate with the initial event (including the public, occupants and

emergency responders) are protected from injury and loss of life; and

2. Persons intimate with the initial event have a decreased risk of injury or death. To demonstrate that the above life safety objectives have been achieved in accordance with established radiological, toxicology and human factors criteria, the design shall provide: 1. Effective and reliable means of detecting fires for all areas; 2. Effective and reliable means of emergency notification to workers, including the nature

of the emergency and protective actions by workers; 3. Multiple and separate safe egress paths from any area; 4. Exit locations that are easily accessible to workers; 5. Sufficient exiting capacity for the number of workers accounting for the emergency

movement of crowds; 6. Effective and reliable identification and illumination of egress routes and exits; 7. Protection of workers from fires and their by-products (i.e., combustion products, smoke,

heat, etc.) during egress and in areas-of-refuge; 8. Protection of workers performing plant control and mitigation functions during or

following a fire; 9. Adequate supporting infrastructure (lighting, access, etc.) for workers to perform

emergency response, plant control and mitigation actions during or following a fire; 10. Structural integrity and stability of buildings and structures to ensure workers and

emergency responder safety during and after a fire; 11. Protection of workers from the release or dispersion of hazardous substances, radioactive

material or nuclear material from fires. Environmental Protection and Nuclear Safety (Section 7.9.3 in RD-337)

The design shall minimize the release, dispersion and impact of hazardous substances or radioactive material from fires on the environment.

Fire shall be treated as a design basis accident. The essential safety functions shall be available during a fire.

Fire suppression systems shall be designed and located such that rupture, or spurious or inadvertent operation, will not significantly impair the capability of SSCs important to safety.

Specific Evaluation Criteria from RD-346 that may be used as part of the assessment are: Confirming Unimpeded Implementation of Emergency Plans (Section 5.5.4 in RD-346) Prior to construction, the proponent confirms with the surrounding municipalities and the affected provinces, territories, American states, and neighbouring countries, that implementation of their respective emergency plans and related protective actions will not be compromised for the life cycle of the proposed site.

Population and Emergency Planning Considerations (Section 5.5 in RD-346) Exclusion Zone (Section 5.5.1 in RD-346) The exclusion zone is defined in the Class I Nuclear Facilities Regulations as, “A parcel of land within or surrounding a nuclear facility on which there is no permanent dwelling and over which a licensee has the legal authority to exercise control.”

Protective Zone (Section 5.5.2 in RD-346)

The protective zone is the area beyond the exclusion zone that needs to be considered with respect to implementing emergency measures. This includes consideration of such matters as population distribution and density, land and water usage, roadways, evacuation planning, and consequence analysis.

Planning Considerations (Section 5.5.3 in RD-346) The evaluation takes the following population and emergency planning considerations into account to support achievement of the safety goals: 1. Population density and distribution within the protective zone, with particular focus on

existing and projected population densities and distributions in the region, including resident populations and transient populations—this data is kept up to date over the lifetime of the NPP;

2. Present and future use of land and resources; 3. Physical site characteristics that could impede the development and implementation of

emergency plans; 4. Populations in the vicinity of the NPP that are difficult to evacuate or shelter (for

example, schools, prisons, hospitals); 5. Ability to maintain population and land-use activities in the protective zone at levels that

will not impede implementation of the emergency plans; 6. Confirmation with the surrounding municipalities and the affected provinces, territories,

and foreign states that their respective emergency plans and related protective actions can be implemented for the life cycle of the proposed site.

3. References 1. RD-337 “Design of New Nuclear Power Plants”. 2. RD-346 “Site Evaluation for Nuclear Power Plants”. 3. RD-310 “Safety Analysis for Nuclear Power Plants”. 4. CSA N293 “Fire Protection for CANDU Nuclear Power Plants”. 5. National Building Code of Canada. 6. National Fire Code of Canada. 7. NFPA 804 “Standard for Fire Protection for Advanced Light Water Reactor Electric

Generating Plants”.

8. NFPA 805 “Performance-Based Standard for Fire Protection for Light Water Reactor Electric Generating Plants”.

9. NFPA 806 “Performance Based Standard for Fire Protection for Advanced Nuclear Reactor Electric Generating Plants”.

10. NFPA 101 “Life Safety Code”.

APPENDIX H

Transportation Events

CNSC’s Packaging and Transport of Nuclear Substances Regulations (PTNSR) and Transport Canada’s Transport of Dangerous Goods (TDG) Regulations apply for the shipment of material identified as Dangerous Goods. For Class 7 material, these regulations are currently based on the IAEA Regulations for the Safe Transport of Radioactive Material, TS-R-1, 1996 Edition (Revised) with some exceptions. The IAEA regulations define the design, manufacture, testing, documentation, use, maintenance and inspection requirements for the packages to be used for transport of nuclear substances and in-transit storage operations. For Dangerous Goods, as defined by the TDG Act and Regulations, the transportation requirements of the TDG, NFCC, GNSC Regulations and RD-337 are applied. For hazardous substances the NFCC and GNSC Regulations and RD-337 are applied. The design and performance requirement of the package is based on the activity it is authorized to carry and the consequences of its failure during normal and postulated accident conditions. The Environmental impact statement (EIS) provides information on the substances that will be transported, Type of packages, that will be used, mode of transport to ship the substance and confirmation that the requirements of PTNSR, TDG, NFCC and GNSC Regulations will be met.