Why nuclear is regulated

Hana Okoye's last rotation at Meridian Nuclear Engineering is in the regulatory affairs group, a small office on the third floor that the engineers call the translation desk. Its director, Elena Marchetti, spent twelve years as a CNSC staff reviewer before joining the firm. On Hana's first morning she drops a binder on the desk: the licence conditions handbook for a CANDU station, nearly four hundred pages. "Everything the plant does is in here somewhere," she says. "Your job this term is to understand why each page exists. Once you know why we are regulated, the rules stop looking arbitrary."

The case for regulation

Almost every industry is regulated to some extent, but nuclear power is regulated more closely than nearly any other. The reasons are not mysterious. A nuclear reactor holds a very large inventory of radioactive material in a small space. Most of the time that inventory is contained by multiple barriers and causes no harm. But the earlier courses in this program showed that a severe accident, though very unlikely, can release radioactive material over a wide area, affect people who had no part in the decision to build the plant, and leave consequences that last for decades. Radiation cannot be seen, smelled or felt, so the public cannot judge the risk for itself.

Economists describe this situation as a combination of market failures. The harm from an accident would fall largely on third parties, an externality the operator does not fully pay for. The operator knows far more about the plant's condition than the public does, an information asymmetry. And the consequences of a single serious accident affect the whole industry, so even well-run plants depend on the performance of the worst one. Regulation addresses all three: it sets minimum standards that apply to everyone, it requires information to be disclosed and checked by an independent body, and it gives the public a way to take part in decisions.

There is also an international reason. Nuclear materials can be diverted to weapons, and nuclear facilities can be targets of malicious acts. States have therefore agreed through treaties to control nuclear materials, account for them and protect them. Domestic regulators are the bodies that put those obligations into practice, as lesson 8 describes.

What a regulator does

A nuclear regulator has several distinct functions. It writes or proposes the rules, usually as regulations under a statute and as guidance documents that explain how the rules can be met. It licenses facilities and activities, deciding whether an applicant has shown that it will operate safely. It inspects and assesses licensees to check that they are meeting their commitments. It enforces, using tools that range from a written request to an order to shut a plant down. And it informs the public and other governments about what it has found. These functions are often summarized as standard setting, authorization, review and assessment, inspection, enforcement and communication, the terms used in the IAEA safety standards that lesson 11 introduces.

Independence and the separation of promotion from regulation

The most important property of a regulator is independence: its safety decisions must not be influenced by the people who promote, own or profit from the technology. Early nuclear programs often combined promotion and regulation in the same agency, and both Canada and the United States later separated them. Independence does not mean that the regulator is accountable to no one. It means that its technical and legal decisions are made on safety grounds, by people who do not answer to the industry or to the ministries that promote nuclear power, and that it is open about how it reaches them.

In Canada, the Atomic Energy Control Board was created in 1946 under the Atomic Energy Control Act. For decades it regulated an industry in which the federal government was also a major owner and promoter through Atomic Energy of Canada Limited. The Nuclear Safety and Control Act, passed in 1997 and in force in 2000, replaced the board with the Canadian Nuclear Safety Commission, gave it a clearer mandate focused on health, safety, security, the environment and Canada's international commitments, and made it a quasi-judicial tribunal whose decisions are taken in public hearings. Lesson 2 describes the Act and the Commission in detail.

Prescriptive, performance-based and risk-informed rules

Regulations can be written in different styles. A prescriptive rule says exactly what to do: install two independent shutdown systems, test a valve every 92 days. A performance-based rule says what result must be achieved and leaves the method to the licensee: keep the peak cladding temperature below a limit during a loss of coolant accident. A risk-informed approach uses the results of probabilistic safety assessment, together with engineering judgement and defence in depth, to focus attention on what matters most to safety. Modern regulation in both countries mixes all three. Prescriptive rules are easy to inspect but can freeze outdated designs; performance-based rules allow innovation but need good measures of performance; risk-informed decisions direct resources to the most significant hazards but depend on the quality of the risk models.

The CNSC describes its approach as risk-informed and performance-based, and many of its regulatory documents set out requirements together with guidance that licensees may follow or replace with an alternative that they justify. The Commission also applies a graded approach: the depth of review and the stringency of requirements are scaled to the risk of the facility, so a small research reactor is not treated like a large power station.

A risk-informed decision in practice

Suppose a licensee proposes a change, for example to extend the interval between tests of a pump. A risk-informed review asks how much the change increases the estimated core damage frequency and large early release frequency, how large those frequencies already are, whether defence in depth and safety margins are maintained, and whether the change will be monitored. The best-known framework for the first two questions comes from Regulatory Guide 1.174, which divides the plane of baseline frequency and change in frequency into regions: very small changes are normally acceptable, small changes are acceptable if the baseline is not too high and the effects are tracked, and larger changes are not normally acceptable. Canadian reviews use comparable safety goals and the same idea of looking at both the size of the change and the total risk.

# Classify proposed licensing-basis changes against risk acceptance regions
# (thresholds as commonly quoted for Regulatory Guide 1.174; changes are illustrative).
def region(cdf, dcdf):
    if dcdf < 1e-6:
        return "III: very small change, normally acceptable"
    if dcdf < 1e-5 and cdf < 1e-4:
        return "II: small change, acceptable with tracking of cumulative effects"
    return "I: not normally acceptable"
cases = [("extend pump test interval", 2.0e-5, 4.0e-7),
         ("remove a backup diesel from service longer", 2.0e-5, 6.0e-6),
         ("defer a large seismic upgrade", 2.0e-5, 2.0e-5)]
for name, cdf, d in cases:
    print(f"{name:45s} CDF {cdf:.1e}/y  change {d:.1e}/y -> region {region(cdf, d)}")
print("risk results are one input; defence in depth and margins are also checked")

extend pump test interval                     CDF 2.0e-05/y  change 4.0e-07/y -> region III: very small change, normally acceptable
remove a backup diesel from service longer    CDF 2.0e-05/y  change 6.0e-06/y -> region II: small change, acceptable with tracking of cumulative effects
defer a large seismic upgrade                 CDF 2.0e-05/y  change 2.0e-05/y -> region I: not normally acceptable
risk results are one input; defence in depth and margins are also checked

The output shows that the three changes fall in different places. A tiny increase in risk is acceptable almost regardless of the baseline. A moderate increase is acceptable only because the plant's total core damage frequency is well below the threshold, and it comes with the expectation that the licensee will track the cumulative effect of its changes. A larger increase is not normally accepted. Elena points out to Hana that this is never the whole decision: the reviewer also checks that defence in depth and safety margins are kept, and the numbers carry uncertainty that must be considered.

The cost and benefit of regulation

Regulation has costs. Licensees pay for the regulator's work in both countries through fees, and they spend much more on preparing applications, maintaining documents and responding to inspections. Lengthy or unpredictable reviews can make new projects more expensive and slower. Supporters of reform argue that some requirements add cost without adding safety. Others warn that the history of nuclear accidents shows what happens when regulators are too close to industry or too eager to speed things up. A good regulator tries to be efficient without lowering its standards: it is clear about what it expects, decides on a predictable schedule, and spends its effort where the risk is greatest.

The CNSC recovers most of its licensing and compliance costs from licensees under its Cost Recovery Fees Regulations, with the rest funded by Parliament. Recent federal policy has asked regulators to support the efficient review of major projects, including new reactors, and the CNSC has set out target timelines for its reviews while stating that safety is not negotiable.

How accidents shaped the rules

Much of today's regulatory framework was written in response to events. The 1979 accident at Three Mile Island in Pennsylvania released very little radioactive material, but it showed that operators could misread the condition of a plant, that control rooms were poorly designed for abnormal events, and that emergency planning around plants was weak. Regulators on both sides of the border responded with requirements on operator training and licensing, control room design reviews, symptom-based emergency procedures and off-site emergency plans. The industry created its own peer review organization, now the Institute of Nuclear Power Operations, to share lessons and press for excellence beyond the regulatory minimum.

The 1986 Chernobyl accident showed the consequences of a design with an unstable feedback, a weak safety culture and a regulator without real independence. It led to the creation of the World Association of Nuclear Operators, to new international conventions on early notification and assistance, and eventually to the Convention on Nuclear Safety, under which countries report on their regulatory systems and review each other's reports. The 2011 Fukushima Daiichi accident, caused by an earthquake and tsunami beyond the design basis, led to stress tests and action plans around the world. Plants added portable equipment for extended loss of power, strengthened protection against flooding and earthquakes, and improved severe accident management. Japan rebuilt its regulator as a more independent body after investigators concluded that the old one had been too close to the industry it oversaw.

Each event exposed a gap that had been considered too unlikely to address. The lesson that regulators draw is that the licensing basis must be revisited as knowledge changes, that events beyond the design basis must be considered in a structured way, and that the human and organizational side of safety matters as much as the hardware. Lesson 12 returns to these and other cases in more depth.

Marcel Thibodeau, who has worked at Canadian stations for thirty years, tells Hana that he remembers the Fukushima action items arriving. "The CNSC issued a list of actions to every licensee within months," he says. "Some were already in hand. Others, like the emergency mitigating equipment, meant new trucks, pumps and connection points at every station. The point was that we could keep the fuel cool even if everything we normally rely on was gone."

Elena adds a caution. Responding to events is necessary, but a regulator that acts only after accidents is always one step behind. The aim of a modern system is to anticipate: to use operating experience from around the world, research and risk analysis to find weaknesses before they cause harm. That is why the rest of this course spends as much time on the routine work of licensing, inspection and review as on the response to crises.