Québec, 1 August 2013
Honorable Joe Oliver,
Minister of Natural Resources,
Members of Parliament of Canada
Parliament, Ottawa
Re: Probability of a severe nuclear accident 100 times higher than thelevel of social acceptability
Honorable Joe Oliver and Honorable Members of Parliament,
-1. Introduction
We appreciate the fact that on May 24th you replied to our letter dated April 11th 2013 (see attachment 1 for both letters), in which we had drawn attention to the urgent need to decrease at least tenfold the probability of severe nuclear accidents in Canada, as had been proposed in an article published in October 2009 by former federal employee and nuclear engineer John Waddington (see attachment 2).
Your May 24th letter failed however to address the important issues concerning nuclear safety regulation that our April 11th letter had raised. Your letter had nothing but praise for the Canadian Nuclear Safety Commission (CNSC), despite the fact that the CNSC is itself part of the nuclear risk problem as John Waddington and many other analysts have argued in recent years. In the present letter we wish to convince you that your government is faced with a serious problem regarding safety culture in the field of nuclear regulation.
On the basis of federal data we find that the probability of a severe nuclear accident in Canada is 100 times higher than the level of social acceptability. Over a five-year period in the Toronto area, the probability of occurrence of a nuclear accident with severe core damage may be as high as the probability of getting three sixes on a single throw of three dice. Because of many prevailing uncertainties connected with high-pressure tube degradation mechanisms in CANDU nuclear reactors, the severe accident probability may actually be much higher than the three-dice value. We respectfully and urgently request the Canadian federal government to intervene, before a severe accident takes place.
Governmental intervention was indirectly requested by John Waddington in his October 2009 article which we quoted in our April 11th letter. As you read the following quote you might keep in mind that nuclear engineer John Waddington worked for many years for Atomic Energy Canada Limited (AECL) and then at the CNSC; he is an ‘’insider’’ and a promoter of a further expansion of nuclear energy. Waddington wrote:
Waddington : ‘’The paper presents the case that there are major deficiencies in the current regulatory scheme which, if not corrected, will likely prevent the achievement of the new safety goals that have been set for Generation III reactors and beyond, which is a reduction by a factor of ten in the expected frequencies of core damage and of severe accidents.’’
-2. Safety culture deficiencies in many fields.
On July 6th 2013 there occurred in the city of Lac-Mégantic, in south-eastern Québec, a railroad accident which turned into a tragedy with the loss of 50 human lives and the destruction of part of the city center. Television and printed media were quick to point out serious deficiencies in the federal regulation of railway transport which contributed directly to this tragedy. On July 20th the newspaper La Presse published an article by well-known journalist Vincent Marissal who investigated the railway situation in Canada (see attachment 3 for the article entitled «Un drame ineluctable»). Vincent Marissal interviewed Jean-Pierre Gagnon, a railroad security expert who retired in Spring 2013 after 32 years in Transport Canada. Jean-Pierre Gagnon had tried for years to improve Canadian railway regulations, partly in collaboration with the Association of American Railroads, but without much success. Marissal also interviewed many persons in the railroad industry who did not want to be named. Marissal’s article reveals a great deal of laisser faire in the Canadian railroad business. We will use the following two quotes to raise questions later about similar deficiencies in nuclear regulation in Canada.
Marissal : «Ultimement, cela relève de la volonté politique du gouvernement, qui a résolument favorisé la business avant la sécurité, nous disent nos sources.» Translation: ‘’In the final analysis this stems from a political agenda in the government that has definitely chosen to favor business rather than safety, according to our information sources.’’
Vincent Marissal’s article ends with this quote from an employee of a large railroad firm :
«Transports Canada, c’est une parure! Ce sont les compagnies ferroviaires qui font leurs propres règlements.» Translation: ‘’Transport Canada is an ornament ! It is the railroad companies that make up their own rules.’’
In the week following the Lac-Mégantic tragedy the Union des municipalités du Québec (UMQ) formally asked the federal government to immediately carry out a rigorous inspection of railway equipment and to review and modernize its railway regulatory system. Furthermore, the UMQ is planning to collaborate with similar associations in the USA in order to put pressure on all pertinent governments on both sides of the border.
As this story is developing there comes more to light the important question of the safety culture in many different fields. Thanks to unusually exhaustive media coverage of the Lac-Mégantic tragedy, the public is beginning to see a broader picture connecting major tragedies with deficiencies in safety culture not only in industry but also at the level of federal regulation. Looking for root causes of the Lac-Mégantic disaster, for example, some newspaper articles have made a connection with other disasters, such as the explosion of the Challenger space shuttle at Cape Canaveral in Florida on January 28th 1986.
Numerous authors in academia and elsewhere have studied the root causes of major accidents such as the two space shuttle tragedies (Challenger in January 1986 and Columbia in February 2003), fatal airplane crashes, large oil spills from tankers and ocean platforms, railroad accidents and nuclear reactor meltdowns (Three Mile Island in 1979, Chernobyl in 1986, and Fukushima in 2011). Many books have been written on these topics, notably ‘’Normal Accidents, Living with High Risk Technologies ’’ (1984, revised in 1999) by Charles Perrow, ‘’The Challenger Launch Decision’’ (1996) by Diane Vaughan, and ‘’Challenger Revealed’’ (2006) by Richard C. Cook. The television series Mayday is most remarkable in explaining the immediate and the root causes of airplane crashes. The Mayday series brilliantly teaches the paramount importance of building and strictly adhering to a safety culture.
In his remarkable October 2009 article nuclear engineer John Waddington emphasized human error and institutional failure as dominant contributing factors to major accidents. Waddington referred to the research work of EmeritusProfessor James T. Reason of the University of Manchester in Massachusetts. The description of professor Reason’s research focus at URL is :
Reason’s research focus : ‘’For the past 25 years, his principal research area has been human error and the way people and organizational processes contribute to the breakdown of complex, well-defended technologies such as commercial aviation, nuclear power generation, process plants, railways, marine operations, financial services, and healthcare institutions. His error classification and models of system breakdown are widely used in these domains, particularly by accident investigators.’’
This description underlines the fact that safety culture is a concept that applies to many high-technology fields. A similar idea has been extensively developed by Professor Diane Vaughan of Columbia University starting with her well-researched and broadly praised book ‘’The Challenger Launch Decision’’. In an article on Lac-Mégantic published on July 14th 2013 in the Canadian Press, Professor Jean-Paul Lacoursière of the University of Sherbrooke drew attention to the exhaustive work carried out by Professor Diane Vaughan of Columbia University on the root causes of major accidents. Much information about Professor Vaughan’s research can be found in a 2008 ConsultingNewsLine (CNL) interview archived at the following URL :
In 2003, in recognition of her excellent work in analyzing the root causes of the Challenger space shuttle disaster, sociologist Diane Vaughan was invited to join the Columbia Accident Investigation Board (CAIB) set up by NASA (National Air and Space Administration). On page 2 of the CNL interview Diane Vaughan said the following:
Diane Vaughan : ‘’I’m interested in the dark side of organizations : how things go wrong - mistakes, misconduct, disaster. Research indicates that troubles came not only from individual failures but also from organizational failures.
……… …………………
a long incubation period filled with early warning signs that were either missed or misinterpreted or ignored. Concepts common to all are structural secrecy, the normalization of deviance, signals – missed signals, weak signals, routine signals. All of these are common in failures of all sorts. Primarily, the work has introduced the idea of how deviance becomes normalized in different kinds of organizations.’’
The last line underlines a key contribution, a discovery, made by Professor Diane Vaughan, namely the concept of ‘’normalized deviance’’ in large organizations. On page 3 of the interview she gave the following description of this key concept:
Diane Vaughan : ‘’Social normalization of deviance means that people within the organization become so much accustomed to a deviant behaviour that they don’t consider it as deviant, despite the fact that they far exceed their own rules for the elementary safety. But it is a complex process with some kind of organizational acceptance.’’
In the case of the Challenger disaster the problem of flames burning through O-rings on the giant booster rockets had been observed and well documented by NASA engineers. Prior to January 28th 1986 several engineers, and budget administrator Richard C. Cook, had tried to convince upper NASA management that the O-ring problem needed to be fixed if an explosion was to be avoided during launch. Talking about these engineers Professor Charles Perrow wrote in his book on page 380:
Charles Perrow : ‘’They pounded tables and raised their voices but were told to take off their engineering hats and put on their managerial ones.’’
But as Diane Vaughan writes, the level of ‘’acceptable risk’’ had been redefined by NASA, so that ‘’flying with the flaw was normal and acceptable.’’
-3. Normalized deviance, institutional failure, in the field of nuclear energy.
The major contribution of academic researchers, such as sociology professors Diane Vaughan and Charles Perrow, is to have found common elements that lead to major accidents in many different fields, so that a unified understanding of major accidents becomes possible. In his book Charles Perrow deals explicitly with nuclear power (he had been on the commission that investigated the Three Mile Island nuclear meltdown), petrochemical plants, aircraft and airways, marine accidents and earthbound systems (dams, quakes, mines and lakes). Charles Perrow and Diane Vaughan underline the crucial role played in major accidents by institutional failure, in other words the role played by deficiencies in the safety culture. Here is how Diane Vaughan put it on page 7 of her interview with Consulting News Line:
Diane Vaughan : ‘’The basic lesson that sociologists bring is that the organization matters. If there are problems, the tendency of corporate or public agency administrators is to blame individuals. However, organization characteristics – cultures, structures, politics, economic resources, their presence or absence, their allocation, put pressure on individuals to behave in deviant ways to achieve organization goals. If you want to fix a problem, you can’t just fire the responsible person. You have to fix the organization, or else the next person to take the job will just experience the same pressures. Like Columbia after Challenger, the harmful behavior persists.’’
Note Diane Vaughan’s words ‘’You have to fix the organization’’. That was the central message that nuclear engineer John Waddington conveyed in his October 2009 article. In section 2.4 entitled ‘’Common factors’’, Waddington referred to the work of Professor James T. Reason who found that human error makes a contribution of approximately 75% to major accidents in the fields of jet transport, air traffic control, maritime vessels, chemical industry, U.S. nuclear power plants, and road transportation. Referring to the discovery of a ‘’near miss’’ nuclear event at the Davis Besse nuclear power plant in Ohio in March 2002, John Waddington wrote the following :
John Waddington : ‘’When a serious accident or a near miss occurs, it usually appears at first that human error on the part of control room operators or maintainers (or pilots in the aviation business) - that is, the people at “the sharp end” of operations - played a large part in causing the accident.
But closer inspection and analysis shows that most of the root causes of the accident arise from failings in the way in which complex technological organisations such as airlines or electrical utilities organize themselves. The errors are still human errors, but they arise from latent weaknesses in the way the organization runs, rather than individual error. The usual term for these weaknesses is “Institutional Failure”. It is this type of failure that provides the greatest contributor to real accidents and near misses.’’
Waddington’s conclusion is so important that we repeat it in bold letters:
‘’The usual term for these weaknesses is “Institutional Failure”. It is this type of failure that provides the greatest contributor to real accidents and near misses.’’
The concept of ‘’institutional failure’’ is what Diane Vaughan called ‘’normalized deviance’’.
In section 3 entitled ‘’The issue for the nuclear industry’’, John Waddington reported that the international nuclear power community has been supporting efforts towards reducing the probability of a severe nuclear accident by at least a factor of ten. He wrote:
John Waddington : ‘’The predicted Core Damage Frequency and the Severe Accident Frequency for new plants are derived from detailed, logical analyses of all the components of a plant using Probabilistic Safety Assessment (PSA) techniques that identify and quantify the effects of all component and system failures. These analyses provide an excellent measure of the failure rate that can be expected of the plant design itself. They do not measure the failure rate of the institution that runs the plant.
Although the probability of human error is being built into these analyses on a wider basis as tools and knowledge improve, they do not attempt to capture the broader effects of human errors that arise from organizational deficiencies, i.e. Institutional Failures, as is discussed in a recent CNSI paper on the subject.’’
CSNI is the acronym for the Committee on the Safety of Nuclear Installations, which reports to the Nuclear Energy Agency (NEA) of the Organization for Economic Cooperation and Development (OECD). Note John Waddington’s emphasis on the fact that the much vaunted PSAs (Probabilistic Safety Assessments) do not take into account institutional failure.
When we turn to the Canadian situation we observe that the CNSC has so far denied playing a role in what Waddington and others refer to as ‘’institutional failure’’. As the above-mentioned authors have pointed out, it is clear that institutional denial is not the attitude that will lower the part of institutional failure in the root cause of major accidents. At the CNSC Pickering hearing on May 30th 2013 Greenpeace representative Shawn-Patrick Stensil challenged the CNSC to stop denying the reality and importance of institutional failure as a root cause of major accidents.
In the following sections we will give examples of several documented decisions and assertions by the CNSC that render legitimate our asking the question : is the CNSC exempt from institutional failure ?
-4. Dr Greg Rzentkowski and the one hundredfold reduction of accident probability
In the last week of May 2013 the Canadian Nuclear Safety Commission (CNSC) held a public hearing in Pickering, near Toronto, during which much pertinent information on nuclear accident probability was revealed and intensely debated among CNSC Commissioners and staff, Ontario Power Generation (OPG) staff, and interveners from the public and from various public interest organizations. The transcripts of the CNSC public hearing in Pickering on May 27-31 2013 run over 1200 pages (they can be downloaded from the CNSC web site see at this URL : ). The CNSC is rendering the Canadian and American public a great service in organizing public hearings with lots of time for discussions, in having very accurate transcripts produced and in archiving them on its web site.
On the basis of an enormous amount of information that has been produced and accumulated by the CNSC over the years and that is now in the public domain on its web site, one can assert that at least a one hundredfold reduction in the probability of a severe nuclear accident in Canada is required if nuclear power is to meet the level of social acceptability encountered in scheduled commercial jet travel.
This assertion is made on the basis of the Nuclear Safety and Control Act of 1997, and on the basis of a previous Ontario court decision going back to 1996. In a court case concerning the seismic risk to nuclear reactors in Ontario, the Weston Geophysical Corporation (Weston GC) of Westboro, Massachusetts, had been mandated by the Canada Department of Justice counsel to assess the seismic risk relevant to nuclear reactors in Ontario and in New Brunswick. A report by Weston GC for this court case is archived by Natural Resources Canada under ‘’Geological Survey of Canada, Open file 2929’’, dated June 1994 (this file can be found at URL In order to judge the social acceptability of earthquake-triggered nuclear accidents Weston GC had chosen to compare the probability of occurrence of a severe nuclear accident with the probability of dying in an airplane crash. We adopt the same criterion of social acceptability. This is a well-defined criterion which presents the advantages of having a precedent in court and of not being subject to change by any of the numerous organizations or firms dealing with nuclear reactors.