Strategic Role of Safety Culture in CANDU Operations

Safety culture in a CANDU station is the product of the collective mindset of its workforce. It determines how an operator responds to an unexpected alarm, how a technician verifies a valve position, and how a front-line supervisor weighs the schedule against a lingering doubt about equipment condition. The heavy-water moderated, horizontal fuel channel design provides inherent barriers against the release of fission products, but these passive features rely on active systems and human actions that must function with high reliability. The ultimate barrier is the organizational system that fosters vigilance, rewards candor, and insists on thoroughness, even when pressures to maintain production are high.

A strong safety culture reduces the number and size of the "holes" in the defence-in-depth model. It ensures that latent pathogens—flawed procedures, inadequate training, or weak interface designs—are identified and corrected before they line up with an active error. The International Atomic Energy Agency (IAEA) has consistently identified deficient safety culture as a contributing factor in major nuclear events worldwide, including Chernobyl and Fukushima. In response, CANDU operators, guided by the Canadian Nuclear Safety Commission (CNSC), have built a framework that systematically embeds safety into every process. This includes a leadership-driven commitment to safety, an environment where questioning and reporting are encouraged, and a continuous learning approach that adapts to new knowledge and operating experience. For the CANDU fleet, safety culture is not a separate initiative; it is integrated into management systems, performance metrics, and everyday work practices.

Regulatory Framework and Industry Standards

Canada’s nuclear safety regime is internationally respected, and the CNSC sets clear expectations for safety culture. The regulatory body’s safety culture guidance outlines key principles that operators must integrate into their management systems. These align closely with the IAEA Safety Culture framework and the IAEA's General Safety Requirements (GSR Part 2), which stress that leadership, personal accountability, and a questioning attitude are foundational. The CNSC requires licensees to conduct periodic safety culture assessments and to demonstrate continuous improvement. These assessments include employee surveys, field observations, and independent reviews of organizational processes.

All CANDU facilities must demonstrate conformance with CNSC requirements through regular inspections, performance metrics, and licensing documentation. In addition, industry organizations such as the CANDU Owners Group (COG) facilitate peer reviews and information exchange, enabling stations to benchmark their safety culture maturity against best-in-class performers. This collaborative approach ensures that lessons learned at one site quickly become protective measures across the fleet. The COG human performance committee, for example, develops shared training modules and conducts cross-site operating experience reviews that address both technical and cultural issues. This horizontal collaboration is a hallmark of the CANDU industry, allowing both large and small stations to benefit from collective wisdom.

Core Components of an Effective Safety Culture

While each station tailors its programs to local conditions, certain components are universal in a healthy CANDU safety culture:

  • Safety Mindfulness: Individuals maintain an alertness to the potential for error and the consequences of deviation from procedures. This mindfulness is cultivated through repeated training scenarios that simulate degraded conditions and through daily reflection on risks. At the start of every shift, crews review plant status, recent events, and focus areas to sharpen attention.
  • Questioning Attitude: Employees at all levels are empowered to stop work when a mismatch or unexpected condition arises. The culture reinforces that no scheduled activity is so urgent that it cannot be paused for safety verification. This principle is embedded in formal stop-work authority policies and is visibly supported by senior leaders.
  • Reporting Culture: A non-punitive environment for reporting hazards, near misses, and even minor errors is critical. Data from these reports feed into corrective action programs and trend analyses that prevent recurrence. CANDU stations maintain confidential reporting channels and encourage reporting of both safety and quality concerns.
  • Just Culture: While encouraging open reporting, the organization distinguishes between acceptable behaviour (an honest mistake) and unacceptable behaviour (willful violation). This fairness underpins trust in the safety system. Managers undergo training to apply just culture principles consistently, ensuring that disciplinary actions are reserved for intentional wrongdoing.
  • Continuous Learning: Safety is not a static target. Operating experience from within the fleet and from external nuclear organizations is systematically reviewed to update procedures, training, and equipment. This learning cycle includes self-assessments, external reviews, and incorporation of industry alerts.

A well-documented risk in long-running organizations is the normalization of deviance—the gradual acceptance of conditions that stray from the original design or operating basis. CANDU operators combat this through rigorous adherence to configuration management, regular self-assessments, and a low threshold for reporting anomalies. These components are not merely posted on walls; they are integrated into performance objectives, leadership training, and daily briefings. For example, station performance scorecards include metrics on the number of safety concerns raised and the timeliness of corrective actions, demonstrating that safety culture is measured and managed like any other critical business process.

Building Competence: Training Programs for CANDU Staff

CANDU stations invest heavily in training because the complexity of reactor physics, digital control systems, and the potential consequences of mismanagement demand a workforce with deep technical knowledge and unshakeable procedural discipline. Training programs follow the Systematic Approach to Training (SAT), a methodology endorsed by the IAEA that links job analysis, learning objectives, and performance evaluation. The SAT process starts with a comprehensive task analysis for each position, identifying the knowledge, skills, and attitudes required. Learning objectives are then developed, and training delivery methods are selected to achieve those objectives. Finally, evaluation measures determine whether the training was effective and where improvements are needed.

Initial Licensing and Qualification Training

New operators, maintainers, and technical staff enter a structured initial qualification program that can span up to two years. For reactor operators, this includes intensive classroom coverage of CANDU thermalhydraulics, reactor kinetics, radiation protection, and plant systems. Candidates must then pass rigorous CNSC-administered examinations to obtain a licence. The licensing process includes both written and oral exams, as well as comprehensive simulator evaluations that test the operator’s ability to manage normal operations, abnormal events, and emergency conditions. Similarly, maintenance personnel complete trade-specific training alongside plant-specific courses that emphasize the safety functions of the equipment they will service. For example, electrical technicians learn the specific failure modes of CANDU safety system components, and mechanical maintainers are trained on the unique challenges of fuel handling and heat transport system maintenance.

Training facilities such as the Bruce Power Training Centre and the replica control room simulators at OPG’s Darlington and Pickering sites provide hands-on experience. These full-scope simulators expose trainees to normal operations, anticipated transients, and severe accident scenarios, building muscle memory and cognitive agility long before they face real plant conditions. The simulators are modelled exactly on the actual control rooms, including the same panel layouts, computer interfaces, and alarm systems. Trainees spend hundreds of hours in the simulator, progressively taking on more complex roles—from assistant operator to shift supervisor—under the watch of experienced instructors who emphasize procedural adherence, teamwork, and communication.

Continuing Training and Professional Development

Once qualified, all staff enter a cycle of continuing training mandated by the CNSC. Typically, licensed operators complete a minimum number of hours in the simulator every year, focusing on both routine evolutions and low-frequency, high-consequence events. This ensures that skills remain sharp and that operators can handle scenarios they might not encounter in daily operations. Maintenance technicians and engineers attend refresher courses on safety-significant systems and new fleet-wide advisories. Ongoing training also incorporates changes to regulatory requirements, equipment upgrades, and human performance findings. For instance, when a new type of valve actuator is installed in a CANDU station, all relevant maintainers receive dedicated training on its proper installation and testing before it is put into service.

Professional development extends beyond technical skill. Leadership development programs for supervisors and managers focus on safety coaching, decision-making under uncertainty, and fostering a climate where workers feel safe to raise concerns. These programs recognize that a front-line supervisor’s reaction to a reported issue often determines whether the next issue will be reported at all. Training modules cover topics such as effective communication, recognizing and addressing unsafe conditions, and managing competing priorities. Role-playing exercises allow supervisors to practice difficult conversations about safety performance and to receive feedback on their approach.

Simulation, Drills, and Tabletop Exercises

Simulated emergency drills are a cornerstone of CANDU safety readiness. Full-scale exercises involving multiple agencies—on-site emergency response teams, local police, fire services, and provincial emergency management organizations—test coordination and communication under realistic time pressure. These exercises simulate severe accident scenarios, such as a loss-of-coolant accident combined with a station blackout, and require participants to make protective action recommendations for the surrounding public. In the control room, simulator scenarios are often unannounced and graded against strict performance criteria related to procedure adherence, crew resource management, and decision-making. Crews are evaluated not only on the technical correctness of their actions but also on how well they communicate, delegate tasks, and maintain situational awareness.

Tabletop exercises for management teams complement operational drills by rehearsing crisis communication, protective action recommendations, and public information delivery. These exercises involve senior leaders, communications staff, and regulatory personnel who must coordinate their response under time pressure. The post-drill debriefings are as important as the exercise itself, as they generate a detailed list of corrective actions and systemic improvements that are tracked to closure. Lessons learned from drills are shared across the fleet through COG and other industry channels, ensuring that one station’s insights become an industry standard practice.

Organizational Best Practices for Sustaining Safety

Training alone cannot sustain a mature safety culture. Organizational structures and routines must consistently reinforce the behaviours that training instills. The following practices are standard across high-performing CANDU organizations.

Leadership and Management Commitment

Safety leadership starts at the top. Site vice presidents and department managers conduct regular safety walkabouts, visibly engaging with front-line workers to discuss ongoing risks and safety observations. This "management by walking around" (MBWA) approach ensures that leaders are accessible and that their interest in safety is genuine and informed. Leaders set the tone by allocating adequate resources to maintenance, training, and safety improvements even under budget pressures. They also model vulnerability by sharing their own mistake experiences, demonstrating that error reporting is an expected and valued behaviour. For example, during monthly all-hands meetings, a station director might describe a recent personal oversight and the corrective action taken—this transparency encourages others to do the same.

Leadership commitment is measured through safety culture surveys, which are administered periodically to gauge the workforce’s perception of management’s safety priority. These surveys are designed by organizational psychologists and benchmarked against other high-reliability industries. Results are shared transparently across the organization, and action plans are developed with employee involvement, closing the loop between feedback and improvement.

Open Safety Reporting and Just Culture

CANDU sites operate safety reporting systems that allow any employee, contractor, or visitor to document a safety concern or near miss without fear of reprisal. Reports can be submitted anonymously through secure online portals or paper forms, and every submission is investigated in a timely manner. The organization then communicates findings back to the reporter (if known) and more broadly through safety bulletins. This process demonstrates that reporting leads to action, which encourages continued reporting. Stations track the number of reports per month and the time to closure, using these metrics as indicators of safety culture health.

Addressing the barriers to reporting—fear of consequences, management indifference, and time pressure—is a continuous effort. A just culture framework ensures that disciplinary actions are reserved for cases of deliberate wrongdoing or gross negligence, while unintentional errors become learning opportunities. This clarity encourages proactive reporting and early identification of weak signals that could escalate into significant events. Leaders are trained in just culture principles so that their responses to incidents are consistent and fair. The framework includes defined categories of behaviour (human error, at-risk behaviour, reckless behaviour) and corresponding responses. Regular training refreshes ensure that managers remain proficient in applying these distinctions consistently.

Human Performance and Error Prevention Tools

Drawing on lessons from aviation and other high-reliability industries, CANDU organizations deploy a suite of human performance tools. These tools are not just taught in initial training; they are drilled regularly and audited during field observations:

  • Pre-job briefings: Structured discussions before any safety-significant task to clarify roles, identify potential hazards, establish contingency plans, and confirm that all required resources (tools, procedures, personnel) are available. Briefings use a checklist format to ensure consistency and cover critical elements such as the task purpose, authorization, and stop-work criteria.
  • Three-way communication: A repeat-back technique to ensure accurate understanding of instructions between control room operators and field workers. For example, the control room operator says a command, the field worker repeats it back, and the operator confirms. This is used for all safety-critical communications, especially during valve line-ups, system isolations, and electrical switching.
  • Self-checking (STAR): A fundamental individual tool where workers Stop, Think, Act, and Review before any critical action. This simple loop interrupts automatic or fatigued behaviour, addressing a root cause of many procedural errors.
  • Critical Step Analysis: For high-risk tasks such as electrical switching or primary system isolations, a formal analysis identifies the specific step where an incorrect action would have immediate consequences for safety. A "two-person rule" or independent verification is applied at that precise step.
  • Peer checking: A second qualified individual verifies critical steps, valve line-ups, or software inputs. The peer checker observes the action, confirms it against the procedure, and signs off.
  • Stop when unsure: Formal empowerment to pause work until a concern is resolved, reinforced through policy and leadership endorsement. Employees are trained to use this language without fear of reprisal, and managers publicly praise instances where stop-work prevented a potential error.
  • Procedure use and adherence: Operators are trained to follow the procedure, not memory. All safety-significant tasks require the use of written procedures that are kept current. Deviations from procedure require formal authorization and a documented rationale.

Supervisors coach crew members in real time, reinforcing correct use and celebrating instances where a stop-work authority prevented a potential error. Human performance observations are recorded and trended to identify patterns, such as recurring breakdowns in three-way communication, and targeted training is delivered accordingly.

Continuous Improvement and Performance Monitoring

A mature safety culture never becomes complacent. CANDU stations embed continuous improvement through comprehensive self-assessment programs, external operational experience reviews, and a structured corrective action program (CAP). The CAP captures equipment deficiencies, programmatic issues, and human performance observations from multiple sources—including safety reports, inspections, audits, and training evaluations. Each item is categorized by safety significance, assigned to a responsible owner, and tracked to documented closure through a database system. Trend analysis is performed quarterly to identify recurring issues that may indicate systemic weaknesses.

Internal audit groups and independent safety review committees examine station performance against CNSC requirements and industry best practices. These committees include members from outside the station, bringing fresh perspectives. Their assessments often lead to upgrades in training curricula, procedure rewrites, or organizational changes. Industry-wide initiatives, coordinated through the CANDU Owners Group, allow stations to share operating experience alerts and successful improvement strategies. This fleet-wide learning has addressed topics such as aging management of fuel channels, digital control system reliability, and the human factors implications of control room modernization.

Beyond internal and industry audits, stations may invite external organizations such as the IAEA to conduct Safety Culture Assessment Review Team (SCART) missions. These in-depth, independent reviews provide an external benchmark of safety culture maturity, offering insights that internal teams might overlook. The findings from SCART missions are taken seriously at the executive level, and resulting action plans are integrated into the station’s strategic objectives. This openness to external scrutiny is a defining characteristic of a learning organization.

Learning from Events and Adapting to Change

While Canada’s CANDU fleet maintains an exemplary safety record, the industry has not been without operational events that tested safety culture. Excessive tritium releases at Pickering in the 1990s, for example, prompted a fundamental overhaul of maintenance practices, training emphasis on contamination control, and a renewed focus on public communication. These events were not celebrated, but they were fully extracted for their learning value. Detailed root-cause analyses were shared across the fleet, and the resulting changes to procedures and training modules inoculated all stations against similar failures. Similarly, a reactor trip event due to a misaligned valve led to fleet-wide procedural changes and enhanced pre-job briefings.

International events also serve as powerful catalysts for improvement. The Fukushima Daiichi accident in 2011 triggered a comprehensive stress test program across all Canadian stations. While CANDU reactors have inherent characteristics that differentiate them from the boiling water reactors at Fukushima, the process examined station capabilities to withstand extreme external events beyond their original design basis. This resulted in the deployment of additional portable equipment, enhanced emergency response protocols, and strengthened training for severe accident management. The hallmark of a strong safety culture is how an organization responds when things go wrong. Instead of defensive posturing, CANDU licensees have embraced transparency, issuing public event reports and engaging with community liaison committees. This openness builds trust and reinforces internally that safety takes precedence over reputational concerns.

Conclusion

The safety culture of CANDU reactors is a deliberate, engineered outcome of leadership commitment, systematic training, and organizational practices that insist on continuous learning. From the simulator floor to the boardroom, every element is designed to promote a questioning attitude, rigorous adherence to procedures, and the willingness to report even minor anomalies. By aligning with CNSC expectations and international frameworks, and by collaborating through industry groups, CANDU operators sustain an environment where competency and vigilance are the norm.

As the fleet undertakes major refurbishment projects and life extensions, the safety culture will be tested by new contractors, first-of-a-kind challenges, and the pressures of schedule and cost. The training programs and organizational best practices described here provide the foundation to meet those challenges without compromising the protection of workers, the public, and the environment. Safety culture is not a destination but a continuous journey—and the CANDU community remains steadfastly on that path, knowing that the true measure of success is not a single event-free day, but the sustained discipline to learn, adapt, and improve over decades.