There are two things. One is that we have moved beyond, let's say, a more deterministic approach to safety, in which you try to guess what the specific catastrophe would be, to more of what we call a risk-informed design, which is more a defence in-depth strategy.
If you look, for example, at the Fukushima incident, the plant itself survived the earthquake and the tsunami and actually shut down. The problem was that it required, after a very few hours, outside help for power and for water, and other types of things. We see that we need to move past that what I'll call fragile design and on to a more robust design that doesn't require this outside intervention. That is especially appropriate for the discussion we're having today regarding northern Canada.
Mr. Binder, you talked about these assets that are located not directly on site. That is an approach being taken to, again, mitigate the more fragile nature of some of the older operating plants, which, again, is not necessarily practical or appropriate for application in northern Canada, because they would be very difficult logistically.
Our approach is actually to make the reactor system itself very robust in terms of what I call a coping time. The idea is that it can survive for two to four weeks without any outside help whatsoever after the most severe type of accident. You can almost look at it as being that these extra assets are pre-positioned inside the containment underground, safely protected. So you have layer upon layer of defence. That's the way you need to think about how to create a system that is safe.
For example, for the airline industry, advanced airplanes today are designed to have an accident once in every 10 million years per flight. We try to take that to even a couple of orders of magnitude safer than that. In order to do that, you need to think differently about safety. The safety case we are in the process of starting to share with the CNSC does exactly that.
I'll give just one example to make my point. If you think about power, I made the comment that we have a passively safe design that doesn't require power. But we don't ever want to get to that situation. So of course the first line of defence is that you're connected to a power grid. If you lose the power grid because of an ice storm or something like that, then you have on-site diesel generators. If you lose those on-site diesel generators, you have backup batteries. If you lose those batteries, then of course you have natural circulation from gravity. Behind that, you have another layer of defence. So there are many layers here.
The key is that all of these designs are contained inside this safety containment underground. It's a very different approach. There's a shift from what I'll call a fragile design that is dependent upon outside help in a very short period of time to a very robust design with multiple layers of defence that has long-term coping capabilities so that it doesn't rely on immediate outside assistance. This is designed in from the beginning. Again, part of the reason was to create an option that is applicable to more remote locations where you don't have these kinds of support capabilities.