In the older Canadian licensing tradition, three special safety functions were designated — shut down, close the containment boundary, and cool the fuel. (These functions are universally recognized in international docu­ments and practice.) The unavailability of each system was required to be less than 10-3 per demand. Recognizing the primary importance of reactor shutdown after some abnormal occurrence, two independent shutdown systems were required after the first commercial 43-unit plant was installed at Pickering. Regular testing of each of the special safety systems was required during plant operation; test results were reported to the regulatory agency in order to ensure that each unavailability requirement was being met. (In practice they were not always met; subsequent effort then imme­diately became an action item on the part of the operating organization.)