Wednesday, May 10, 2017

A Nordic Compendium on Nuclear Safety Culture

A new research paper* covers the challenges of establishing and improving nuclear safety culture (NSC) in a dynamic, i.e., project, environment.  The authors are Finnish and Swedish and it appears the problems of the Olkiluoto 3 plant inform their research interests.  Their summary and review of current NSC literature is of interest to us. 

They begin with an overall description of how organizational (and cultural) changes can occur in terms of direction, rate and scale.

Direction

Top-down (or planned) change relies on the familiar unfreeze-change-refreeze models of Kurt Lewin and Ed Schein.  Bottom-up (or emergent) change emphasizes self-organization and organizational learning.  Truly free form, unguided change leads to NSC being an emergent property of the organization.  As we know, the top-down approach is seldom, if ever, 100% effective because of frictional losses, unintended consequences or the impact of competing, emergent cultural currents.  In a nod to a systems perspective, the authors note organizational structures and behavior influence (and are influenced by) culture.

Rate

“Organizational change can also be distinguished by the rate of its occurrence, i.e, whether the change occurs abruptly or smoothly [italics added].” (p. 8)  We observe that most nuclear plants try to build on past success, hence they promote “continuous improvement” programs that don’t rattle the organization.  In contrast, a plant with major NSC problems sometimes receives shock treatment, often in the form of a new senior manager who is expected to clean things up.  New management systems and organizational structures can also cause abrupt change.

Scale

The authors identify four levels of change.  Most operating plants exhibit the least disruptive changes, called fine tuning and incremental adjustmentModular transformation attempts to change culture at the department level; corporate transformation is self-explanatory. 

The authors sound a cautionary note: “the more radical types of changes might not be easily initiated – or might not even be feasible, considering that safety culture is by nature a slowly and progressively changing phenomenon. The obvious condition where a safety-critical organization requires radical changes to its safety culture is when it is unacceptably unhealthy.” (p. 9)

Culture Change Strategies

The authors list seven specific strategies for improving NSC:

  • Change organizational structures,
  • Modify the behavior of a target group through, e.g. incentives and positive reinforcement,
  • Improve interaction and communication to build a shared culture,
  • Ensure all organizational members are committed to safety and jointly participate in its improvement,
  • Training,
  • Promote the concept and importance of NSC,
  • Recruit and select employees who will support a strong NSC.
This section includes a literature review for examples of the specific strategies.

Project Organizations

The nature of project organizations is discussed in detail including their time pressures, wide use of teams, complex tasks and a context of a temporary organization in a relatively permanent environment.  The authors observe that “in temporary organisations, the threat of prioritizing “production” over safety may occur more naturally than in permanent organizations.” (pp. 16-17)  Projects are not limited to building new plants; as we have seen, large projects (Crystal River containment penetration, SONGS steam generator replacement) can kill operating plants.

The balance of the paper covers the authors’ empirical work.

Our Perspective 


This is a useful paper because it provides a good summary of the host of approaches and methods that have been (and are being) applied in the NSC space.  That said, the authors offer no new insights into NSC practice.

Although the paper’s focus is on projects, basically new plant construction, people responsible for fixing NSC at problem plants, e.g., Watts Bar, should peruse this report for lessons they can apply that might help achieve the step function NSC improvements such plants need.


*  K.Viitanen, N. Gotcheva and C. Rollenhagen, “Safety Culture Assurance and Improvement Methods in Complex Projects – Intermediate Report from the NKS-R SC AIM” (Feb. 2017).  Thanks to Aili Hunt of the LinkedIn Nuclear Safety Culture group for publicizing this paper.

Wednesday, April 12, 2017

Nuclear Safety Culture at the 2017 NRC Regulatory Information Conference

NRC 2017 RIC
Nuclear Safety Culture (NSC) was assigned one technical session at the 2017 NRC Regulatory Information Conference (RIC).  The topic was maintaining a strong NSC during plant decommissioning.  This post reviews the session presentations and provides our perspective on the topic.

Nuclear Regulatory Commission (NRC)*

The presenter discussed the agency’s expectations that the requirements of the SC Policy Statement will continue to be met during decommissioning, recognizing that plant old-timers may experience issues with trust, commitment and morale while newcomers, often contractors, will need to be trained and managed to meet NSC standards going forward.  The presentation was on-target but contained no new information or insights.

International Atomic Energy Agency (IAEA)**

This presentation covered the IAEA documents that discuss NSC, viz., the General Safety Requirement “Leadership and Management for Safety,” and the Safety Guides “Application of the Management System for Facilities and Activities,” which covers NSC characteristics, and “The Management System for Nuclear Installations,” which covers NSC assessments, plus supporting IAEA Safety Reports and Technical Documents.  There was one slide covering decommissioning issues, none of which was new.

The slides were dense with turgid text; this presentation must have been excruciating to sit through.  The best part was IAEA did not attempt to add any value through some new approach or analysis, which always manages to muck up the delivery of any potentially useful information. 

Kewaunee***

The Kewaunee plant was shut down on May 7, 2013.  The shutdown announcement on Oct. 22, 2012 was traumatic for the staff and they went through several stages of grieving.  Management has worked to maintain transparency and an effective corrective action program, and retain people who can accept changing conditions.  It is a challenge for management to maintain a strong NSC as the plant transitions to long-term SAFSTOR.

It’s not surprising that Kewaunee is making the best of what is undoubtedly an unhappy situation for many of those involved.  The owner, Dominion Resources, has a good reputation in NSC space.

Vermont Yankee****

This plant was shut down on Dec. 29, 2014.  The site continued applying its process to monitor for NSC issues but some concerns still arose (problems in radiation practices, decline in industrial safety performance) that indicated an erosion in standards.  Corrective actions were developed and implemented.  A Site Review Committee provides oversight of NSC.

The going appears a little rougher at Vermont Yankee than Kewaunee.  This is not a surprise given both the plant and its owner (Entergy) have had challenges in maintaining a strong NSC. 

Our Perspective

The session topic reflects a natural life cycle: industrial facilities are built, operate and then close down.  But that doesn’t mean it’s painless to manage through the phase changes. 

In an operating plant, complacency is a major threat.  Complacency opens the door to normalization of deviation and other gremlins that move performance toward the edge of the envelope.  In the decommissioning phase, we believe loss of fear is a major threat.  Loss of fear of dramatic, even catastrophic radiological consequences (because the fuel has been off-loaded and the plant will never operate again) can lead to losing focus, lack of attention to procedural details, short cuts and other behaviors that can have significant negative consequences such as industrial accidents or mishandling of radioactive materials.

In a “Will the last person out please turn off the lights” environment, maintaining everyone’s focus on safety is challenging for people who operated the plant, often spending a large part of their careers there.  The lack of local history is a major reason to transfer work to specialty decommissioning contractors as quickly as possible. 

In 2016, NSC didn’t merit a technical session at the RIC; it was relegated to a tabletop presentation.  As the industry shrinks, we hope NSC doesn’t get downgraded to a wall poster.


*  D. Sieracki, “Safety Culture and Decommissioning,” 2017 RIC (Mar. 15, 2017).

**  A. Orrell, “Safety Culture and the IAEA International Perspectives,” 2017 RIC (Mar. 15, 2017).

***  S. Yeun, “Maintaining a Strong Safety Culture after Shutdown,” 2017 RIC (Mar. 15, 2017).

****  C. Chappell, “Safety Culture in Decommissioning: Vermont Yankee Experience,” 2017 RIC (Mar. 15, 2017).

Saturday, April 1, 2017

Totally Nude, Naked Nuclear Safety Culture

I admit it.  The title is a cheap April Fools trick to draw new, perhaps less conventional, visitors to Safetymatters.  The only thing you’ll see here is the naked truth about nuclear safety culture (NSC), which we have been preaching about for years.

We’ve repeatedly listed the ingredients for a strong NSC: decision-making that recognizes goal conflicts and establishes clear, consistent safety priorities; an effective corrective action program; a mental model of organizational functioning that considers interrelationships and feedback loops among key variables; a compensation plan that rewards safety performance; and leadership that walks the talk on NSC.

We’ve also said that, absent constant maintenance, NSC will invariably decay over time because of complacency and system dynamics.  Complacency leads to hubris (“It can’t happen here”) and opens the door for the drift toward failure that occurs with normalization of deviance and group think.  System dynamics include constant environmental adaptations, goal conflicts, shifting priorities, management incentives tilted toward production and cost achievements, and changing levels of intra-organizational trust. 

NSC in practice appears to have approached an asymptote to the ideal.  Problems still occur; currently Entergy, TVA and AREVA are in the hot seat.  We have to ask: Is the industry’s steady-state NSC a low-intensity war of Whac-a-Mole?  You be the judge.

Monday, March 27, 2017

Nuclear Safety Culture: Catching up with the NRC

NRC Building
No big nuclear safety culture (NSC) news has come out of the Nuclear Regulatory Commission (NRC) so far in 2017 but there have been a few minor items worth mentioning.

New Leadership Model for NRC*

In 2015, the NRC staff proposed developing an explicit NRC leadership model that would complement the agency’s existing Principles of Good Regulation and Organizational Values (Principles).  The model’s attributes would include “empowering employees . . . creative thinking, innovation, and informed risk-taking . . . .”  The Commission disagreed, saying staff should focus on the characteristics of the Principles that support the identified organizational attributes.

Subsequent staff research identified performance improvement opportunities in the areas of employee decision-making, empowerment and consensus, employee creativity, informed risk-taking and innovation.  They are re-proposing an explicit leadership model that focuses on “Empowerment & Shared Leadership, Innovation & Risk Tolerance, Participative Decision-Making, Diversity in Thought, Receptivity to New Ideas and Thinking, and Collaboration & Teamwork . . . .”

This was a significant social science project to rationalize development of a highly specified management model.  Could it contribute to improving the agency’s “effectiveness, efficiency, and agility”?  Or is it, in essence, a regulation that would suck energy away from what NRC leaders need to do to succeed in a changing environment?  You be the judge.

NRC Lessons-Learned Program (LLP)**

This program was established after the Davis-Bessie fiasco to review agency, nuclear industry and outside incidents for lessons-learned that verify or could strengthen NRC processes.  Because a recognized lesson-learned leads to an NRC corrective action plan (i.e., resource usage) there is a high threshold for accepting proposed lessons-learned.  In the past year, six incidents ranging from the government response to the Flint, MI water crisis to two gripe papers published by the Union of Concerned Scientists passed a preliminary screen.  Ultimately, none of the items met the LLP minimum criteria although all were addressed by other NRC groups or processes.  

The LLP Oversight Board is considering whether the LLP should be discontinued, the threshold should be lowered, or the status quo approach should be continued.  Our concern is that the hard-headedness which characterizes the nuclear industry has also infected the LLP and prevents them from being open to actually learning anything from the experience of others.

Continued NSC Pressure on Problem Plants

Finally, NRC continues to (rightfully) squeeze plants with recognized NSC problems to fix such problems.  Arkansas Nuclear One (ANO) has a Confirmatory Action Letter (CAL) that requires the plant to implement specific improvement steps, including establishing a NSC Observer function to monitor leader behavior and enhancing decision making to ensure NSC aspects are considered.***  We discussed ANO’s NSC problems at length on June 16, 2016.

Watts Bar received part 2 of an inspection report on plant performance in the areas of NSC and Safety Conscious Work Environment (SCWE).****  It was a continuation of the beat down they received in part 1 (which we reviewed on Nov. 14, 2016).  The major findings were site-wide challenges to Watts Bar’s SCWE and weaknesses in the criteria used to evaluate NSC standards.  The inspection team’s detailed findings were too numerous to list here but included disagreeing with the site’s interpretation of safety “pulsing” data, management relaxing the standards for evaluating NSC data, overly limited assessment of NSC survey results and weaknesses in the training for NSC monitors.  The report is worth reading to show what a diligent inspector sees when looking at the same plant-produced NSC data that management has been cherry-picking for positive results and trends.

Our Perspective

The first calendar quarter of 2017 looks like business as usual at the NRC, at least when it comes to NSC.  That’s probably as it should be; we really don’t want them to be too distracted by the downsizing and problems occurring in the U.S. commercial nuclear industry.  The agency is trying to figure out how to be more agile and, without saying so, looking forward to having to do the same work with fewer resources.  (While some costs, e.g., plant inspection activities, are variable and can scale down with the industry, our guess is much of their work/cost structure is more-or-less fixed.)

There was a safety culture session at the recent Regulatory Information Conference, which we will separately review.


*  Memo from V.M. McCree to NRC Commissioners, “Re-Examination of the Need for a U.S. Nuclear Regulatory Commission Leadership Model” (Feb. 6, 2017).  ADAMS ML16348A323.

**  Memo from V.M. McCree to NRC Commissioners, “Annual Report on the Lessons-Learned Program” (Feb. 17, 2017).  ADAMS
ML16231A323.

***  Letter from T.R. Farnholtz (NRC) to R. Anderson (ANO), “Arkansas Nuclear One – NRC Component Design Bases Inspection and Confirmatory Action Letter Follow-up Inspection Report 05000313/2016008 AND 05000368/2016008” (Feb. 28, 2017), pp. A3-5/-6.  ADAMS ML17059D000.

****  Letter from J.T. Munday (NRC) to J.W. Shea (TVA), “Watts Bar Nuclear Plant – NRC Problem Identification and Resolution Inspection (Part 2); and Safety Conscious Work Environment Issue of Concern Follow-up; NRC Inspection Report 05000390/2016013, 05000391/2016013” (March 10, 2017), pp. 2, 13-16.  ADAMS ML17069A133.

Wednesday, March 8, 2017

Nuclear Safety Culture at the Department of Energy—An Update

We haven’t reported on the U.S. Department of Energy’s (DOE) safety culture (SC) in awhile.  Although there hasn’t been any big news lately, we can look at some individual facts and then connect the dots to say something about SC.

Let’s start with some high-level good news.  In late 2016 DOE announced it had conducted its 100th SC training class for senior leaders of both federal and contractor entities across the DOE complex.*  The class focuses on teaching leaders the why and how of maintaining a collaborative workplace and Safety Conscious Work Environment (SCWE), and fostering trust in the work environment. 

Now let’s turn to a more localized situation.  In Feb 2014, a storage drum burst at the DOE’s Waste Isolation Pilot Plant (WIPP) in New Mexico, resulting in a small release of radioactive material.  The drum burst because a sorbent added to the waste had been changed without considering the difference in chemical properties.**  This has been an expensive incident.  The plant has been closed for over three years; it was authorized to reopen in Jan 2017 and shipments are scheduled to resume in April 2017.*** 

The drum that burst came from the Los Alamos National Laboratory (LANL).  The WIPP Recovery Plan envisions continuing the pre-incident practice of the waste generators being responsible for correctly packing their waste: “All waste generators will have rigorous characterization, treatment, and packaging processes and procedures in place to ensure compliance with WIPP Waste Acceptance Criteria [WAC].”****  As we said in our May 3, 2016 post: “For this approach to work, WAC compliance by the waste generators . . . must be completely effective and 100% reliable.”  In the same post, we reported the Defense Nuclear Facilities Safety Board (DNFSB) had recognized this weak link in the chain.  However, because DNFSB cannot force changes it could only recommend that DOE “explore defense-in-depth measures that enhance WIPP’s capability to detect and respond to problems caused by unexpected failures in the WAC compliance program.”

As described in the current WAC, WIPP’s “defense-in-depth” appears to be limited to the local DOE office and the WIPP contractor performing Generator Site Technical Reviews, which cover sites’ implementation of WIPP requirements.*****  These reviews are supposed to assure that deficiencies are detected and noncompliant shipments are avoided but it’s not clear if any physical surveillance is involved or if this is strictly a paperwork exercise.

The foregoing is important because it ties to SC.  Firstly, WIPP has had SC issues, in fact, a deficient SC was identified as contributing to shortcomings in the handling of the aftermath of the drum explosion.  (We reviewed this in detail on May 3 and May 5, 2014.)  WIPP SC is supposedly better now: “NWP [the WIPP contractor] has made continuous improvements in their safety culture and has really embraced the recommendations provided in the 2015 review, as well as subsequent reviews and surveys.”^  Secondly, other SC problems, too myriad to even list here, have arisen throughout the DOE complex over the years.  (Click on the DOE label to see our reports on such problems.)

Finally, we present a recent data point for LANL.  In DOE’s report on criticality safety infractions and program non-compliances for FY 2016, LANL had the most such incidents, by far, of the DOE’s 24 sites and projects.^^  Most of the non-compliances were self-identified.  Now does this evidence a strong SC that recognizes and reports its problems or a weak SC that allows the problems to occur in the first place?  You be the judge.

Our Perspective

Through initiatives such as SC training, it appears that at the macro level, DOE is (finally) communicating that minimally complying with basic regulations for how organizations should treat employees is not enough; establishing trust, mainly through showing respect for employees’ efforts to raise safety questions and point out safety problems, is essential.  That’s a good thing.

But we see signs of weakness at the operational level, viz., between WIPP and its constellation of waste generators.  Although we are not fans of “Normal Accident” theory which says accidents are inevitable in tightly coupled, low slack environments, e.g., a nuclear power plant, we can appreciate the application of that mental model in the case of WIPP.  Historically, one feature of the DOE complex that has limited problems to specific locations is the weak coupling between facilities.  When every facility with bomb-making waste is shipping it to WIPP, tighter coupling is created in the overall waste management system.  Every waste generator’s SC can have an impact on WIPP’s safety performance.  The system does need more defense-in-depth.  At a minimum, WIPP should station resident inspectors at every waste generator site to verify compliance with the WAC.

Bottom line: DOE is trying harder in the SC space but their history does not inspire huge confidence going forward. 


*  “DOE Conducts 100th Safety Culture Training Class” (Dec. 29, 2016).

**  Organic kitty litter had been substituted for inorganic kitty litter.  See this Jan. 10, 2017 Forbes article for a good summary of the WIPP incident.

***  “WIPP Road Show Early Stops Planned in Carlsbad & Hobbs,” WIPP website (Feb. 27, 2017).  Retrieved March 7, 2017. 

****  DOE, “Waste Isolation Pilot Plant Recovery Plan,” Rev 0 (Sept. 30, 2014), p. 24.

*****  DOE, “Transuranic Waste Acceptance Criteria for the Waste Isolation Pilot Plant,” Rev 8.0 (July 5, 2016), pp. 20-21.

^  DOE, “Department of Energy Operational Readiness Review for the Waste Isolation Pilot Plant” (Dec. 2016), p. 33.

^^   DOE, “2016 Annual Metrics Report to the Defense Nuclear Facilities Safety Board – Nuclear Criticality Safety Programs” (Jan. 2017), p. 3.

Tuesday, February 7, 2017

Is TEPCO’s Nuclear Safety Culture Still Weak?

Cover of TEPCO Self-Assessment
Tokyo Electric Power Co. (TEPCO) recently conducted a self-assessment* (SA) to ascertain progress vis-à-vis the goals in their Nuclear Safety Reform Plan.  The SA covered both Fukushima Daiichi and the undamaged plants.  It was approved by TEPCO’s president and reported to the Nuclear Reform Monitoring Committee (NRMC), an independent group of experts that advises TEPCO’s board of directors.  The committee reviewed the SA and communicated their evaluation to the board.  This post reviews both the SA and committee documents focusing on findings and observations related to safety culture (SC).

The TEPCO Self-Assessment

Comments with actual or potential relevance for culture appear throughout the 20-page SA report and are summarized below.  It appears about half of the SA findings and concrete action plans could have some connection to organizational culture.

Scores of employees have received awards for achieving goals related to stronger nuclear safety culture (NSC) and senior managers have been emphasizing nuclear safety but weaknesses still exist in implementing all the traits of a strong NSC.  Unsafe behaviors with respect to industrial safety are being corrected and the need for stronger nuclear safety is being established.  However, communications to the worker level with respect to nuclear safety may be insufficient.  The importance of nuclear safety is emphasized in new employee training and in meetings with contractor representatives. (pp. 4-5)  This is a mixed bag in the part of the SA most likely to be concerned with SC, viz., “Management Reforms Prioritizing Nuclear Safety.”

The company is working on strengthening work processes to improve risk management but employees report processes are unchanged and no clear priorities are established, factors that may increase fatigue and decrease motivation, both of which challenge the development of NSC. (p. 6)

Stricter safety regulations are being implemented and are no longer resisted based on their cost or operating impact. At Fukushima, the emphasis when performing work has shifted from speed to risk reduction to proceed safely. (pp. 8-9)  All good news.

Daily meetings share information on operating experience and near-misses but the overall information set is not leveraged because it is not managed to lead to long-term improvements. (p. 10)  In other words, continuous improvement is still a goal, not a reality.

Training is good for teaching employees how to complete tasks but the curriculum is insufficient to cultivate and inculcate a high level of safety performance.  The need for a more systematic approach to training is recognized but has not been realized. (pp. 12-13)

Overall findings of the SA emphasize the need to enhance a questioning attitude, strengthen supervision, and upgrade education and training. (p. 20)

NRMC Report and Cover Letter

The NRMC reviewed the SA in a 7-page report.**  One improvement noted by the NRMC was “Safety culture awareness has permeated throughout the organization and has improved significantly.”  However, the first three items on the list of nine Recommendations deal with NSC:

“Consistent efforts should be made to build a strong nuclear safety culture and instill the nuclear safety culture in an organizational culture.  The need for formal training and/or professional facilitation for the managers should be evaluated to instill a strong safety culture in the organization. . . . a safety culture program should be developed to the same standards” for contractors. (p. 5) 

There is also a one-page cover letter to the report.  Its primary focus is SC:

“TEPCO has made significant progress but must not become complacent . . . . TEPCO should instill . . . a strong safety culture throughout the organization, . . . TEPCO is encouraged to take further actions for the safety culture alignment at all levels of the organization . . .”

Our Perspective

SC and NSC occupy much of the space in all these documents.  What should we make of that, if anything?  One possibility is SC is acceptable but can always be improved or strengthened.  After all, as the NRMC notes “any self-assessment process must be critical by nature and therefore should identify areas for future improvement.”

A darker possibility is that TEPCO’s SC is still weak.  The NRMC’s report doesn’t have the language we usually see in the typical U.S. NSC report which says or implies “The plant is operating safely (indicating the NSC is at least minimally acceptable) but has improvement opportunities.”  We have to ask the NRMC: Is TEPCO’s current NSC acceptable or not?  Everyone understands Fukushima Daiichi is not operating, in fact, it’s still a mess where finding a lost fuel rod is world-wide news, but are current clean-up efforts occurring in an adequately safety-conscious environment?  The disaster occurred in 2011; some of the shortcomings noted in the SA should have been squared away by now.

On a different note, how does the SA address some topics dear to us?  Goal conflict is addressed when safety is mentioned as the primary goal and improvements are being made without cost being a major consideration.  The corrective action program (CAP) is mentioned but only as a tool for implementing improvement in the operating experience program.  Decision making is not mentioned at all so we don’t know how safety is being integrated into the decision making process at any level.  Another mixed bag.

Bottom line: Is SC front and center in all these documents because it is not yet acceptable?


*  “Report on TEPCO’s Self-Assessment of Progress” (Jan. 2017).

**  Nuclear Reform Monitoring Committee, “Review of the TEPCO’s Self-Assessment Effort on Nuclear Safety Reform,” (Jan. 30, 2017).


***  Nuclear Reform Monitoring Committee, Cover letter to "Review of the TEPCO's Self-Assessment Effort on Nuclear Safety Reform," (Jan. 30, 2017).  The public versions of all these TEPCO documents are copy protected so quotes have been retyped.

Friday, January 27, 2017

Leadership, Decisions, Systems Thinking and Nuclear Safety Culture

AcciMap Excerpt
We recently read a paper* that echoes some of the themes we emphasize on Safetymatters, viz., leadership, decisions and a systems view.  Following is an excerpt from the abstract:

Leadership is progressively being recognized as a key** factor in supporting successful performance across a range of domains. . . . the decisions and actions that characterize safety leadership thus become important emergent properties in the prevention of incidents, which should be considered within the context of the broader organizational system and not merely constrained to understanding events or conditions that shape performance at the ‘sharp end’.”  [emphasis added]

The authors go on to analyze decisions and actions after a mining incident (landslide) using a combination of three different schemes: Rasmussen’s Risk Management Framework (RMF) and corresponding AcciMap, and the Critical Decision Method (CDM).

The RMF describes work systems as comprised of various levels and argues that safety performance is affected by decisions and actions at all levels from politicians in the external environment down through company executives and managers and finally to individual workers.  Rasmussen’s AcciMap is an expansive causal diagram for an accident or incident that displays the contributions (or omissions) at each level in the RMF and their connections.

CDM uses semi-structured interviews to obtain information about how individuals formulate their decisions, including context such as background knowledge and immediate influencing factors.  Consistent with the RMF, case study interviews were conducted with individuals at different organizational levels.  CDM data were used to construct the AcciMap.

We won’t go into the details of the analysis but it identified over a dozen key decisions made at different organizational levels before and during the incident; most were connected to at least one other key decision.  The AcciMap illustrates decisions and communications across multiple levels and thus provides a useful picture of how an organization anticipates and responds to an unusual situation.

Our Perspective

The authors argue, and we agree, that this type of analysis provides greater detail and insight into the performance of an organization’s safety management system than traditional accident investigations (especially those focused on finding someone to blame).

This article does not specifically discuss culture.  But the body of decisions an organization produces is the strongest evidence and most visible artifact of its culture.  Organizational decisions are far more important than responses to surveys or interviews where people can report what they believe (or hope) the culture is, or what they think their audience wants to hear.

We like that RMF and AcciMap are agnostic: they can be used to analyze either “what went wrong” or “what went right” scenarios.  (The case study was in the latter category because no one was hurt in the incident.)  If an assessor is looking at a sample of decisions to infer a nuclear organization’s culture, most of those decisions will have had positive (or at least no negative) consequences.

The authors are Australian academics but this short (8 pages total) paper is quite readable and a good introduction to CDM and Rasmussen’s constructs.  The references include people whose work we have positively reviewed on Safetymatters, including Dekker, Hollnagel, Leveson and Reason.

Bottom line: There is nothing about culture or nuclear here, but the overall message reinforces our beliefs about how to think about Nuclear Safety Culture.


*  S-L Donovana, P.M. Salmonb and M.G. Lennéa, “The leading edge: A systems thinking methodology for assessing safety leadership,” Procedia Manufacturing 3 (2015), pp. 6644–6651.  Available at sciencedirect.com; retrieved Jan. 19, 2017.

**  Note they do not say “one and only” or even “most important.”

Monday, January 16, 2017

Nuclear Safety Culture and the Shrinking U.S. Nuclear Plant Population

In the last few years, nuclear plant owners have shut down or scheduled for shutdown 17 units totaling over 14,000 MW.  Over half of these units had (or have) nuclear safety culture (NSC) issues sufficiently noteworthy to warrant mention here on Safetymatters.  We are not saying that NSC issues alone have led to the permanent shutdown of any plant, but such issues often accompany poor decision-making that can hasten a plant’s demise.  Following is a roll call of the deceased or endangered plants.

Plants with NSC issues

NSC issues provide windows into organizational behavior; the sizes of issues range from isolated problems to systemic weaknesses.

FitzPatrick

This one doesn’t exactly belong on the list.  Entergy scheduled it for shutdown in Jan. 2017 but instead it will likely be purchased by a white knight, Exelon, in a transaction brokered by the governor of New York.  With respect to NSC, in 2012 FitzPatrick received a Confirmatory Order (CO) after the NRC discovered violations, the majority of which were willful, related to adherence to site radiation protection procedures. 

Fort Calhoun

This plant shut down on Oct. 24, 2016.  According to the owner, the reason was “market conditions.”  It’s hard for a plant to be economically viable when it was shut down for over two years because of scheduled maintenance, flooding, a fire and various safety violations.  The plant kept moving down the NRC Action Matrix which meant more inspections and a third-party NSC assessment.  A serious cultural issue was how the plant staff’s perception of the Corrective Action Program (CAP) had evolved to view the CAP as a work management system rather than the principal way for the plant to identify and fix its problems.  Click on the Fort Calhoun label to pull up our related posts.

Indian Point 2 and 3

Units 2 and 3 are scheduled to shut down in 2020 and 2021, respectively.  As the surrounding population grew, the political pressure to shut them down also increased.  A long history of technical and regulatory issues did not inspire confidence.  In NSC space, they had problems with making incomplete or false statements to the NRC, a cardinal sin for a regulated entity.  The plant received a Notice of Violation (NOV) in 2015 for providing information about a licensed operator's medical condition that was not complete and accurate; they received a NOV in 2014 because a chemistry manager falsified test results.  Our May 12, 2014 post on the latter event is a reader favorite. 

Palisades

This plant had a long history of technical and NSC issues.  It is scheduled for shutdown on Oct. 1, 2018.  In 2015 Palisades received a NOV because it provided information to the NRC that was not complete and accurate; in 2014 it received a CO because a security manager assigned a person to a role for which he was not qualified; in 2012 it received a CO after an operator left the control room without permission and without performing a turnover to another operator.  Click on the Palisades label to pull up our related posts.

Pilgrim

This plant is scheduled for shutdown on May 31, 2019.  It worked its way to column 4 of the Action Matrix in Sept. 2015 and is currently undergoing an IP 95003 inspection, including an in-depth evaluation of the plant’s CAP and an independent assessment of the plant’s NSC.  In 2013, Pilgrim received a NOV because it provided information to the NRC that was not complete and accurate; in 2005 it received a NOV after an on-duty supervisor was observed sleeping in the control room.

San Onofre 2 and 3

These units ceased operations on Jan. 1, 2012.  The proximate cause of death was management incompetence: management opted to replace the old steam generators (S/Gs) with a large, complex design that the vendor had never fabricated before.  The new S/Gs were unacceptable in operation when tube leakage occurred due to excessive vibrations.  NSC was never anything to write home about either: the plant was plagued for years by incidents, including willful violations, and employees claiming they feared retaliation if they reported or discussed such incidents.

Vermont Yankee

This plant shut down on Dec. 29, 2014 ostensibly for “economic reasons” but it had a vociferous group of critics calling for it to go.  The plant evidenced a significant NSC issue in 2009 when plant staff parsed an information request to the point where they made statements that were “incomplete and misleading” to state regulators about tritium leakage from plant piping.  Eleven employees, including the VP for operations, were subsequently put on leave or reprimanded.  Click on the Vermont Yankee label to pull up our related posts.

Plant with no serious or interesting NSC issues 


The following plants have not appeared on our NSC radar in the eight years we’ve been publishing Safetymatters.  We have singled out a couple of them for extremely poor management decisions.

Crystal River basically committed suicide when they tried to create a major containment penetration on their own and ended up with a delaminating containment.  It ceased operations on Sept. 26, 2009.

Kewaunee shut down on May 7, 2013 for economic reasons, viz., the plant owner apparently believed their initial 8-year PPA would be followed by equal or even higher prices in the electricity market.  The owner was wrong.

Rounding out the list, Clinton is scheduled to shut down June 1, 2017; Diablo Canyon 1 and 2 will shut down in 2024 and 2025, respectively; Oyster Creek is scheduled to shut down on June 1, 2019; and Quad Cities 1 and 2 are scheduled to shut down on June 1, 2018 — all for business reasons.

Our Perspective

Bad economics (low natural gas prices, no economies of scale for small units) were the key drivers of these shutdown decisions but NSC issues and management incompetence played important supporting roles.  NSC problems provide ammunition to zealous plant critics but, more importantly, also create questions about plant safety and viability in the minds of the larger public.

Friday, January 6, 2017

Reflections on Nuclear Safety Culture for the New Year

©iStockphoto.com
The start of a new year is an opportunity to take stock of the current situation in the U.S. nuclear industry and reiterate what we believe with respect to nuclear safety culture (NSC).

For us, the big news at the end of 2016 was Entergy’s announcement that Palisades will be shutting down on Oct. 1, 2018.*  Palisades has been our poster child for a couple of things: (1) Entergy’s unwillingness or inability to keep its nose clean on NSC issues and (2) the NRC’s inscrutable decision making on when the plant’s NSC was either unsatisfactory or apparently “good enough.”

We will have to find someone else to pick on but don’t worry, there’s always some new issue popping up in NSC space.  Perhaps we will go to France and focus on the current AREVA and Électricité de France imbroglio which was cogently summarized in a Power magazine editorial: “At the heart of France’s nuclear crisis are two problems.  One concerns the carbon content of critical steel parts . . . manufactured or supplied by AREVA . . . The second problem concerns forged, falsified, or incomplete quality control reports about the critical components themselves.”**  Anytime the adjectives “forged” or “falsified” appear alongside nuclear records, the NSC police will soon be on the scene.  

Why do NSC issues keep arising in the nuclear industry?  If NSC is so important, why do organizations still fail to fix known problems or create new problems for themselves?  One possible answer is that such issues are the occasional result of the natural functioning of a low-tolerance, complex socio-technical system.  In other words, performance may drift out of bounds in the normal course of events.  We may not be able to predict where such issues will arise (although the missed warning signals will be obvious in retrospect) but we cannot reasonably expect they can be permanently eliminated from the system.  In this view, an NSC can be acceptably strong but not 100% effective.

If they are intellectually honest, this is the implicit mental model that most NSC practitioners and “experts” utilize even though they continue to espouse the dogma that more engineering, management, leadership, oversight, training and sanctions can and will create an actual NSC that matches some ideal NSC.  But we’ve known for years what an ideal NSC should look like, i.e., its attributes, and how responsibilities for creating and maintaining such a culture should be spread across a nuclear organization.***  And we’re still playing Whac-A-Mole.

At Safetymatters, we have promoted a systems view of NSC, a view that we believe provides a more nuanced and realistic view of how NSC actually works.  Where does NSC live in our nuclear socio-technical system?  Well, it doesn’t “live” anywhere.  NSC is, to some degree, an emergent property of the system, i.e., it is visible because of the ongoing functioning of other system components.  But that does not mean that NSC is only an effect or consequence.  NSC is both a consequence and a cause of system behavior.  NSC is a cause through the way it affects the processes that create hard artifacts, such as management decisions or the corrective action program (CAP), softer artifacts like the leadership exhibited throughout an organization, and squishy organizational attributes like the quality of hierarchical and interpersonal trust that permeates the organization like an ether or miasma. 

Interrelationships and feedback loops tie NSC to other organizational variables.  For example, if an organization fixes its problems, its NSC will appear stronger and the perception of a strong NSC will influence other organizational dynamics.  This particular feedback loop is generally reinforcing but it’s not some superpower, as can be seen in a couple of problems nuclear organizations may face: 

Why is a CAP ineffective?  The NSC establishes the boundaries between the desirable, acceptable, tolerable and unacceptable in terms of problem recognition, analysis and resolution.  But the strongest SC cannot compensate for inadequate resources from a plant owner, a systemic bias in favor of continued production****, a myopic focus on programmatic aspects (following the rules instead of searching for a true answer) or incompetence in plant staff. 

Why are plant records falsified?  An organization’s party line usually pledges that the staff will always be truthful with customers, regulators and each other.  The local culture, including its NSC, should reinforce that view.  But fear is always trying to slip in through the cracks—fear of angering the boss, fear of missing performance targets, fear of appearing weak or incompetent, or fear of endangering a plant’s future in an environment that includes the plant’s perceived enemies.  Fear can overcome even a strong NSC.

Our Perspective

NSC is real and complicated but it is not mysterious.  Most importantly, NSC is not some red herring that keeps us from seeing the true causes of underlying organizational performance problems.  Safetymatters will continue to offer you the information and insights you need to be more successful in your efforts to understand NSC and use it as a force for better performance in your organization.

Your organization will not increase its performance in the safety dimension if it continues to apply and reprocess the same thinking that the nuclear industry has been promoting for years.  NSC is not something that can be directly managed or even influenced independent of other organizational variables.  “Leadership” alone will not fix your organization’s problems.  You may protect your career by parroting the industry’s adages but you will not move the ball down the field without exercising some critical and independent thought.

We wish you a safe and prosperous 2017.


*  “Palisades Power Purchase Agreement to End Early,” Entergy press release (Dec. 8,2016).

**  L. Buchsbaum, “France’s Nuclear Storm: Many Power Plants Down Due to Quality Concerns,” Power (Dec. 1, 2016).  Retrieved Jan. 4, 2017.

***  For example, take a look back at INSAG-4 and NUREG-1756 (which we reviewed on May 26, 2015).

****  We can call that the Nuclear Production Culture (NPC).