The Criminalization of Safety (Part 1)

US DOJ logo

Nuclear safety management and culture relies on nuclear personnel conducting themselves in accordance with espoused values and making safety the highest priority.  When failures occur individual workers may be (and often are) blamed but broader implications are generally portrayed as an organizational culture deficiency and addressed in that context.  

Only rarely does the specter of criminality enter the picture, requiring a level of malfeasance - intentional conduct or recklessness - that is beyond the boundaries of conventional safety culture. 

The potential for criminal liability raises several issues.  What is the nexus between safety culture and criminal behavior?  What is the significance of the increased frequency of criminal prosecutions following major accidents or scandals in nuclear and other industries?  And where does culpability really lie - with individuals? culture? the corporation? or the complex socio-technical systems within which individuals act?

If one has been paying close attention to the news fairly numerous examples of criminal prosecutions involving safety management issues across a variety of industries and regulatory bodies is occurring.  It is becoming quite a list of late.  We thought this would be an appropriate time to take stock of these trends and their implications for nuclear safety management.

Recent Experience

We have prepared a table* summarizing relevant experience from the nuclear and other high risk industries.  (The link is to a pdf file as it is impractical to display the complete table within this blog post.)  Below is a table snippet showing a key event: the criminal prosecutions associated with the Davis Besse reactor vessel head corrosion in 2001/2002. First Energy, the owner/operator, pleaded guilty to criminal charges and two lower level employees were found guilty at trial.  A third individual, a contractor working for First Energy, was acquitted at trial.

More currently high level executives of TEPCO, the owner/operator of the Fukushima plant in Japan, were charged, though the circumstances are a bit odd.  Prosecutors had twice declined to bring criminal charges but were ultimately overruled by a citizens panel.  The case is expected to be difficult to prove.  Nonetheless this is an attempt to hold the former TEPCO Chairman and heads of the nuclear division criminally accountable.

The only other recent examples in the U.S. nuclear industry that we could identify involved falsification of documents, in one instance by a chemistry manager at Indian Point and the other a security officer at River Bend.**  One has pleaded guilty and sentenced to probation; the other case has been referred to the U.S. Department of Justice (DOJ).

Looking beyond nuclear, the picture is dominated by several major operational accidents - the Deepwater Horizon drill rig explosion and the explosion of the Upper Big Branch coal mine owned by Massey Energy.  Deepwater resulted in guilty pleas by the three corporations involved in the drilling operation - BP, Transocean and Halliburton - with massive criminal and civil fines.  BP’s plea included felony manslaughter.  Several employees also faced criminal charges.  Two faced involuntary manslaughter charges in addition to violations of the Clean Water Act.  The manslaughter charges were later dropped by prosecutors.  One employee pleaded guilty to the Clean Water Act violations and was sentenced to probation, the other went to trial and was acquitted.

The Massey case is noteworthy in that criminal charges ultimately climbed the corporate ladder all the way to the CEO.  Ultimately he was acquitted of felony charges of securities fraud and making false statements, but he “was convicted of a single count of conspiring to violate federal safety standards; he was not convicted of any count holding him responsible for the 2010 accident at the Upper Big Branch mine.”***  It “is widely believed to be the first CEO of a major U.S. corporation to be convicted of workplace safety related charges following an industrial accident.”****  Three other individuals also pleaded or were found guilty of misdemeanor charges.

Next up are the auto companies, GM, Volkswagen and Mitsubishi.  The GM scandal involved the installation of faulty ignition switches in cars that subsequently resulted in a number of deaths.  GM entered into a plea agreement with DOJ admitting criminal wrongdoing and paid large monetary fines.  As of this time no criminal charges have been brought against GM employees.  VW and Mitsubishi have both admitted to manipulating fuel economy and emissions testing and there is speculation that other auto manufacturers could be in the same boat.  The investigations are ongoing at this time but criminal pleas at the corporate level are all but certain.

Last in this pantheon is the city of Flint water quality scandal.  The Attorney General of Michigan recently filed criminal charges against three individuals and promised “more charges soon”.  The interesting aspect here is that the three charged are all government workers - one for the city and two for the Michigan Department of Environmental Quality.  And the two state officials have been charged with misconduct in office, a felony.  Essentially regulators are being held accountable for their oversight.  As David Ullmann, a former chief of DOJ’s environmental crimes section, stated, “It’s extremely unusual and maybe unprecedented for state and local officials to be charged with criminal drinking water violations.”  This bears watching.

In Part 2 we will analyze the trends in these cases and draw some insights into the possible significance of efforts to criminalize safety performance.  In Part 3 we will offer our observations regarding implications for nuclear safety management and some thoughts on approaches to mitigate the need for criminalization.


*  Criminal Prosecutions of Safety Related Events (May 22, 2016).

**  We posted on the Indian Point incident on May 12, 2014 and the River Bend case on Feb. 20, 2015.

***  A. Blinder, "Mixed Verdict for Donald Blankenship, Ex-Chief of Massey Energy, After Coal Mine Blast," New York Times (Dec. 3, 2015 corrected Dec. 5, 2015).

****  K. Maher, "Former Massey Energy CEO Sentenced to 12 Months in Prison," Wall Street Journal (April 6, 2016).  The full article may only be accessible to WSJ subscribers.

Nuclear Safety Culture is Improving at the Waste Isolation Pilot Plant—Maybe

The WIPP

On Feb. 14, 2014, a drum containing radioactive waste exploded at the Department of Energy (DOE) Waste Isolation Pilot Plant (WIPP) resulting in the release of americium and plutonium into the environment.  In our May 3, 2014 review of the DOE’s phase 1 accident report, a weak safety culture (SC) was deemed a significant contributing factor to the incident.  The plant has yet to resume normal operations.

Over the last two years, DOE and Nuclear Waste Partnership (NWP, the prime contractor) have made efforts to strengthen the SC at the WIPP.  Following are two data points we can use to infer how much progress they’ve made.

Incentive Payment to NWP

In FY2015 NWP earned a performance fee* based on both objective and subjective criteria.  Overall, NWP received 85.7% of the total potential fee ($11,714K out of $13,665K.)
 
The objective portion comprised 75% of the total potential fee and NWP was awarded 89.7% of that amount ($9,194K).  Only one objective criterion appears related to SC, viz., “reducing preventive and corrective maintenance backlogs” and NWP received the full fee possible, $550K out of $550K.

The subjective portion comprised 25% of the total potential fee and NWP was awarded 73.7% of that amount ($2,520K).  There is more information about SC in this portion of the award fee determination document.  DOE said NWP’s performance on improving its safety programs reflected “a maturing nuclear safety culture with continuous improvements.”  However, there were signs of SC weakness in the Areas for Improvement including “The contractor did not provide sufficient objective evidence of closure of all of the corrective actions it submitted as complete in FY2015”; “The small number of self-assessments by the contractor in FY2015 was inadequate to measure performance” and “Recent improvements in the nuclear safety culture are slowly being realized in the safe execution of work . . .”

DNFSB Critique of WIPP's Upgraded Documented Safety Analysis 

A recent Defense Nuclear Facilities Safety Board (DNFSB) staff report** reviews the WIPP Documented Safety Analysis (DSA) currently being updated by NWP under the oversight of DOE.  The DNFSB report identifies one significant issue for DOE management attention, summarized below:

The Feb. 2014 explosion occurred because Los Alamos National Laboratory (LANL) shipped ignitable waste to WIPP even though the existing Waste Acceptance Criteria (WAC) prohibited such action.  Currently, other LANL-generated drums containing potentially ignitable waste are securely stored at WIPP.

The draft DSA does not analyze the possibility that some similar accident could occur involving a container arriving at WIPP in the future.  Instead, DOE and NWP argue that improvements to the WIPP WAC and/or WAC compliance program will reliably prevent problems in future waste receipts.  In other words, something that happened before will not happen again because WIPP will be watching for it.  For this approach to work, WAC compliance by the waste generators and WIPP inspectors must be completely effective and 100% reliable.  DNFSB recommends that DOE and NWP management “explore defense-in-depth measures that enhance WIPP’s capability to detect and respond to problems caused by unexpected failures in the WAC compliance program.”

Our Perspective

The performance fee awards indicate that NWP needs to keep working to strengthen its SC to an acceptable level.

The DSA issue is more troublesome.  What kind of effective SC would blow off (pun intended) its responsibility to consider the possibility of recurrence of exactly the kind of problem that occurred before and caused the WIPP to be shut down for over two years?  We criticize other organizations for over-analyzing the specifics of individual accidents while ignoring other possibilities, especially systemic issues, but in this case, NWP and DOE are not even reaching the lowest perceptible bar of repeat incident prevention.

We’ll give the DNFSB points for raising the DSA issue but take away some points because they didn’t make a straightforward recommendation that NWP and DOE complete a more thorough analysis of the specific hazard of another drum of prohibited waste slipping through the system and into the underground.

At best, we can say the SC at the WIPP is incrementally improved.  DOE has always taken a half-hearted approach to SC and their lack of commitment is visible here.


*  T. Shrader (DOE) to P. Breidenbach (NWP), "Contract DE-EM0001971 Nuclear Waste Partnership LLC - Award Fee Determination for the Period October 1, 2014 through September 30, 2015, and FY2015 Fee Determination Scorecard for Total Earned Award Fee and Performance Based Incentives" (April 12, 2016).

**  J.L. Connery (DNFSB) to E.J. Moniz (DOE), letter with DNFSB Staff Issue Report “Waste Isolation Pilot Plant Documented Safety Analysis” dated Jan. 13, 2016 attached (Mar. 28, 2016).

A Professor's Essay on Nuclear Safety Culture

Prof. Najmedin Meshkati recently published an article* that reviews how the Chernobyl and Fukushima disasters demonstrated the essential need for a strong safety culture (SC) in the nuclear industry.  The article is summarized below.

He begins by reminding us the root cause of the Chernobyl accident was a deficient SC, a problem that affected not only the Chernobyl plant but also permeated the entire Soviet nuclear ecosystem. 

Fukushima is characterized as an anthropogenic accident, i.e, caused by human action or inaction.  He contrasts the fate of TEPCO’s Fukushima Daiichi plant with the Tohoku Electric Power Company’s Onagawa plant.  Onagawa was closer to the earthquake epicenter than Fukushima and faced a taller tsunami but shut down safely and with limited damage.  The author concludes Tohoku had a stronger SC than TEPCO.  We reviewed Meshkati’s earlier paper comparing TEPCO and Tohoku on March 19, 2014.

He also mentions the 1961 SL-1 reactor accident** and the 1979 TMI accident.  Both presented the opportunity for SC lessons learned but they were obviously not taken to heart by all industry participants.

The author concludes with a cautionary note to newly expanding nuclear countries: human factors and SC are critical success factors “and operators’ individual mindfulness and improvisation potential need to be nurtured and cultivated by the organizations that operate such systems; and regulatory regimes should envision, encourage, and enforce them.”

Our Perspective

There is nothing new here.  The article reads like a reasonably well-researched paper prepared for a college senior seminar, with multiple linked references.***  Meshkati does have the advantage of having been “on the ground” at both Chernobyl and Fukushima but that experience does not inform this article beyond adding a bit of color to his description of the Chernobyl sarcophagus (a “temple of eternal doom”).  Overall, the article does not provide new information or insights for Safetymatters readers who have examined the accidents in any level of detail.

What’s interesting is the platform on which the article appeared.  The WorldPost is produced by The Huffington Post, a politically liberal news and opinion website, and the Berggruen Institute, a political and social think tank.  We would not have expected the HuffPost to be associated with an article that exhibits any faint pro-nuclear flavor, even one as vanilla as this.

We don’t celebrate the anniversaries of Chernobyl and Fukushima but we should certainly remember the events, especially when we see the nuclear industry hubris meter trending toward the red zone.


*  N. Meshkati, “Chernobyl’s 30th Anniversary (and Fukushima’s 5th): A Tale of Preventable Nuclear Accidents and the Vital Role of Safety Culture,” The WorldPost (April 22, 2016).

**  Stationary Low-Power Reactor Number One (SL-1) was a U.S. Army prototype small power reactor.  A Jan. 3, 1961 accident killed its three operators.

***  I looked at all the links but didn’t see anything new for the “must read” list.  However, you might quickly check them out if you are interested in these significant historical events.

Faked Radiation Reports at Two German Nuclear Plants: Bad Apples or Nuclear Safety Culture Problem?

Philippsburg

According to an article* on German news site The Local, workers at two EnBW** nuclear plants submitted reports for radiation checks that were never performed. 

At the Philippsburg plant, a single subcontractor had been submitting reports based on checks he never carried out.  The consequences were severe—the government has ordered a halt to EnBW’s plans to restart the unit.

At the permanently shutdown Biblis plant, a worker filed faked reports throughout 2014-15.

Our Perspective

Germany intends to shut down all its nuclear plants by 2022.  Perhaps a few employees are shutting down a little early.  Snark aside, maintaining a strong safety culture in the face of an anticipated shutdown (and subsequent job losses) is a significant challenge for any organization in any industry but it is especially acute in the nuclear space where the actions of a single distracted, unmotivated or alienated individual can lead to significant regulatory, political, public relations and/or physical plant problems.


*  “Inspectors faked safety checks at two nuclear plants,” The Local (April 15, 2016).

**  Energie Baden-Württemberg AG, a German electric utility company.

Is Entergy’s Nuclear Safety Culture Hurting the Company or the Industry?

Entergy Headquarters  Source: Nola.com

A recent NRC press release* announced a Confirmatory Order (CO) issued to Entergy Operations, Inc. following an investigation that determined workers at Waterford 3 failed to perform fire inspections and falsified records.  Regulatory action directed at an Entergy plant has a familiar ring and spurs us to look at various problems that have arisen in Entergy’s fleet over the years.  The NRC has connected the dots to safety culture (SC) in some cases while other problems suggest underlying cultural issues. 

Utility-Owned Plants

These plants were part of the utility mergers that created Entergy.

Arkansas Nuclear One (ANO)

ANO is currently in Column 4 of the NRC Action Matrix and subject to an intrusive IP 95003 inspection.  ANO completed an independent SC assessment.  We reviewed their problems on June 25, 2015 and concluded “. . . the ANO culture endorses a “blame the contractor” attitude, accepts incomplete investigations into actual events and potential problems, and is content to let the NRC point out problems for them.”

In 2013 ANO received a Notice of Violation (NOV) after an employee deliberately falsified documents regarding the performance of Emergency Preparedness drills and communication surveillances.**

Grand Gulf

We are not aware of any SC issues at Grand Gulf.

River Bend

In 2014 Entergy received a CO to document commitments made because of the willful actions of an unidentified River Bend security officer in March 2012.

(In 2014 the NRC Office of Investigations charged that a River Bend security officer had deliberately falsified training records in Oct. 2013.  It appears a subsequent NRC investigation did not substantiate that charge.***)

In 2012 River Bend received a NOV for operators in the control room accessing the internet in violation of an Entergy procedure.

In 2011 River Bend received a CO to document commitments made because an employee apparently experienced retaliatory action after asking questions related to job qualifications.  Corrective actions included Entergy reinforcing its commitment to a safety conscious work environment, reviewing Employee Concerns Program enhancements and conducting a plant wide SC survey.

In 1999 River Bend received a NOV for deliberately providing an NRC inspector with information that was incomplete and inaccurate.

Waterford 3

As noted in the introduction to this post, Waterford 3 recently received a CO because of failure to perform fire inspections and falsifying records.

Entergy Wholesale Plants

These plants were purchased by Entergy and are located outside Entergy’s utility service territory.

FitzPatrick

Entergy purchased FitzPatrick in 2000.

In 2012, FitzPatrick received a CO after the NRC discovered violations, the majority of which were willful, related to adherence to site radiation protection procedures.  Corrective actions included maintaining the SC processes described in NEI 09-07 “Fostering a Strong Nuclear Safety Culture.”

Entergy plans on closing the plant Jan. 27, 2017.

Indian Point

Entergy purchased Indian Point 3 in 2000 and IP2 in 2001.

In 2015 Indian Point received a NOV because it provided information to the NRC related to a licensed operator's medical condition that was not complete and accurate in all material respects.

In 2014 Indian Point received a NOV because a chemistry manager falsified test results.  The manager subsequently resigned and then Entergy tried to downplay the incident.  Our May 12, 2014 post on this event is a reader favorite.

During 2006-08 Indian Point received two COs and three NOVs for its failure to install backup power for the plant’s emergency notification system.

Palisades

Entergy purchased Palisades in 2007.

In 2015 Entergy received a NOV because it provided information to the NRC related to Palisades’ compliance with ASME Code acceptance criteria that was not complete and accurate in all material respects.

In 2014 Entergy received a CO because a Palisades security manager assigned a supervisor to an armed responder role for which he was not currently qualified (see our July 24, 2014 post).

Over 2011-12 a virtual SC saga played out at Palisades.  It is too complicated to summarize here but see our Jan. 30, 2013 post.

In 2012 Palisades received a CO after an operator left the control room without permission and without performing a turnover to another operator.  Corrective actions included conducting a SC assessment of the Palisades Operations department.

Pilgrim

Entergy purchased Pilgrim in 1999.

Like ANO, Pilgrim is also in column 4 of the Action Matrix.  They are in the midst of a three-phase IP 95003 inspection currently focused on corrective action program weaknesses (always a hot button issue for us); a plant SC assessment will be performed in the third phase.

In 2013, Pilgrim received a NOV because it provided information to the NRC related to medical documentation on operators that was not complete and accurate in all material respects.

In 2005 Pilgrim received a NOV after an on-duty supervisor was observed sleeping in the control room. 

Vermont Yankee

Entergy purchased Vermont Yankee in 2002.

During 2009, Vermont Yankee employees made “incomplete and misleading” statements to state regulators about tritium leakage from plant piping.  Eleven employees, including the VP for operations, were subsequently put on leave or reprimanded.  Click the Vermont Yankee label to see our multiple posts on this incident. 

Vermont Yankee ceased operations on Dec. 29, 2014.

Our Perspective

These cases involved behavior that was wrong or, at a minimum, lackadaisical.  It’s not a stretch to infer that a weak SC may have been a contributing factor even where it was not specifically cited.

Only three U.S. nuclear units are in column 4 of the NRC’s Action Matrix—and all three are Entergy plants.  Only TVA comes close to Entergy when it comes to being SC-challenged.

We can’t predict the future but it doesn’t take a rocket scientist to plot Entergy’s nuclear trajectory.  One plant is dead and the demise of another has been scheduled.  It will be no surprise if Indian Point goes next; it’s in a densely populated region, occasionally radioactively leaky and a punching bag for New York politicians.

Does Entergy’s SC performance inspire public trust and confidence in the company?  Does their performance affect people's perception of other plants in the industry?  You be the judge.


*  NRC press release, “NRC Issues Confirmatory Order to Entergy Operations, Inc.” (April 8, 2016).  ADAMS ML16099A090.

**  COs and NOVs are summarized from Escalated Enforcement Actions Issued to Reactor Licensees on the NRC website.

***  J.M. Rollins (NRC) to J. McCann (Entergy), Closure of Investigation 014-2014-046 (Jan. 25, 2016.)  ADAMS ML16025A141.

Safety Culture at the 2016 NRC Regulatory Information Conference

RIC program cover

The official evidence of the NRC’s interest in safety culture (SC) at the 2016 Regulatory Information Conference (RIC) consisted of a tabletop presentation on SC training initiatives and support materials.  The tabletop was available during the entire conference and the intent was to engage with participants and make them aware of the SC learning resources that the NRC published this past year.

At past RICs, SC merited a technical session slot in the program, one of thirty-to-forty such sessions at the conference.

Our Perspective

SC has never been an A-list topic at the RIC but we’ll allow that a constant human presence at a tabletop may provide greater opportunities for interacting with conference participants than a single technical session.

We believe SC should get more exposure and promotion at the RIC.  For example, the 2014 RIC had a very good SC panel with three companies that had been (or were still) on the NRC’s SC s___ list making presentations on their get-well efforts.  We reviewed that RIC on April 25, 2014.

Perhaps the NRC could dragoon a few Chief Nuclear Officers to come in and talk about their pay packages and how they are incentivized and rewarded for establishing and maintaining a strong SC.  Now that would be interesting.

Nuclear Safety Culture Problem at TVA: NRC Issues Chilling Effect Letter to Watts Bar

Watts Bar  Source: Wikipedia

The U.S. Nuclear Regulatory Commission (NRC) recently sent a “chilling effect letter”* (CEL) to the Tennessee Valley Authority (TVA) over NRC’s belief that reactor operators at TVA’s Watts Bar plant do not feel free to raise safety concerns because they fear retaliation and do not feel their concerns are being addressed.  The NRC questions whether the plant’s corrective action program (CAP) and Employee Concerns Program have been effective at identifying and resolving the operators’ concerns.  In addition, NRC is concerned that plant management is exercising undue influence over operators’ activities thereby compromising a safety-first environment in the control room.

TVA officials must respond to the NRC within 30 days with a plan describing how they will address the issues identified in the CEL.

What’s a Chilling Effect Letter?

“CELs are issued when the NRC has concluded that the work environment is “chilled,” (i.e., workers perceive that the licensee is suppressing or discouraging the raising of safety concerns or is not addressing such concerns when they are raised).”**

Our Perspective

The absence of fear of retaliation is the principal attribute of an effective safety conscious work environment (SCWE) which in turn is an important component of a strong safety culture (SC).  Almost all commercial nuclear plants in the U.S. have figured out how to create and maintain an acceptable SCWE.

TVA appears to be an exception and a slow learner.  This is not a new situation for them.  As the CEL states, “a Confirmatory Order (EA-09-009, EA-09-203) remains in effect to confirm commitments made by TVA for all three [emphasis added] nuclear stations to address past SCWE issues.”

We have reported multiple times on long-standing SC problems at another TVA plant, Browns Ferry.  And, as we posted on Apr. 25, 2014, Browns Ferry management even made a presentation on their SC improvement actions at the 2014 NRC Regulatory Information Conference.

NRC raised questions about the Watts Bar CAP.  As we have long maintained, CAP effectiveness (promptly responding to identified issues, accurately characterizing them and permanently fixing them) is a key artifact of SC and a visible indicator of SC strength.

As regular readers know, we believe executive compensation is another indicator of SC.  The recipient of the CEL is TVA’s Chief Nuclear Officer (CNO).  According to TVA’s most recent SEC 10-K,*** the CNO made about $2.1 million in FY 2015.  Almost $1 million of the total was short-term (annual) and long-term incentive pay.  The components of the CNO’s annual incentive plan included capability factor, forced outage rate, equipment reliability and budget performance—safety is not mentioned.****  The long-term plan included the wholesale rate excluding fuel, load not served and external measures that included an undefined “nuclear performance index.”  To the surprise of no one who follows these things, the CNO is not being specifically incentivized to create a SCWE or a strong SC.

Bottom line: This CEL is just another brick in the wall for TVA.   


*  C. Haney (NRC) to J.P. Grimes (TVA), “Chilled Work Environment for Raising and Addressing Safety Concerns at the Watts Bar Nuclear Plant” (Mar. 23, 2016) ADAMS ML16083A479.

**  D.J. Sieracki, “U.S. Nuclear Regulatory Commission Safety Culture Oversight,” IAEA  International Conference on Human and Organizational Aspects of Assuring Nuclear Safety (Feb. 24, 2016), p. 115 of “Programme and Abstracts.”

***  Tennessee Valley Authority SEC Form 10-K (annual report) for the fiscal year ended Sept. 30, 2015.  Executive compensation is discussed on pp. 152-77.

****  The calculation of the annual incentive plan payouts for named executives included a corporate multiplier based on six performance measures, one of which was safety performance based on the number of recordable injuries per hours worked, i.e., industrial safety.  The weights of the six components are not shown.