Nuclear Safety Culture: Catching up with the NRC

NRC Building

No big nuclear safety culture (NSC) news has come out of the Nuclear Regulatory Commission (NRC) so far in 2017 but there have been a few minor items worth mentioning.

New Leadership Model for NRC*

In 2015, the NRC staff proposed developing an explicit NRC leadership model that would complement the agency’s existing Principles of Good Regulation and Organizational Values (Principles).  The model’s attributes would include “empowering employees . . . creative thinking, innovation, and informed risk-taking . . . .”  The Commission disagreed, saying staff should focus on the characteristics of the Principles that support the identified organizational attributes.

Subsequent staff research identified performance improvement opportunities in the areas of employee decision-making, empowerment and consensus, employee creativity, informed risk-taking and innovation.  They are re-proposing an explicit leadership model that focuses on “Empowerment & Shared Leadership, Innovation & Risk Tolerance, Participative Decision-Making, Diversity in Thought, Receptivity to New Ideas and Thinking, and Collaboration & Teamwork . . . .”

This was a significant social science project to rationalize development of a highly specified management model.  Could it contribute to improving the agency’s “effectiveness, efficiency, and agility”?  Or is it, in essence, a regulation that would suck energy away from what NRC leaders need to do to succeed in a changing environment?  You be the judge.

NRC Lessons-Learned Program (LLP)**

This program was established after the Davis-Bessie fiasco to review agency, nuclear industry and outside incidents for lessons-learned that verify or could strengthen NRC processes.  Because a recognized lesson-learned leads to an NRC corrective action plan (i.e., resource usage) there is a high threshold for accepting proposed lessons-learned.  In the past year, six incidents ranging from the government response to the Flint, MI water crisis to two gripe papers published by the Union of Concerned Scientists passed a preliminary screen.  Ultimately, none of the items met the LLP minimum criteria although all were addressed by other NRC groups or processes.  

The LLP Oversight Board is considering whether the LLP should be discontinued, the threshold should be lowered, or the status quo approach should be continued.  Our concern is that the hard-headedness which characterizes the nuclear industry has also infected the LLP and prevents them from being open to actually learning anything from the experience of others.

Continued NSC Pressure on Problem Plants

Finally, NRC continues to (rightfully) squeeze plants with recognized NSC problems to fix such problems.  Arkansas Nuclear One (ANO) has a Confirmatory Action Letter (CAL) that requires the plant to implement specific improvement steps, including establishing a NSC Observer function to monitor leader behavior and enhancing decision making to ensure NSC aspects are considered.***  We discussed ANO’s NSC problems at length on June 16, 2016.

Watts Bar received part 2 of an inspection report on plant performance in the areas of NSC and Safety Conscious Work Environment (SCWE).****  It was a continuation of the beat down they received in part 1 (which we reviewed on Nov. 14, 2016).  The major findings were site-wide challenges to Watts Bar’s SCWE and weaknesses in the criteria used to evaluate NSC standards.  The inspection team’s detailed findings were too numerous to list here but included disagreeing with the site’s interpretation of safety “pulsing” data, management relaxing the standards for evaluating NSC data, overly limited assessment of NSC survey results and weaknesses in the training for NSC monitors.  The report is worth reading to show what a diligent inspector sees when looking at the same plant-produced NSC data that management has been cherry-picking for positive results and trends.

Our Perspective

The first calendar quarter of 2017 looks like business as usual at the NRC, at least when it comes to NSC.  That’s probably as it should be; we really don’t want them to be too distracted by the downsizing and problems occurring in the U.S. commercial nuclear industry.  The agency is trying to figure out how to be more agile and, without saying so, looking forward to having to do the same work with fewer resources.  (While some costs, e.g., plant inspection activities, are variable and can scale down with the industry, our guess is much of their work/cost structure is more-or-less fixed.)

There was a safety culture session at the recent Regulatory Information Conference, which we will separately review.


*  Memo from V.M. McCree to NRC Commissioners, “Re-Examination of the Need for a U.S. Nuclear Regulatory Commission Leadership Model” (Feb. 6, 2017).  ADAMS ML16348A323.

**  Memo from V.M. McCree to NRC Commissioners, “Annual Report on the Lessons-Learned Program” (Feb. 17, 2017).  ADAMS ML16231A323.

***  Letter from T.R. Farnholtz (NRC) to R. Anderson (ANO), “Arkansas Nuclear One – NRC Component Design Bases Inspection and Confirmatory Action Letter Follow-up Inspection Report 05000313/2016008 AND 05000368/2016008” (Feb. 28, 2017), pp. A3-5/-6.  ADAMS ML17059D000.

****  Letter from J.T. Munday (NRC) to J.W. Shea (TVA), “Watts Bar Nuclear Plant – NRC Problem Identification and Resolution Inspection (Part 2); and Safety Conscious Work Environment Issue of Concern Follow-up; NRC Inspection Report 05000390/2016013, 05000391/2016013” (March 10, 2017), pp. 2, 13-16.  ADAMS ML17069A133.

Nuclear Safety Culture at the Department of Energy—An Update

We haven’t reported on the U.S. Department of Energy’s (DOE) safety culture (SC) in awhile.  Although there hasn’t been any big news lately, we can look at some individual facts and then connect the dots to say something about SC.

Let’s start with some high-level good news.  In late 2016 DOE announced it had conducted its 100th SC training class for senior leaders of both federal and contractor entities across the DOE complex.*  The class focuses on teaching leaders the why and how of maintaining a collaborative workplace and Safety Conscious Work Environment (SCWE), and fostering trust in the work environment. 

Now let’s turn to a more localized situation.  In Feb 2014, a storage drum burst at the DOE’s Waste Isolation Pilot Plant (WIPP) in New Mexico, resulting in a small release of radioactive material.  The drum burst because a sorbent added to the waste had been changed without considering the difference in chemical properties.**  This has been an expensive incident.  The plant has been closed for over three years; it was authorized to reopen in Jan 2017 and shipments are scheduled to resume in April 2017.*** 

The drum that burst came from the Los Alamos National Laboratory (LANL).  The WIPP Recovery Plan envisions continuing the pre-incident practice of the waste generators being responsible for correctly packing their waste: “All waste generators will have rigorous characterization, treatment, and packaging processes and procedures in place to ensure compliance with WIPP Waste Acceptance Criteria [WAC].”****  As we said in our May 3, 2016 post: “For this approach to work, WAC compliance by the waste generators . . . must be completely effective and 100% reliable.”  In the same post, we reported the Defense Nuclear Facilities Safety Board (DNFSB) had recognized this weak link in the chain.  However, because DNFSB cannot force changes it could only recommend that DOE “explore defense-in-depth measures that enhance WIPP’s capability to detect and respond to problems caused by unexpected failures in the WAC compliance program.”

As described in the current WAC, WIPP’s “defense-in-depth” appears to be limited to the local DOE office and the WIPP contractor performing Generator Site Technical Reviews, which cover sites’ implementation of WIPP requirements.*****  These reviews are supposed to assure that deficiencies are detected and noncompliant shipments are avoided but it’s not clear if any physical surveillance is involved or if this is strictly a paperwork exercise.

The foregoing is important because it ties to SC.  Firstly, WIPP has had SC issues, in fact, a deficient SC was identified as contributing to shortcomings in the handling of the aftermath of the drum explosion.  (We reviewed this in detail on May 3 and May 5, 2014.)  WIPP SC is supposedly better now: “NWP [the WIPP contractor] has made continuous improvements in their safety culture and has really embraced the recommendations provided in the 2015 review, as well as subsequent reviews and surveys.”^  Secondly, other SC problems, too myriad to even list here, have arisen throughout the DOE complex over the years.  (Click on the DOE label to see our reports on such problems.)

Finally, we present a recent data point for LANL.  In DOE’s report on criticality safety infractions and program non-compliances for FY 2016, LANL had the most such incidents, by far, of the DOE’s 24 sites and projects.^^  Most of the non-compliances were self-identified.  Now does this evidence a strong SC that recognizes and reports its problems or a weak SC that allows the problems to occur in the first place?  You be the judge.

Our Perspective

Through initiatives such as SC training, it appears that at the macro level, DOE is (finally) communicating that minimally complying with basic regulations for how organizations should treat employees is not enough; establishing trust, mainly through showing respect for employees’ efforts to raise safety questions and point out safety problems, is essential.  That’s a good thing.

But we see signs of weakness at the operational level, viz., between WIPP and its constellation of waste generators.  Although we are not fans of “Normal Accident” theory which says accidents are inevitable in tightly coupled, low slack environments, e.g., a nuclear power plant, we can appreciate the application of that mental model in the case of WIPP.  Historically, one feature of the DOE complex that has limited problems to specific locations is the weak coupling between facilities.  When every facility with bomb-making waste is shipping it to WIPP, tighter coupling is created in the overall waste management system.  Every waste generator’s SC can have an impact on WIPP’s safety performance.  The system does need more defense-in-depth.  At a minimum, WIPP should station resident inspectors at every waste generator site to verify compliance with the WAC.

Bottom line: DOE is trying harder in the SC space but their history does not inspire huge confidence going forward. 


*  “DOE Conducts 100th Safety Culture Training Class” (Dec. 29, 2016).

**  Organic kitty litter had been substituted for inorganic kitty litter.  See this Jan. 10, 2017 Forbes article for a good summary of the WIPP incident.

***  “WIPP Road Show Early Stops Planned in Carlsbad & Hobbs,” WIPP website (Feb. 27, 2017).  Retrieved March 7, 2017. 

****  DOE, “Waste Isolation Pilot Plant Recovery Plan,” Rev 0 (Sept. 30, 2014), p. 24.

*****  DOE, “Transuranic Waste Acceptance Criteria for the Waste Isolation Pilot Plant,” Rev 8.0 (July 5, 2016), pp. 20-21.

^  DOE, “Department of Energy Operational Readiness Review for the Waste Isolation Pilot Plant” (Dec. 2016), p. 33.

^^   DOE, “2016 Annual Metrics Report to the Defense Nuclear Facilities Safety Board – Nuclear Criticality Safety Programs” (Jan. 2017), p. 3.

Is TEPCO’s Nuclear Safety Culture Still Weak?

Cover of TEPCO Self-Assessment

Tokyo Electric Power Co. (TEPCO) recently conducted a self-assessment* (SA) to ascertain progress vis-à-vis the goals in their Nuclear Safety Reform Plan.  The SA covered both Fukushima Daiichi and the undamaged plants.  It was approved by TEPCO’s president and reported to the Nuclear Reform Monitoring Committee (NRMC), an independent group of experts that advises TEPCO’s board of directors.  The committee reviewed the SA and communicated their evaluation to the board.  This post reviews both the SA and committee documents focusing on findings and observations related to safety culture (SC).

The TEPCO Self-Assessment

Comments with actual or potential relevance for culture appear throughout the 20-page SA report and are summarized below.  It appears about half of the SA findings and concrete action plans could have some connection to organizational culture.

Scores of employees have received awards for achieving goals related to stronger nuclear safety culture (NSC) and senior managers have been emphasizing nuclear safety but weaknesses still exist in implementing all the traits of a strong NSC.  Unsafe behaviors with respect to industrial safety are being corrected and the need for stronger nuclear safety is being established.  However, communications to the worker level with respect to nuclear safety may be insufficient.  The importance of nuclear safety is emphasized in new employee training and in meetings with contractor representatives. (pp. 4-5)  This is a mixed bag in the part of the SA most likely to be concerned with SC, viz., “Management Reforms Prioritizing Nuclear Safety.”

The company is working on strengthening work processes to improve risk management but employees report processes are unchanged and no clear priorities are established, factors that may increase fatigue and decrease motivation, both of which challenge the development of NSC. (p. 6)

Stricter safety regulations are being implemented and are no longer resisted based on their cost or operating impact. At Fukushima, the emphasis when performing work has shifted from speed to risk reduction to proceed safely. (pp. 8-9)  All good news.

Daily meetings share information on operating experience and near-misses but the overall information set is not leveraged because it is not managed to lead to long-term improvements. (p. 10)  In other words, continuous improvement is still a goal, not a reality.

Training is good for teaching employees how to complete tasks but the curriculum is insufficient to cultivate and inculcate a high level of safety performance.  The need for a more systematic approach to training is recognized but has not been realized. (pp. 12-13)

Overall findings of the SA emphasize the need to enhance a questioning attitude, strengthen supervision, and upgrade education and training. (p. 20)

NRMC Report and Cover Letter

The NRMC reviewed the SA in a 7-page report.**  One improvement noted by the NRMC was “Safety culture awareness has permeated throughout the organization and has improved significantly.”  However, the first three items on the list of nine Recommendations deal with NSC:

“Consistent efforts should be made to build a strong nuclear safety culture and instill the nuclear safety culture in an organizational culture.  The need for formal training and/or professional facilitation for the managers should be evaluated to instill a strong safety culture in the organization. . . . a safety culture program should be developed to the same standards” for contractors. (p. 5) 

There is also a one-page cover letter to the report.  Its primary focus is SC:

“TEPCO has made significant progress but must not become complacent . . . . TEPCO should instill . . . a strong safety culture throughout the organization, . . . TEPCO is encouraged to take further actions for the safety culture alignment at all levels of the organization . . .”

Our Perspective

SC and NSC occupy much of the space in all these documents.  What should we make of that, if anything?  One possibility is SC is acceptable but can always be improved or strengthened.  After all, as the NRMC notes “any self-assessment process must be critical by nature and therefore should identify areas for future improvement.”

A darker possibility is that TEPCO’s SC is still weak.  The NRMC’s report doesn’t have the language we usually see in the typical U.S. NSC report which says or implies “The plant is operating safely (indicating the NSC is at least minimally acceptable) but has improvement opportunities.”  We have to ask the NRMC: Is TEPCO’s current NSC acceptable or not?  Everyone understands Fukushima Daiichi is not operating, in fact, it’s still a mess where finding a lost fuel rod is world-wide news, but are current clean-up efforts occurring in an adequately safety-conscious environment?  The disaster occurred in 2011; some of the shortcomings noted in the SA should have been squared away by now.

On a different note, how does the SA address some topics dear to us?  Goal conflict is addressed when safety is mentioned as the primary goal and improvements are being made without cost being a major consideration.  The corrective action program (CAP) is mentioned but only as a tool for implementing improvement in the operating experience program.  Decision making is not mentioned at all so we don’t know how safety is being integrated into the decision making process at any level.  Another mixed bag.

Bottom line: Is SC front and center in all these documents because it is not yet acceptable?


*  “Report on TEPCO’s Self-Assessment of Progress” (Jan. 2017).

**  Nuclear Reform Monitoring Committee, “Review of the TEPCO’s Self-Assessment Effort on Nuclear Safety Reform,” (Jan. 30, 2017).

***  Nuclear Reform Monitoring Committee, Cover letter to "Review of the TEPCO's Self-Assessment Effort on Nuclear Safety Reform," (Jan. 30, 2017).  The public versions of all these TEPCO documents are copy protected so quotes have been retyped.

Leadership, Decisions, Systems Thinking and Nuclear Safety Culture

AcciMap Excerpt

We recently read a paper* that echoes some of the themes we emphasize on Safetymatters, viz., leadership, decisions and a systems view.  Following is an excerpt from the abstract:

“Leadership is progressively being recognized as a key** factor in supporting successful performance across a range of domains. . . . the decisions and actions that characterize safety leadership thus become important emergent properties in the prevention of incidents, which should be considered within the context of the broader organizational system and not merely constrained to understanding events or conditions that shape performance at the ‘sharp end’.”  [emphasis added]

The authors go on to analyze decisions and actions after a mining incident (landslide) using a combination of three different schemes: Rasmussen’s Risk Management Framework (RMF) and corresponding AcciMap, and the Critical Decision Method (CDM).

The RMF describes work systems as comprised of various levels and argues that safety performance is affected by decisions and actions at all levels from politicians in the external environment down through company executives and managers and finally to individual workers.  Rasmussen’s AcciMap is an expansive causal diagram for an accident or incident that displays the contributions (or omissions) at each level in the RMF and their connections.

CDM uses semi-structured interviews to obtain information about how individuals formulate their decisions, including context such as background knowledge and immediate influencing factors.  Consistent with the RMF, case study interviews were conducted with individuals at different organizational levels.  CDM data were used to construct the AcciMap.

We won’t go into the details of the analysis but it identified over a dozen key decisions made at different organizational levels before and during the incident; most were connected to at least one other key decision.  The AcciMap illustrates decisions and communications across multiple levels and thus provides a useful picture of how an organization anticipates and responds to an unusual situation.

Our Perspective

The authors argue, and we agree, that this type of analysis provides greater detail and insight into the performance of an organization’s safety management system than traditional accident investigations (especially those focused on finding someone to blame).

This article does not specifically discuss culture.  But the body of decisions an organization produces is the strongest evidence and most visible artifact of its culture.  Organizational decisions are far more important than responses to surveys or interviews where people can report what they believe (or hope) the culture is, or what they think their audience wants to hear.

We like that RMF and AcciMap are agnostic: they can be used to analyze either “what went wrong” or “what went right” scenarios.  (The case study was in the latter category because no one was hurt in the incident.)  If an assessor is looking at a sample of decisions to infer a nuclear organization’s culture, most of those decisions will have had positive (or at least no negative) consequences.

The authors are Australian academics but this short (8 pages total) paper is quite readable and a good introduction to CDM and Rasmussen’s constructs.  The references include people whose work we have positively reviewed on Safetymatters, including Dekker, Hollnagel, Leveson and Reason.

Bottom line: There is nothing about culture or nuclear here, but the overall message reinforces our beliefs about how to think about Nuclear Safety Culture.


*  S-L Donovana, P.M. Salmonb and M.G. Lennéa, “The leading edge: A systems thinking methodology for assessing safety leadership,” Procedia Manufacturing 3 (2015), pp. 6644–6651.  Available at sciencedirect.com; retrieved Jan. 19, 2017.

**  Note they do not say “one and only” or even “most important.”

Nuclear Safety Culture and the Shrinking U.S. Nuclear Plant Population

In the last few years, nuclear plant owners have shut down or scheduled for shutdown 17 units totaling over 14,000 MW.  Over half of these units had (or have) nuclear safety culture (NSC) issues sufficiently noteworthy to warrant mention here on Safetymatters.  We are not saying that NSC issues alone have led to the permanent shutdown of any plant, but such issues often accompany poor decision-making that can hasten a plant’s demise.  Following is a roll call of the deceased or endangered plants.

Plants with NSC issues

NSC issues provide windows into organizational behavior; the sizes of issues range from isolated problems to systemic weaknesses.

FitzPatrick

This one doesn’t exactly belong on the list.  Entergy scheduled it for shutdown in Jan. 2017 but instead it will likely be purchased by a white knight, Exelon, in a transaction brokered by the governor of New York.  With respect to NSC, in 2012 FitzPatrick received a Confirmatory Order (CO) after the NRC discovered violations, the majority of which were willful, related to adherence to site radiation protection procedures. 

Fort Calhoun

This plant shut down on Oct. 24, 2016.  According to the owner, the reason was “market conditions.”  It’s hard for a plant to be economically viable when it was shut down for over two years because of scheduled maintenance, flooding, a fire and various safety violations.  The plant kept moving down the NRC Action Matrix which meant more inspections and a third-party NSC assessment.  A serious cultural issue was how the plant staff’s perception of the Corrective Action Program (CAP) had evolved to view the CAP as a work management system rather than the principal way for the plant to identify and fix its problems.  Click on the Fort Calhoun label to pull up our related posts.

Indian Point 2 and 3

Units 2 and 3 are scheduled to shut down in 2020 and 2021, respectively.  As the surrounding population grew, the political pressure to shut them down also increased.  A long history of technical and regulatory issues did not inspire confidence.  In NSC space, they had problems with making incomplete or false statements to the NRC, a cardinal sin for a regulated entity.  The plant received a Notice of Violation (NOV) in 2015 for providing information about a licensed operator's medical condition that was not complete and accurate; they received a NOV in 2014 because a chemistry manager falsified test results.  Our May 12, 2014 post on the latter event is a reader favorite. 

Palisades

This plant had a long history of technical and NSC issues.  It is scheduled for shutdown on Oct. 1, 2018.  In 2015 Palisades received a NOV because it provided information to the NRC that was not complete and accurate; in 2014 it received a CO because a security manager assigned a person to a role for which he was not qualified; in 2012 it received a CO after an operator left the control room without permission and without performing a turnover to another operator.  Click on the Palisades label to pull up our related posts.

Pilgrim

This plant is scheduled for shutdown on May 31, 2019.  It worked its way to column 4 of the Action Matrix in Sept. 2015 and is currently undergoing an IP 95003 inspection, including an in-depth evaluation of the plant’s CAP and an independent assessment of the plant’s NSC.  In 2013, Pilgrim received a NOV because it provided information to the NRC that was not complete and accurate; in 2005 it received a NOV after an on-duty supervisor was observed sleeping in the control room.

San Onofre 2 and 3

These units ceased operations on Jan. 1, 2012.  The proximate cause of death was management incompetence: management opted to replace the old steam generators (S/Gs) with a large, complex design that the vendor had never fabricated before.  The new S/Gs were unacceptable in operation when tube leakage occurred due to excessive vibrations.  NSC was never anything to write home about either: the plant was plagued for years by incidents, including willful violations, and employees claiming they feared retaliation if they reported or discussed such incidents.

Vermont Yankee

This plant shut down on Dec. 29, 2014 ostensibly for “economic reasons” but it had a vociferous group of critics calling for it to go.  The plant evidenced a significant NSC issue in 2009 when plant staff parsed an information request to the point where they made statements that were “incomplete and misleading” to state regulators about tritium leakage from plant piping.  Eleven employees, including the VP for operations, were subsequently put on leave or reprimanded.  Click on the Vermont Yankee label to pull up our related posts.

Plant with no serious or interesting NSC issues 

The following plants have not appeared on our NSC radar in the eight years we’ve been publishing Safetymatters.  We have singled out a couple of them for extremely poor management decisions.

Crystal River basically committed suicide when they tried to create a major containment penetration on their own and ended up with a delaminating containment.  It ceased operations on Sept. 26, 2009.

Kewaunee shut down on May 7, 2013 for economic reasons, viz., the plant owner apparently believed their initial 8-year PPA would be followed by equal or even higher prices in the electricity market.  The owner was wrong.

Rounding out the list, Clinton is scheduled to shut down June 1, 2017; Diablo Canyon 1 and 2 will shut down in 2024 and 2025, respectively; Oyster Creek is scheduled to shut down on June 1, 2019; and Quad Cities 1 and 2 are scheduled to shut down on June 1, 2018 — all for business reasons.

Our Perspective

Bad economics (low natural gas prices, no economies of scale for small units) were the key drivers of these shutdown decisions but NSC issues and management incompetence played important supporting roles.  NSC problems provide ammunition to zealous plant critics but, more importantly, also create questions about plant safety and viability in the minds of the larger public.

Reflections on Nuclear Safety Culture for the New Year

©iStockphoto.com

The start of a new year is an opportunity to take stock of the current situation in the U.S. nuclear industry and reiterate what we believe with respect to nuclear safety culture (NSC).

For us, the big news at the end of 2016 was Entergy’s announcement that Palisades will be shutting down on Oct. 1, 2018.*  Palisades has been our poster child for a couple of things: (1) Entergy’s unwillingness or inability to keep its nose clean on NSC issues and (2) the NRC’s inscrutable decision making on when the plant’s NSC was either unsatisfactory or apparently “good enough.”

We will have to find someone else to pick on but don’t worry, there’s always some new issue popping up in NSC space.  Perhaps we will go to France and focus on the current AREVA and Électricité de France imbroglio which was cogently summarized in a Power magazine editorial: “At the heart of France’s nuclear crisis are two problems.  One concerns the carbon content of critical steel parts . . . manufactured or supplied by AREVA . . . The second problem concerns forged, falsified, or incomplete quality control reports about the critical components themselves.”**  Anytime the adjectives “forged” or “falsified” appear alongside nuclear records, the NSC police will soon be on the scene.  

Why do NSC issues keep arising in the nuclear industry?  If NSC is so important, why do organizations still fail to fix known problems or create new problems for themselves?  One possible answer is that such issues are the occasional result of the natural functioning of a low-tolerance, complex socio-technical system.  In other words, performance may drift out of bounds in the normal course of events.  We may not be able to predict where such issues will arise (although the missed warning signals will be obvious in retrospect) but we cannot reasonably expect they can be permanently eliminated from the system.  In this view, an NSC can be acceptably strong but not 100% effective.

If they are intellectually honest, this is the implicit mental model that most NSC practitioners and “experts” utilize even though they continue to espouse the dogma that more engineering, management, leadership, oversight, training and sanctions can and will create an actual NSC that matches some ideal NSC.  But we’ve known for years what an ideal NSC should look like, i.e., its attributes, and how responsibilities for creating and maintaining such a culture should be spread across a nuclear organization.***  And we’re still playing Whac-A-Mole.

At Safetymatters, we have promoted a systems view of NSC, a view that we believe provides a more nuanced and realistic view of how NSC actually works.  Where does NSC live in our nuclear socio-technical system?  Well, it doesn’t “live” anywhere.  NSC is, to some degree, an emergent property of the system, i.e., it is visible because of the ongoing functioning of other system components.  But that does not mean that NSC is only an effect or consequence.  NSC is both a consequence and a cause of system behavior.  NSC is a cause through the way it affects the processes that create hard artifacts, such as management decisions or the corrective action program (CAP), softer artifacts like the leadership exhibited throughout an organization, and squishy organizational attributes like the quality of hierarchical and interpersonal trust that permeates the organization like an ether or miasma. 

Interrelationships and feedback loops tie NSC to other organizational variables.  For example, if an organization fixes its problems, its NSC will appear stronger and the perception of a strong NSC will influence other organizational dynamics.  This particular feedback loop is generally reinforcing but it’s not some superpower, as can be seen in a couple of problems nuclear organizations may face: 

Why is a CAP ineffective?  The NSC establishes the boundaries between the desirable, acceptable, tolerable and unacceptable in terms of problem recognition, analysis and resolution.  But the strongest SC cannot compensate for inadequate resources from a plant owner, a systemic bias in favor of continued production****, a myopic focus on programmatic aspects (following the rules instead of searching for a true answer) or incompetence in plant staff. 

Why are plant records falsified?  An organization’s party line usually pledges that the staff will always be truthful with customers, regulators and each other.  The local culture, including its NSC, should reinforce that view.  But fear is always trying to slip in through the cracks—fear of angering the boss, fear of missing performance targets, fear of appearing weak or incompetent, or fear of endangering a plant’s future in an environment that includes the plant’s perceived enemies.  Fear can overcome even a strong NSC.

Our Perspective

NSC is real and complicated but it is not mysterious.  Most importantly, NSC is not some red herring that keeps us from seeing the true causes of underlying organizational performance problems.  Safetymatters will continue to offer you the information and insights you need to be more successful in your efforts to understand NSC and use it as a force for better performance in your organization.

Your organization will not increase its performance in the safety dimension if it continues to apply and reprocess the same thinking that the nuclear industry has been promoting for years.  NSC is not something that can be directly managed or even influenced independent of other organizational variables.  “Leadership” alone will not fix your organization’s problems.  You may protect your career by parroting the industry’s adages but you will not move the ball down the field without exercising some critical and independent thought.

We wish you a safe and prosperous 2017.


*  “Palisades Power Purchase Agreement to End Early,” Entergy press release (Dec. 8,2016).

**  L. Buchsbaum, “France’s Nuclear Storm: Many Power Plants Down Due to Quality Concerns,” Power (Dec. 1, 2016).  Retrieved Jan. 4, 2017.

***  For example, take a look back at INSAG-4 and NUREG-1756 (which we reviewed on May 26, 2015).

****  We can call that the Nuclear Production Culture (NPC).

Canadian Draft Regulation on Nuclear Safety Culture

Draft REGDOC cover

The Canadian Nuclear Safety Commission (CNSC) has published a draft regulatory document REGDOC-2.1.2, “Safety Culture” for comment*  The REGDOC will be a requirement for nuclear power plants and provide guidance for other nuclear entities and activities.  

The REGDOC establishes “requirements and guidance for fostering and assessing safety culture.” (p. 1)  The CNSC’s purpose is to promote a healthy safety culture (SC) which they say “is a key factor in reducing the likelihood of safety-related events and mitigating their potential impact, and in continually improving safety performance.” (ibid.)

Section 2 specifies five characteristics of a healthy SC: Safety is a clearly recognized value, accountability for safety is clear, a learning organization is built around safety, safety is integrated into all activities in the organization, and a safety leadership process exists in the organization.  For each characteristic, the document lists observable indicators. 

Sections 3 and 4 describe how licensees should perform SC assessments.  Specifically, assessments should be empirical, valid, practical and functional.  Each of these three characteristics is fleshed out with relevant criteria.  The document goes on to discuss the mechanics of performing assessments: developing a communications strategy, defining the assessment framework, selecting team members, planning and conducting assessments, developing findings and recommendations, writing reports, etc.

Our Perspective

The REGDOC is clear and relatively brief.  None of the content is controversial or even new; the document is based on multiple International Atomic Energy Agency (IAEA) publications.  (14 of 15 references in the document are from IAEA.  The “Additional Information” page includes items from INPO, NEI and WANO.)

Here’s how the REGDOC addresses SC topics that are important to us:

Decision making - Satisfactory

The introduction to the SC characteristics says “The highest level of governing documentation should make safety the utmost priority – overriding the demands of production and project schedules . . .” (p. 4)  The specific SC indicators include “Timely decisions are made that reflect the value and relative priority placed on safety.” (ibid.)  “Workers are involved in risk assessment and decision-making processes.” (p. 5)  “A proactive and long-term approach to safety is demonstrated in decision making.” (p. 6)  We would have liked a more explicit treatment of safety-production-cost goal conflict but what the CNSC has included is OK.

Taking a systems view of SC - Unacceptable

This topic is only mentioned in a table of SC maturity model indicators that is in an appendix to the REGDOC.  The links between SC and other important organizational attributes must be inferred from the observable indicators.  There is no discussion of the interrelationship between SC and other important organizational attributes, e.g., the safety conscious work environment, management’s commitment to safety, or workers’ trust in management to do the right thing.

Rewards and compensation - Unacceptable 

The discussion is limited to workers.  What about senior management compensation and incentives?  How much are senior managers paid, if anything, for establishing and maintaining a healthy SC?

The discussion on performing assessments refers several times to a SC maturity model that is appended to the REGDOC.  The model has three stages of organizational maturity—requirement driven, goal driven and continually improving, along with specific observable behaviors associated with each stage.  The model can be used to “describe and interpret the organization’s safety culture, . . .” (p. 10)  Nowhere does the REGDOC explicitly state that stage 3 (a continually improving organization) is the desired configuration.  This is a glaring omission in the REGDOC.

Bottom line: If you keep up with IAEA’s SC-related publications, you don’t need to look at this draft REGDOC which adds zero value to our appreciation or understanding of SC.


*  Canadian Nuclear Safety Commission, draft regulatory document REGDOC-2.1.2, “Safety Culture” (Sept. 2016).  The CNSC is accepting public comments on the document until Jan. 31, 2017.