The start of a new year is an opportunity to take stock of the current situation in the U.S. nuclear industry and reiterate what we believe with respect to nuclear safety culture (NSC).
For us, the big news at the end of 2016 was Entergy’s announcement that Palisades will be shutting down on Oct. 1, 2018.* Palisades has been our poster child for a couple of things: (1) Entergy’s unwillingness or inability to keep its nose clean on NSC issues and (2) the NRC’s inscrutable decision making on when the plant’s NSC was either unsatisfactory or apparently “good enough.”
We will have to find someone else to pick on but don’t worry, there’s always some new issue popping up in NSC space. Perhaps we will go to France and focus on the current AREVA and Électricité de France imbroglio which was cogently summarized in a Power magazine editorial: “At the heart of France’s nuclear crisis are two problems. One concerns the carbon content of critical steel parts . . . manufactured or supplied by AREVA . . . The second problem concerns forged, falsified, or incomplete quality control reports about the critical components themselves.”** Anytime the adjectives “forged” or “falsified” appear alongside nuclear records, the NSC police will soon be on the scene.
Why do NSC issues keep arising in the nuclear industry? If NSC is so important, why do organizations still fail to fix known problems or create new problems for themselves? One possible answer is that such issues are the occasional result of the natural functioning of a low-tolerance, complex socio-technical system. In other words, performance may drift out of bounds in the normal course of events. We may not be able to predict where such issues will arise (although the missed warning signals will be obvious in retrospect) but we cannot reasonably expect they can be permanently eliminated from the system. In this view, an NSC can be acceptably strong but not 100% effective.
If they are intellectually honest, this is the implicit mental model that most NSC practitioners and “experts” utilize even though they continue to espouse the dogma that more engineering, management, leadership, oversight, training and sanctions can and will create an actual NSC that matches some ideal NSC. But we’ve known for years what an ideal NSC should look like, i.e., its attributes, and how responsibilities for creating and maintaining such a culture should be spread across a nuclear organization.*** And we’re still playing Whac-A-Mole.
At Safetymatters, we have promoted a systems view of NSC, a view that we believe provides a more nuanced and realistic view of how NSC actually works. Where does NSC live in our nuclear socio-technical system? Well, it doesn’t “live” anywhere. NSC is, to some degree, an emergent property of the system, i.e., it is visible because of the ongoing functioning of other system components. But that does not mean that NSC is only an effect or consequence. NSC is both a consequence and a cause of system behavior. NSC is a cause through the way it affects the processes that create hard artifacts, such as management decisions or the corrective action program (CAP), softer artifacts like the leadership exhibited throughout an organization, and squishy organizational attributes like the quality of hierarchical and interpersonal trust that permeates the organization like an ether or miasma.
Interrelationships and feedback loops tie NSC to other organizational variables. For example, if an organization fixes its problems, its NSC will appear stronger and the perception of a strong NSC will influence other organizational dynamics. This particular feedback loop is generally reinforcing but it’s not some superpower, as can be seen in a couple of problems nuclear organizations may face:
Why is a CAP ineffective? The NSC establishes the boundaries between the desirable, acceptable, tolerable and unacceptable in terms of problem recognition, analysis and resolution. But the strongest SC cannot compensate for inadequate resources from a plant owner, a systemic bias in favor of continued production****, a myopic focus on programmatic aspects (following the rules instead of searching for a true answer) or incompetence in plant staff.
Why are plant records falsified? An organization’s party line usually pledges that the staff will always be truthful with customers, regulators and each other. The local culture, including its NSC, should reinforce that view. But fear is always trying to slip in through the cracks—fear of angering the boss, fear of missing performance targets, fear of appearing weak or incompetent, or fear of endangering a plant’s future in an environment that includes the plant’s perceived enemies. Fear can overcome even a strong NSC.
Our Perspective
NSC is real and complicated but it is not mysterious. Most importantly, NSC is not some red herring that keeps us from seeing the true causes of underlying organizational performance problems. Safetymatters will continue to offer you the information and insights you need to be more successful in your efforts to understand NSC and use it as a force for better performance in your organization.
Your organization will not increase its performance in the safety dimension if it continues to apply and reprocess the same thinking that the nuclear industry has been promoting for years. NSC is not something that can be directly managed or even influenced independent of other organizational variables. “Leadership” alone will not fix your organization’s problems. You may protect your career by parroting the industry’s adages but you will not move the ball down the field without exercising some critical and independent thought.
Back in June, the International Atomic Energy Agency (IAEA) hosted an International Conference on Operational Safety.* Conference sessions covered Peer Reviews, Corporate Management, Post-Fukushima Improvements, Operating Experience, Leadership and Safety Culture and Long Term Operation. Later, the IAEA published a summary of conference highlights, including conclusions in the session areas.** It reported the following with respect to safety culture (SC):
“No organization works in isolation: the safety culture of the operator is influenced by the safety culture of the regulator and vice versa. Everything the regulator says or does not say has an effect on the operator. The national institutions and other cultural factors affect the regulatory framework. Corporate leadership is integral to achieving and improving safety culture, the challenge here is that regulators are not always allowed to conduct oversight at the corporate management level.”
Whoa! This is an example of the kind of systemic thinking that we have been preaching for years. We wondered who said that so we reviewed all the SC presentations looking for clues. Perhaps not surprisingly, it was a bit like gold-mining: one has to crush a lot of ore to find a nugget.
Most of the ore for the quote was provided by a SC panelist who was not one of the SC speakers but a Swiss nuclear regulator (and the only regulator mentioned in the SC session program). Her slide bullets included “The regulatory body needs to take different perspectives on SC: SC as an oversight issue, impact of oversight on licensees’ SC, the regulatory body’s own SC, [and] Self-reflection on its own SC.” Good advice to regulators everywhere.
As far as we can tell, no presenter made the point that regulators seldom have the authority to oversee corporate management; perhaps that arose during the subsequent discussion.
SC Presentations
The SC presentations contained hearty, although standard fare. A couple were possibly more revealing, which we’ll highlight later.
The German, Japanese and United Kingdom presentations reviewed their respective SC improvement plans. In general these plans are focused on specific issues identified during methodical diagnostic investigations. The plan for the German Philippsburg plant focuses on specific management responsibilities, personnel attitudes and conduct at all hierarchy levels, and communications. The Japanese plan concentrates on continued recovery from the Fukushima disaster. TEPCO company-wide issues include Safety awareness, Engineering capability and Communication ability. The slides included a good system dynamics-type model. At EDF’s Heysham 2 in the UK, the interventions are aimed at improving management (leadership, decision-making), trust (just culture) and organizational learning. As a French operator of a UK plant, EDF recognizes they must tune interventions to the local organization’s core values and beliefs.
The United Arab Emirates presentation described a model for their new nuclear organization; the values, traits and attributes come right out of established industry SC guidelines.
The Entergy presenter parroted the NRC/INPO party line on SC definition, leadership responsibility, traits, attributes and myriad supporting activities. It’s interesting to hear such bold talk from an SC-challenged organization. Maybe INPO or the NRC “encouraged” him to present at the conference. (The NRC is not shy about getting licensees with SC issues to attend the Regulatory Information Conference and confess their sins.)
The Russian presentation consisted of a laundry list of SC improvement activities focused on leadership, personnel reliability, observation and cross-cultural factors (for Hanhikivi 1 in Finland). It was all top-down. There was nothing about empowering or taking advantage of individuals’ knowledge or experience. You can make your own inferences.
Management Presentations
We also reviewed the Management sessions for further clues. All the operator presenters were European and they had similar structures, with “independent” safety performance advisory groups at the plant, fleet and corporate levels. They all appeared to focus on programmatic strengths and weaknesses in the safety performance area. There was no indication any of the groups opined on management performance. The INPO presenter noted that SC is included in every plant and corporate evaluation and SC issues are highlighted in the INPO Executive Summary to a CEO.
Our Perspective
The IAEA press release writer did a good job of finding appealing highlights to emphasize. The actual presentations were more ordinary and about what you’d expect from anything involving IAEA: build the community, try to not offend anyone. For example, the IAEA SC presentation stressed the value in developing a common international SC language but acknowledged that different industry players and countries can have their own specific needs.
Bottom line: Read the summary and go to the conference materials if something piques your interest—but keep your expectations modest.
In April 1995 the American Nuclear Society (ANS) sponsored a nuclear safety culture (SC) conference in Vienna. This was a large undertaking, with over 80 presentations; the proceedings are almost 900 pages in length.* Presenters included industry participants, regulators, academics and consultants. 1995 was early in the post-Soviet era and the new openness (and concerns about Soviet reactors) led to a large number of presenters from Russia, Ukraine and Eastern Europe. This post presents some conference highlights on topics we emphasize on Safetymatters.
Decision Making
For us, decision making should be systemic, i.e., consider all relevant inputs and the myriad ways a decision can affect consequences. The same rigor should be applied to all kinds of decisions—finance, design, operations, resource allocation, personnel, etc. Safety should always have the highest priority and decisions should accord safety its appropriate consideration. Some presenters echoed this view.
“Safety was (and still is) seen as being vital to the success of the industry and hence the analysis and assessment of safety became an integral part of management decision making” (p. 41); “. . . in daily practice: overriding priority to safety is the principle, to be taken into account before making any decision” (p. 66); and “The complexity of operations implies a systemic decision process.” (p. 227)
The relationship between leadership and decisions was mentioned. “The line management are a very important area, as they must . . . realise how their own actions and decisions affect Safety Culture. The wrong actions, or perceived messages could undermine the work of the team leaders” (p. 186); “. . . statements alone do not constitute support; in the intermediate and long-term, true support is demonstrated by behavior and decision and not by what is said.” (p. 732)
Risk was recognized as a factor in decision making. “Risk culture yields insights that permit balanced safety vs.cost decisions to be made” (p. 325); “Rational decision making is based on facts, experience, cognitive (mental) models and expected outcomes giving due consideration to uncertainties in the foregoing and the generally probabilistic nature of technical and human matters. Conservative decision making is rational decision making that is risk-averse. A conservative decision is weighted in favor of risk control at the expense of cost.” (p. 435)
In sum, nuclear thought leaders knew what good decision making should look like—but we still see cases that do not live up to that standard.
Rewards
Rewards or compensation were mentioned by people from nuclear operating organizations. Incentive-based compensation was included as a key aspect of the TEPCO management approach (p. 551) and a nuclear lab manager recommended using monetary compensation to encourage cooperation between organizational departments. (p. 643) A presenter from a power plant said “A recognition scheme is in place . . . to recognise and reward individuals and teams for their contribution towards quality improvement and nuclear safety enhancement.” (p. 805)
Rewards were also mentioned by several presenters who did not come from power plants. For example, the reward system should stress safety (p. 322); rewards should be given for exhibiting a “caring attitude” about SC (p. 348) and to people who call attention to safety problems. (p. 527) On the flip side, a regulator complained about plants that rewarded behavior that might cause safety to erode. (pp. 651, 656)
Even in 1995 the presentations could have been stronger since INSAG-4** is so clear on the topic: “Importantly, at operating plants, systems of reward do not encourage high plant output levels if this prejudices safety. Incentives are therefore not based on production levels alone but are also related to safety performance.” (INSAG-4, p. 11) Today, our own research has shown that nuclear executives’ compensation often favors production.
Systems Approach
We have always favored nuclear organizational mental models that consider feedback loops, time delays, adaptation, evolution and learning—a systems approach. Presenters’ references to a system include “commercial, public, and military operators of complex high reliability socio-technical systems” (p. 260); “. . . assess the organisational, managerial and socio-technical influences on the Safety Culture of socio-technical systems such as nuclear power plants” (p. 308); “Within the complex system such as . . . [a] nuclear power plant there is a vast number of opportunities for failures to stay hidden in the system” (p. 541); and “It is proposed that the plant should be viewed as an integrated sociotechnical system . . .” (p. 541)
There are three system-related presentations that we suggest you read in their entirety; they have too many good points to summarize here. One is by Electricité de France (EdF) personnel (pp. 193-201), another by Constance Perin (pp. 330-336) and a third by John Carroll (pp. 338-345).
Here’s a sample, from Perin: “Through self-analysis, nuclear organizations can understand how they currently respond socially, culturally, and technically to such system characteristics of complexity, density, obscured signals, and delayed feedback in order to assure their capacities for anticipating, preventing, and recovering from threats to safety.” (p. 330) It could have been written yesterday.
The Role of the Regulator
By 1995 INSAG-4 had been published and generally accepted by the nuclear community but countries were still trying to define the appropriate role for the regulator; the topic merited a half-dozen presentations. Key points included the regulator (1) requiring that an effective SC be established, (2) establishing safety as a top-level goal and (3) performing some assessment of a licensee’ safety management system (either directly or part of ordinary inspection duties). There was some uncertainty about how to proceed with compliance focus vs. qualitative assessment.
Today, at least two European countries are looking at detailed SC assessment, in effect, regulating SC. In the U.S., the NRC issued a SC policy statement and performs back-door, de facto SC regulation through the “bring me another rock” approach.
So conditions have changed in regulatory space, arguably for the better when the regulator limits its focus to truly safety-significant activities.
Our Perspective
In 1995, some (but not all) people held what we’d call a contemporary view of SC. For example, “Safety culture constitutes a state of mind with regard to safety: the value we attribute to it, the priority we give it, the interest we show in it. This state of mind determines attitudes and behavior.” (p. 495)
But some things have changed. For example, several presentations mentioned SC surveys—their design, administration, analysis and implications. We now (correctly) understand that SC surveys are a snapshot of safety climate and only one input into a competent SC assessment.
And some things did not turn out well. For example, a TEPCO presentation said “the decision making process is governed by the philosophy of valuing harmony highly so that a conclusion preferred by all the members is chosen as far as possible when there are divided opinions.” (p. 583) Apparently harmony was so valued that no one complained that Fukushima site protection was clearly inadequate and essential emergency equipment was exposed to grave hazards.
** International Nuclear Safety Advisory Group, “Safety Culture,” Safety Series No. 75-INSAG-4, (Vienna: IAEA, 1991). INSAG-4 included a definition of SC, a description of SC components, and illustrative evidence that the components exist in a specific organization.
We recently came across a paper that should be of significant interest to nuclear safety decision makers. “Safety Management in a Competitiveness Context” was presented in March 2008 by Jean-Marie Rousseau of the Institut de Radioprotection et de Surete Nucleaire (IRSN). As the title suggests the paper examines the effects of competitive pressures on a variety of nuclear safety management issues including decision making and the priority accorded safety. Not surprisingly:
“The trend to ignore or to deny this phenomenon is frequently observed in modern companies.” (p. 7)
The results presented in the paper came about from a safety assessment performed by IRSN to examine safety management of EDF [Electricite de France] reactors including:
“How real is the ‘priority given to safety’ in the daily arbitrations made at all nuclear power plants, particularly with respect to the other operating requirements such as costs, production, and radiation protection or environmental constraints?” (p. 2)
The pertinence is clear as “priority given to safety” is the linchpin of safety culture policy and expected behaviors. In addition the assessment focused on decision-making processes at both the strategic and operational levels. As we have argued, decisions can provide significant insights into how safety culture is operationalized by nuclear plant management.
Rousseau views nuclear operations as a “highly complex socio-technical system” and his paper provides a brief review of historical data where accidents or near misses displayed indications of the impact of competing priorities on safety. The author notes that competitiveness is necessary just as is safety and as such it represents another risk that must be managed at organizational and managerial levels. This characterization is intriguing and merits further reflection particularly by regulators in their pursuit of “risk informed regulation”. Nominally regulators apply a conceptualization of risk that is hardware and natural phenomena centric. But safety culture and competitive pressures also could be justified as risks to assuring safety - in fact much more dynamic risks - and thus be part of the framework of risk informed regulation.* Often, as is the case with this paper, there is some tendency to assert that achievement of safety is coincident with overall performance excellence - which in a broad sense it is - but notwithstanding there are many instances where there is considerable tension - and potential risk.
Perhaps most intriguing in the assessment is the evaluation of EDF’s a posteriori analyses of its decision making processes as another dimension of experience feedback.** We quote the paper at length:
“The study has pointed out that the OSD***, as a feedback experience tool, provides a priori a strong pedagogic framework for the licensee. It offers a context to organize debates about safety and to share safety representations between actors, illustrated by a real problematic situation. It has to be noticed that it is the only tool dedicated to “monitor” the safety/competitiveness relationship.
"But the fundamental position of this tool (“not to make judgment about the decision-maker”) is too restrictive and often becomes “not to analyze the decision”, in terms of results and effects on the given situation.
"As the existence of such a tool is judged positively, it is necessary to improve it towards two main directions: - To understand the factors favouring the quality of a decision-making process. To this end, it is necessary to take into account the decision context elements such as time pressure, fatigue of actors, availability of supports, difficulties in identifying safety requirements, etc. - To understand why a “qualitative decision-making process” does not always produce a “right decision”. To this end, it is necessary to analyze the decision itself with the results it produces and the effects it has on the situation.” (p. 8)
We feel this is a very important aspect that currently receives insufficient attention. Decisions can provide a laboratory of safety management performance and safety culture actualization. But how often are decisions adequately documented, preserved, critiqued and shared within the organization? Decisions that yield a bad (reportable) result may receive scrutiny internally and by regulators but our studies indicate there is rarely sufficient forensic analysis - cause analyses are almost always one dimensional and hardware and process oriented. Decisions with benign outcomes - whether the result of “good” decision making or not - are rarely preserved or assessed. The potential benefits of detailed consideration of decisions have been demonstrated in many of the independent assessments of accidents (Challenger, Columbia, BP Texas Oil Refinery, etc.) and in research by Perin and others.
We would go a step further than proposed enhancements to the OSD. As Rousseau notes there are downsides to the routine post-hoc scrutiny of actual decisions - for one it will likely identify management errors even in the absence of a bad decision outcome. This would be one more pressure on managers already challenged by a highly complex decision environment. An alternative is to provide managers the opportunity to “practice” making decisions in an environment that supports learning and dialogue on achieving the proper balances in decisions - in other words in a safety management simulator. The industry requires licensed operators to practice operations decisions on a simulator for similar reasons - why not nuclear managers charged with making safety decisions?
* As the IAEA has noted, “A danger of concentrating too much on a quantitative risk value that has been generated by a PSA [probabilistic safety analysis] is that...a well-designed plant can be operated in a less safe manner due to poor safety management by the operator.” IAEA-TECDOC-1436, Risk Informed Regulation of Nuclear Facilities: Overview of the Current Status, February 2005. ** EDF implemented safety-availability-Radiation-Protection-environment observatories (SAREOs) to increase awareness of the arbitration between safety and other performance factors. SAREOs analyze in each station the quality of the decision-making process and propose actions to improve it and to guarantee compliance with rules in any circumstances [“Nuclear Safety: our overriding priority” EDF Group‟s file responding to FTSE4Good nuclear criteria] *** Per Rousseau, “The OSD (Observatory for Safety/Availability) is one of the “safety management levers” implemented by EDF in 1997. Its objective is to perform retrospective analyses of high-stake decisions, in order to improve decision-making processes.” (p. 7)
As described in the linked article, workers at Electricite de France are raising concerns about conflicting pressures to work faster, achieve higher capacity factors and provide competitive electricity. EdF has long held a very high reputation for its nuclear operations, in part attributed to the national government’s central ownership and operating responsibilities. While it remains to be seen the extent of such concerns, it is apparent that central ownership does not provide a shield against many of the same pressures experienced by U.S. plants. The article also highlights the potential complications of heavy reliance on subcontractors if it leads to the loss of core competencies in the host organization.
