Nuclear Safety Culture and the Shrinking U.S. Nuclear Plant Population

In the last few years, nuclear plant owners have shut down or scheduled for shutdown 17 units totaling over 14,000 MW.  Over half of these units had (or have) nuclear safety culture (NSC) issues sufficiently noteworthy to warrant mention here on Safetymatters.  We are not saying that NSC issues alone have led to the permanent shutdown of any plant, but such issues often accompany poor decision-making that can hasten a plant’s demise.  Following is a roll call of the deceased or endangered plants.

Plants with NSC issues

NSC issues provide windows into organizational behavior; the sizes of issues range from isolated problems to systemic weaknesses.

FitzPatrick

This one doesn’t exactly belong on the list.  Entergy scheduled it for shutdown in Jan. 2017 but instead it will likely be purchased by a white knight, Exelon, in a transaction brokered by the governor of New York.  With respect to NSC, in 2012 FitzPatrick received a Confirmatory Order (CO) after the NRC discovered violations, the majority of which were willful, related to adherence to site radiation protection procedures. 

Fort Calhoun

This plant shut down on Oct. 24, 2016.  According to the owner, the reason was “market conditions.”  It’s hard for a plant to be economically viable when it was shut down for over two years because of scheduled maintenance, flooding, a fire and various safety violations.  The plant kept moving down the NRC Action Matrix which meant more inspections and a third-party NSC assessment.  A serious cultural issue was how the plant staff’s perception of the Corrective Action Program (CAP) had evolved to view the CAP as a work management system rather than the principal way for the plant to identify and fix its problems.  Click on the Fort Calhoun label to pull up our related posts.

Indian Point 2 and 3

Units 2 and 3 are scheduled to shut down in 2020 and 2021, respectively.  As the surrounding population grew, the political pressure to shut them down also increased.  A long history of technical and regulatory issues did not inspire confidence.  In NSC space, they had problems with making incomplete or false statements to the NRC, a cardinal sin for a regulated entity.  The plant received a Notice of Violation (NOV) in 2015 for providing information about a licensed operator's medical condition that was not complete and accurate; they received a NOV in 2014 because a chemistry manager falsified test results.  Our May 12, 2014 post on the latter event is a reader favorite. 

Palisades

This plant had a long history of technical and NSC issues.  It is scheduled for shutdown on Oct. 1, 2018.  In 2015 Palisades received a NOV because it provided information to the NRC that was not complete and accurate; in 2014 it received a CO because a security manager assigned a person to a role for which he was not qualified; in 2012 it received a CO after an operator left the control room without permission and without performing a turnover to another operator.  Click on the Palisades label to pull up our related posts.

Pilgrim

This plant is scheduled for shutdown on May 31, 2019.  It worked its way to column 4 of the Action Matrix in Sept. 2015 and is currently undergoing an IP 95003 inspection, including an in-depth evaluation of the plant’s CAP and an independent assessment of the plant’s NSC.  In 2013, Pilgrim received a NOV because it provided information to the NRC that was not complete and accurate; in 2005 it received a NOV after an on-duty supervisor was observed sleeping in the control room.

San Onofre 2 and 3

These units ceased operations on Jan. 1, 2012.  The proximate cause of death was management incompetence: management opted to replace the old steam generators (S/Gs) with a large, complex design that the vendor had never fabricated before.  The new S/Gs were unacceptable in operation when tube leakage occurred due to excessive vibrations.  NSC was never anything to write home about either: the plant was plagued for years by incidents, including willful violations, and employees claiming they feared retaliation if they reported or discussed such incidents.

Vermont Yankee

This plant shut down on Dec. 29, 2014 ostensibly for “economic reasons” but it had a vociferous group of critics calling for it to go.  The plant evidenced a significant NSC issue in 2009 when plant staff parsed an information request to the point where they made statements that were “incomplete and misleading” to state regulators about tritium leakage from plant piping.  Eleven employees, including the VP for operations, were subsequently put on leave or reprimanded.  Click on the Vermont Yankee label to pull up our related posts.

Plant with no serious or interesting NSC issues 

The following plants have not appeared on our NSC radar in the eight years we’ve been publishing Safetymatters.  We have singled out a couple of them for extremely poor management decisions.

Crystal River basically committed suicide when they tried to create a major containment penetration on their own and ended up with a delaminating containment.  It ceased operations on Sept. 26, 2009.

Kewaunee shut down on May 7, 2013 for economic reasons, viz., the plant owner apparently believed their initial 8-year PPA would be followed by equal or even higher prices in the electricity market.  The owner was wrong.

Rounding out the list, Clinton is scheduled to shut down June 1, 2017; Diablo Canyon 1 and 2 will shut down in 2024 and 2025, respectively; Oyster Creek is scheduled to shut down on June 1, 2019; and Quad Cities 1 and 2 are scheduled to shut down on June 1, 2018 — all for business reasons.

Our Perspective

Bad economics (low natural gas prices, no economies of scale for small units) were the key drivers of these shutdown decisions but NSC issues and management incompetence played important supporting roles.  NSC problems provide ammunition to zealous plant critics but, more importantly, also create questions about plant safety and viability in the minds of the larger public.

The Criminalization of Safety (Part 1)

US DOJ logo

Nuclear safety management and culture relies on nuclear personnel conducting themselves in accordance with espoused values and making safety the highest priority.  When failures occur individual workers may be (and often are) blamed but broader implications are generally portrayed as an organizational culture deficiency and addressed in that context.  

Only rarely does the specter of criminality enter the picture, requiring a level of malfeasance - intentional conduct or recklessness - that is beyond the boundaries of conventional safety culture. 

The potential for criminal liability raises several issues.  What is the nexus between safety culture and criminal behavior?  What is the significance of the increased frequency of criminal prosecutions following major accidents or scandals in nuclear and other industries?  And where does culpability really lie - with individuals? culture? the corporation? or the complex socio-technical systems within which individuals act?

If one has been paying close attention to the news fairly numerous examples of criminal prosecutions involving safety management issues across a variety of industries and regulatory bodies is occurring.  It is becoming quite a list of late.  We thought this would be an appropriate time to take stock of these trends and their implications for nuclear safety management.

Recent Experience

We have prepared a table* summarizing relevant experience from the nuclear and other high risk industries.  (The link is to a pdf file as it is impractical to display the complete table within this blog post.)  Below is a table snippet showing a key event: the criminal prosecutions associated with the Davis Besse reactor vessel head corrosion in 2001/2002. First Energy, the owner/operator, pleaded guilty to criminal charges and two lower level employees were found guilty at trial.  A third individual, a contractor working for First Energy, was acquitted at trial.

More currently high level executives of TEPCO, the owner/operator of the Fukushima plant in Japan, were charged, though the circumstances are a bit odd.  Prosecutors had twice declined to bring criminal charges but were ultimately overruled by a citizens panel.  The case is expected to be difficult to prove.  Nonetheless this is an attempt to hold the former TEPCO Chairman and heads of the nuclear division criminally accountable.

The only other recent examples in the U.S. nuclear industry that we could identify involved falsification of documents, in one instance by a chemistry manager at Indian Point and the other a security officer at River Bend.**  One has pleaded guilty and sentenced to probation; the other case has been referred to the U.S. Department of Justice (DOJ).

Looking beyond nuclear, the picture is dominated by several major operational accidents - the Deepwater Horizon drill rig explosion and the explosion of the Upper Big Branch coal mine owned by Massey Energy.  Deepwater resulted in guilty pleas by the three corporations involved in the drilling operation - BP, Transocean and Halliburton - with massive criminal and civil fines.  BP’s plea included felony manslaughter.  Several employees also faced criminal charges.  Two faced involuntary manslaughter charges in addition to violations of the Clean Water Act.  The manslaughter charges were later dropped by prosecutors.  One employee pleaded guilty to the Clean Water Act violations and was sentenced to probation, the other went to trial and was acquitted.

The Massey case is noteworthy in that criminal charges ultimately climbed the corporate ladder all the way to the CEO.  Ultimately he was acquitted of felony charges of securities fraud and making false statements, but he “was convicted of a single count of conspiring to violate federal safety standards; he was not convicted of any count holding him responsible for the 2010 accident at the Upper Big Branch mine.”***  It “is widely believed to be the first CEO of a major U.S. corporation to be convicted of workplace safety related charges following an industrial accident.”****  Three other individuals also pleaded or were found guilty of misdemeanor charges.

Next up are the auto companies, GM, Volkswagen and Mitsubishi.  The GM scandal involved the installation of faulty ignition switches in cars that subsequently resulted in a number of deaths.  GM entered into a plea agreement with DOJ admitting criminal wrongdoing and paid large monetary fines.  As of this time no criminal charges have been brought against GM employees.  VW and Mitsubishi have both admitted to manipulating fuel economy and emissions testing and there is speculation that other auto manufacturers could be in the same boat.  The investigations are ongoing at this time but criminal pleas at the corporate level are all but certain.

Last in this pantheon is the city of Flint water quality scandal.  The Attorney General of Michigan recently filed criminal charges against three individuals and promised “more charges soon”.  The interesting aspect here is that the three charged are all government workers - one for the city and two for the Michigan Department of Environmental Quality.  And the two state officials have been charged with misconduct in office, a felony.  Essentially regulators are being held accountable for their oversight.  As David Ullmann, a former chief of DOJ’s environmental crimes section, stated, “It’s extremely unusual and maybe unprecedented for state and local officials to be charged with criminal drinking water violations.”  This bears watching.

In Part 2 we will analyze the trends in these cases and draw some insights into the possible significance of efforts to criminalize safety performance.  In Part 3 we will offer our observations regarding implications for nuclear safety management and some thoughts on approaches to mitigate the need for criminalization.


*  Criminal Prosecutions of Safety Related Events (May 22, 2016).

**  We posted on the Indian Point incident on May 12, 2014 and the River Bend case on Feb. 20, 2015.

***  A. Blinder, "Mixed Verdict for Donald Blankenship, Ex-Chief of Massey Energy, After Coal Mine Blast," New York Times (Dec. 3, 2015 corrected Dec. 5, 2015).

****  K. Maher, "Former Massey Energy CEO Sentenced to 12 Months in Prison," Wall Street Journal (April 6, 2016).  The full article may only be accessible to WSJ subscribers.

Is Entergy’s Nuclear Safety Culture Hurting the Company or the Industry?

Entergy Headquarters  Source: Nola.com

A recent NRC press release* announced a Confirmatory Order (CO) issued to Entergy Operations, Inc. following an investigation that determined workers at Waterford 3 failed to perform fire inspections and falsified records.  Regulatory action directed at an Entergy plant has a familiar ring and spurs us to look at various problems that have arisen in Entergy’s fleet over the years.  The NRC has connected the dots to safety culture (SC) in some cases while other problems suggest underlying cultural issues. 

Utility-Owned Plants

These plants were part of the utility mergers that created Entergy.

Arkansas Nuclear One (ANO)

ANO is currently in Column 4 of the NRC Action Matrix and subject to an intrusive IP 95003 inspection.  ANO completed an independent SC assessment.  We reviewed their problems on June 25, 2015 and concluded “. . . the ANO culture endorses a “blame the contractor” attitude, accepts incomplete investigations into actual events and potential problems, and is content to let the NRC point out problems for them.”

In 2013 ANO received a Notice of Violation (NOV) after an employee deliberately falsified documents regarding the performance of Emergency Preparedness drills and communication surveillances.**

Grand Gulf

We are not aware of any SC issues at Grand Gulf.

River Bend

In 2014 Entergy received a CO to document commitments made because of the willful actions of an unidentified River Bend security officer in March 2012.

(In 2014 the NRC Office of Investigations charged that a River Bend security officer had deliberately falsified training records in Oct. 2013.  It appears a subsequent NRC investigation did not substantiate that charge.***)

In 2012 River Bend received a NOV for operators in the control room accessing the internet in violation of an Entergy procedure.

In 2011 River Bend received a CO to document commitments made because an employee apparently experienced retaliatory action after asking questions related to job qualifications.  Corrective actions included Entergy reinforcing its commitment to a safety conscious work environment, reviewing Employee Concerns Program enhancements and conducting a plant wide SC survey.

In 1999 River Bend received a NOV for deliberately providing an NRC inspector with information that was incomplete and inaccurate.

Waterford 3

As noted in the introduction to this post, Waterford 3 recently received a CO because of failure to perform fire inspections and falsifying records.

Entergy Wholesale Plants

These plants were purchased by Entergy and are located outside Entergy’s utility service territory.

FitzPatrick

Entergy purchased FitzPatrick in 2000.

In 2012, FitzPatrick received a CO after the NRC discovered violations, the majority of which were willful, related to adherence to site radiation protection procedures.  Corrective actions included maintaining the SC processes described in NEI 09-07 “Fostering a Strong Nuclear Safety Culture.”

Entergy plans on closing the plant Jan. 27, 2017.

Indian Point

Entergy purchased Indian Point 3 in 2000 and IP2 in 2001.

In 2015 Indian Point received a NOV because it provided information to the NRC related to a licensed operator's medical condition that was not complete and accurate in all material respects.

In 2014 Indian Point received a NOV because a chemistry manager falsified test results.  The manager subsequently resigned and then Entergy tried to downplay the incident.  Our May 12, 2014 post on this event is a reader favorite.

During 2006-08 Indian Point received two COs and three NOVs for its failure to install backup power for the plant’s emergency notification system.

Palisades

Entergy purchased Palisades in 2007.

In 2015 Entergy received a NOV because it provided information to the NRC related to Palisades’ compliance with ASME Code acceptance criteria that was not complete and accurate in all material respects.

In 2014 Entergy received a CO because a Palisades security manager assigned a supervisor to an armed responder role for which he was not currently qualified (see our July 24, 2014 post).

Over 2011-12 a virtual SC saga played out at Palisades.  It is too complicated to summarize here but see our Jan. 30, 2013 post.

In 2012 Palisades received a CO after an operator left the control room without permission and without performing a turnover to another operator.  Corrective actions included conducting a SC assessment of the Palisades Operations department.

Pilgrim

Entergy purchased Pilgrim in 1999.

Like ANO, Pilgrim is also in column 4 of the Action Matrix.  They are in the midst of a three-phase IP 95003 inspection currently focused on corrective action program weaknesses (always a hot button issue for us); a plant SC assessment will be performed in the third phase.

In 2013, Pilgrim received a NOV because it provided information to the NRC related to medical documentation on operators that was not complete and accurate in all material respects.

In 2005 Pilgrim received a NOV after an on-duty supervisor was observed sleeping in the control room. 

Vermont Yankee

Entergy purchased Vermont Yankee in 2002.

During 2009, Vermont Yankee employees made “incomplete and misleading” statements to state regulators about tritium leakage from plant piping.  Eleven employees, including the VP for operations, were subsequently put on leave or reprimanded.  Click the Vermont Yankee label to see our multiple posts on this incident. 

Vermont Yankee ceased operations on Dec. 29, 2014.

Our Perspective

These cases involved behavior that was wrong or, at a minimum, lackadaisical.  It’s not a stretch to infer that a weak SC may have been a contributing factor even where it was not specifically cited.

Only three U.S. nuclear units are in column 4 of the NRC’s Action Matrix—and all three are Entergy plants.  Only TVA comes close to Entergy when it comes to being SC-challenged.

We can’t predict the future but it doesn’t take a rocket scientist to plot Entergy’s nuclear trajectory.  One plant is dead and the demise of another has been scheduled.  It will be no surprise if Indian Point goes next; it’s in a densely populated region, occasionally radioactively leaky and a punching bag for New York politicians.

Does Entergy’s SC performance inspire public trust and confidence in the company?  Does their performance affect people's perception of other plants in the industry?  You be the judge.


*  NRC press release, “NRC Issues Confirmatory Order to Entergy Operations, Inc.” (April 8, 2016).  ADAMS ML16099A090.

**  COs and NOVs are summarized from Escalated Enforcement Actions Issued to Reactor Licensees on the NRC website.

***  J.M. Rollins (NRC) to J. McCann (Entergy), Closure of Investigation 014-2014-046 (Jan. 25, 2016.)  ADAMS ML16025A141.

NRC Office of Investigations 2014 Annual Report: From Cases to Culture

The Nuclear Regulatory Commission (NRC) Office of Investigations (OI) recently released its FY2014 annual report.*  The OI investigates alleged wrongdoing by entities regulated by the NRC; OI’s focus is on willful and deliberate actions that violate NRC regulations and/or criminal statutes.

The OI report showed a definite downward trend in the number of new cases being opened, overall a 41% drop between FY2010 and FY2014.  Only one of the four categories of cases increased over that time frame, viz., material false statements, which held fairly steady through FY2013 but popped in FY2014 to 67% over FY2010.  We find this disappointing because false statements can often be linked to cultural attributes that prioritize getting a job done over compliance with regulations.

The report includes a chapter on “Significant Investigations.”  There were eight such investigations, four involving nuclear power plants.  We have previously reported on two of these cases, the Indian Point chemistry manager who falsified test results (see our May 12, 2014 post) and the Palisades security manager who assigned a supervisor to an armed responder role for which he was not currently qualified (see our July 24, 2014 post).  The other two, summarized below, occurred at River Bend and Salem.

In the River Bend case, a security officer deliberately falsified training records by taking a plant access authorization test for her son, a contractor employed by a plant supplier.  Similar to the Palisades case, Entergy elected alternative dispute resolution (ADR) and ended up with multiple corrective actions including revising its security procedures, establishing new controls for security-related information (SRI), evaluating SRI storage, developing a document highlighting the special responsibilities of nuclear security personnel, establishing decorum protocols for certain security posts, preparing and delivering a lessons learned presentation, conducting an independent third party safety culture (SC) assessment of the River Bend security organization [emphasis added], and delivering refresher training on 10 CFR 50.5 and 50.9.  Most of these requirements are to be implemented fleet-wide, i.e., at all Entergy nuclear plants, not just River Bend.**

The Salem case involved a senior reactor operator who used an illegal substance then performed duties while under its influence.  The NRC issued a Level III Notice of Violation (NOV) to the operator.  The operator’s NRC license was terminated at PSE&G’s request.***  PSE&G was not cited in this case.

Our Perspective

You probably noticed that three of the “significant” cases involved Entergy plants.  Entergy is no stranger to issues with a possible cultural component including the following:****

In 2013, Arkansas Nuclear One received a NOV after an employee deliberately falsified documents regarding the performance of Emergency Preparedness drills and communication surveillances.

In 2012, Fitzpatrick received a Confirmatory Order (Order) after the NRC discovered violations, the majority of which were willful, related to adherence to site radiation protection procedures.

During 2006-08, Indian Point received two Orders and three NOVs for its failure to install backup power for the plant’s emergency notification system.

In 2012, Palisades received an Order after an operator left the control room without permission and without performing a turnover to another operator.  Entergy went to ADR and ended up with multiple corrective actions, some fleet-wide.  We have posted many times about the long-running SC saga at Palisades—click on the Palisades label to pull up the posts. 

In 2005, Pilgrim received a NOV after an on-duty supervisor was observed sleeping in the control room.  In 2013, Pilgrim received a NOV for submitting false medical documentation on operators.

In 2012, River Bend received a NOV for operators in the control room accessing the internet in violation of an Entergy procedure. 

These cases involve behavior that was (at least in hindsight) obviously wrong.  It’s not a stretch to suggest that a weak SC may have been a contributing factor.  So has Entergy received the message?  You be the judge.

“Think of how stupid the average person is, and realize half of them are stupider than that.” ― George Carlin (1937–2008)


*  NRC Office of Investigations, “2014 OI Annual Report,” NUREG-1830, Vol. 11 (Feb. 2015).  ADAMS ML15034A064.

**  M.L. Dapas (NRC) to E.W. Olson (River Bend), “Confirmatory Order, Notice of Violation, and Civil Penalty – NRC Special Inspection Report 05000458/2014407 and NRC Investigation Report 4-2012-022- River Bend Station” (Dec. 3, 2014).  ADAMS ML14339A167.

***  W.M. Dean (NRC) to G. Meekins (an individual), “Notice of Violation (Investigation Report No. 1-2014-013)” (July 9, 2014).  ADAMS ML14190A471.

****  All Entergy-related NRC enforcement actions were obtained from the NRC website.

Willful Violations at Indian Point

We report in this post on a situation that developed at Indian Point more than two years ago and was just recently closed out via NRC notices of violation to an individual (a Chemistry Manager for Entergy Nuclear Operations) and to Entergy Nuclear Operations itself. 

What should we make of another willful misconduct episode?  A misguided individual who made some bad choices but where the actual impact on safety (per Entergy and the NRC) was not significant?  The individual resigned (and plead to a felony conviction and probation), corrective actions to reinforce proper behaviors have been taken, and violations issued...what difference does it make?

The Events Surrounding the Misconduct

We are attaching a series of references as they contain more detail than we can recount in a blog post.  In particular Reference 4 provides the most comprehensive rendition of the relevant events.  Very briefly this is what occurred: During 2011 routine testing of diesel fuel oil at Indian Point (IP), as required by Tech Specs, indicated that the limits on particulate concentration were exceeded.  The Chemistry Manager with responsibility for this testing did not report (initiate Condition Reports) the anomalous results which would have resulted in the reserve fuel oil storage tank (RFOST) being declared inoperable.  The LCO is 30 days and if operability was not restored, shutdown of both IP units would have been required. [Ref 2, Cover Letter]  In early 2012 as part of a systems engineering self-assessment, the anomalous results and lack of reporting were identified.  The Chemistry Manager falsely indicated that re-sampling and testing had been performed which were acceptable.  He subsequently made false data entries to support this story.

A short time later employee concerns were filed via the Entergy Ethics Line and the Employee Concerns Program (ECP).  Entergy initiated an investigation using outside attorneys (Morgan Lewis).  At the same time the NRC initiated an Office of Investigations (OI) investigation.  The Chemistry Manager refused to cooperate in the investigation and resigned.  Subsequent testing of the fuel oil indicated limits were being exceeded and compensatory actions were taken.  Pursuant to the investigations the Chemistry Manager admitted willful misconduct.  The US Attorney issued a criminal complaint and ultimately the manager plead to a felony and received probation.  Entergy was cited for a Severity Level III violation, civil penalty waived.

Further Observations

Plowing through the documentation of this issue left us with a few lingering questions.  One is with regard to the sanitized LER that Entergy submitted to the NRC in August 2012.  The LER makes no mention of the filing of employee concerns, investigation by outside attorneys or the NRC OI investigation.  For that matter the LER never mentions that the cause of the event was willful misconduct by a department manager.  Rather it characterizes the situation in the abstract - as a failure to use the corrective action program.  In other words a whole lot was happening in the background which would cast the event in a different light, including its potential significance.*

While the cited violations are linked to the misconduct of the Chemistry Manager, it appears there had been ongoing issues within the Chemistry Department for some time: entering test data diligently, understanding the significance of the data, and initiating CRs.  “The circumstances surrounding the violations are of concern to the NRC because they indicate a lack of consideration for (and/or knowledge of) TS requirements by ENO Chemistry staff.  The NRC also noted that the Chemistry Manager would not have had the opportunity to commit the violations had ENO staff exhibited the proper regard for the site TS.”  [Ref 4, p. 4]  But in its chronology of events, Entergy contends that in March 2102 there was “no reason to question the integrity of former Chemistry Manager…” [Ref 4, Encl 2, slide 15].  Perhaps not the integrity, but what about management effectiveness? 

Further context.  Entergy gives itself credit for how it responded to the evolving situation.  They highlight that a self-assessment team identified the anomalies (true), that employees raised concerns through established programs (true), that Entergy conducted an investigation (true).  [Ref 4, Encl 2, slide 35]  But what is missing is that normal business processes (management oversight, QA audits, or Chemistry Department personnel) did not identify the anomalies prior to the self-assessment; that employees felt the need to use the Ethics Line and the ECP rather than directly raising within the management chain; that upon discovery of the anomalies, it appears that Entergy went to great lengths to avoid declaring that the fuel oil did not meet specs.**  The net result is that the RFOST was able to be maintained as operable for almost three months before definitive action was taken to filter the oil. [Ref 4, Encl 2, slides 17-21]

Why?

The most interesting and relevant question posed by these events is why did the Chemistry Manager take the actions he did?  “The Manager said that he falsified the data because he needed more time to prove his theory [that the IP Chemistry Department’s sampling practices were poor] and incorporate new test methods, and he had not wanted the plant to unnecessarily shut down.”  [Ref 2, Encl 1] That is the extent of what the NRC reports on its investigation of the motive of the Chemistry Manager.  An employee for 29 years undertakes a series of deliberate violations of his professional responsibilities “to prove his theory”.  Perhaps. 

One of the final corrective actions implemented for this event occurred in December 2013 when the General Manager for Plant Operations briefed the Department Managers on deliberate misconduct.  Included was a statement, "If we have to shutdown the plant we will do so". [Ref 4, Encl 2, slide 32] Without reading too much into a single bullet point, one wonders if this is a tacit acknowledgment by Entergy that the Chemistry Manager may have been influenced to do what he did because he did not want to be the cause of a plant shutdown.

We would be very interested to see how much probing was done by the NRC investigators, or Entergy’s attorneys, of this individual’s motive, particularly in terms of any perceived pressure to keep the plant operating.  Such pressure needn’t come from Entergy, it seems self-evident that Indian Point’s licensing situation and the long standing political opposition within New York State poses an existential threat to the plant.  If his motive was just a matter of a revised test “theory”, were these the first out-of-spec fuel oil test results on his watch?  If there had been others, how were they handled?  How long had he been in the position?  Had he initiated any other actions prior to this time to investigate the testing protocol?  As we noted in our post dated September 12, 2013 regarding the NRC’s Information Notice on willful violations, in none of the cited examples did the NRC provide any perspective on the motives of the individuals or the potential effects of the environment within which they were working.

Safety and Safety Culture

How does all of this shed any light on safety and safety culture? 

A key dimension of safety culture is the accurate assessment of safety significance.  The position of Entergy, and adopted by the NRC***, was that the actual impact of the violations on reactor safety was not significant. [Ref 4, Encl 2, slide 36]  Also note that NRC finds that all of this is in the ROP category for “green” significance. The argument is a familiar one.  TS limits are conservative and below what is actually “OK”.  And if particulates are a problem there are filters on the diesel generators, and these can be changed out during operation of the diesels if necessary.  This is a familiar characterization - safety significance is evaluated within the strict boundaries of the NRC’s safety construct of design basis assumptions, almost exclusively hardware based.  As we noted in our September 24, 2013 post, this ignores the larger environment and “system” within which people actually function. 

The Synergy Safety Culture Survey conducted from Feb to April 2012 is cited as finding a “healthy work environment in Chemistry Department” - yet this was at the very time test results were being falsified by the manager and employees were resorting to the ECP to raise issues.  Other assessments by the NRC and INPO also did not identify issues. [Ref 4, Encl 2, slide 29].  There is reference to an “independent investigation” of the employee concerns but the documentation does not reveal who did the investigation or its findings.  The investigation found “no one interviewed” had a reluctance to raise an issue.  Nowhere is the prior use of the Ethics Line and ECP by several individuals on an anonymous basis explained. 

Something that is hard to square is the NRC assertion that there is a strong link between willful violations and safety culture, and the results of these various assessments at Indian Point by Synergy, the NRC and INPO.  So if there is a link, and safety culture assessments don’t reveal its presence, are the assessments valid?  Or if the assessments are valid, is there really a link with willful misconduct? 

Here’s our take.  Willful misconduct is an indication of an issue with the safety culture.  But the issue arises out of a broader and more complex context than the NRC or industry is willing to address.  At Indian Point there is an overriding operating context where the extension of the plants’ operating licenses is being contested by powerful political forces in New York State.  If the licenses are not extended, the plants close and people lose their jobs.  This is not theoretical as the Entergy-owned plant, Vermont Yankee, is doing just that.  If you are an employee at Indian Point, you must feel that pressure every day.  When an issue comes up such as failed diesel fuel tests that could result in temporary shutdown of both units, it is an additional threat to the viability of the plant.  That pressure can create a powerful desire to rationalize the fuel tests are not valid and/or that slightly contaminated fuel isn’t a significant safety concern because…[see Entergy and NRC agreement that it is not a significant safety concern].  So there is a situation where there is an immediate and significant penalty (shutdown of both units) versus a test result that may or may not be valid or of real safety significance.  The result: deliberate misconduct in burying the test results but also very possibly (I am speculating) the individual and others in the organization can still believe that safety is not impacted.  As actions are consistent with “real” safety significance, it preserves the myth that safety culture is still healthy.


*  As stated in the NRC Enforcement Policy (on page 9, section 2.2.1.d): “Willful violations are of particular concern because the NRC’s regulatory program is based on licensees and their contractors, employees, and agents acting with integrity and communicating with candor. The Commission cannot tolerate willful violations. Therefore, a violation may be considered more significant than the underlying noncompliance if it includes indications of willfulness.” [NRC Information Notice 2013-15]

**  The sequence of events starting in March 2012 in response to RFOST sample (by off-site testing lab) being out of spec: the RFOST is declared inoperable but a supervisor declares that the sample test method was not appropriate, the department procedure is revised to allow on-site testing of a new sample (what was site review process? procedure revision appears to have occurred and become effective in one day), and the test results are now found acceptable.  This allows the RFOST to be declared operable. Without telling anyone, the former Chem Mgr sends a split sample for off-site testing and it comes back over spec.  Why wouldn’t plant management have required a split sample in the first place to verify on-site test?  Two employee concerns are filed, the ML investigation is initiated and the Chemistry Manager resigns.  At the next sampling in mid-April, once again the on-site analysis finds the sample to be within spec but management now requires outside testing in light of the resignation of the Chemistry Manager.  Outside test indicates out-of-spec but an “evaluation” concludes that the in-house results are valid and  RFOST remains “operable”.  Another month goes by and sample is taken in late May.  Sample sent outside, late June results indicate out-of-spec.  This time the RFOST is declared inoperable.  Not clear if late May sample was tested on-site (or why not) and why this time the outside test result is deemed valid.  A final footnote, one of the corrective actions for this event was to discontinue on-site oil analysis but no discussion of why, or why it had been approved in the first place.

***  “the underlying technical findings would have been evaluated as having very low safety significance (i.e. green) under the Reactor Oversight Process (ROP) because the higher fuel oil particulate concentration would not have impacted the ability of the EDGs to fulfill their safety function.” [Ref 4, p. 3]

References

1 - J.A. Ventosa (Entergy) to NRC, Licensee Event Report # 2012-007-00 (Aug. 20, 2012).  ADAMS ML12235A541.

2 - NRC to J. Ventosa, NRC Inspection Report Nos. 05000247/2013011 & 05000286/2013011 and NRC Office of Investigation Reports No. 1-2012-036 (Dec. 18, 2013)  ADAMS ML13354B806.

3 - NRC to D. Wilson (former Chemistry Mgr.), Notice of Violation and Order Prohibiting Involvement in NRC-Licensed Activities (April 29, 2014).  ADAMS ML14118A337.

4 - NRC to J. Ventosa, Notice of Violation (April 29, 2014).  ADAMS ML14118A124.