The Canadian Nuclear Safety Commission (CNSC) has published a draft regulatory document REGDOC-2.1.2, “Safety Culture” for comment* The REGDOC will be a requirement for nuclear power plants and provide guidance for other nuclear entities and activities.
The REGDOC establishes “requirements and guidance for fostering and assessing safety culture.” (p. 1) The CNSC’s purpose is to promote a healthy safety culture (SC) which they say “is a key factor in reducing the likelihood of safety-related events and mitigating their potential impact, and in continually improving safety performance.” (ibid.)
Section 2 specifies five characteristics of a healthy SC: Safety is a clearly recognized value, accountability for safety is clear, a learning organization is built around safety, safety is integrated into all activities in the organization, and a safety leadership process exists in the organization. For each characteristic, the document lists observable indicators.
Sections 3 and 4 describe how licensees should perform SC assessments. Specifically, assessments should be empirical, valid, practical and functional. Each of these three characteristics is fleshed out with relevant criteria. The document goes on to discuss the mechanics of performing assessments: developing a communications strategy, defining the assessment framework, selecting team members, planning and conducting assessments, developing findings and recommendations, writing reports, etc.
Our Perspective
The REGDOC is clear and relatively brief. None of the content is controversial or even new; the document is based on multiple International Atomic Energy Agency (IAEA) publications. (14 of 15 references in the document are from IAEA. The “Additional Information” page includes items from INPO, NEI and WANO.)
Here’s how the REGDOC addresses SC topics that are important to us:
Decision making - Satisfactory
The introduction to the SC characteristics says “The highest level of governing documentation should make safety the utmost priority – overriding the demands of production and project schedules . . .” (p. 4) The specific SC indicators include “Timely decisions are made that reflect the value and relative priority placed on safety.” (ibid.) “Workers are involved in risk assessment and decision-making processes.” (p. 5) “A proactive and long-term approach to safety is demonstrated in decision making.” (p. 6) We would have liked a more explicit treatment of safety-production-cost goal conflict but what the CNSC has included is OK.
Taking a systems view of SC - Unacceptable
This topic is only mentioned in a table of SC maturity model indicators that is in an appendix to the REGDOC. The links between SC and other important organizational attributes must be inferred from the observable indicators. There is no discussion of the interrelationship between SC and other important organizational attributes, e.g., the safety conscious work environment, management’s commitment to safety, or workers’ trust in management to do the right thing.
Rewards and compensation - Unacceptable
The discussion is limited to workers. What about senior management compensation and incentives? How much are senior managers paid, if anything, for establishing and maintaining a healthy SC?
The discussion on performing assessments refers several times to a SC maturity model that is appended to the REGDOC. The model has three stages of organizational maturity—requirement driven, goal driven and continually improving, along with specific observable behaviors associated with each stage. The model can be used to “describe and interpret the organization’s safety culture, . . .” (p. 10) Nowhere does the REGDOC explicitly state that stage 3 (a continually improving organization) is the desired configuration. This is a glaring omission in the REGDOC.
Bottom line: If you keep up with IAEA’s SC-related publications, you don’t need to look at this draft REGDOC which adds zero value to our appreciation or understanding of SC.
* Canadian Nuclear Safety Commission, draft regulatory document REGDOC-2.1.2, “Safety Culture” (Sept. 2016). The CNSC is accepting public comments on the document until Jan. 31, 2017.
A recent Nuclear Energy Agency (NEA) publication* describes desirable safety culture (SC) characteristics for a nuclear regulator. Its purpose is to provide a benchmark for both established and nascent regulatory bodies.
The document’s goal is to describe a “healthy” SC. It starts with the SC definition in INSAG-4** then posits five principles for an effective nuclear regulator: Safety leadership is demonstrated at all levels; regulatory staff set the standard for safety; and the regulatory body facilitates co-operation and open communication, implements a holistic approach to safety, and encourages continuous improvement, learning and self-assessment.
The principle that caught our attention is the holistic (or systemic) approach to safety. This approach is discussed multiple times in the document. In the Introduction, the authors say the regulator “should actively scrutinise how its own safety culture impacts the licensees’ safety culture. It should also reflect on its role within the wider system and on how its own culture is the result of its interactions with the licensees and all other stakeholders.” (p. 12)
A subsequent chapter contains a more expansive discussion of each principle and identifies relevant attributes. The following excerpts illustrate the value of a holistic approach. “A healthy safety culture is dependent on the regulatory body using a robust, holistic, multi-disciplinary approach to safety. Regulators oversee and regulate complex socio-technical systems that, together with the regulatory body itself, form part of a larger system made up of many stakeholders, with competing as well as common interests. All the participants in this system influence and react to each other, and there is a need for awareness and understanding of this mutual influence.” (p. 19)
“[T]he larger socio-technical system [is] influenced by technical, human and organisational, environmental, economic, political and societal factors [including national culture]. Regulators should strive to do more than simply establish standards; they should consider the performance of the entire system that ensures safety.” (p. 20)
And “Safety issues are complex and involve a number or inter-related factors, activities and groups, whose importance and effect on each other and on safety might not be immediately recognisable.” (ibid.)
The Conclusions include the following: “Regulatory decisions need to consider the performance and response of the entire system delivering safety, how the different parts of the system are coupled and the direction the system is taking.” (p. 28)
Our Perspective
Much of this material in this publication will be familiar to Safetymatters readers*** but the discussion of a holistic approach to regulation is more extensive than we’ve seen elsewhere. For that reason alone, we think this document is worth your quick review. We have been promoting a systems view of the nuclear industry, from individual power plants to the overall socio-technical-legal-political construct, for years.
The committee that developed the guidance consisted of almost thirty members from over a dozen countries, the International Atomic Energy Agency and NEA itself. It’s interesting that China was not represented on the committee although it has world's largest nuclear power plant construction program**** and, one would hope, substantial interest in effective safety regulation and safety culture. (Ooops! China is not a member of the NEA. Does that say something about China's perception of the NEA's value proposition?)
* Nuclear Energy Agency, “The Safety Culture of an Effective Nuclear Regulatory Body” (2016). Thanks to Madalina Tronea for publicizing this document. Dr. Tronea is the founder/moderator of the LinkedIn Nuclear Safety Culture discussion group. The NEA is an arm of the Organisation for Economic Co-operation and Development (OECD).
** International Nuclear Safety Advisory Group, “Safety Culture,” Safety Series No. 75-INSAG-4, (Vienna: IAEA, 1991), p. 4.
*** For example, the list of challenges a regulator faces includes the usual suspects: maintain the focus on safety, avoid complacency, resist external pressures, avoid regulatory capture and maintain technical competence. (pp. 23-25)
A reader sent us a copy of “Safety Assessment Principles for Nuclear Facilities” (SAPs) published by the United Kingdom’s Office for Nuclear Regulation (ONR).* For documents like this, we usually jump right to the treatment of safety culture (SC). However, in this case we were impressed with the document’s accessibility, organization and integrated (or holistic) approach so we want to provide a more general review.
ONR uses the SAPs during technical assessments of nuclear licensees’ safety submissions. The total documentation package developed by a licensee to demonstrate high standards of nuclear safety is called the “safety case.”
Accessibility
The language is clear and intended for newbies as well as those already inside the nuclear tent. For example, “The SAPs contain principles and guidance. The principles form the underlying basis for regulatory judgements made by inspectors, and the guidance associated with the principles provides either further explanation of a principle, or their interpretation in actual applications and the measures against which judgements can be made.” (p. 11)
Also furthering ease of use, the document is not strewn with acronyms. As a consequence, one doesn’t have to sit with glossary in hand just to read the text.
Organization
ONR presents eight fundamental principles including responsibility for safety, limitation of risks to individuals and emergency planning. We’ll focus on another fundamental principle, Leadership and Management (L&M) because (a) L&M activities create the context and momentum for a positive SC and (b) it illustrates holistic thinking.
L&M is comprised of four subordinate (but still high-level) inter-related principles: leadership, capable organization, decision making and learning. “Because of their inter-connected nature there is some overlap between the principles. They should therefore be considered as a whole and an integrated approach will be necessary for their delivery.” (p. 18)
Drilling down further, the guidance for leadership includes many familiar attributes. We want to acknowledge attributes we have been emphasizing on Safetymatters or reflect new thoughts. Specifically, leaders must recognize and resolve conflict between safety and other goals, ensure that the reward systems promote the identification and management of risk, encourage safe behavior and discourage unsafe behavior or complacency; and establish a common purpose and collective social responsibility for safety. (p.19)
Decision making (another Safetymatters hot button issue) receives a good treatment. Topics covered include explicit recognition of goal conflict; appreciating the potential for error, uncertainty and the unexpected; and the essential functions of active challenges and a questioning attitude.
We do have one bone to pick under L&M: we would like to see words to the effect that safety performance and SC should be significant components of the senior management reward system.
Useful Points
Helpful nuggets pop up throughout the text. A few examples follow.
“The process of analysing safety requires creativity, where people can envisage the variety of routes by which radiological risks can arise from the technology. . . . Safety is achieved when the people and physical systems together reliably control the radiological hazards inherent in the technology. Therefore the organizational systems (ie interactions between people) are just as important as the physical systems, . . . “ (pp. 25-26)
“[D]esigners and/or dutyholders may wish to put forward safety cases that differ from [SAP] expectations. As in the past, ONR inspectors should consider such submissions on their individual merits. . . . ONR will need to be assured that such cases demonstrate equivalence to the outcomes associated with the use of the principles here,. . .” (p. 14) The unstated principle here is equifinality; in more colorful words, there is more than one way to skin a cat.
There are echoes of other lessons we’ve been preaching on Safetymatters. For example “The principle of continuous improvement is central to achieving sustained high standards of nuclear safety. . . . Seeking and applying lessons learned from events, new knowledge and experience, both nationally and internationally, must be a fundamental feature of the safety culture of the nuclear industry.” (p. 13)
And, in a nod to Nicholas Taleb, if a “hazard is particularly high, or knowledge of the risk is very uncertain, ONR may choose to concentrate primarily on the hazard.” (p. 8)
Our Perspective
Most of the content of the SAPs will be familiar to Safetymatters readers. We suggest you skim the first 23 pages of the document covering introductory material and Leadership & Management. SAPs is an excellent example of a regulator actually trying to provide useful information and guidance to current and would-be licensees and is far better than the simple-minded laundry lists promulgated by IAEA.
The Nuclear Regulatory Commission (NRC) Office of Investigations (OI) recently released its FY2014 annual report.* The OI investigates alleged wrongdoing by entities regulated by the NRC; OI’s focus is on willful and deliberate actions that violate NRC regulations and/or criminal statutes.
The OI report showed a definite downward trend in the number of new cases being opened, overall a 41% drop between FY2010 and FY2014. Only one of the four categories of cases increased over that time frame, viz., material false statements, which held fairly steady through FY2013 but popped in FY2014 to 67% over FY2010. We find this disappointing because false statements can often be linked to cultural attributes that prioritize getting a job done over compliance with regulations.
The report includes a chapter on “Significant Investigations.” There were eight such investigations, four involving nuclear power plants. We have previously reported on two of these cases, the Indian Point chemistry manager who falsified test results (see our May 12, 2014 post) and the Palisades security manager who assigned a supervisor to an armed responder role for which he was not currently qualified (see our July 24, 2014 post). The other two, summarized below, occurred at River Bend and Salem.
In the River Bend case, a security officer deliberately falsified training records by taking a plant access authorization test for her son, a contractor employed by a plant supplier. Similar to the Palisades case, Entergy elected alternative dispute resolution (ADR) and ended up with multiple corrective actions including revising its security procedures, establishing new controls for security-related information (SRI), evaluating SRI storage, developing a document highlighting the special responsibilities of nuclear security personnel, establishing decorum protocols for certain security posts, preparing and delivering a lessons learned presentation, conducting an independent third party safety culture (SC) assessment of the River Bend security organization [emphasis added], and delivering refresher training on 10 CFR 50.5 and 50.9. Most of these requirements are to be implemented fleet-wide, i.e., at all Entergy nuclear plants, not just River Bend.**
The Salem case involved a senior reactor operator who used an illegal substance then performed duties while under its influence. The NRC issued a Level III Notice of Violation (NOV) to the operator. The operator’s NRC license was terminated at PSE&G’s request.*** PSE&G was not cited in this case.
Our Perspective
You probably noticed that three of the “significant” cases involved Entergy plants. Entergy is no stranger to issues with a possible cultural component including the following:****
In 2013, Arkansas Nuclear One received a NOV after an employee deliberately falsified documents regarding the performance of Emergency Preparedness drills and communication surveillances.
In 2012, Fitzpatrick received a Confirmatory Order (Order) after the NRC discovered violations, the majority of which were willful, related to adherence to site radiation protection procedures.
During 2006-08, Indian Point received two Orders and three NOVs for its failure to install backup power for the plant’s emergency notification system.
In 2012, Palisades received an Order after an operator left the control room without permission and without performing a turnover to another operator. Entergy went to ADR and ended up with multiple corrective actions, some fleet-wide. We have posted many times about the long-running SC saga at Palisades—click on the Palisades label to pull up the posts.
In 2005, Pilgrim received a NOV after an on-duty supervisor was observed sleeping in the control room. In 2013, Pilgrim received a NOV for submitting false medical documentation on operators.
In 2012, River Bend received a NOV for operators in the control room accessing the internet in violation of an Entergy procedure.
These cases involve behavior that was (at least in hindsight) obviously wrong. It’s not a stretch to suggest that a weak SC may have been a contributing factor. So has Entergy received the message? You be the judge.
“Think of how stupid the average person is, and realize half of them are stupider than that.” ― George Carlin (1937–2008)
* NRC Office of Investigations, “2014 OI Annual Report,” NUREG-1830, Vol. 11 (Feb. 2015). ADAMS ML15034A064.
We report in this post on a situation that developed at Indian Point more than two years ago and was just recently closed out via NRC notices of violation to an individual (a Chemistry Manager for Entergy Nuclear Operations) and to Entergy Nuclear Operations itself.
What should we make of another willful misconduct episode? A misguided individual who made some bad choices but where the actual impact on safety (per Entergy and the NRC) was not significant? The individual resigned (and plead to a felony conviction and probation), corrective actions to reinforce proper behaviors have been taken, and violations issued...what difference does it make?
The Events Surrounding the Misconduct
We are attaching a series of references as they contain more detail than we can recount in a blog post. In particular Reference 4 provides the most comprehensive rendition of the relevant events. Very briefly this is what occurred: During 2011 routine testing of diesel fuel oil at Indian Point (IP), as required by Tech Specs, indicated that the limits on particulate concentration were exceeded. The Chemistry Manager with responsibility for this testing did not report (initiate Condition Reports) the anomalous results which would have resulted in the reserve fuel oil storage tank (RFOST) being declared inoperable. The LCO is 30 days and if operability was not restored, shutdown of both IP units would have been required. [Ref 2, Cover Letter] In early 2012 as part of a systems engineering self-assessment, the anomalous results and lack of reporting were identified. The Chemistry Manager falsely indicated that re-sampling and testing had been performed which were acceptable. He subsequently made false data entries to support this story.
A short time later employee concerns were filed via the Entergy Ethics Line and the Employee Concerns Program (ECP). Entergy initiated an investigation using outside attorneys (Morgan Lewis). At the same time the NRC initiated an Office of Investigations (OI) investigation. The Chemistry Manager refused to cooperate in the investigation and resigned. Subsequent testing of the fuel oil indicated limits were being exceeded and compensatory actions were taken. Pursuant to the investigations the Chemistry Manager admitted willful misconduct. The US Attorney issued a criminal complaint and ultimately the manager plead to a felony and received probation. Entergy was cited for a Severity Level III violation, civil penalty waived.
Further Observations
Plowing through the documentation of this issue left us with a few lingering questions. One is with regard to the sanitized LER that Entergy submitted to the NRC in August 2012. The LER makes no mention of the filing of employee concerns, investigation by outside attorneys or the NRC OI investigation. For that matter the LER never mentions that the cause of the event was willful misconduct by a department manager. Rather it characterizes the situation in the abstract - as a failure to use the corrective action program. In other words a whole lot was happening in the background which would cast the event in a different light, including its potential significance.*
While the cited violations are linked to the misconduct of the Chemistry Manager, it appears there had been ongoing issues within the Chemistry Department for some time: entering test data diligently, understanding the significance of the data, and initiating CRs. “The circumstances surrounding the violations are of concern to the NRC because they indicate a lack of consideration for (and/or knowledge of) TS requirements by ENO Chemistry staff. The NRC also noted that the Chemistry Manager would not have had the opportunity to commit the violations had ENO staff exhibited the proper regard for the site TS.” [Ref 4, p. 4] But in its chronology of events, Entergy contends that in March 2102 there was “no reason to question the integrity of former Chemistry Manager…” [Ref 4, Encl 2, slide 15]. Perhaps not the integrity, but what about management effectiveness?
Further context. Entergy gives itself credit for how it responded to the evolving situation. They highlight that a self-assessment team identified the anomalies (true), that employees raised concerns through established programs (true), that Entergy conducted an investigation (true). [Ref 4, Encl 2, slide 35] But what is missing is that normal business processes (management oversight, QA audits, or Chemistry Department personnel) did not identify the anomalies prior to the self-assessment; that employees felt the need to use the Ethics Line and the ECP rather than directly raising within the management chain; that upon discovery of the anomalies, it appears that Entergy went to great lengths to avoid declaring that the fuel oil did not meet specs.** The net result is that the RFOST was able to be maintained as operable for almost three months before definitive action was taken to filter the oil. [Ref 4, Encl 2, slides 17-21]
Why?
The most interesting and relevant question posed by these events is why did the Chemistry Manager take the actions he did? “The Manager said that he falsified the data because he needed more time to prove his theory [that the IP Chemistry Department’s sampling practices were poor] and incorporate new test methods, and he had not wanted the plant to unnecessarily shut down.” [Ref 2, Encl 1] That is the extent of what the NRC reports on its investigation of the motive of the Chemistry Manager. An employee for 29 years undertakes a series of deliberate violations of his professional responsibilities “to prove his theory”. Perhaps.
One of the final corrective actions implemented for this event occurred in December 2013 when the General Manager for Plant Operations briefed the Department Managers on deliberate misconduct. Included was a statement, "If we have to shutdown the plant we will do so". [Ref 4, Encl 2, slide 32] Without reading too much into a single bullet point, one wonders if this is a tacit acknowledgment by Entergy that the Chemistry Manager may have been influenced to do what he did because he did not want to be the cause of a plant shutdown.
We would be very interested to see how much probing was done by the NRC investigators, or Entergy’s attorneys, of this individual’s motive, particularly in terms of any perceived pressure to keep the plant operating. Such pressure needn’t come from Entergy, it seems self-evident that Indian Point’s licensing situation and the long standing political opposition within New York State poses an existential threat to the plant. If his motive was just a matter of a revised test “theory”, were these the first out-of-spec fuel oil test results on his watch? If there had been others, how were they handled? How long had he been in the position? Had he initiated any other actions prior to this time to investigate the testing protocol? As we noted in our post dated September 12, 2013 regarding the NRC’s Information Notice on willful violations, in none of the cited examples did the NRC provide any perspective on the motives of the individuals or the potential effects of the environment within which they were working.
Safety and Safety Culture
How does all of this shed any light on safety and safety culture?
A key dimension of safety culture is the accurate assessment of safety significance. The position of Entergy, and adopted by the NRC***, was that the actual impact of the violations on reactor safety was not significant. [Ref 4, Encl 2, slide 36] Also note that NRC finds that all of this is in the ROP category for “green” significance. The argument is a familiar one. TS limits are conservative and below what is actually “OK”. And if particulates are a problem there are filters on the diesel generators, and these can be changed out during operation of the diesels if necessary. This is a familiar characterization - safety significance is evaluated within the strict boundaries of the NRC’s safety construct of design basis assumptions, almost exclusively hardware based. As we noted in our September 24, 2013 post, this ignores the larger environment and “system” within which people actually function.
The Synergy Safety Culture Survey conducted from Feb to April 2012 is cited as finding a “healthy work environment in Chemistry Department” - yet this was at the very time test results were being falsified by the manager and employees were resorting to the ECP to raise issues. Other assessments by the NRC and INPO also did not identify issues. [Ref 4, Encl 2, slide 29]. There is reference to an “independent investigation” of the employee concerns but the documentation does not reveal who did the investigation or its findings. The investigation found “no one interviewed” had a reluctance to raise an issue. Nowhere is the prior use of the Ethics Line and ECP by several individuals on an anonymous basis explained.
Something that is hard to square is the NRC assertion that there is a strong link between willful violations and safety culture, and the results of these various assessments at Indian Point by Synergy, the NRC and INPO. So if there is a link, and safety culture assessments don’t reveal its presence, are the assessments valid? Or if the assessments are valid, is there really a link with willful misconduct?
Here’s our take. Willful misconduct is an indication of an issue with the safety culture. But the issue arises out of a broader and more complex context than the NRC or industry is willing to address. At Indian Point there is an overriding operating context where the extension of the plants’ operating licenses is being contested by powerful political forces in New York State. If the licenses are not extended, the plants close and people lose their jobs. This is not theoretical as the Entergy-owned plant, Vermont Yankee, is doing just that. If you are an employee at Indian Point, you must feel that pressure every day. When an issue comes up such as failed diesel fuel tests that could result in temporary shutdown of both units, it is an additional threat to the viability of the plant. That pressure can create a powerful desire to rationalize the fuel tests are not valid and/or that slightly contaminated fuel isn’t a significant safety concern because…[see Entergy and NRC agreement that it is not a significant safety concern]. So there is a situation where there is an immediate and significant penalty (shutdown of both units) versus a test result that may or may not be valid or of real safety significance. The result: deliberate misconduct in burying the test results but also very possibly (I am speculating) the individual and others in the organization can still believe that safety is not impacted. As actions are consistent with “real” safety significance, it preserves the myth that safety culture is still healthy.
* As stated in the NRC Enforcement Policy (on page 9, section 2.2.1.d): “Willful violations are of particular concern because the NRC’s regulatory program is based on licensees and their contractors, employees, and agents acting with integrity and communicating with candor. The Commission cannot tolerate willful violations. Therefore, a violation may be considered more significant than the underlying noncompliance if it includes indications of willfulness.” [NRC Information Notice 2013-15]
** The sequence of events starting in March 2012 in response to RFOST sample (by off-site testing lab) being out of spec: the RFOST is declared inoperable but a supervisor declares that the sample test method was not appropriate, the department procedure is revised to allow on-site testing of a new sample (what was site review process? procedure revision appears to have occurred and become effective in one day), and the test results are now found acceptable. This allows the RFOST to be declared operable. Without telling anyone, the former Chem Mgr sends a split sample for off-site testing and it comes back over spec. Why wouldn’t plant management have required a split sample in the first place to verify on-site test? Two employee concerns are filed, the ML investigation is initiated and the Chemistry Manager resigns. At the next sampling in mid-April, once again the on-site analysis finds the sample to be within spec but management now requires outside testing in light of the resignation of the Chemistry Manager. Outside test indicates out-of-spec but an “evaluation” concludes that the in-house results are valid and RFOST remains “operable”. Another month goes by and sample is taken in late May. Sample sent outside, late June results indicate out-of-spec. This time the RFOST is declared inoperable. Not clear if late May sample was tested on-site (or why not) and why this time the outside test result is deemed valid. A final footnote, one of the corrective actions for this event was to discontinue on-site oil analysis but no discussion of why, or why it had been approved in the first place.
*** “the underlying technical findings would have been evaluated as having very low safety significance (i.e. green) under the Reactor Oversight Process (ROP) because the higher fuel oil particulate concentration would not have impacted the ability of the EDGs to fulfill their safety function.” [Ref 4, p. 3]
