The March 2012 NRC Regulatory Information Conference included a session on the NRC’s Safety Culture Policy Statement. NRC personnel made most of the session presentations but there was one industry report on the NEI’s safety culture initiative. The NEI presentation* included the figure shown below which we’ll assume represents industry’s current schematic for how a site’s safety culture should be assessed and maintained.
The good news here is the central role of the site’s corrective action program (CAP). The CAP is where identified issues get evaluated, prioritized and assigned; it is a major source for changes to the physical plant and plant procedures. A strong safety culture is reflected in an efficient, effective CAP and vice versa.
Another positive aspect is the highlighted role of site management in responding to safety culture issues by implementing appropriate changes in site policies, programs, training, etc.
We also approve of presentation text that outlined industry’s objective to have “A repeatable, holistic approach for assessing safety culture on a continuing basis” and to use “Frequent evaluations [to] promote sensitivity to faint signals.”
Opportunities for Improvement
There are some other factors, not shown in the figure or the text, that are also essential for establishing and maintaining a strong safety culture. One of these is the site’s decision making process, or processes. Is decision making consistently conservative, transparent, robust and fair? How is goal conflict handled? How about differences of opinion? Are sensors in place to detect risk perception creep or normalization of deviance?
Management commitment to safety is another factor. Does management exercise leadership to reinforce safety culture and is management trusted by the organization?
A third set of factors establishes the context for decision making and culture. What are corporate’s priorities? What resources are available to the site? Absent sufficient resources, the CAP and other mechanisms will assign work that can’t be accomplished, backlogs will grow and the organization will begin to wonder just how important safety is. Finally, what are management’s performance objectives and incentive plan?
One may argue that the above “opportunities” are beyond the scope of the industry safety culture objective. Well, yes and no. While they may be beyond the scope of the specific presentation, we believe that nuclear safety culture can only be understood and possibly influenced by accepting a complete, dynamic model of ALL the factors that affect, and are affected by, safety culture. Lack of a system view is like trying to drive a car with some of the controls missing—it will eventually run off the road.
This month the Nuclear Energy Agency, a part of the Organization for Economic Co-Operation and Development, published a report on problems identified and lessons learned at nuclear plants during the construction phase. The report focuses on three plants currently under construction and also includes incidents from a larger population of plants and brief reviews of other related studies.
The report identifies a litany of problems that have occurred during plant construction; it is of interest to us because it frequently mentions safety culture as something that needs to be emphasized to prevent such problems. Unfortunately, there is not much usable guidance beyond platitudinous statements such as “Safety culture needs to be established prior to the start of authorized activities such as the construction phase, and it is applied to all participants (licensee, vendor, architect engineer, constructors, etc.)”, “Safety culture should be maintained at very high level from the beginning of the project” and, from an U.K. report, “. . . an understanding of nuclear safety culture during construction must be emphasized.”*
These should not be world-shaking insights for regulators (the intended audience for the report) or licensees. On the other hand, the industry continues to have problems that should have been eliminated after the fiascos that occurred during the initial build-out of the nuclear fleet in the 1960s through 1980s; maybe it does need regular reminding of George Santayana’s aphorism: “Those who cannot remember the past are condemned to repeat it.”
(Ed. note: We have asked Bill Mullins to develop occasional posts for Safetymatters. His posts will focus on, but not be limited to, the Hanford Waste Treatment Plant aka the Vit Plant.)
In a recent post the question was posed: “Can reality in the nuclear operating environment be similar (to the challenges of production pressures on scientists), or is nuclear somehow unique and different?” In a prior post a Chief Nuclear Officer is quoted: “ . . the one issue is our corrective action program culture, our -- and it’s a culture that evolved over time. We looked at it more of a work driver, more of a -- you know, it’s a way to manage the system rather than . . . finding and correcting our performance deficiency.”
Another recent post describes the inherently multi-factor and non-linear character of what we’ve come to refer to as “Nuclear Safety Culture.” Bob Cudlin observed: “We think there are a number of potential causes that are important to ensuring strong safety culture but are not receiving the explicit attention they deserve. Whatever the true causes we believe that there will be multiple causes acting in a systematic manner - i.e., causes that interact and feedback in complex combinations to either reinforce or erode the safety culture state.”
I’d like to suggest a framework in which these questions and observations can be brought into useful relationship for thinking about the future of the US National Nuclear Energy Enterprise (NNEE).
This week I read yet another report on the Black Swan at Fukushima – this one representing views of US Nuclear industry heavy weights. It is just one of perhaps a dozen reviews, complete or on-going, that are adding to the stew pot of observations, findings, and recommendations about lessons to be learned from those “wreck the plant” events. I was wondering how all this “stuff” comes together in a manner that gives confidence that the net reliability of the US NNEE is increased rather than encumbered.
Were all these various “nuclear safety” reports scientific papers of the type referred to in the recent news story, then we would understand how they are “received” into the shared body of knowledge. Contributions would be examined, validations pursued, implications assessed, and yes, rewards or sanctions for work quality distributed. This system for the conduct of scientific research is very mature and has seemingly responded well to the extraordinary growth in volume and variety of research during the past half-century.
In the case of the Fukushima reports (and I’d suggest as validated by the corresponding pile of Deepwater Horizon reviews) there is no process akin to the publishing standards commonly employed in science or other academic research. In form, industrial catastrophes are typically investigated with some variation of causal analysis; also typically a distinguished panel of “experts” is assembled to conduct the review.
The credentials of those selected experts are relied upon to lend gravity to report results; this is generally in lieu of any peer or independent stakeholder review. An exception to this occurs when legislative hearings are convened to receive testimony from panel members and/or the responsible officials implicated in the events – but these second tier reviews are more often political theater than exercises in “seeking to understand.”
Since the TMI accident this trial by Blue Ribbon Panel methodology has proliferated; often firms such a BP hire such reviews (e.g. the Baker Panel on Texas City) to be done for official stakeholders that are below the level of regulatory or legislative responsibility. In the case of Deepwater Horizon and Fukushima it has been virtually open season for interested parties with any sort of credentialed authority (i.e. academic, professional society, watchdog group, etc.) to offer up a formal assessment of these major events.
And today of course we have the 24 hour news cycle with its voracious maw and indiscriminate headline writers; and let’s not forget the opinionated individuals like me – blogging furiously away with no authentic credentials but personal experience! How, I ask myself, does “sense-making” occur across the NNEE in this flurry of bits and bytes – unencumbered by the benefit of a reasoning tradition such as the world of scientific research? Not very well would be my conclusion.
There would appear to be an unexamined assumption that some mechanisms do exist to vet all the material generated in these investigation reports, but that seems to be susceptible to the kind of “forest lost for the trees” misperception cited in the Chief Nuclear Officer’s quote regarding corrective action systems becoming “the way we think about managing work.” I can understand how, for a line manager at a single nuclear plant site that is operating in the main course of its life cycle, a scarce resource pot would lead to focusing on every improvement opportunity you’d like to address appearing as a “corrective action.” I would go a step further and say that given the domination of 10 CFR 50 Appendix B on the hierarchical norms for “quality” and “safety” that managing to a single “list” makes sense – if only to ensure that each potential action is evaluated for its nuclear licensing implications.
At the site level, the CNO has a substantial and carefully groomed basis for establishing the relative significance of each material condition in the plant; in most instances administrative matters are brightly color-coded “nuclear” or “other.” As we move up the risk-reckoning ladder through corporate decision-making and then branching into a covey of regulatory bodies, stockholder perspectives, and public perceptions, the purity of issue descriptions degrades – benchmarks become fuzzy.
The overlap of stakeholder jurisdictions presents multiple perspectives (via diverse lexicons) for what “safety,” “risk,” and “culture” weights are to be assigned to any particular issue. Often the issue as first identified is a muddle of actual facts and supposition which may or may not be pruned upon further study. The potential for dilemmas, predicaments, and double-binding stakeholder expectations goes up dramatically. I would suggest that responses to the recent spate of high-profile nuclear facility events, beginning with the Davis-Besse Reactor Pressure Vessel Head near-miss, has provoked a serious cleavage in our collective ability to reason prudently about the policy, industrial strategy, and regulatory levels of risk. The consequences of this cleavage are to increase the degree of chaotic programmatic action and to obscure the longer term significance of these large-scale, unanticipated/unwelcome events, i.e., Black Swan vulnerabilities.
In the case of the NNEE I hypothesize that we are victims of our own history – and the presumption of exceptional success in performance improvement that followed the TMI event. With the promulgation of the Reactor Oversight Process in 1999, NRC and the industry appeared to believe that a mature understanding of oversight and self-governance practice existed and that going forward clarity would only increase regarding what factors were important to sustained high reliability across the entire NNEE. That presumption has proven a premature one, but it does not appear from the Fukushima responses that many in leadership positions recognize this fact. Today, the US NNEE finds itself trapped in a “limits to growth system.” That risk-reckoning system institutionalizes a series of related conclusions about the overall significance of nuclear energy health hazards and their relationship to other forms of risk common to all large industrial sectors.
The NNEE elements of thought leadership appear to act (on the evidence of the many Fukushima reports) as if the rationale of 10 CFR 50 Appendix B regarding “conditions adverse to quality” and the preeminence of “nuclear safety corrective actions” is beyond question. It’s time to do an obsolescence check on what I’ve come to call the Nuclear Fear Cycle.
Quoting Bob Cudlin again: “Whatever the true causes we believe that there will be multiple causes acting in a systematic manner - i.e., causes that interact and feedback in complex combinations to either reinforce or erode the safety culture state.” You are invited to ponder the following system.
(Mr. Mullins is a Principal at Better Choices Consulting.)
An article in the New York Times* earlier this week caught our attention as part of our contemplation of the causes of safety culture issues and effectiveness. The article itself is about the increasing incidence of misconduct by scientists in their research and publications, particularly in scientific journals. There may in fact be a variety of factors that are responsible, including just the sheer accessibility of journal published research and the increased opportunity that errors will be spotted. But the main thrust of the article is that other more insidious forces may be responsible:
“But other forces are more pernicious. To survive professionally, scientists feel the need to publish as many papers as possible….And sometimes they cut corners or even commit misconduct to get there.”
The article goes on to describe how in the scientific community the ability to publish is key to professional recognition, advancement and award of grant money. There is enormous pressure to publish first and publish often to overcome “cutthroat competition”.
So how do retractions of scientific papers relate to nuclear safety culture? In the most general sense the presence and impact of “pressure” on scientists reminds us of the situation in nuclear generation - now very much a high stakes business - and the consequent pressure on nuclear managers to meet business goals and in some cases, personal compensation goals. Nuclear personnel (engineers, managers, operators, craftsmen, etc.), like the scientists in this article, are highly trained and expected to observe certain cultural norms; a strong safety culture is expected. For scientists there is adherence to the scientific method itself and the standards for integrity of their peer community. Yet both may be compromised when the desire for professional success becomes dominant.
The scientific environment is in most ways much simpler than a nuclear operating organization and this may help shed light on the causes of normative failures. Nuclear organizations are inherently large and complex. The consideration of culture often becomes enmeshed in issues such as leadership, communications, expectations, pronouncements regarding safety priorities, perceptions, SCWE, etc. In the simpler scientific world, scientists are essentially sole proprietors of their careers, even if they work for large entities. They face challenges to their advancement and viability, they make choices, and sometimes they make compromises. Can reality in the nuclear operating environment be similar, or is nuclear somehow unique and different?
The promulgation of the NRC’s safety culture policy statement and industry efforts to remain out in front of regulatory scrutiny have led to increasing attention to identifying safety culture issues and achieving a consistently strong safety culture.
The typical scenario for the identification of safety culture problems starts with performance deficiencies of one sort or another, identified by the NRC through the inspection process or internally through various quality processes. When the circumstances of the deficiencies suggest that safety culture traits, values or behaviors are involved, safety culture may be deemed in need of strengthening and a standard prescription is triggered. This usually includes the inevitable safety culture assessment, retraining, re-iteration of safety priorities, re-training in safety culture principles, etc. The safety culture surveys focus on perceptions of problems and organizational “hot spots” but rarely delve deeply into underlying causes. Safety culture surveys generate anecdotal data based on the perceptions of individuals, primarily focused on whether safety culture traits are well established but generally not focused on asking “why” there are deficiencies.
This approach to safety culture seems to us to suffer from several limitations. One is that the standard prescription does not necessarily yield improved, sustainable results, an indication that symptoms are being treated instead of causes. And therein is the source of the other limitation, a lack of explicit consideration of the possible causes that have led to safety culture being deficient. The standard prescribed fixes include an implicit presumption that safety culture issues are the result of inadequate training, insufficient reinforcement of safety culture values, and sometimes the catchall of “leadership” shortcomings.
We think there are a number of potential causes that are important to ensuring strong safety culture but are not receiving the explicit attention they deserve. Whatever the true causes we believe that there will be multiple causes acting in a systematic manner - i.e., causes that interact and feedback in complex combinations to either reinforce or erode the safety culture state. For now we want to use this post to highlight the need to think more about the reasons for safety culture problems and whether a “causal chain” exists. Nuclear safety relies heavily on the concept of root causes as a means to understand the origin of problems and a belief that “fix-the-root cause” will “fix-the-problem”. But a linear approach may not be effective in understanding or addressing complex organizational dynamics, and concerted efforts in one dimension may lead to emergent issues elsewhere.
In upcoming posts we’ll explore specific causes of safety culture performance and elicit readers’ input on their views and experience.
Things have gone from bad to worse for Fort Calhoun. The plant shut down in April 2011 for refueling, but the shutdown was extended to address various issues, including those associated with Missouri River flooding in summer 2011. The plant’s issues were sufficiently numerous and significant that the NRC issued a CAL specifying actions OPPD had to take before restarting.
In addition to these “normal” issues, a fire occurred in June 2011—an incident that has just gotten them a “Red” finding from the NRC. Currently, it is the only plant in the country under NRC Inspection Manual Chapter 0350, which includes a restart checklist. As part of the restart qualification, the NRC will review OPPD’s third-party safety culture survey and, if they aren’t satisfied with the results, NRC will conduct its own safety culture assessment.*
Focusing a little more on Fort Calhoun’s safety culture, one particular item caught our attention: OPPD’s CNO saying, during an NRC-OPPD meeting, that one of their basic problems was their corrective action program culture. (The following is an unscripted exchange, not prepared testimony.)
“Commissioner Apostolakis: . . . what I would be more interested in is to know, in your opinion, what were the top two or three areas where you feel you went wrong and you ended up in this unhappy situation?
“[OPPD CNO] David Bannister: . . . the one issue is our corrective action program culture, our -- and it’s a culture that evolved over time. We looked at it more of a work driver, more of a -- you know, it’s a way to manage the system rather than . . . finding and correcting our performance deficiency.”**
Note the nexus between the culture and the CAP, with the culture evolving to accept a view of the CAP as a work management system rather than the primary way the plant identifies, analyzes, prioritizes and fixes its issues. Notwithstanding Fort Calhoun’s culture creep, the mechanics and metrics of an effective CAP are well-known to nuclear operators around the world. It is a failure of management if an organization loses track of the ball in this area.
What’s Going to Happen?
I have no special insight into this matter but I will try to read the tea leaves. Recently, the NRC has been showing both its “good cop” and “bad cop” personas. The good cop has approved the construction of multiple new nuclear units, thus showing that the agency does not stand in the way of industry extension and expansion.
Meanwhile, the bad cop has his foot on the necks of a few problem plants, including Fort Calhoun. The plant is an easy target: it is the second-smallest plant in the country and isolated (OPPD has no other nuclear facilities). The NRC will not kill the plant but may leave it twisting in the wind indefinitely, reminding us of Voltaire’s famous observation in Candide:
“. . . in this country, it is wise to kill an admiral from time to time so to encourage the others.”
* Fort Calhoun Station Manual Chapter 0350 Oversight Panel Charter (Jan. 12, 2012) ADAMS ML120120661.
** NRC Public Meeting Transcript, Briefing on Fort Calhoun (Feb. 22, 2012) p. 62 ADAMS ML120541135.
It may seem odd to find a source of fresh air in the context of the Massey coal mine disaster of 2010, a topic on which we have posted before. But the news last week of a former mine supervisor’s guilty plea yielded some very direct observations on the breakdown of safety in the mine. In a Wall Street Journal piece on March 29, 2012, it was reported:
“Booth Goodwin, the U.S. Attorney in Charleston, W.Va., wrote in the plea agreement that "‘laws were routinely violated’ by Massey because of a belief that ‘following those laws would decrease coal production.’"
Sometimes it takes a lawyer’s bluntness to cut through all the contributing circumstances and symptoms of a safety failure and place a finger directly on the cause. How often have you seen such unvarnished truth telling with regard to safety culture issues at nuclear plants?
“[The supervisor] specifically pleaded guilty to tipping off miners underground about inspections, falsifying record books, illegally rewiring a mining machine to operate without a functioning methane monitor and altering the mine's ventilation to trick a federal inspector.”
The above findings are more typical of what one sees in nuclear plant inspection reports and which are attributed to lack of strong safety culture. This in turn triggers the inevitable safety culture assessments, retraining, re-iteration of safety priorities, etc that appear to be the standard prescription for a safety culture “fever”. But what - continuing a not so good medical analogy - is causing the fever? And why would one expect that the one size fits all prescription is the right answer?
To us it gets down to something that isn’t receiving enough attention. What are the root causes of the problems that are typically associated with a finding that safety culture needs to be strengthened? We will share our thoughts, and ask for yours, in an upcoming post.
