Willful Violations at Indian Point

We report in this post on a situation that developed at Indian Point more than two years ago and was just recently closed out via NRC notices of violation to an individual (a Chemistry Manager for Entergy Nuclear Operations) and to Entergy Nuclear Operations itself. 

What should we make of another willful misconduct episode?  A misguided individual who made some bad choices but where the actual impact on safety (per Entergy and the NRC) was not significant?  The individual resigned (and plead to a felony conviction and probation), corrective actions to reinforce proper behaviors have been taken, and violations issued...what difference does it make?

The Events Surrounding the Misconduct

We are attaching a series of references as they contain more detail than we can recount in a blog post.  In particular Reference 4 provides the most comprehensive rendition of the relevant events.  Very briefly this is what occurred: During 2011 routine testing of diesel fuel oil at Indian Point (IP), as required by Tech Specs, indicated that the limits on particulate concentration were exceeded.  The Chemistry Manager with responsibility for this testing did not report (initiate Condition Reports) the anomalous results which would have resulted in the reserve fuel oil storage tank (RFOST) being declared inoperable.  The LCO is 30 days and if operability was not restored, shutdown of both IP units would have been required. [Ref 2, Cover Letter]  In early 2012 as part of a systems engineering self-assessment, the anomalous results and lack of reporting were identified.  The Chemistry Manager falsely indicated that re-sampling and testing had been performed which were acceptable.  He subsequently made false data entries to support this story.

A short time later employee concerns were filed via the Entergy Ethics Line and the Employee Concerns Program (ECP).  Entergy initiated an investigation using outside attorneys (Morgan Lewis).  At the same time the NRC initiated an Office of Investigations (OI) investigation.  The Chemistry Manager refused to cooperate in the investigation and resigned.  Subsequent testing of the fuel oil indicated limits were being exceeded and compensatory actions were taken.  Pursuant to the investigations the Chemistry Manager admitted willful misconduct.  The US Attorney issued a criminal complaint and ultimately the manager plead to a felony and received probation.  Entergy was cited for a Severity Level III violation, civil penalty waived.

Further Observations

Plowing through the documentation of this issue left us with a few lingering questions.  One is with regard to the sanitized LER that Entergy submitted to the NRC in August 2012.  The LER makes no mention of the filing of employee concerns, investigation by outside attorneys or the NRC OI investigation.  For that matter the LER never mentions that the cause of the event was willful misconduct by a department manager.  Rather it characterizes the situation in the abstract - as a failure to use the corrective action program.  In other words a whole lot was happening in the background which would cast the event in a different light, including its potential significance.*

While the cited violations are linked to the misconduct of the Chemistry Manager, it appears there had been ongoing issues within the Chemistry Department for some time: entering test data diligently, understanding the significance of the data, and initiating CRs.  “The circumstances surrounding the violations are of concern to the NRC because they indicate a lack of consideration for (and/or knowledge of) TS requirements by ENO Chemistry staff.  The NRC also noted that the Chemistry Manager would not have had the opportunity to commit the violations had ENO staff exhibited the proper regard for the site TS.”  [Ref 4, p. 4]  But in its chronology of events, Entergy contends that in March 2102 there was “no reason to question the integrity of former Chemistry Manager…” [Ref 4, Encl 2, slide 15].  Perhaps not the integrity, but what about management effectiveness? 

Further context.  Entergy gives itself credit for how it responded to the evolving situation.  They highlight that a self-assessment team identified the anomalies (true), that employees raised concerns through established programs (true), that Entergy conducted an investigation (true).  [Ref 4, Encl 2, slide 35]  But what is missing is that normal business processes (management oversight, QA audits, or Chemistry Department personnel) did not identify the anomalies prior to the self-assessment; that employees felt the need to use the Ethics Line and the ECP rather than directly raising within the management chain; that upon discovery of the anomalies, it appears that Entergy went to great lengths to avoid declaring that the fuel oil did not meet specs.**  The net result is that the RFOST was able to be maintained as operable for almost three months before definitive action was taken to filter the oil. [Ref 4, Encl 2, slides 17-21]

Why?

The most interesting and relevant question posed by these events is why did the Chemistry Manager take the actions he did?  “The Manager said that he falsified the data because he needed more time to prove his theory [that the IP Chemistry Department’s sampling practices were poor] and incorporate new test methods, and he had not wanted the plant to unnecessarily shut down.”  [Ref 2, Encl 1] That is the extent of what the NRC reports on its investigation of the motive of the Chemistry Manager.  An employee for 29 years undertakes a series of deliberate violations of his professional responsibilities “to prove his theory”.  Perhaps. 

One of the final corrective actions implemented for this event occurred in December 2013 when the General Manager for Plant Operations briefed the Department Managers on deliberate misconduct.  Included was a statement, "If we have to shutdown the plant we will do so". [Ref 4, Encl 2, slide 32] Without reading too much into a single bullet point, one wonders if this is a tacit acknowledgment by Entergy that the Chemistry Manager may have been influenced to do what he did because he did not want to be the cause of a plant shutdown.

We would be very interested to see how much probing was done by the NRC investigators, or Entergy’s attorneys, of this individual’s motive, particularly in terms of any perceived pressure to keep the plant operating.  Such pressure needn’t come from Entergy, it seems self-evident that Indian Point’s licensing situation and the long standing political opposition within New York State poses an existential threat to the plant.  If his motive was just a matter of a revised test “theory”, were these the first out-of-spec fuel oil test results on his watch?  If there had been others, how were they handled?  How long had he been in the position?  Had he initiated any other actions prior to this time to investigate the testing protocol?  As we noted in our post dated September 12, 2013 regarding the NRC’s Information Notice on willful violations, in none of the cited examples did the NRC provide any perspective on the motives of the individuals or the potential effects of the environment within which they were working.

Safety and Safety Culture

How does all of this shed any light on safety and safety culture? 

A key dimension of safety culture is the accurate assessment of safety significance.  The position of Entergy, and adopted by the NRC***, was that the actual impact of the violations on reactor safety was not significant. [Ref 4, Encl 2, slide 36]  Also note that NRC finds that all of this is in the ROP category for “green” significance. The argument is a familiar one.  TS limits are conservative and below what is actually “OK”.  And if particulates are a problem there are filters on the diesel generators, and these can be changed out during operation of the diesels if necessary.  This is a familiar characterization - safety significance is evaluated within the strict boundaries of the NRC’s safety construct of design basis assumptions, almost exclusively hardware based.  As we noted in our September 24, 2013 post, this ignores the larger environment and “system” within which people actually function. 

The Synergy Safety Culture Survey conducted from Feb to April 2012 is cited as finding a “healthy work environment in Chemistry Department” - yet this was at the very time test results were being falsified by the manager and employees were resorting to the ECP to raise issues.  Other assessments by the NRC and INPO also did not identify issues. [Ref 4, Encl 2, slide 29].  There is reference to an “independent investigation” of the employee concerns but the documentation does not reveal who did the investigation or its findings.  The investigation found “no one interviewed” had a reluctance to raise an issue.  Nowhere is the prior use of the Ethics Line and ECP by several individuals on an anonymous basis explained. 

Something that is hard to square is the NRC assertion that there is a strong link between willful violations and safety culture, and the results of these various assessments at Indian Point by Synergy, the NRC and INPO.  So if there is a link, and safety culture assessments don’t reveal its presence, are the assessments valid?  Or if the assessments are valid, is there really a link with willful misconduct? 

Here’s our take.  Willful misconduct is an indication of an issue with the safety culture.  But the issue arises out of a broader and more complex context than the NRC or industry is willing to address.  At Indian Point there is an overriding operating context where the extension of the plants’ operating licenses is being contested by powerful political forces in New York State.  If the licenses are not extended, the plants close and people lose their jobs.  This is not theoretical as the Entergy-owned plant, Vermont Yankee, is doing just that.  If you are an employee at Indian Point, you must feel that pressure every day.  When an issue comes up such as failed diesel fuel tests that could result in temporary shutdown of both units, it is an additional threat to the viability of the plant.  That pressure can create a powerful desire to rationalize the fuel tests are not valid and/or that slightly contaminated fuel isn’t a significant safety concern because…[see Entergy and NRC agreement that it is not a significant safety concern].  So there is a situation where there is an immediate and significant penalty (shutdown of both units) versus a test result that may or may not be valid or of real safety significance.  The result: deliberate misconduct in burying the test results but also very possibly (I am speculating) the individual and others in the organization can still believe that safety is not impacted.  As actions are consistent with “real” safety significance, it preserves the myth that safety culture is still healthy.


*  As stated in the NRC Enforcement Policy (on page 9, section 2.2.1.d): “Willful violations are of particular concern because the NRC’s regulatory program is based on licensees and their contractors, employees, and agents acting with integrity and communicating with candor. The Commission cannot tolerate willful violations. Therefore, a violation may be considered more significant than the underlying noncompliance if it includes indications of willfulness.” [NRC Information Notice 2013-15]

**  The sequence of events starting in March 2012 in response to RFOST sample (by off-site testing lab) being out of spec: the RFOST is declared inoperable but a supervisor declares that the sample test method was not appropriate, the department procedure is revised to allow on-site testing of a new sample (what was site review process? procedure revision appears to have occurred and become effective in one day), and the test results are now found acceptable.  This allows the RFOST to be declared operable. Without telling anyone, the former Chem Mgr sends a split sample for off-site testing and it comes back over spec.  Why wouldn’t plant management have required a split sample in the first place to verify on-site test?  Two employee concerns are filed, the ML investigation is initiated and the Chemistry Manager resigns.  At the next sampling in mid-April, once again the on-site analysis finds the sample to be within spec but management now requires outside testing in light of the resignation of the Chemistry Manager.  Outside test indicates out-of-spec but an “evaluation” concludes that the in-house results are valid and  RFOST remains “operable”.  Another month goes by and sample is taken in late May.  Sample sent outside, late June results indicate out-of-spec.  This time the RFOST is declared inoperable.  Not clear if late May sample was tested on-site (or why not) and why this time the outside test result is deemed valid.  A final footnote, one of the corrective actions for this event was to discontinue on-site oil analysis but no discussion of why, or why it had been approved in the first place.

***  “the underlying technical findings would have been evaluated as having very low safety significance (i.e. green) under the Reactor Oversight Process (ROP) because the higher fuel oil particulate concentration would not have impacted the ability of the EDGs to fulfill their safety function.” [Ref 4, p. 3]

References

1 - J.A. Ventosa (Entergy) to NRC, Licensee Event Report # 2012-007-00 (Aug. 20, 2012).  ADAMS ML12235A541.

2 - NRC to J. Ventosa, NRC Inspection Report Nos. 05000247/2013011 & 05000286/2013011 and NRC Office of Investigation Reports No. 1-2012-036 (Dec. 18, 2013)  ADAMS ML13354B806.

3 - NRC to D. Wilson (former Chemistry Mgr.), Notice of Violation and Order Prohibiting Involvement in NRC-Licensed Activities (April 29, 2014).  ADAMS ML14118A337.

4 - NRC to J. Ventosa, Notice of Violation (April 29, 2014).  ADAMS ML14118A124.

WIPP - Release the Hounds

(Ed. note: This is Safetymatters’ second post on the Phase 1 WIPP report.  Bob and I independently saw the report, concluded it raised important questions about DOE and its investigative process and headed for our keyboards.  We will try to get an official response to our posts—but don’t hold your breath.) 

Earlier this week the DOE released its Accident Investigation Report on the Radiological Release Event at the Waste Isolation Pilot Plant.  The report is a prodigious effort in the just over two months since the event.  It is also a serious indictment of DOE’s management of WIPP and arguably, the DOE itself.  There is however a significant flaw in the investigation and report: the investigators were kept on too tight a leash.  Itemization of failures, particularly pervasive failures, without pursuing how and why they occurred is not sufficient.  It also highlights the essence and value of systems analysis - identifying the fundamental dynamics that produced the failures and solutions that change those dynamics.

At first blush the issuance of yet another report on safety issues and safety management performance at a DOE facility would hardly merit a rush to the keyboard to dissect the findings.  Yet we believe this report is a tipping point in the pervasive and continuing issues at DOE facilities and should be a call for much more aggressive action.  It doesn’t take long for the report to get to the point in the Executive Summary:

“The Board identified the root cause of Phase 1 of the investigation of the release of radioactive material from underground to the environment to be NWP’s and CBFO’s management failure to fully understand, characterize, and control the radiological hazard.” [emphasis added] (p. ES-6)  NWP is Nuclear Waste Partnership, the contractor with direct management responsibility for WIPP operations, and CBFO is the Carlsbad Field Office of the DOE.

To complete the picture the investigation board also found as a contributing cause, that DOE Headquarters oversight was ineffective.  So in sum, the board found a total failure of the management system responsible for radiological safety at the WIPP. 

Interestingly there has been a rather muted response to this report.  The DOE issued the report with a strikingly neutral press release quoting Matt Moury, Environmental Management Deputy Assistant Secretary, Safety, Security, and Quality Programs: “The Department believes this detailed report will lead WIPP recovery efforts as we work toward resuming disposal operations at the facility.”  And Joe Franco, DOE’s Carlsbad Field Office Manager: “We understand the importance of these findings, and the community’s sense of urgency for WIPP to become operational in the future.”*  (We note that both statements focus on resumption of operations versus correction of deficiencies.)  New Mexico’s U.S. Senators Udall and Heinrich called the findings “deeply troubling” but then simply noted that they expected DOE management to take the necessary corrective actions.**  If there is any sense of urgency we would think it might be directed at understanding how and why there was such a total management failure at the WIPP.

To fully appreciate the range and depth of failures associated with this event one really needs to read the board’s report.  Provided below is a brief summary of some of the highlights that illustrate the identified issues:

-    Implementation of the NWP Conduct of Operations Program is not fully compliant with DOE policy;
-    NWP does not have an effective Radiation Protection Program in accordance with 10 Code of Federal Regulations (CFR) 835, Occupational Radiation Protection;
-    NWP does not have an effective maintenance program;
-    NWP does not have an effective Nuclear Safety Program in accordance with 10 CFR 830 Subpart B, Safety Basis Requirements;
-    NWP implementation of DOE O 151.1C, Comprehensive Emergency Management System, was ineffective;
-    The current site safety culture does not fully embrace and implement the principles of DOE Guide (G) 450.4-1C, Integrated Safety Management Guide [note: findings consistent with findings of the 2012 SCWE self assessment results]; and DOE oversight of NWP was ineffective;
-    Execution of CBFO oversight in accordance with DOE O 226.1B was ineffective; and
-    As previously mentioned, DOE Headquarters (HQ) line management oversight was ineffective. (pp. ES 7-8)

Many of the specific deficiencies cited in the report are not point in time occurrences but stem from chronic and ongoing weaknesses in programs, personnel, facilities and resources. 

Losing the Scent

As mentioned in the opening paragraph we feel that while the report is of significant value it contains a shortcoming that will likely limit its effectiveness in correcting the identified issues.  In so many words the report fails to ask “Why?”  The report is a massive catalogue of failures yet never fully pursues the ultimate and most relevant question: Why did the failures occur?  One almost wonders how the investigators could stop short of systematic and probing interviews of key decision makers.

For example in the maintenance area, “The Board determined that the NWP maintenance and engineering programs have not been effective…”; “Additionally, configuration management was not being maintained or adequately justified when changes were made.”; “There is an acceptance to tolerate or otherwise justify (e.g., lack of funding) out-of-service equipment.” (p. 82)  And that’s where the analysis stops. 

Unfortunately (but predictably) what follows from the constrained analysis are equally unfocused corrective actions based on the following linear construct: “this is a problem - fix the problem”.  Even the corrective action vocabulary becomes numbingly sterile: “needs to take action to ensure…”, “needs to improve…”, “need to develop a performance improvement plan…”,  “needs to take a more proactive role…”.

We do not want to be overly critical as the current report reflects a little over two months of effort and may not have afforded sufficient time to pull the string on so many issues.  But it is time to realize that these types of efforts are not sufficient to understand, and therefore ultimately correct, the issues at WIPP and DOE and institutionalize an effective safety management system.


*  DOE press release, “DOE Issues WIPP Radiological Release Investigation Report” (April 24, 2014)  Retrieved May 5, 2014.

**  Senators Udall and Heinrich press release, “Udall, Heinrich Statement on Department of Energy WIPP Radiological Release Investigation Report” (April 24, 2014).  Retrieved May 5, 2014.

DOE Report on WIPP's Safety Culture

On Feb. 14, 2014, an incident at the Department of Energy (DOE) Waste Isolation Pilot Plant (WIPP) resulted in the release of radioactive americium and plutonium into the environment.  This post reviews DOE’s Phase 1 incident report*, with an emphasis on safety culture (SC) concerns.

From the Executive Summary

The Accident Investigation Board (the Board) concluded that a more thorough hazard analysis, coupled with a better filter system could have prevented the unfiltered above ground release. (p. ES-1)

The root cause of the incident was Nuclear Waste Partnership’s (NWP**, the site contractor) and the DOE Carlsbad Field Office’s (CBFO) failure to manage the radiological hazard. “The cumulative effect of inadequacies in ventilation system design and operability compounded by degradation of key safety management programs and safety culture [emphasis added] resulted in the release of radioactive material . . . and the delayed/ineffective recognition and response to the release.” (pp. ES 6-7)

The report presents eight contributing causes, most of which point to NWP deficiencies.  SC was included as a site-wide concern, specifically the SC does not fully implement DOE safety management policy, “[t]here is a lack of a questioning attitude, reluctance to bring up and document issues, and an acceptance and normalization of degraded equipment and conditions.”  A recent Safety Conscious Work Environment (SCWE) survey suggests a chilled work environment. (p. ES-8)

The report includes 31 conclusions, 4 related to SC.  “NWP and CBFO have allowed the safety culture at the WIPP project to deteriorate . . . Questioning attitudes are not welcomed by management . . . DOE has exacerbated the safety culture problem by referring to numbers of [problem] reports . . . as a measure of [contractor] performance . . . . [NWP and CBFO] failed to identify weaknesses in . . . safety culture.” (pp. ES 14-15, 19-20)

The report includes 47 recommendations (called Judgments of Need) with 4 related to SC.  They cover leadership (including the CBFO site manager) behavior, organizational learning, questioning attitude, more extensive use of existing processes to raise issues, engaging outside SC expertise and improving contractor SC-related processes. (ibid.)

Report Details

The body of the report presents the details behind the conclusions and recommendations.  Following are some of the more interesting SC items, starting with our hot button issues: decision making (esp. the handling of goal conflict), corrective action, compensation and backlogs. 

Decision Making

The introduction to section 5 on SC includes an interesting statement:  “In normal human behavior, production behaviors naturally take precedence over prevention behaviors unless there is a strong safety culture - nurtured by strong leadership.” (p. 61)

The report suggests nature has taken its course: WIPP values production first and most.  “Eighteen emergency management drills and exercises were cancelled in 2013 due to an impact on operations. . . .Management assessments conducted by the contractor have a primary focus on cost and schedule performance.” (p. 62)  “The functional checks on CAMs [continuous air monitors] were often delayed to allow waste-handling activities to continue.” (p. 64)  “[D]ue consideration for prioritization of maintenance of equipment is not given unless there is an immediate impact on the waste emplacement processes.” (p. ES-17)  These observations evidence an imbalance between the goals of production and prevention (against accidents and incidents) and, following the logic of the introductory statement, a weak SC.

Corrective Action

The corrective action program has problems.  “The [Jan. 2013] SCWE Self-Assessment . . . identified weaknesses in teamwork and mutual respect . . . Other than completing the [SCWE] National Training Center course, . . . no other effective corrective actions have been implemented. . . . [The Self-Assessment also ]“identified weaknesses in effective resolution of reported problems.” (p. 63)  For problems that were reported, “The Board noted several instances of reported deficiencies that were either not issued, or for which corrective action plans were not developed or acted on for months.” (p. 65)

Compensation

Here is the complete text of Conclusion 14, which was excerpted above: “DOE has exacerbated the safety culture problem by referring to numbers of ORPS [incident and problem] reports and other deficiency reporting documents, rather than the significance of the events, as a measure of performance by Source Evaluation Boards during contract bid evaluations, and poor scoring on award fee determinations.  Directly tying performance to the number of occurrence reports drives the contractor to non-disclosure of events in order to avoid the poor score. [emphasis added]  This practice is contrary to the Department’s goals of the development and implementation of a strong safety culture across our projects.” (p. ES-15)  ‘Nuff said. 

Backlogs

Maintenance was deferred if it interfered with production.  Equipment and systems were  allowed to degrade (pp. ES-7, ES-17, C-7)  There is no indication that maintenance backlogs were a problem; the work simply wasn’t done.

Other SC Issues

In addition to our Big Four and the issues cited from the Executive Summary, the report mentions the following concerns.  (A listing of all SC deficiencies is presented on p. D-3.)

• Delay in recognizing and responding to events,
• Bias for negative conclusions on Unreviewed Safety Question Determinations, and
• Infrequent presence of NWP management in the underground and surface.

Our Perspective

For starters, the Board appears to have a limited view of what SC is.  They see it as a cause for many of WIPP's problems but it can be fixed if it is “nurtured by strong leadership” and the report's recommendations are implemented.  The recommendations are familiar and can be summed up as “Row harder!”***  In reality, SC is both cause (it creates the context for decision making) and consequence (it is influenced by the observed actions of all organization members, not just senior management).  SC is an organizational property that cannot be managed directly.  

The report is a textbook example of linear, deterministic thinking, especially Appendix E (46 pgs.) on events and causal factors related to the incident.  The report is strong on what happened but weak on why things happened.  Going through Appendix E, SC is a top-level blanket cause of nuclear safety program and radiological event shortcomings (and, to a lesser degree, ventilation, CAMs and ground control problems) but there is no insight into how SC interacts with other organizational variables or with WIPP’s external (political, regulatory, DOE policy) environment. 

Here’s an example of what we’re talking about, viz., how one might gain some greater insight into a problem by casting a wider net and applying a bit of systems thinking.  The report faults DOE HQ for ineffective oversight, providing inadequate resources and not holding CBFO accountable for performance.  The recommended fix is for DOE HQ “to better define and execute their roles and responsibilities” for oversight and other functions. (p. ES-21)  That’s all what and no why.  Is there some basic flaw in the control loop involving DOE HQ, CBFO and NWP?  DOE HQ probably believes it transmits unambiguous orders and expectations through its official documents—why weren’t they being implemented in the field and why didn’t DOE know it?  Is the information flow from DOE to CBFO to NWP clear and adequate (policies, goals); how about the flow in the opposite direction (performance feedback, problems)?  Is something being lost in the translation from one entity to another?  Does this control problem exist between DOE HQ and other sites, i.e., is it a systemic problem?  Who knows.****

Are there other unexamined factors that make WIPP's problems more likely?  For example, has WIPP escaped the scrutiny and centralized controls that DOE applies to other entities?  As a consequence, has WIPP had too much autonomy to adjust its behavior to match its perception of the task environment?  Are DOE’s and WIPP’s mental models of the task environment similar or even adequate?  Perhaps WIPP (and possibly DOE) see the task environment as simpler than it actually is, and therefore the strategies for handling the environment lack requisite variety.  Was there an assumption that NWP would continue the apparently satisfactory performance of the previous contractor?  It's obvious these questions do not specifically address SC but they seek to ascertain how the organizations involved are actually functioning, and SC is an important variable in the overall system.

Contrast with Other DOE SC Investigations 

This report presents a sharp contrast to the foot-dragging that takes place elsewhere in DOE.  Why can’t DOE bring a similar sense of urgency to the SC investigations it is supposed to be conducting at its other facilities?  Was the WIPP incident that big a deal (because it involved a radioactive release) or is it merely something that DOE can wrap its head around?  (After all, WIPP is basically an underground warehouse.)  In any event, something rang DOE’s bell because they quickly assembled a 5 member board with 16 advisor/consultants and produced a 300 page report in less than two months.*****

Bottom line: You don't need to pore over this report but it provides some perspective on how DOE views SC and demonstrates that a giant agency can get moving if it's motivated to do so.


*  DOE Office of Environmental Management, “Accident Investigation Report: Radiological Release Event at the Waste Isolation Pilot Plant on February 14, 2014, Phase 1” (April 2014).  Retrieved April 30, 2014.  Our thanks to Mark Lyons who posted this report on the LinkedIn Nuclear Safety group discussion board.

**  NWP LLC was formed by URS Energy and Construction, Inc. and Babcock & Wilcox Technical Services Group, Inc.  Their major subcontractor is AREVA Federal Services, LLC.  All three firms perform work at other, i.e., non-WIPP, DOE facilities.  NWP assumed management of WIPP on Oct. 1, 2012.  From NWP website.  Retrieved May 2, 2014.

***  To the Board's credit, they did not go looking for individual scapegoats to blame for WIPP's difficulties.

****  In fairness, the report has at least one example of a feedback loop in the CBFO-NWP sub-system: CBFO's use of the condition reports as an input to NWP’s compensation review and NWP's predictable reaction of creating fewer condition reports.

*****  The Accident Investigation Board was appointed on Feb. 27, 2014 and completed its Phase 1 investigation on March 28, 2014.  The Phase 1 report was released to the public on April 22, 2014.

Safety Culture at the NRC Regulatory Information Conference

NRC Public Meeting

The NRC held their annual Regulatory Information Conference (RIC) March 11-13, 2014.  It included a session on safety culture (SC), summarized below.*

NRC Presentation

The NRC presentation reviewed their education and outreach activities on the SC Policy Statement (SCPS) and their participation in IAEA meetings to develop an implementation strategy for the IAEA Nuclear Safety Action Plan. 

The only new item was Safety Culture Trait Talk, an educational brochure.  Each brochure covers one of the nine SC traits in the SCPS, describing why the trait is important and providing examples of associated behaviors and attitudes, and an illustrative scenario. 

It appears only one brochure, Leadership Safety Values and Actions, is currently available.**  A quick read suggests the brochure content is pretty good.  The “Why is this trait important?” content was derived from an extensive review of SC-related social science literature, which we liked a lot and posted about Feb. 10, 2013.  The “What does this trait look like?” section comes from the SC Common Language initiative, which we have reviewed multiple times, most recently on April 6, 2014.  The illustrative scenario is new content developed for the brochure and provides a believable story of how normalization of deviance can creep into an organization under the skirt of an employee bonus program based on plant production.

Licensee Presentations

There were three licensee presentations, all from entities that the NRC has taken to the woodshed over SC deficiencies.  Presenting at the RIC may be part of their penance but it’s interesting to see what folks who are under the gun to change their SC have to say.

Chicago Bridge & Iron, which is involved in U.S. nuclear units currently under construction, got in trouble for creating a chilled work environment at one of its facilities.  The fixes focus on their Safety Conscious Work Environment and Corrective Action Program.   Detailed activities come from the familiar menu: policy updates, a new VP role, training, oversight, monitoring, etc.  Rapping CB&I’s knuckles certainly creates an example for other companies trying to cash in on the “Nuclear Renaissance” in the U.S.  Whatever CB&I does, they are motivated to make it work because there is probably a lot of money at stake.  The associated NRC Confirmatory Order*** summarizes the history of the precipitating incident and CB&I’s required corrective actions.

Browns Ferry has had SC-related problems for a long time and has been taken to task by both NRC and INPO.  The presentation includes one list of prior plant actions that DIDN’T work while a different list displays current actions that are supposedly working.  Another slide shows improvement in SC metrics based on survey data—regular readers know how we feel about SC surveys.  The most promising initiative they are undertaking is to align with the rest of the TVA fleet on NEI 09-07 “Fostering a Strong Nuclear Safety Culture.”  Click on the Browns Ferry label to see our posts that mention the plant.

Fort Calhoun’s problems started with the 2011 Missouri River floods and just got worse, moving them further down the ROP Action Matrix and forcing them to (among many other things) complete an independent SC assessment.  They took the familiar steps, creating policies, changing out leadership, conducting training, etc.  They also instituted SC “pulse” surveys and use the data to populate their SC performance indicators.  Probably the most important action plant owner OPPD took was to hire Exelon to manage the plant.  Fort Calhoun’s SC-related NRC Confirmatory Action Letter was closed in March 2013 so they are out of the penalty box.

Bottom line: The session presentations are worth a look.


*  RIC Session T11: Safety Culture Journeys: Lessons Learned from Culture Change Efforts (Mar. 11, 2014).  Retrieved April 25, 2014.  Slides for all the presentations are available from this page.

**  “Leadership Safety Values and Actions,” NRC Safety Culture Trait Talk, no. 1 (Mar. 2014).  ADAMS ML14051A543.  Retrieved April 25, 2014.

***  NRC Confirmatory Order EA-12-189 re: Chicago Bridge and Iron (Sept. 16, 2013).  ADAMS ML13233A432.  Retrieved April 25, 2014.

Assessing Safety Culture Using Cultural Attributes

Two weeks ago we posted on NUREG-2165, a document that formalizes a “common language” for describing nuclear safety culture (SC).  The NUREG contains a set of SC traits, attributes that define each trait and examples that would evidence each attribute.  We expressed concern about how traits and attributes could and would be applied in practice to assess SC.

Well, we didn’t have to wait very long.  This post reviews a recent International Nuclear Safety Journal article* that describes the SC oversight process developed by the Romanian nuclear regulatory agency (CNCAN).  The CNCAN process uses the International Atomic Energy Agency (IAEA) SC definition and attributes and illustrates how attributes can be used to evaluate SC.  Note that CNCAN is not attempting to directly regulate SC but they are taking comprehensive steps to evaluate and influence the licensee’s SC.

CNCAN started with the 37 IAEA attributes and decided that 20 were accessible via the normal review and inspection activities.  Some of the 20 could be assessed using licensee and related documentation, others through interviews with licensee and contractor personnel, and others by direct observation of relevant activities. 

CNCAN recognizes there are limitations to using this process, e.g., findings that reflect a reviewer’s subjective opinion, the quality of match (relevance) between an attribute and a specific technical or functional area, the quality of the information gathered and used, and over-reliance on one specific finding.  Time is also an issue.  “[A] large number of review and inspection activities are required, over a relatively long period of time, to gather sufficient data in order to make a judgement on the safety culture of an organisation as a whole.” (p. 4)

However, they are optimistic about longer-term effectiveness.  “. . . evidence of certain attributes not being met for several functional areas and processes would provide a clear indication of a problem that would warrant increased regulatory surveillance.”  In addition, “[t]he implementation of the [oversight process] proved that all the routine regulatory reviews and inspections reveal aspects that are of certain relevance to safety culture.  Interaction with plant staff during the various inspection activities and meetings, as well as the daily observation by the resident inspectors, provide all the necessary elements for having an overall picture of the safety culture of the licensee.” (ibid., emphasis added)

Our Perspective

We reviewed a draft of the CNCAN SC oversight process on March 23, 2012.  We found the treatment of issues we consider important to be generally good.  For example, in the area of decision making, goal conflict is explicitly addressed, from production vs. safety to differing personal opinions.  Corrective action (CA) gets appropriate attention, including CA prioritization based on safety significance and verification that fixes are implemented and effective.  Backlogs in many areas, including maintenance and corrective actions, are addressed.  In general, the treatment is more thorough than the examples included in the NUREG.

However, the treatment of management incentives is weak.  We favor a detailed evaluation of the senior managers’ compensation scheme focusing on how much of their compensation is tied to achieving safety (vs. production or other) goals.

So, do we feel better about the qualms we expressed over the NUREG, viz., that it is a step on the road to the bureaucratization of SC evaluation, a rigid checklist approach that ultimately creates an incomplete and possibly inaccurate picture of a plant’s SC?  Not really.  Our concerns are described below.

Over-simplification

For starters, CNCAN decided to focus on 20 attributes because they believed it was possible to gather relevant information on them.  What about the other 17?  Are they unrelated to SC simply because it might be hard to access them?

A second simplification is limiting the information search to artifacts: documents, interviews and observations.  One does not have to hold some esoteric belief, e.g., that SC is an emergent organizational property that results from the functioning of a socio-technical system, to see that focusing on the artifacts may be similar to the shadows in Plato’s cave.  Early on, the article refers to this problem by quoting from a 1999 NEA report: “the regulator can evaluate the outward operational manifestations of safety culture as well as the quality of work processes, and not the safety culture itself.” (p. 2)

Limited applicability

Romania has a single nuclear plant and what is, at heart, a one-size-fits-all approach is much more practical when “all” equals one.  This type of approach might even work in, say, France, where there are multiple plants but a single operator.  On the other hand, the U.S. currently has 32 operators reporting to 81 owners.**  Developing SC assessment techniques that are comprehensive, consistent and perceived as fair by such a large group is not a simple task.  The U.S. approach will continue to subsume SC evaluation under the ROP, which arguably ties SC evaluation to “objective” safety-related performance but unfortunately leads to de facto regulation of SC, less transparency and incomprehensible results in specific cases.***

(It could be worse.  For an example, just look at DOE where the recent “guidance” on conducting SC self-assessments led to unreliable self-assessment results that can’t be compared with each other.  For more on DOE, see our March 31, 2014 post or click on the DOE label at the bottom of this post.)

Bottom line

Ultimately the article can be summarized as follows: It’s hard, maybe impossible to directly evaluate SC but here’s what we (CNCAN) are doing and we think it works.  We say a CNCAN-style approach may be helpful but one should remain alert to important SC factors that may be overlooked.


*  M. Tronea, “Trends and Challenges in Regulatory Assessment of Nuclear Safety Culture,” International Nuclear Safety Journal, vol. 3 no. 1 (2014), pp. 1-5.  Retrieved April 14, 2014.  Dr. Tronea works for the Romanian nuclear authority (CNCAN) and is the founder/moderator of the LinkedIn Nuclear Safety group.

**  NEI website, retrieved April 15, 2014.

***  For an example, see our Jan. 30, 2013 post on Palisades. 

GM’s CEO Revealing Revelation

GM CEO Mary Barra

As most of our readers are aware General Motors has been much in the news of late regarding a safety issue associated with the ignition switches in the Chevy Cobalt.  At the beginning of April the new CEO of GM, Mary Barra, testified at Congressional hearings investigating the issue.  A principal focus of the hearings was the extent to which GM executives were aware of the ignition switch issues which were identified some ten years ago but did not result in recalls until this February.  Barra has initiated a comprehensive internal investigation of the issues to determine why it took so many years for a safety defect to be announced.

In a general sense this sounds all too familiar as the standard response to a significant safety issue.  Launch an independent investigation to gather the facts and figure out what happened, who knew what, who decided what and why.  The current estimate is that it will take almost two months for this process to be completed.  Also familiar is that accountability inevitably starts (and often ends) at the engineering and low level management levels.  To wit, GM has already announced that two engineers involved in the ignition switch issues have been suspended.

But somewhat buried in Barra’s Congressional testimony is an unusually revealing comment.  According to the Wall Street Journal, Barra said “senior executives in the past were intentionally not involved in details of recalls so as to not influence them.”*  Intentionally not involved in decisions regarding recalls - recalls which can involve safety defects and product liability issues and have significant public and financial liabilities.  Why would you not want the corporation's executives to be involved?  And if one is to believe the rest of Barra’s testimony, it appears executives were not even aware of these issues.

Well, what if executives were involved in these critical decisions - what influence could they have that GM would be afraid of?  Certainly if executive involvement would assure that technical assessments of potential safety defects were rigorous and conservative - that would not be undue influence.  So that leaves the other possibility - that involvement of executives could inhibit or constrain technical assessments from assuring an appropriate priority for safety.  This would be tantamount to the chilling effect popularized in the nuclear industry.  If management involvement creates an implicit pressure to minimize safety findings, there goes the safety conscious work environment and safety.

If keeping executives out of the decision process is believed to yield “better” decisions, it says some pretty bad things about either their competence or ethics.  Having executives involved should at least ensure that they are aware and knowledgeable of potential product safety issues and in a position to proactively assure that decisions and actions are appropriate.   What might be the most likely explanation is that executives don’t want the responsibility and accountability for these types of decisions.  They might prefer to remain protected at the safety policy level but leave the messy reality of comporting those dictates with real world business considerations to lower levels of the organization.  Inevitably accountability rolls downhill to somebody in the engineering or lower management ranks. 

One thing that is certain.  Whatever the substance and process of GM’s decision, it is not transparent, probably not well documented, and now requires a major forensic effort to reconstitute what happened and why.  This is not unusual and it is the standard course in other industries including nuclear generation.  Wouldn’t we be better off if decisions were routinely subject to the rigor of contemporaneous recording including how complex and uncertain safety issues are decided in the context of other business priorities, and by whom?


*  J.B. White and J. Bennett, "Some at GM Brass Told of Cobalt Woe," Wall Street Journal online (Apr. 11, 2014)

NRC Issues Safety Culture Common Language NUREG

The NRC has issued NUREG-2165* which formalizes the safety culture (SC) common language that has been under development since the NRC SC Policy Statement (SCPS) was issued.  On topics important to us the NUREG repeats word-for-word the text of a document** prepared after a common language workshop held January 29-30, 2013.  Both documents contain a set of SC traits, attributes that define each trait and examples that would evidence each attribute.  Because the language is the same, our opinion on the treatment of our important topics remains the same, as described in detail in our Feb. 28, 2013 post.  Specifically, the treatment of

Decision making, including the treatment of goal conflicts, is Good;

Corrective action, part of problem identification and resolution, is Satisfactory;

Management Incentives is Unsatisfactory because the associated attributes focuses on workers, not managers, and any senior management incentive program is not mentioned; and

Work Backlogs are mentioned in a couple of specific areas so the overall grade is Minimally Acceptable.

But we have one overarching concern that transcends our opinion of common language specifics.

Our Perspective

Our biggest issue with the traits, attributes and examples approach is our fear it will lead to the complete bureaucratization of SC evaluation, either consciously or unconsciously.  The examples in particular can morph into soft requirements on a physical or mental checklist.  Such an approach leads to numerous questions.  How many of the 10 traits does a healthy or positive SC exhibit?***  How many of the 40 attributes?  Are the traits equally important?  How about the attributes?  Could the weighting factors vary across plant sites?  How many examples must be observed before an attribute is judged acceptably present?

We understand the value of effective communications among regulators, licensee personnel and other stakeholders.  But we worry about possible unintended consequences as people attempt to apply the guidance in NUREG-2165, especially in the NRC’s Reactor Oversight Process (ROP).****


*  NRC NUREG-2165, “Safety Culture Common Language” (Mar. 2014).  ADAMS ML14083A200.

**  Nuclear Safety Culture Common Language 4th Public Workshop January 29-31, 2013.  ADAMS ML13031A343.

***  The NUREG-2165 text describes a “healthy” SC while the SCPS (published as NUREG/BR-0500, Rev. 1, ADAMS ML12355A122) refers to a “positive” SC.  The correct answer to “how many traits?” may be “more than ten” because the authors note “There may also be traits not included in the SCPS that are important in a healthy safety culture.” (p. 2)

****  The common language “initiative is within the Commission-directed framework for enhancing the ROP treatment of cross-cutting areas to more fully address safety culture.” (p. 3)  This may require a little linguistic jujitsu since the SCPS says “traits were not developed for inspection purposes.”

Our Gaze Returns to DOE and its Safety Culture

The Department of Energy (DOE) recently submitted a report* to the Defense Nuclear Facilities Safety Board (DNFSB) covering DOE’s evaluation of Safety Conscious Work Environment (SCWE) self-assessments at various DOE facilities.  This evaluation was included in the DOE’s Implementation Plan** (IP) developed in response to the DNFSB report, Safety Culture at the Waste Treatment and Immobilization Plant.*** (WTP, or the Vit Plant).  This post provides some background on how WTP safety culture (SC) problems led to a wider assessment of SC in DOE facilities and then reviews the current report.

Background

The DNFSB report on the WTP was issued June 9, 2011; it said the WTP SC was “flawed.”  Issues included discouraging technical dissent, goal conflicts between schedule/budget and safety, and intimidation of personnel.  We posted on the DNFSB report June 15, 2011.  The report’s recommendations included this one: that the Secretary of Energy “conduct an Extent of Condition Review to determine whether these safety culture weaknesses are limited to the WTP Project, . . .” (DNFSB, p. 6) 

After some back-and-forth between DOE and DNFSB, DOE published their IP in December 2011.  We reviewed the IP on Jan. 24, 2012.  Although the IP contained multiple action items, our overall impression was “that DOE believes there is no fundamental safety culture issue. . . . While endlessly citing all the initiatives previously taken or underway, never does the DOE reflect on why these initiatives have not been effective to date.”  So we were not exactly optimistic but DOE did say it would “conduct an Extent of Condition Review to find out whether similar safety culture weaknesses exist at other sites in addition to the WTP and whether there are barriers to strong safety culture at Headquarters and the Department as a whole (e.g., policies or implementation issues). The review will focus on the Safety Conscious Work Environment (SCWE) at each site examined.” (IP, p. 17)  In other words, SC was reduced to SCWE from the get-go.****

Part of the DOE review was to assess SCWE at a group of selected DOE facilities.  DOE submitted SC assessments covering five facilities to DNFSB on Dec. 12, 2012.  We reviewed the package in our post Jan. 25, 2013 and observed “The DOE submittal contained no meta-analysis of the five assessments, and no comparison to Vit Plant concerns.  As far as [we] can tell, the individual assessments made no attempt to focus on whether or not Vit Plant concerns existed at the reviewed facilities.”  We called the submittal “foot dragging” by DOE.

Report on SCWE Self-Assessments

A related DOE commitment was to perform SCWE self-assessments at numerous DOE facilities and then evaluate the results to determine if SCWE issues similar to WTP’s existed elsewhere.  It is important to understand that this latest report is really only the starting point for evaluating the self-assessments because it focuses on the processes used during the self-assessments and not the results obtained. 

The evaluation of the self-assessments was a large undertaking.  The evaluation team visited 22 DOE and contractor organizations and performed document reviews for 9 additional organizations, including the DOE Office of River Protection and Bechtel National, major players in the WTP drama. 

Problems abounded.  Self-assessment guidance was prepared but not distributed to all sites in a timely manner and there was no associated training.  Each self-assessment team had a “subject matter expert” but the qualifications for that role were not specified.  Data collection methods were not consistently applied and data analyses were of variable quality.  As a consequence, the self-assessment approaches used varied widely and the results obtained had variable reliability.

The self-assessment reports exhibited varying quality.  Some were satisfactory but “In many of the self-assessment reports, the overall conclusions did not accurately reflect the information in the data and analysis sections. In some cases, negative results were presented with a statement rationalizing or minimizing the issue, rather than indicating a need to find out more about the issue and resolve it.  In other cases, although data and/or analysis reflected potential problems, those problems were not mentioned in the conclusions or executive summaries, which senior management is most likely to read.” (p. 7)

The evaluation team summarized as follows: “The overall approach ultimately used to self-assess SCWE across the complex did not provide for consistent application of assessment methodologies and was not designed to ensure validity and credibility. . . . The wide variation in the quality of methodologies and analysis of results significantly reduces the confidence in the conclusions of many of the self-assessments.  Consequently, caution should be used in drawing firm conclusions about the state of SCWE or safety culture across the entire DOE complex based on a compilation of results from all the site self-assessments.” (p. iii)

“The Independent Oversight team concluded that DOE needs to take additional actions to ensure that future self-assessments provide a valid and accurate assessment of the status of the safety culture at DOE sites and organizations, . . .” (p. 8)  This is followed by a series of totally predictable recommendations for process improvements: “enhance guidance and communications,” increase management “involvement in, support for, and monitoring of site self-assessments,” and “DOE sites . . . should increase their capabilities to perform self-assessments . . .” (pp. 9-10)

Our Perspective

The steps taken to date do not inspire confidence in the DOE’s interest in determining if and what SCWE (much less more general SC) issues exist in the DOE complex.  For the facilities that were directly evaluated, we have some clues to the existence similar problems.  For the facilities that conducted self-assessments, so far we have—almost nothing.

There is one big step remaining: DOE also said it would “develop a consolidated report from the results of the self-assessments and HSS independent reviews.” (IP, p. 20)  We await that report with bated breath.

For our U.S. readers: This is your tax dollars at work. 


*  DOE Office of Enforcement and Oversight, “Independent Oversight Evaluation of Line Self-Assessments of Safety Conscious Work Environment” (Feb. 2014).

**  U.S. Dept. of Energy, “Implementation Plan for Defense Nuclear Facilities Safety Board Recommendation 2011-1, Safety Culture at the Waste Treatment and Immobilization Plant”  (Dec. 2011).

***  Defense Nuclear Facilities Safety Board, Recommendation 2011-1 to the Secretary of Energy "Safety Culture at the Waste Treatment and Immobilization Plant" (Jun 9, 2011).

****  DOE rationalized reducing the scope of investigation from SC to SCWE by saying “The safety culture issues identified at WTP are primarily SCWE issues. . .” (p. 17)  We posted a lecturette about SC being much more than SCWE here.

NRC "National Report" to IAEA

A March 25, 2014 NRC press release* announced that Chairman Macfarlane presented the Sixth National Report for the Convention on Nuclear Safety** to International Atomic Energy Agency (IAEA) member countries.  The report mentions safety culture (SC) several times, as discussed below.  There is no breaking news in a report like this.  We’re posting about it only because it provides an encyclopedic review of NRC activities including a description of how SC fits into their grand scheme of things.  We also tie the report’s contents to related posts on Safetymatters.  The numbers shown below are section numbers in the report.

6.3.11 Public Participation 

This section describes how the NRC engages with stakeholders and the broader public.  As part of such engagement, the NRC says it expects employers to maintain an open environment where workers are free to raise safety concerns. “These expectations are communicated through the NRC’s Safety Culture Policy Statement” and other regulatory directives and tools. (p. 72)  This is pretty straightforward and we have no comment.

8.1.6.2 Human Resources

Section 8 describes the NRC, from its position in the federal government to how it runs its internal activities.  One such activity is the NRC Inspector General’s triennial General Safety Culture and Climate Survey for NRC employees.  Reporting on the most recent (2012) survey, “the NRC scored above both Federal and private sector benchmarks, although in 2012 the agency did not perform as strongly as it had in the past.” (p. 96)  We posted on the internal SC survey back on April 6, 2013; we felt the survey raised a few significant issues.

10.4 Safety Culture

Section 10 covers activities that ensure that safety receives its “due priority” from licensees and the NRC itself.  Sub-section 10.4 provides an in-depth description of the NRC’s SC-related policies and practices so we excerpt from it at length.

The discussion begins with the SC policy statement and the traits of a positive (sic) SC, including Leadership, Problem identification and resolution, Personal accountability, etc.

The most interesting part is 10.4.1 NRC Monitoring of Licensee Safety Culture which covers “the policies, programs, and practices that apply to licensee safety culture.” (p. 118)  It begins with the Reactor Oversight Process (ROP) and its SC-related enhancements.  NRC staff identified 13 components as important to SC, including decision making, resources, work control, etc.  “All 13 safety culture components are applied in selected baseline, event followup, and supplemental IPs [inspection procedures].” (p. 119)

“There are no regulatory requirements for licensees to perform safety culture assessments routinely. However, depending on the extent of deterioration of licensee performance, the NRC has a range of expectations [emphasis added] about regulatory actions and licensee safety culture assessments, . . .” (p. 119)

“In the routine or baseline inspection program, the inspector will develop an inspection finding and then identify whether an aspect of a safety culture component is a significant causal factor of the finding. The NRC communicates the inspection findings to the licensee along with the associated safety culture aspect. 

“When performing the IP that focuses on problem identification and resolution, inspectors have the option to review licensee self-assessments of safety culture. The problem identification and resolution IP also instructs inspectors to be aware of safety culture components when selecting samples.” (p. 119)

“If, over three consecutive assessment periods (i.e., 18 months), a licensee has the same safety culture issue with the same common theme, the NRC may ask [emphasis added] the licensee to conduct a safety culture self-assessment.” (p. 120)

If the licensee performance degrades to Column 3 of the ROP Action Matrix and “the NRC determines that the licensee did not recognize that safety culture components caused or significantly contributed to the risk-significant performance issues, the NRC may request [emphasis added] the licensee to complete an independent assessment of its safety culture.” (p. 120)

For licensees in Column 4 of the ROP “the NRC will expect [emphasis added] the licensee to conduct a third-party independent assessment of its safety culture. The NRC will review the licensee’s assessment and will conduct an independent assessment of the licensee’s safety culture . . .” (p. 120)

ROP SC considerations “provide the NRC staff with (1) better opportunities to consider safety culture weaknesses . . . (2) a process to determine the need to specifically evaluate a licensee’s safety culture . . . and (3) a structured process to evaluate the licensee’s safety culture assessment and to independently conduct a safety culture assessment for a licensee . . . .  By using the existing Reactor Oversight Process framework, the NRC’s safety culture oversight activities are based on a graded approach and remain transparent, understandable, objective, risk-informed, performance-based, and predictable.” (p. 120)

We described this hierarchy of NRC SC-related activities in a post on May 24, 2013.  We called it de facto regulation of SC.  Reading the above only confirms that conclusion.  When the NRC asks, requests or expects the licensee to do something, it’s akin to a military commander’s “wishes,” i.e., they’re the same as orders.

10.4.2 The NRC Safety Culture 

This section covers the NRC’s actions to strengthen its internal SC.  This actions include appointing an SC Program Manager; integrating SC into the NRC’s Strategic Plan; developing training; evaluating the NRC’s problem identification, evaluation and resolution processes; and establishing clear expectations and accountability for maintaining current policies and procedures. 

We would ask how SC affects (and is affected by) the NRC’s decision making and resource allocation processes, work practices, operating experience integration and establishing personal accountability for maintaining the agency’s SC.  What’s good for the goose (licensee) is good for the gander (regulator).

Institute of Nuclear Power Operations (INPO) 

INPO also provided content for the report.  Interestingly, it is a 39-page Part 3 in the body of the report, not an appendix.  Part 3 covers INPO’s mission, organization, etc. and includes a section on SC.

6. Priority to Safety (Safety Culture)

The industry and INPO have their own definition of SC: “An organization’s values and behaviors—modeled by its leaders and internalized by its members—that serve to make nuclear safety the overriding priority.” (p. 230)

“INPO activities reinforce the primary obligation of the operating organizations’ leadership to establish and foster a healthy safety culture, to periodically assess safety culture, to address shortfalls in an open and candid fashion, and to ensure that everyone from the board room to the shop floor understands his or her role in safety culture.” (p. 231)

We believe our view of SC is broader than INPO’s.  As we said in our July 24, 2013 post “We believe culture, including SC, is an emergent organizational property created by the integration of top-down activities with organizational history, long-serving employees, and strongly held beliefs and values, including the organization's “real” priorities.  In other words, SC is a result of the functioning over time of the socio-technical system.  In our view, a CNO can heavily influence, but not unilaterally define, organizational culture including SC.” 

Conclusion

This 341 page report appears to cover every aspect of the NRC’s operations but, as noted in our introduction, it does not present any new information.  It’s a good reference document to cite if someone asks you what the NRC is or what it does.

We found it a bit odd that the definition of SC in the report is not the definition promulgated in the NRC SC Policy Statement.  Specifically, the report says the NRC uses the 1991 INSAG definition of SC: “that assembly of characteristics and attitudes in organizations and individuals which establishes that, as an overriding priority, nuclear safety issues receive the attention warranted by their significance.” (p. 118)

The Policy Statement says “Nuclear safety culture is the core values and behaviors resulting from a collective commitment by leaders and individuals to emphasize safety over competing goals to ensure protection of people and the environment.”***

Of course, both definitions are different from the INPO definition provided above.  We’ll leave it as an exercise for the reader to figure out what this means.


*  NRC Press Release No: 14-021, “NRC Chairman Macfarlane Presents U.S. National Report to IAEA’s Convention on Nuclear Safety” (Mar. 25, 2014).  ADAMS ML14084A303.

**  NRC NUREG-1650 Rev. 5, “The United States of America Sixth National Report for the Convention on Nuclear Safety” (Oct. 2013).  ADAMS ML13303B021. 

***  NUREG/BR 0500 Rev 1, “Safety Culture Policy Statement” (Dec 2012).  ADAMS ML12355A122.  This definition comports with the one published in the Federal Register Vol. 76, No. 114 (June 14, 2011) p. 34777.

Safety Culture at Tohoku Electric vs. Tokyo Electric Power Co. (TEPCO)

Fukushima No. 1 (Daiichi)

An op-ed* in the Japan Times asserts that the root cause of the Fukushima No. 1 (Daiichi) plant’s failures following the March 11, 2011 earthquake and tsunami was TEPCO’s weak corporate safety culture (SC).  This post summarizes the op-ed then provides some background information and our perspective.

Op-Ed Summary 

According to the authors, Tohoku Electric had a stronger SC than TEPCO.  Tohoku had a senior manager who strongly advocated safety, company personnel participated in seminars and panel discussions about earthquake and tsunami disaster prevention, and the company had strict disaster response protocols in which all workers were trained.  Although their Onagawa plant was closer to the March 11, 2011 quake epicenter and experienced a higher tsunami, it managed to shut down safely.

SC-related initiatives like Tohoku’s were not part of TEPCO’s culture.  Fukushima No. 1’s problems date back to its original siting and early construction.  TEPCO removed 25 meters off the 35 meter natural seawall of the plant site and built its reactor buildings at a lower elevation of 10 meters (compared to 14.7m for Onagawa).  Over the plant’s life, as research showed that tsunami levels had been underestimated, TEPCO “resorted to delaying tactics, such as presenting alternative scientific studies and lobbying”** rather than implementing countermeasures.

Background and Our Perspective

The op-ed is a condensed version of the authors’ longer paper***, which was adapted from a research paper for an engineering class, presumably written by Ms. Ryu.  The op-ed is basically a student paper based on public materials.  You should read the longer paper, review the references and judge for yourself if the authors have offered conclusions that go beyond the data they present.

I suggest you pay particular attention to the figure that supposedly compares Tohoku and TEPCO using INPO’s ten healthy nuclear SC traits.  Not surprisingly, TEPCO doesn’t fare very well but note the ratings were based on “the author’s personal interpretations and assumptions” (p. 26)

Also note that the authors do not mention Fukushima No. 2 (Daini), a four-unit TEPCO plant about 15 km south of Fukushima No. 1.  Fukushima No. 2 also experienced damage and significant challenges after being hit by a 9m tsunami but managed to reach shutdown by March 18, 2011.  What could be inferred from that experience?  Same corporate culture but better luck?

Bottom line, by now it’s generally agreed that TEPCO SC was unacceptably weak so the authors plow no new ground in that area.  However, their description of Tohoku Electric’s behavior is illuminating and useful.


*  A. Ryu and N. Meshkati, “Culture of safety can make or break nuclear power plants,” Japan Times (Mar. 14, 2014).  Retrieved Mar. 19, 2014.

**  Quoted in the op-ed but taken from “The official report of the Fukushima Nuclear Accident Independent Investigation Commission [NAIIC] Executive Summary” (The National Diet of Japan, 2012), p. 28.  The NAIIC report has a longer Fukushima root cause explanation than the op-ed, viz, “the root causes were the organizational and regulatory systems that supported faulty rationales for decisions and actions, . . .” (p. 16) and “The underlying issue is the social structure that results in “regulatory capture,” and the organizational, institutional, and legal framework that allows individuals to justify their own actions, hide them when inconvenient, and leave no records in order to avoid responsibility.” (p. 21)  IMHO, if this were boiled down, there wouldn’t be much SC left in the bottom of the pot.

***  A. Ryu and N. Meshkati, “Why You Haven’t Heard About Onagawa Nuclear Power Station after the Earthquake and Tsunami of March 11, 2011” (Rev. Feb. 26, 2014).

Deficient Safety Culture at Metro-North Railroad

A new Federal Railroad Administration (FRA) report* excoriates the safety performance of the Metro-North Commuter Railroad which serves New York, Connecticut and New Jersey.  The report highlights problems in the Metro-North safety culture (SC), calling it “poor”, “deficient” and “weak”.  Metro-North’s fundamental problem, which we have seen elsewhere, is putting production ahead of safety.  The report’s conclusion concisely describes the problem: “The findings of Operation Deep Dive demonstrate that Metro-North has emphasized on-time performance to the detriment of safe operations and adequate maintenance of its infrastructure. This led to a deficient safety culture that has manifested itself in increased risk and reduced safety on Metro-North.” (p. 4)

The proposed fixes are likewise familiar: “. . . senior leadership must prioritize safety above all else, and communicate and implement that priority throughout Metro-North. . . . submit to FRA a plan to improve the Safety Department’s mission and effectiveness. . . . [and] submit to FRA a plan to improve the training program. (p. 4)**

Our Perspective 

This report is typical.  It’s not bad, but it’s incomplete and a bit misguided.

The directive for senior management to establish safety as the highest priority and implement that priority is good but incomplete.  There is no discussion of how safety is or should be appropriately considered in decision-making throughout the agency, from its day-to-day operations to strategic considerations.  More importantly, Metro-North’s recognition, reward and compensation practices (keys to shaping behavior at all organizational levels) are not even mentioned.

The Safety Department discussion is also incomplete and may lead to incorrect inferences.  The report says “Currently, no single department or office, including the Safety Department, proactively advocates for safety, and there is no effort to look for, identify, or take ownership of safety issues across the operating departments. An effective Safety Department working in close communication and collaboration with both management and employees is critical to building and maintaining a good safety culture on any railroad.” (p. 13)  A competent Safety Department is certainly necessary to create a hub for safety-related problems but is not sufficient.  In a strong SC, the “effort to look for, identify, or take ownership of safety issues” is everyone’s responsibility.  In addition, the authors don’t appear to appreciate that SC is part of a loop—the deficiencies described in the report certainly influence SC, but SC provides the context for the decision-making that currently prioritizes on-time performance over safety.

Metro-North training is fragmented across many departments and the associated records system is problematic.  The proposed fix focuses on better organization of the training effort.  There is no mention of the need for training content to include any mention of safety or SC.

Not included in the report (but likely related to it) is that Metro-North’s president retired last January.  His replacement says Metro-North is implementing “aggressive actions to affirm that safety is the most important factor in railroad operations.”***

We have often griped about SC assessments where the recommended corrective actions are limited to more training, closer oversight and selective punishment.  How did the FRA do?   


*  Federal Railroad Administration, “Operation Deep Dive Metro-North Commuter Railroad Safety Assessment” (Mar. 2014).  Retrieved Mar. 14, 2014.  The FRA is an agency in the U.S. Department of Transportation.

**  The report also includes a laundry list of negative findings and required/recommended corrective actions in several specific areas.

***  M. Flegenheimer, “Report Finds Punctuality Trumps Safety at Metro-North,” New York Times (Mar. 14, 2014).  Retrieved Mar. 14, 2014)

Eliminate the Bad Before Attempting the Good

An article* in the McKinsey Quarterly suggests executives work at rooting out destructive behaviors before attempting to institute best practices.  The reason is simple: “research has found that negative interactions with bosses and coworkers [emphasis added] have five times more impact than positive ones.” (p. 81)  In other words, a relatively small amount of bad behavior can keep good behavior, i.e., improvements, from taking root.**  The authors describe methods for removing bad behavior and warning signs that such behavior exists.  This post focuses on their observations that might be useful for nuclear managers and their organizations.

Methods

Nip Bad Behavior in the Bud — Bosses and coworkers should establish zero tolerance for bad behavior but feedback or criticism should be delivered while treating the target employee with respect.  This is not about creating a climate of fear, it’s about seeing and responding to a “broken window” before others are also broken.  We spoke a bit about the broken window theory here.

Put Mundane Improvements Before Inspirational Ones/Seek Adequacy Before Excellence — Start off with one or more meaningful objectives that the organization can achieve in the short term without transforming itself.  Recognize and reward positive behavior, then build on successes to introduce new values and strategies.  Because people are more than twice as likely to complain about bad customer service as to mention good customer service, management intervention should initially aim at getting the service level high enough to staunch complaints, then work on delighting customers.

Use Well-Respected Staff to Squelch Bad Behavior — Identify the real (as opposed to nominal or official) group leaders and opinion shapers, teach them what bad looks like and recruit them to model good behavior.  Sounds like co-opting (a legitimate management tool) to me.

Warning Signs

Fear of Responsibility — This can be exhibited by employees doing nothing rather than doing the right thing, or their ubiquitous silence.  It is related to bystander behavior, which we posted on here.

Feelings of Injustice or Helplessness — Employees who believe they are getting a raw deal from their boss or employer may act out, in a bad way.  Employees who believe they cannot change anything may shirk responsibility.

Feelings of Anonymity — This basically means employees will do what they want because no one is watching.  This could lead to big problems in nuclear plants because they depend heavily on self-management and self-reporting of problems at all organizational levels.  Most of the time things work well but incidents, e.g., falsification of inspection reports or test results, do occur.

Our Perspective

The McKinsey Quarterly is a forum for McKinsey people and academics whose work has some practical application.  This article is not rocket science but sometimes a simple approach can help us appreciate basic lessons.  The key takeaway is that an overconfident new manager can sometimes reach too far, and end up accomplishing very little.  The thoughtful manager might spend some time figuring out what’s wrong (the “bad” behavior) and develop a strategy for eliminating it and not simply pave over it with a “get better” program that ignores underlying, systemic issues.  Better to hit a few singles and get the bad juju out of the locker room before swinging for the fences.


*  H. Rao and R.I. Sutton, “Bad to great: The path to scaling up excellence,” McKinsey Quarterly, no. 1 (Feb. 2014), pp. 81-91.  Retrieved Mar. 13, 2014.

**  Even Machiavelli recognized the disproportionate impact of negative interactions.  “For injuries should be done all together so that being less tasted they will give less offence.  Benefits should be granted little by little so that they may be better enjoyed.”  The Prince, ch. VIII.

Declining Safety Culture at the Waste Isolation Pilot Plant?

DOE WIPP

Here’s another nuclear-related facility you may or may not know about: The Department of Energy’s (DOE) Waste Isolation Pilot Plant (WIPP) located near Carlsbad, NM.  WIPP’s mission is to safely dispose of defense-related transuranic radioactive waste.  “Transuranic” refers to man-made elements that are heavier than uranium; in DOE’s waste the most prominent of these elements is plutonium but waste also includes others, e.g., americium.*

Recently there have been two incidents at WIPP.  On Feb. 5, 2014 a truck hauling salt underground caught fire.  There was no radiation exposure associated with this incident.  But on Feb. 14, 2014 a radiation alert activated in the area where newly arrived waste was being stored.  Preliminary tests showed thirteen workers suffered some radiation exposure.

It will come as no surprise to folks associated with nuclear power plants that WIPP opponents have amped up after these incidents.  For our purposes, the most interesting quote comes from Don Hancock of the Southwest Research and Information Center: “I’d say the push for expansion is part of the declining safety culture that has resulted in the fire and the radiation release.”  Not surprisingly, WIPP management disputes that view.**

Our Perspective

So, are these incidents an early signal of a nascent safety culture (SC) problem?  After all, SC issues are hardly unknown at DOE facilities.  Or is the SC claim simply the musing of an opportunistic anti?  Who knows.  At this point, there is insufficient information available to say anything about WIPP’s SC.  However, we’ll keep an eye on this situation.  A bellwether event would be if the Defense Nuclear Facilities Safety Board decides to get involved.


*  See the WIPP and Environmental Protection Agency (EPA) websites for project information.  If the WIPP site is judged suitable, the underground storage area is expected to expand to 100 acres.

The EPA and the New Mexico Environmental Department have regulatory authority over WIPP.  The NRC has regulatory authority over the containers used to ship waste.  See National Research Council, “Improving the Characterization Program for Contact-Handled Transuranic Waste Bound for the Waste Isolation Pilot Plant” (Washington, DC: The National Academies Press, 2004), p. 27.

**  J. Clausing, “Nuclear dump leak raises questions about cleanup,” Las Vegas Review-Journal (Mar. 1, 2014).  Retrieved Mar. 3, 2014.