No. S-01-013

PDF Version (72 KB)

"THE EVOLUTION OF SAFETY GOALS AND
THEIR CONNECTION TO SAFETY CULTURE"

by

Dr. Richard A. Meserve, Chairman
United States Nuclear Regulatory Commission
Atomic Energy Society Of Japan/American Nuclear Society Topical
Meeting On Safety Goals And Safety Culture

Milwaukee, Wisconsin
June 18, 2001

Introduction

Good afternoon. As General Co-Chairman of this AESJ/ANS topical meeting on Safety Goals and Safety Culture, I would like to add my welcome to Milwaukee. As many of you know, Milwaukee is famous for its beer. It is clear to me that it should also be famous for its hospitality.

The aim of this conference is to explore the development of safety goals, the establishment of a safety culture, and the ways in which these two concepts intersect. We benefit from broad international participation in this meeting and my expectation is that we will find many common elements in the ways in which different countries approach these issues. But I am sure that we will also see some differences that are worthy of discussion as well.

Safety goals and safety culture may appear to be two largely independent topics. The first refers to objectives established by a regulatory agency to define its regulatory philosophy and approach to the consideration of risk - especially, the concept of acceptable risk. Safety culture also reflects an element of regulatory philosophy, but can encompass a broader range of issues. We speak, for example, to the need for nuclear plant licensees to establish a culture to promote the safe operation of nuclear power stations. The U.S. Nuclear Regulatory Commission also refers to "safety culture" in discussing the way in which its own staff deals with safety issues. Although there are clearly aspects of safety goals and safety culture that do not bear on one another, the two subjects do have a relationship: the way in which safety goals influence regulatory activities can have an impact on the development and maintenance of an appropriate safety culture.

Let me take a few minutes in this opening session to discuss my views on these subjects from the perspective of the U.S. NRC. I will provide a brief historical perspective on the development of the NRC's safety goals and will discuss the practical implications of applying the safety goals to regulatory activities. I will then describe our perception of safety culture. I will conclude by discussing the intersection between safety goals and safety culture.

Safety Goals

The development of the NRC's safety goals will be discussed at length in tomorrow morning's session. For now, let me provide an overview of the development of the goals, the ways in which they have influenced the NRC's regulatory activities, and some of the challenges that remain in front of us.

The NRC's safety goals are described in our Safety Goal Policy Statement, which was released in August 1986.⁽¹⁾ The development of the Policy Statement began not long after the Three Mile Island accident, and was a first attempt by the Commission to come explicitly to grips with the integration of the quantitative assessment of risk into the regulatory system. A few years earlier, the NRC had funded the Reactor Safety Study, known as WASH-1400 and perhaps even better known as the Rasmussen study. That study represented the first use of probabilistic techniques to estimate the frequency of accidents and their ultimate consequences, thereby allowing a quantitative estimate of risk. The primary issue for the NRC in developing safety goals was to use these techniques to help articulate a level of acceptable risk -- in other words, to define "how safe is safe enough."

The Commission established two goals that are stated in terms of public health risk -- one addressing individual risk and the other addressing societal risk. The risk to an individual is based on the potential for death resulting directly from a reactor accident - that is, a prompt fatality. The societal risk is stated in terms of nuclear power plant operations, as opposed to accidents alone, and addresses the long-term impact on those living near the plant. In both cases, the Commission based its acceptable level of risk on a comparison with other types of risk encountered by individuals and by society from other causes, applying the rule that the consequences of nuclear power plant operation should not result in significant additional risks to life and health. The goals were expressed in qualitative terms, perhaps so the philosophy could be understood by all.

In both cases, however, the Commission also expressed the qualitative goals for the safety of nuclear power plants in terms of individual and societal "quantitative health objectives" or "QHOs." These were established at one one-thousandth of the risk arising from other causes presenting the same type of risk.

It is important to note that the QHOs per se have never been directly reflected in the NRC's regulations, but were promulgated to provide guidance as to the level of "public protection which nuclear plant designers and operators should strive to achieve." They were also meant to provide guidance to the NRC staff to use in the regulatory decision-making process. However, the Commission was clear that the safety goals were not meant "to serve as a sole basis for licensing decisions." In fact, the Commission disclaimed an intent to use the goals in making plant-specific regulatory decisions.

While the safety goals provided a metric to address the question of "how safe is safe enough," practical implementation of the Commission's guidance proved to be difficult. This was the result of the large uncertainties involved in calculation of risk in the mathematical sense of probability times consequences. As a result, the NRC staff began looking for other metrics to use as surrogates for the QHOs in regulatory decision-making.

In 1990, the Commission provided additional guidance to the staff regarding the Safety Goals, endorsing surrogate objectives concerning the frequency of core damage accidents and large releases of radioactivity.⁽²⁾ The numerical value of one-in-ten-thousand for core damage frequency (CDF) was cited as a "very useful subsidiary benchmark...." In addition, a conditional containment failure probability of one-tenth was approved for application to evolutionary light water reactor designs. This resulted in a large release frequency of one in one-hundred-thousand, since containment failure is necessary for a large release to occur. These values have evolved into the "benchmark" values of 10^-4 for CDF and 10^-5 for large early release frequency (LERF), as discussed in Regulatory Guide 1.174 for use in risk-informed regulatory decision-making.⁽³⁾

The application of these goals as an underpinning of the regulatory system has evolved over time from the philosophical to the practical. Now they serve as the basis for many regulatory initiatives. An early example of explicit consideration of risk in a regulation is the NRC's Backfit Rule, originally issued in 1988.⁽⁴⁾ But we have moved on to a much more comprehensive application of risk in our regulations, as most in this audience are undoubtedly aware. The aim, of course, is to use risk as the tool for dissecting and reforming our regulatory system so that the NRC focuses on risk-significant activities, thereby both enhancing safety and reducing needless regulatory burden. In implementing this approach we still adhere to many of the basic concepts discussed in the original Safety Goal Policy Statement, such as the use of risk as only one factor among many in making regulatory decisions.

In short, the development of a practical application of the safety goals and the ancillary tool of PRAs have taken many years, but they have growing significance as the foundation for the NRC's work. That being said, there are challenges that must be confronted. Let me mention a few.

First, we recognize that risk, at least for the foreseeable future, will be only one factor that can guide regulatory decisions. In this connection, I want to emphasize the relationship of risk insights to defense in depth. If one had complete confidence in the accuracy of PRAs, one might conclude that defense in depth could be ignored if the risk were sufficiently low. But the Commission is not prepared to jettison the deterministic processes and the defense-in-depth philosophy that are integral parts of the regulatory system. Defense in depth is to be applied at a high level -- that is, to require both prevention and mitigation -- and then as well at lower levels to compensate for uncertainty. There has been much discussion within the NRC and with our Advisory Committee on Reactor Safeguards as to how defense in depth should be incorporated into a risk-informed regulatory approach and this discussion will no doubt continue.

Second, we may need to reconsider the subsidiary objectives. Although the CDF and LERF goals have proven to be quite useful and valuable in implementing the Commission's safety philosophy, they do tend to skew the focus of attention to severe reactor accidents. While it is unquestionably true that the societal risk from nuclear power is dominated by accidents that have low frequencies and high consequences, the perception of risk on the part of the public is influenced by events of low consequence in terms of radioactive releases, but which have much higher frequencies. This is illustrated, for example, by the reaction following the steam generator tube failure at the Indian Point 2 station in February 2000. The event was widely reported to have involved a release of radioactivity to the environment, although the release was determined to be so slight that the monitoring equipment around the plant could not detect it. Nonetheless, there was an intense public reaction to the event, which continued for several months and has only recently begun to subside. The safety strategy should address plant operations, not just accidents, and should consider the full spectrum of events on a frequency/consequence continuum rather than just extreme events. That is, even a low-consequence event is of concern if its frequency of occurrence is high.

Finally, while we wrestle with incorporating risk insights into our current regulatory processes, we face other practical challenges as well. As you know, in the past few months there has strong interest in exploring new construction. We fully expect to see aggressive use of PRAs in connection with new reactor designs as means of satisfying the Commission's goal of assuring that advanced reactor concepts meet or exceed the level of safety provided by the current generation of reactors. Of course, PRAs are now used in the design process itself, to pinpoint and correct vulnerabilities based on risk insights. In this connection, we are grappling with the possibility that we may have to develop a new regulatory system that, unlike the focus of the current rules on light water reactors, will be independent of technology. The foundation of any such system must inevitably include compliance with the safety goals-or their subsidiary objectives-as demonstrated by PRAs.

Despite these many challenges, the NRC is clearly moving in the direction of greater reliance on quantitative tools and goals -- thereby achieving the promise first signaled by the Commission's Safety Goals nearly 15 years ago. I believe the next 15 years will see accelerated progress.

Safety Culture

Let me turn now to safety culture.

Whereas safety goals are relatively straightforward - at least in concept - safety culture is a much broader and, perhaps, less clearly defined concept. There does, however, seem to be general agreement across the industry as to what "safety culture" requires in terms of maintaining superior performance in plant operations. Elements of safety culture include management emphasis on safety as the highest priority; training for all staff, at all levels, to ensure that each employee understands his or her responsibilities for ensuring safe operations; conservative, safety-conscious decisionmaking; a philosophy of continuous improvement, including critical self-assessment and a questioning attitude; and in the event that problems do arise, a willingness to address problems promptly and effectively. Most important, perhaps, is the fostering of a safety-conscious work environment -- one in which plant staff feel they can (and do) raise concerns without fear of adverse consequences. All of these attributes work together to establish a climate that nurtures high safety performance. Safety culture goes right to the heart of the factor that has been shown in research studies to be of paramount importance for excellence in plant operations: human performance.

Just as safety culture is important in nuclear plant operating organizations, the NRC has a responsibility to maintain a strong safety culture among its own staff. Not surprisingly, the elements of safety culture at the NRC are essentially the same as those we expect from our licensees: management involvement, training, conservatism, a questioning attitude, and an atmosphere in which the staff can raise concerns without fear of retribution. And just as our licensees have on occasion had to deal with problems in maintaining a strong safety culture, the NRC has challenges in this regard as well. Nonetheless, when one looks at the vastly improved performance of the industry in terms of both safety and operations, it appears that both the industry and the NRC have had a fair measure of success in fostering a strong safety culture.

One management challenge is to continue maintain an appropriate culture over time; all too often, we have seen operational excellence eroded by complacency. As a result, we must provide continuing emphasis on safety culture; we will continue to stress the need for vigilance both for our licensees and for ourselves.

The Intersection of Safety Goals and Safety Culture

On a fundamental level, safety goals and safety culture are linked together. In a very real sense, safety culture is a significant contributor to the ability to meet safety goals. This is not to suggest that plant operators use the QHOs or the subsidiary objectives as numerical targets on a day-to-day basis, but rather that a strong safety culture leads to an operational philosophy consistent with the safety goal objectives of minimizing risk. And the connection is becoming closer. Some licensees have begun to employ on-line quantitative risk evaluation to assist in making safety-focused operational decisions.

The NRC's safety culture, as manifested in the staff's approach to regulation, can have an impact on a licensee's safety culture. Over-regulation has the potential to rob a licensee of a sense of "ownership" of the safety performance of a plant, which can degrade licensee performance. Under-regulation has its own obvious set of perils. Thus, the NRC's culture must find the appropriate balance in the oversight process so as to maintain an adequate safety focus without creating unwanted impacts on licensee safety culture. One part of that balance is an appreciation of the role of licensee safety culture in the achievement of safety goals. And so the connection between safety culture and safety goals is again revealed.

Concluding Remarks

In these remarks, I hope to have given you a sense of how the NRC views the issues of safety goals and safety culture, and the ways in which these important concepts interact. I believe that a strong safety culture, augmented by an appreciation for the risk implications of actions of both licensee and regulatory organizations, can assist in the development and maintenance of excellence in nuclear plant operational safety.

1. U.S. NRC, “Safety Goals for the Operations of Nuclear Power Plants; Policy
   Statement,” 51 Federal Register 30028, August 21, 1986.

2. U.S. NRC, Staff Requirements Memorandum on SECY-89-102, “Implementation of the
   Safety Goals,” June 15, 1990.

3. U.S. NRC, Regulatory Guide 1.174, “An Approach for Using Probabilistic Risk
   Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis, July
   1998.

4. Code of Federal Regulations, Title 10, Part 50, §50.109

Privacy Policy | Site Disclaimer
Monday, December 01, 2008