No. S-02-033

PDF Version (46 KB)

I am very pleased to be with you this morning to discuss a topic of singular importance to the nuclear industry and the NRC – safety culture. I will try to supplement the many thoughtful presentations you have received over the course of this meeting by providing the perspective of a regulator. I will discuss the importance of safety culture, the NRC’s current regulatory approach to the issue, the considerations that bear on possible changes to our regulatory approach, and the NRC’s own safety culture.¹

1. INTRODUCTION -- THE IMPORTANCE OF SAFETY CULTURE

Although the elements of safety culture are somewhat amorphous, there is general agreement that they include both organizational and individual aspects. Elements commonly included at the organizational level are senior management commitment to safety, organizational effectiveness, effective communications, organizational learning, and a culture that encourages the identification and resolution of safety issues. Elements identified at the individual level include personal accountability, a questioning attitude, and procedural adherence. The financial health of the organization and the impact of regulatory bodies are occasionally identified as external factors potentially affecting safety culture.

The importance of management attention to safety has long been recognized. In the early 1800s, the DuPont chemical family owned gunpowder manufacturing plants that were plagued by explosions. Safety measures were for the most part limited to excluding metal that could produce a spark. All tools were made out of wood, workers wore clothing with brass buttons and shoes with soles that had brass tacks, and horses were fitted with rubber-like boots that were placed over their horseshoes. Nonetheless, explosions that on the average killed three people occurred about once every 14 months in the early 1800s. As a result, Irénée DuPont redesigned his gunpowder plants both to improve the quality of gunpowder and to enhance safety. According to legend, the major change was that the managers' offices were located just above the rooms where the gunpowder was made. If true, this would have been an early example of a corporate decision to ensure management's total commitment to safety.

As it turns out, the legend is more fiction that fact. Nonetheless, it is the case that Irénée DuPont did transform the design of gunpowder plants in America so as to improve safety. The gunpowder works that Dupont constructed on the banks of the Brandywine River in Delaware had a significantly different layout than other contemporary plants. Rather than building one large structure to house the entire manufacturing process, he built many small buildings that contained different phases of the process, thereby reducing the risk of total destruction of the facility in the event of an explosion. The smaller buildings were built with three heavy, reinforced stone walls, while the fourth wall was of comparatively flimsy wood construction. The fourth wall faced the river so that, in the event of an explosion, the wooden wall would be blown out and the energy released from the blast would be directed over the river, rather than at the other adjacent buildings. This represented a substantial safety advance, unless of course you happened to be boating on the river at the wrong moment.

Although it is apparent that DuPont was seeking to mitigate operational and economic risk through design, the concept of safety culture did not really take hold in the explosives industry in the early 19^th century. The industry continued to be plagued with explosions and worker deaths. Something more was needed -- an organizational and individual commitment to safe operations.

The recognition of the importance of safety culture to the nuclear industry arose largely as a result of the accident at Three Mile Island. The President's Commission On the Accident at Three Mile Island, known as the Kemeny Commission, observed:

After many years of operation of nuclear power plants, with no evidence that any member of the general public has been hurt, the belief that nuclear power plants are sufficiently safe grew into a conviction. One must recognize this to understand why many key steps that could have prevented the accident at Three Mile Island were not taken.²

The report went on to note:

[T]his attitude must be changed to one that says that nuclear power by its very nature is potentially dangerous, and, therefore, one must continually question whether the safeguards already in place are sufficient to prevent major accidents. A comprehensive system is required in which equipment and human beings are treated with equal importance.³

This statement reinforces the point that even with a good design and with carefully crafted procedures, it is only a matter of time before an accident will occur if there is inadequate emphasis on safety culture. Indeed, we have learned over and over again that continuing vigilance on safety matters is essential; a false sense of security can arise by taking undue comfort from periods of good performance.

An important parallel can be drawn in this respect concerning the attitudes of the workers at gunpowder facilities and those at nuclear power plants. Much like the workers at the gunpowder facilities of the past, the workers at nuclear power plants should not need to be instructed on the importance of safety; that need should be self evident. Nonetheless, special considerations beyond those included within plant design and operational procedures were necessary to prevent explosions at gunpowder plants. The same is true at a nuclear power plant. Although appropriate design and procedures are necessary, there is something else that is essential -- an attitude toward operations on the part of both the organization and the individual that serves to assure that safety issues receive close and continuing attention. This is the central objective of the emphasis on safety culture.

2. NRC OVERSIGHT OF SAFETY CULTURE

The Commission has stated as a matter of policy that licensee management should foster an environment that assures safe operation.⁴ But, for reasons that I will explore in a moment, the NRC does not purport to regulate safety culture directly. There is no NRC regulation that articulates an unambiguous direction to licensees to maintain an appropriate safety culture, although certainly aspects of safety culture are regulated. Moreover, the Commission does not have any performance indicators or other inspection tools that are routinely applied at plants to assess safety culture per se. Rather, the NRC seeks to ensure the existence of an appropriate safety culture through a variety of indirect means.

The premise of the reactor oversight process is that if a licensee has a poor safety culture, various performance indicators will cross thresholds, or the licensee's problems will emerge during baseline inspection activities, or both. The baseline inspection program does touch on programmatic areas -- including, in particular, the problem identification and corrective action processes -- that provide important insights on safety culture. Because the corrective action program is the central means for raising, evaluating, and resolving issues, examination of this program has the potential to provide significant insights on the effectiveness of management and the attitudes of plant personnel towards safety. The NRC's verification of implementation of the maintenance rule and the in-service inspection program, which are also a part of the baseline inspection program, provides some assurance that a sensitivity to risk-significant activities is part of the normal operating framework. And the NRC's examination of allegations provides insight into the willingness of licensees to receive and address employee concerns. Thus, important aspects of safety culture are routinely evaluated at operating plants.

Of course, supplemental inspections are performed when significant issues are identified. These inspections focus increased resources in the area of problem identification and resolution so as to assure that licensees are effectively identifying, assessing, and correcting performance deficiencies. Thus, through their focus on the licensee's efforts to determine and correct the root causes of problems, the results of these inspections reveal certain aspects of safety culture. Additionally, both the baseline and supplemental inspection programs encourage inspectors to identify issues related to certain cross-cutting elements that are directly related to safety culture. These include the adequacy of human performance, the establishment of a safety-conscious work environment, and the robustness of the problem identification and resolution program.

Licensees in an extended shutdown may be subject to inspection under the Inspection Manual Chapter 0350 process before restart. They receive increased inspection focusing on the cross-cutting areas that contributed to the plant's shutdown and other associated risk-significant issues. Inspection resources are focused on determining the root causes of the shutdown, on identifying and resolving risk-significant issues, and at assuring an appropriate response. Safety culture and management and organization issues are addressed to the extent that they are associated with the problem being examined.

In short, although the NRC does not attempt to regulate safety culture directly, it does routinely review various elements of safety culture as a regular feature of both its baseline and supplemental inspection activities. The question before the Commission today is whether the approach that has been taken by the Commission is sufficiently focused and comprehensive to meet today's regulatory needs.

3. IS THE NRC REGULATORY APPROACH ADEQUATE?

Let me start the examination of this question by exploring the reasons for the Commission's past decision to forego the direct regulation of safety culture. This reluctance stems from actions arising before my arrival at the Commission, but seems to derive from several related considerations.

First, there is the concern that any attempt to regulate and evaluate safety culture is necessarily very subjective. The concept of safety culture has core ingredients on which perhaps all can agree, but the precise limits of this somewhat amorphous concept are hard to discern. Moreover, given that the concept is not crisply defined, it is not surprising that neither the NRC nor other organizations have found an unambiguous way to measure it. As all of you are aware, one of the driving forces for the development of the Reactor Oversight Process was the desire to provide a more objective and transparent method of performance assessment that could be applied equitably and uniformly over the entire industry. The inclusion of safety culture as a direct element of regulation and inspection is inconsistent with this objective to the extent that safety culture does not lend itself to objective measurement.

Second, some have expressed a concern that an effort to regulate safety culture would intrude inappropriately on management prerogatives. It is apparent that many of the elements of safety culture are inseparable from the management of the licensee's organization. It might be seen as over-reaching for the NRC to evaluate decisions as to management structure and philosophy that are otherwise relegated to the private sector in our society. Indeed, it is hardly clear that the NRC could perform such an evaluation fairly and thoroughly. And there is the danger that any such intrusion by the NRC into management structure and processes would undermine the fundamental principle that the licensee is responsible for safety; NRC involvement in management activities has the potential to dilute a licensee's responsibility and, in effect, might make the NRC the de facto co-manager of the facility.⁵ The recognition that licensees are ultimately responsible for safety implies that they must be allowed some flexibility to achieve safety in their own way.

Third, there is the reality that the most effective safety cultures are ones that are generated as a result of the commitment of the organization itself. One study observed that "the most impressive achievements appear in companies where the pressure for safety has been generated within the organization, apparently independent of external standards."⁶ Thus, we have the paradox that regulatory demands relating to safety culture may serve to dilute or frustrate the achievement of the intended goal by stifling self-generated initiatives by individual licensees. Indeed, over-regulation may tend to lead to uniformity and acceptance of whatever minimal standards the NRC requires, diminishing the pressure for true excellence and creativity arising from individual licensee initiative.

Finally, there is an argument that regulatory pressure for improvements in safety culture is not necessary. Most licensees are clearly committing resources to the assurance of an appropriate safety culture, thus diminishing the need for an NRC focus on the matter. In the past decade, the industry has achieved steady -- one might even say remarkable -- improvement in both plant safety performance and plant economic performance. In 1990, more than 50 events were classified as "significant," or almost one for every two units, and each unit, on the average, experienced one safety system actuation during the year. By 2000, the number of significant events had decreased by more than an order of magnitude, and the average number of safety system actuations per year decreased from one per unit to about one for every three units. Other safety performance data show similar trends.

There have been parallel improvements in economic performance. Plant capacity factors have moved from an average of 65 percent in 1990 to nearly 90 percent today. The result is the production of nearly 40 percent more electricity in 2000 from 8 fewer plants than were operating in 1990. And the production cost of electricity from nuclear generation is now less on average than that from coal or natural gas.

The significant improvements in overall industry performance seem to be attributable, at least in part, to improvements in organizational elements that are generally associated with safety culture. A plant that operates safely typically also operates more reliably, and is thus able to contribute financially to the bottom line. There are thus incentives for a licensee to focus upon the safety culture within its organization not only because this action protects the public and the licensee's investment, but also because it delivers at the bottom line. There are self-reinforcing forces to ensure safety – and the important element of safety culture – without the need for the heavy hand of the regulator.

These considerations certainly provide strong arguments in support of the approach that the NRC has taken -- namely, not to regulate safety culture directly, but to assess aspects of it routinely and to intervene vigorously as the need arises. I must note, however, that there are currently unfolding events that prompt a reexamination of these considerations.

First, despite the improved aggregate performance of the industry, we still encounter problems at individual plants that have their origins in inadequate safety culture. Of course, the whole point of the regulatory system is not simply to enable adequate average performance, but to ensure that every plant is operating safely all the time. And we clearly have not always achieved that objective. Indeed, a recurrent theme over the past decade is the need for improvement of safety culture at plants that are encountering serious difficulties.

The most recent example of the need to reexamine past approaches arises from the reactor vessel head corrosion at the Davis-Besse plant. Material wastage of components as a result of boric acid corrosion caused by primary system leaks has been reported by the industry for more than 30 years. More specifically, Alloy 600 nozzle leakage has been known for more than 15 years. Despite this knowledge, the licensee did not prevent the severe corrosion of the Davis-Besse reactor vessel head. In examining the underlying causes of the situation, NRC's augmented inspection team and its Lessons Learned Task Force confirmed that the management at the Davis-Besse station failed to ensure that plant safety issues received appropriate attention. Specifically, longstanding and recurring primary coolant leaks were not fixed. Moreover, management failed to recognize or address repetitive or recurring problems and to ensure that corrective actions were effective and timely. Engineering resources were stretched and the symptoms, rather than the causes of problems, were addressed in order to minimize the impact on generation. Plant operations were not conducted in a manner which encouraged a questioning attitude, a commitment to excellence, and the identification and resolution of safety issues. In short, the inspections at Davis-Besse have revealed that the head corrosion problem was a direct result of a degraded safety culture.

The NRC must acknowledge its own shortcomings in connection with this event. Among other things, neither the reactor oversight process nor the prior inspection program worked as we had hoped in identifying the problems at Davis-Besse at an early stage. Prior to the discovery of the reactor vessel head corrosion, the performance indicators at the Davis-Besse facility were "green," in ROP parlance, and the baseline inspections did not reveal any significant findings. In particular, there was a lack of awareness by the NRC staff of the significance of the available evidence of degradation. It was only as a result of the deeper inspection in the aftermath of the discovery of the corrosion that we have uncovered the pervasive problems that existed at the plant. Since the underlying cause of the failure was a problem with safety culture, the Davis-Besse episode presents the fundamental question as to whether the NRC's approach to assuring an adequate safety culture is sufficient. The Commission will soon be receiving comments from the NRC's senior management on the recommendations of the Lessons-Learned Task Force and will grapple with potential changes to our regulatory program in response to the shortcomings in the NRC's oversight of Davis-Besse.

There is another issue now before the Commission that also prompts reconsideration of the NRC's approach to the regulation of safety culture. As I am sure many of you are aware, the NRC has been in the process of evaluating its policies for handling harassment and intimidation issues. This effort started in April 2000, when the Discrimination Task Group was formed to consider the need for changes in the NRC's enforcement process relating to alleged reprisals against workers who raise safety concerns. The group's report was finalized in April of this year. A senior management review group then considered the report and recently provided its recommendations for changes to the Commission. The relevant documents are publicly available on the NRC's web site.⁷

The senior management review group recommended a fundamental change in the Commission's approach to handling discrimination cases. Instead of reacting to individual cases through the continuation of the existing investigation and enforcement program, the group proposed that the Commission develop a regulation bearing on the maintenance and oversight of a safety conscious work environment. The recommendation seeks to prevent problems through the imposition of an affirmative requirement on licensees to develop and implement appropriate programs, rather than having the NRC react to problems through investigation and enforcement. The Commission's response to the recommendation will thus present the opportunity to revisit the issue of the direct regulation of an important aspect of safety culture.

A final consideration that bears on the reexamination of the NRC's regulatory approach is the fact that, by choosing not to regulate safety culture directly, the NRC may be increasingly out-of-step with regulators in other countries. For example, the British place great reliance on a new license condition -- Condition 36 -- relating to the review of management changes to ensure that such changes do not adversely affect safety. Other countries similarly have programs to regulate safety culture in direct ways that the NRC has heretofore avoided. I mention this fact not because American regulatory practice should necessarily conform to foreign approaches, but merely to indicate that the trends abroad invite reexamination by the NRC.

There are thus a variety of converging policy considerations that invite the Commission to reconsider its approach to the regulation of safety culture. At this juncture, I cannot predict how the Commission will respond. I, and I suspect my colleagues, have not developed final views as to the appropriate path forward. This conference is timely not only because of your own interest and engagement in issues relating to safety culture, but also because the input of stakeholders on matters before the NRC is welcome.

4. SAFETY CULTURE AT NRC

My talk thus far has focused on the importance of safety culture to licensees. I would be remiss if I did not acknowledge that the NRC also has a responsibility to maintain a strong safety culture among its own staff. Not surprisingly, the elements of safety culture at the NRC are essentially the same as those we expect from our licensees. And just as our licensees have on occasion had to deal with problems in maintaining a strong safety culture, the NRC has challenges in this regard as well.

The candid and open discussion of issues and concerns is an important and necessary element of the NRC's safety culture. NRC employees are encouraged to develop their own best professional judgments, even when those judgments differ from the prevailing staff position or disagree with a policy decision or practice. In order to ensure that these alternative views are considered, NRC has established a process for handling differing professional views and opinions. In September 2000, NRC's inspector general completed a review of this program and identified several weaknesses. The Commission established a special review panel to address these problems and is implementing various changes.

One management challenge that we clearly share with our licensees is the need to continue to maintain an appropriate emphasis on safety culture over time. All too often, we have seen operational excellence eroded by complacency. As a result, we must continue to stress the need for vigilance both by licensees and by NRC staff. Indeed, I expect that we will have some further insights on the NRC's progress in maintaining an appropriate safety culture in another week or two when we obtain the benefit of a survey of the NRC staff that has been undertaken by our Inspector General.

5. CONCLUSION

Let me note one final point in conclusion. Development and maintenance of a strong safety culture is dependent upon a commitment to safety throughout an organization. But the responsibility rests on the organization's leadership to establish priorities, to make the commitment to safety real, and to create a climate in which such a commitment can flourish. Ultimately the people in this room, not your staff or the NRC staff, will determine whether an appropriate safety culture is created and maintained. I ask for your commitment to establish an enduring safety culture within your organizations.

Thank you.

¹M.V. Bonaca and D.A. Powers, ACRS, Safety Culture in the Nuclear Industry, unpublished paper

²John G. Kemeny et al., Report of the President's Commission on the Accident at Three Mile Island, The Need for Change: The Legacy of TMI, U.S. Government Printing Office, 1979, p.9

³Id.

⁴Policy Statement on the Conduct of Nuclear Power Plant Operations, 54 Fed. Reg. 3424 (1989).

⁵Towers Perrin et al, Nuclear Regulatory Review Study, Final Report, October 1994, p. 7

⁶ACNSI Study Group on Human Factors, "Third Report: Organizing for Safety," Advisory Committee on the Safety of Nuclear Installations, Health and Safety Executive, United Kingdom, 1993, p. 16.

⁷www.nrc.gov/reading-rm/doc-collections/commission/secys/2002/secy2002-0166/2002-0166scy.html

Privacy Policy | Site Disclaimer
Monday, December 01, 2008