Safety Culture

July 16, 2003

The Honorable Nils J. Diaz
Chairman
U.S. Nuclear Regulatory Commission
Washington, DC 20555-0001

SUBJECT:	SAFETY CULTURE

Dear Chairman Diaz:

During the 503rd meeting of the Advisory Committee on Reactor Safeguards, June 12-13, 2003, we met with representatives of the public, the industry, and the NRC staff (References 1, a through l) to discuss the collective understanding and attributes of safety culture at nuclear power plants. We also had the benefit of the documents referenced.

CONCLUSIONS AND RECOMMENDATIONS

1. The existing regulations provide an appropriate framework for monitoring the impact of licensee safety culture on performance.
2. The NRC should periodically self-assess its safety climate.

DISCUSSION

The concept of safety culture encompasses a broad spectrum of characteristics that include personnel attitudes, the control of work activities, and organizational structures. Although safety culture means different things to different people, a working definition of the term has been provided by the International Nuclear Safety Advisory Group (INSAG) of the International Atomic Energy Agency (IAEA) (Reference 2). In its view, safety culture is "that assembly of characteristics and attitudes in organizations and individuals which establishes that, as an overriding priority, nuclear plant safety issues receive the attention warranted by their significance." In a Policy Statement on the Conduct of Nuclear Power Plant Operations (Reference 3), the Commission proposed a similar definition.

Although there are alternative definitions of safety culture, there is general agreement on the important attributes of safety culture. These include a questioning attitude, conservative decisionmaking, attention to detail, personal accountability, adherence to procedures, as well as the management traits and processes, such as leadership, conservative operating philosophy, effective training, and effective corrective and preventive action, that reinforce these attributes of the workforce.

Although we are unaware of any quantitative relationship between the characteristics of safety culture and safety performance, there is evidence from nonnuclear power plant applications that safety attitudes and safety performance are positively correlated (Reference 4). It is clearly the judgment of many people in many industries that safety attitudes have enormous impact on safety performance. The Institute of Nuclear Power Operations (INPO), for example, routinely evaluates attributes of safety culture at operating plants. In its policy statement, the Commission stated its conviction that "the working environment provided for the conduct of operations at nuclear power facilities has a direct relationship to safety." We agree that safety culture is important to safety performance.

The mission of a regulatory agency is to ensure good safety performance. Because safety culture is important to such performance, the question arises as to what is the proper role of the regulator with respect to safety culture. The Commission's policy statement makes it clear that it is the responsibility of utility management to establish and maintain "a professional working environment with a focus on safety." The Commission noted, however, that this policy statement should not be construed as limiting NRC authority to take action on matters affecting the safe operation of the plants.

The current regulations do address several important attributes of safety culture, albeit at a fairly high level. Appendix B to 10 CFR Part 50 requires the licensees to establish a quality assurance program. Quality assurance means "all those planned and systematic actions necessary to provide adequate confidence that a structure, system, or component will perform satisfactorily in service." Criterion XVI of Appendix B, "Corrective Actions," states: "Measures shall be established to assure that conditions adverse to quality, such as failures, malfunctions, deficiencies, deviations, defective material and equipment, and nonconformances are promptly identified and corrected."

Conditions that will promote quality as envisaged in Appendix B include adherence to procedures and an effective corrective action program. These are attributes of safety culture. Furthermore, a questioning attitude, conservative decisionmaking, personal accountability, and attention to detail are essential elements of an effective corrective action program. Again, these are elements of safety culture.

A sampling of letters from the NRC regional offices to plant managers shows that the staff does focus considerable attention on aspects of safety culture. Findings such as "plant personnel focused on replacement rather than understanding causes of wear" and "industry experience was not incorporated so as to minimize wear" could be said to reflect two aspects of safety culture that are commonly cited, namely, a "questioning attitude" of personnel and the plant's "organizational learning." It is important to note that these findings are not the results of an evaluation of questioning attitude in general or the effectiveness of the organizational learning processes of the licensees using tools from the social sciences, such as questionnaires. These findings are based on observations related to specific incidents; i.e., they are based on actual licensee performance.

The Reactor Oversight Process (ROP) identifies three "cross-cutting" issues (Reference 5): Human Performance, Safety-Conscious Work Environment, and Problem Identification and Resolution (PI&R). All three are strongly affected by safety culture. The examples of findings given to utility managers that we cited above resulted from inspections carried out under the ROP.

The NRC Inspection Manual appears to provide adequate guidance to ensure that licensees are detecting and correcting problems. Inspection Procedure 71152, Identification and Resolution of Problems, requires that every 2 years the inspectors select a sample of conditions adverse to quality that the licensee has processed through its corrective action program. The purpose is to focus on problem identification, resolution, and the effectiveness of corrective actions.

Appendix 1 to this inspection procedure lists a number of questions that are intended to help the inspectors assess whether there are impediments to the establishment of a safety-conscious work environment. These should not be construed as being formal interviews. Appendix 1 states: "It is not intended that these questions be asked verbatim, but rather that they form the basis for gathering insights regarding whether there are impediments to the formation of a safety-conscious work environment."

We conclude that the regulatory framework for monitoring aspects of safety culture is largely in place. This framework is appropriately performance based. Agency actions resulting from performance findings are appropriately based on their risk significance according to the action matrix of the ROP. Broader evaluations of safety culture, such as management emphasis on safety and personnel attitudes, belong to the industry. At our June 2003 meeting, we were pleased to learn from industry representatives that there is a great deal of activity on understanding what a good safety culture is and improving tools for evaluating it.

The catalyst for the renewed industry-wide interest in the issue of safety culture and its impact on human performance was, of course, the recent incident at the Davis-Besse nuclear power plant. The NRC staff's Lessons-Learned Task Force (LLTF) concluded that (Reference 6):

• the NRC failed to adequately review, assess, and followup on relevant operating experience, and
• the NRC failed to integrate known or available information into its assessments of Davis-Besse's safety performance.

The LLTF has made numerous recommendations regarding the improvement of the NRC's processes. Some of these are directly related to safety culture. For example, recommendation 3.3.1(1) addresses the issue of "maintaining a questioning attitude in the conduct of inspection activities." We agree with this recommendation. However, we believe that the agency's safety culture is fundamentally sound. The NRC is focused on safety, and safety issues receive the attention warranted by their significance. At this point, it is useful to distinguish between the concepts of safety culture and safety climate. Safety culture refers to the enduring fundamental values of an organization. Safety climate is a temporal state, a snapshot in time of conditions that may influence safety culture attributes.¹ Safety climate is subject to change and can vary throughout the organization.

The agency is already assessing its programs and policies, e.g., by assessing the effectiveness of various regulations. We believe that it would be useful for the NRC to undertake a self-assessment of its current safety climate. This evaluation should include aspects of safety culture such as conservative decisionmaking, willingness to raise and report issues, and questioning attitude in the presence of inconclusive evidence.

It is important to place the current emphasis on safety culture in perspective. The industry and NRC staff have mature programs to monitor reliability at the active equipment level. The reliability of passive equipment is monitored through inservice inspection and testing programs. Human reliability is monitored through simulator testing programs for control room crews. Awareness of safety culture adds to understanding and management of the deeper causes that shape human performance.

Sincerely,

/RA/

Mario V. Bonaca
Chairman

References:

1. Presentations at ACRS Workshop on Safety Culture, June 12-13, 2003
   1. Ashok Thadani, Director, Office of Nuclear Regulatory Research, NRC, Safety Culture, June 12, 2003.
   2. Chuck Dugger, Vice President, Nuclear Energy Institute, Collective Understanding of Safety Culture, June 12, 2003.
   3. Thomas E. Murley, Nuclear Energy Agency, Early Signs of Deteriorating Safety Performance, June 12, 2003.
   4. Howard Whitcomb, III, Esq, Comments on Collective Understanding of Safety Culture, and William N. Keisler, Nuclear Maintenance Integration Consultants, Organization Half-Life, The Un-Monitored Disintegration in Reactor and Public Safety, June 12, 2003.
   5. David Collins, Engineering Analyst, Dominion Nuclear Connecticut, Managing Safety Culture, June 12, 2003.
   6. Alan Price, Vice President, Dominion Nuclear Connecticut, Safety Culture, June 12, 2003.
   7. David Trimble, Clare Goodman, Lisamarie Jarriel, and J.J. Persensky, NRC, Attributes of Safety Culture, June 12, 2003.
   8. George Felgate, Director, Analysis Division, Institute of Nuclear Power Operations, Safety Culture Attributes, June 12, 2003.
   9. Lew Myers, Chief Operating Officer, First Energy Nuclear Operating Company, Organizational Safety Culture, June 12, 2003.
   10. Jack Grobe, Chairman, Davis-Besse Oversight Panel and Geoff Wright, Inspection Team Leader, NRC, Management and Human Performance Inspection at Davis-Besse, June 12, 2003.
   11. William O'Connor, Chairman of the Board, Utility Service Alliance and Vice President, Nuclear Generation, Detroit Edison, Nuclear Safety Culture Assessment, June 12, 2003.
   12. Sonja B. Haber, Human Performance Analysis Corporation, Attributes of Safety Culture, June 12, 2003.
2. International Nuclear Safety Advisory Group, Safety Culture, Safety Series No. 75 NSAG-4, International Atomic Energy Agency, Vienna, 1991.
3. U.S. Nuclear Regulatory Commission, "Policy Statement on the Conduct of Nuclear Power Plant Operations," Federal Register, 54FR 3424, January 24, 1989.
4. U. S. Nuclear Regulatory Commission, NUREG-1756, Safety Culture: A Survey of the State of the Art, Prepared by Advisory Committee on Reactor Safeguards, J. N. Sorensen, Senior Fellow, ACRS (see also Reliability Engineering & System Safety, vol. 76, pp. 189-204, 2002).
5. U. S. Nuclear Regulatory Commission, Recommendations for Reactor Oversight Process Improvements, SECY-99-007, 1999.
6. U. S. Nuclear Regulatory Commission, Degradation of the Davis-Besse Nuclear Power Station Reactor Pressure Vessel Head. Lessons-Learned Report, September 30, 2002.

---

¹In testimony before the Commission on June 25, 1998, the Director of the survey used by the NRC Office of Inspector General to assess the agency's safety culture, said, "We needed to make sure we had an overview of culture; namely, shared values and beliefs, practices, and policies, but we also needed to get a valid snapshot of the most urgent or acute issues facing the agency currently. That more has to do with the climate or the 'now' of a particular organization."