Nuclear Safety Culture Fundamentals
Nuclear Safety Culture Fundamentals
A training and testing program created and
maintained
by Charles R. Jones, Nuclear Safety Consultant
In the United States of America, there are at three significantly different types of nuclear organizations involved with nuclear power such that they can have a significant impact on public safety as a result of releasing large amounts of radioactive materials to the environment. The most obvious nuclear organizations are those associated with commercial nuclear power plants and the Navy's nuclear propulsion program. The third organizational type having such potentially significant impacts is the nuclear weapons complex, an infrastructure that has control over various nuclear materials used in nuclear weapons or stored in the form of nuclear waste. Several other countries around the world have responsibilities for one or more of these three types of nuclear organizational environments.
There has been a great deal of effort over the past decade or so to improve nuclear safety standards in such area as nuclear plant design and operational fundamentals. The purpose of this training and testing program is to provide a definitive statement and measure of each participant's attitude on and understanding of a limited number of nuclear safety issues as they may be impacted by an organization's nuclear safety culture. The measure is taken relative to a composite understanding of the highest nuclear safety culture standards found among the three basic nuclear organizations identified above.
You can use the results of this training as a bench mark with your employer
and with your colleagues. You will at least be aware of the key concepts,
and will be more prepared to discuss them in your own way.
This online discussion can be used for General Employee Training (GET),
and the accompanying tests will provide the needed feedback. The employer
can accept any or all of the previous scores or require an update, depending
upon the level assessment needed for the individual.
The part of the nuclear organizational environment that is unique to the special safety requirements of the nuclear industry is hereby defined as the required nuclear safety culture. Whether or not the required nuclear safety culture is consistent with modern notions of effective organizational cultures found in other industries is not necessarily important. The unique nuclear industry safety requirements are be met through the unique nuclear safety culture. Just because some organizational or cultural approach works in another industry does not mean that it is consistent with the needs of the nuclear industry.
For example, the issue of nuclear safety is so important that a no-fault approach is the most appropriate one for the nuclear industry. By this we mean that a worker is not considered to be the root cause of a problem in a nuclear plant. Thus, the worker enjoys a limited level of accountability for mistakes made, unless those mistakes are deliberate or repeated due to carelessness. Accountability rests largely with management since it is management that selects, trains, assigns, and supervises the workers. While many nuclear plant events are described as caused by personnel error, this is seldom true.
It is in the area of management accountability that the Navy program has been the best example for the rest of the industry. Even so, only a few Navy people ever reach this realization themselves. When I conducted one-on-one training for Navy Nuclear Chief Engineer Candidates seeking to pass Admiral Hyman Rickover's Chief Engineer Examination, one of the key obstacles that I had to overcome was the notion that the individual was responsible for knowing and deciding properly on every problem that might come up. While each person in the Navy nuclear propulsion program is responsible for knowing everything included in the formal training curriculum (and that is a lot of material), no one is expected to be able to know and do everything and to not make honest mistakes once in a while.
This is especially true when unanticipated problems arise for which no training was provided in the first place. It is at this point that the culture must be effective. The hardest words for a nuclear professional to utter are "I don't know." As part of Admiral Rickover's Chief Engineer Examination, each prospective chief engineer was asked increasingly difficult questions until this was the only appropriate response. Indeed, the best answer a candidate could offer Rickover and his people at this point was "I don't know. That is your job, so I would contact the Naval Reactors staff as soon as possible to get direction." Many prospective chief engineers failed the examination due to their inclination to operate nuclear power plants under a culture that was based on guesses and assumptions.
Also relatively unique to the nuclear industry safety culture is the expectation that operators and workers will have and use detailed procedures exactly as written whenever possible. This is easy to state but very difficult for most people to understand at the level needed. The term "skill of the craft" comes up all the time in performing repair work or conducting tests. Not only are many skilled craftsmen leaving the industry, not all of them even had the required skills in the first place. In any case, such terms should be considered to be "red flags" and an indication that the written procedures are not adequate. Other nuclear safety culture "red flags" are the words "interpreted" and "assumed."
There are many possible examples of procedural failures that are caused by inadequate skills, path-of-least-resistance interpretations, and simplifying assumptions. One of my favorite examples is the "simple" process of bolting flanges together properly, such as for piping, valves, and pump casings. Bolting requirements, procedures, and techniques were at one time considered to be well understood and might not even be included in any detail in the manufacturer's technical manual. There are generic guides, and most nuclear training programs include something on bolting.
Nevertheless, I have found that many commercial nuclear power plants and almost all nuclear weapons facilities and laboratories have significant bolting problems that are evident based on visual inspection of the flanges. It would be worse if someone were actually monitoring the work in progress. At one commercial plant, the bolting associated with recent work was so bad even with the advantage of having a plant bolting procedure that I challenged the maintenance training supervisor to show me his actual training on the procedure. It had mistakenly been deleted from the training program during the previous year.
At many nuclear weapon facilities the issues are more profound for a variety of reasons, including having to deal with a wide range of systems, designers, maintainers, and operators, especially at nuclear weapons laboratories. At one nuclear laboratory I found the waste tank overflow isolation valves had fully painted stem threads. Of course, such valves are not operable, but they attempted to operate them for me anyway.
Again, "skill of the craft" is a "red flag." To make this point even stronger, I will provide another example of procedural nuclear safety culture. I had occasion in the Navy to conduct testing on the reactor plants for a new aircraft carrier, the USS Nimitz, CVN68. The nuclear safety culture during the test program had the additional burden of setting the stage for all of the rest of nuclear powered aircraft carriers to be built over the next 25 years. Every error that we failed to correct would undoubtedly show up again in another test program. Moreover, having also served in the only other nuclear powered aircraft carrier, the USS Enterprise, CVN65, we were sensitive to the fact that everything had to be perfect if we were going to achieve the reliability of an eight reactor propulsion plant with only two reactors.
Thus, it became standard procedure to make sure that every procedure used in the Nimitz test program was as perfect as humanly possible. Corrections were often required, and each correction had to be approved by Admiral Rickover's staff regardless of the time of day, even on weekends. We were able to get the change process down to two hours. In one case we had to change a procedure step from "start the pump by pushing the start button" to "start the pump by turning the start button." While this was an obvious error that was well within the "skill of the craft" to correct, Admiral Rickover ordered a review of the entire procedure since such a mistake meant that the engineers who wrote, reviewed, and approved the procedure did not know the system well enough.
The essence of the appropriate nuclear safety culture can also be conveyed to some degree simply by describing the importance of the plant documentation in terms of its development and use. Not only is the documentation developed under a relatively complex review system that imposes complex writing requirements, the resulting documentation is also used within a complex operational review process. One of the most difficult hurdles encountered by the Department of Energy over the past decade was getting maintenance personnel to wait in line to get permission to do even routine work on the plant. They might have to wait an hour or two to get permission to do a ten minute job. Most of these workers found it difficult to accept or understand that getting permission to do a job is actually part of the job.
Another human habit expected to achieve high standards within a good nuclear safety culture is proper communications among the plant operators. Many procedures are necessarily communicated verbally even when the details are in written form. Each verbal order or direction must be repeated back exactly as given, including an indication that it is understood and that the step will be done, and including a report when it has been done.
All of this is contrary to human nature and contradicts many years of non-nuclear communications and expectations. Even after many years of repeated training and actual use of formal communications, operators continue to be embarrassed by and seemingly impatient with this particular formality requirement. Indeed, at some plants operators have been found to be sleeping while on watch, so we can infer that many others fail to communicate formally when they are not being watched. Indeed, many fail to meet the formal communication standard even when they are being observed. An effective nuclear safety culture includes the failure to use formal communication methods as a deliberate failure on the part of both operators involved. As previously stated, it is only in the area of deliberate failure that a worker or operator should bear the primary responsibility for errors. Thus, anyone can easily assess this part of a nuclear safety culture by observing communications in the control room or in any other nuclear operating environment.
The overall efficiency of the procedures imposed by a good nuclear safety culture can only be appreciated within the context of the nuclear safety goal. While I have heard this goal expressed different ways over the years, the nuclear safety goal that seems to fit my expectations best is that we can allow no major nuclear accident to occur during the next million years. To meet this goal, we must ensure the safety of each one of thousands of nuclear facilities performing thousands of actions using thousands of different people every one of those years. In spite of this goal, we have already had at least two such major accidents. Thus, while it is somewhat embarrassing to have to state the obvious, it is easy to see that much more needs to be done rather than less.
One final note on nuclear safety culture will bring much of this into focus. Nuclear safety always requires having control, being in control, and exercising control over everything associated with the design, manufacture, construction, testing, operations, and maintenance of the nuclear facility. Even more comprehensive is the life-cycle approach that includes controlling all aspects of decommissioning and decontamination.
When we find where we have lost control, we have often found the root
cause of a problem. Control is established through design documentation,
operating and maintenance procedures, adequate and recurrent training,
defense in depth through supervision, ensuring design adequacy and reliability,
performing proper and timely maintenance, comprehensive testing for degradations,
and the application of a sophisticated and unrelenting nuclear safety culture.
Even if these consequences are viewed as transitory when compared with the potential need to rely on nuclear technology for the next several thousand years, each such accident has the effect of reducing the credibility of the nuclear industry -- and rightly so. If we are not able to control the use of nuclear technology in a reliably safe manner, we should not be allowed to use this technology at all. Without the availability of a safe nuclear energy source, mankind may have to deal with increasingly severe energy shortage problems when petroleum becomes less available. Even if all goes well and nuclear power is available and needed to provide a significant portion of the worlds energy needs, the importance of an adequate nuclear safety culture will still increase.
A good nuclear safety culture helps ensure that the special efforts required to achieve success on a daily basis at a nuclear power plant or other nuclear facility fall within the personal capabilities of each individual. If an individual does something wrong, it is far more important to make it right than to seek to protect oneself from embarrassment or the perceived responsibility for secondary issues such as a schedule delay. Managers must be careful to create an organizational environment in which each person is motivated to reveal and correct adverse conditions rather than to conceal such problems and potential problems.
At one Department of Energy facility, a worker was fired for removing a safety tag from some equipment without proper authorization. This action was taken by plant managers based primarily on an order communicated by telephone from an official in Washington, DC. Rather than ask how such a thing could happen after all of the emphasis given to ensuring adherence to stringent tag out procedures, managers tried to make the point that such actions would not be tolerated under any conditions. They did not even bother to investigate those conditions; they just recorded the surrounding events and responded blindly to them, making the assumption that the individual worker bore the majority of the accountability for such an error.
I happened to be on an operational review team after this tag removal and firing event, and I was startled when I uncovered the results of management's actions. I found that most of the craft personnel who were close to these events were subsequently "negatively motivated" to take any initiative at all. They became reluctant to even look for problems, they started to ignore the ones that they found, and they would certainly not report any problems to management. They decided that any new problems uncovered and reported would potentially put someone's job in jeopardy, possibly their own. It became personally safer to be as passive as possible. The nuclear safety culture at this plant was severely damaged by a single phone call from someone who had a strong personality but an inadequate understanding of nuclear safety culture.
There are potentially many individuals at a nuclear plant or facility
at any one time who are new to the nuclear safety culture, unable to understand
it, or unwilling to meet its challenges and requirements. If one of these
individual is a manager, he or she might let outside influences such as
the one described above unduly influence plant safety. If the organizational
nuclear safety culture is strong, other managers will correct that manager
and avoid adverse safety consequences. Also, if the individual is a front
line supervisor, it is possible to detect and prevent problems. However,
if the cultural problem is with the actual hands on worker or operator,
the chances of avoiding adverse consequences virtually disappear. Thus,
the least powerful member of the team is the most important member in many
instances. The presence of a bad manager or supervisor is often less damaging
than the presence of a bad worker or operator.
The Navy also ensures that its best and most experienced people are assigned to its most critical Navy tasks. Even though Admiral Rickover was credited with having his own unique management style, each of the officers in his program had considerable leeway to do things differently as long as the basic program principles were not violated. The Navy picked the best officers it could find to manage each department for its new aircraft carrier, including the reactor and engineering departments. Thus, the people assigned by the Navy to build and startup the Nimitz aircraft carrier reactor and propulsion plants were considered to be the best available to the Navy. They were hand picked by Admiral Rickover when they entered his program, and they were hand picked again for these critical assignments. They were also relied upon to manage their organizations such that the best possible overall result would be generated for the Navy, observing and staying within the limits of guiding principles.
One of these principles was (and continues to be as far as I know) that management is responsible for everything that happens, good or bad. If this is true, and if management must somehow meet these comprehensive obligations, how can management prevent a worker who is worried about a routine personal problem from making a mistake? It is easy to say management is responsible. It is quite another matter to understand how such a responsibility can be met.
The answer is that the manager must strive to know about all such obstacles and must make real efforts to remove them. For example, if a worker is worried about picking up a child late from daycare due to having to finish a task at the nuclear plant, the manager should see to it that the child is picked up on time even if the manager has to do so personally. The key principle involved in this example has nothing to do with nuclear safety culture. Contrary to the expectations of some managers, a worker will often put family before work. It is up to management to make sure that there is no reason to do so by identifying and resolving such conflicts in advance. Even applying their best efforts in this regard, management will miss many opportunities to remove obstacles from the paths of the workers.
Of course, most workers would keep such personal issues to themselves
in most situations, and managers would generally not consider dealing with
such issues personally even if they found out about them. With the childcare
example in mind, you can also see that supposedly enlightened concepts
such as "management by walking around" are fundamentally appropriate but
are often inadequate to meet the challenge of removing obstacles from the
paths of the workers. Much more direct and personal knowledge and action
are needed, and they can be achieved (if at all) only within the framework
of a defined and vigorous nuclear safety culture.
Having witnessed and participated in many different nuclear plant organizations since 1966, there is only one that ever impressed me as having a really good nuclear safety culture. Not only did the senior nuclear manager at that plant have an excellent nuclear safety culture relevant answer to this question, he vigorously practiced it and demanded that each manager under him do the same.
His answer was given to me in 1973, long before the era of enlightened management philosophies. He believed that management's primary role is "to remove obstacles from the paths of the workers." While this is a simple concept, it is not easily understood and implemented. It is difficult just to get managers to look for such obstacles, much less recognize them and deal with them properly. Moreover, most workers are aware of the obstacles, but they are sometimes ineffective in removing them. In any case, "removing obstacles from the paths of the workers" is the most elegant and relevant management function description that I have ever encountered.
Since you are probably wondering where I found this insightful manager and how I know that he is right about all of this, I will fill in these blanks for you. The freedom of management action found in the Navy is often reflected on with dismay in the commercial nuclear power industry since the Navy is viewed as having unlimited resources. Contrary to this notion of unlimited resources, those of us who are more familiar with the Navy program know that the controlling factor is really an unwillingness to violate basic principles.
One source of this emphasis on principles is simply an 1849 quote from Commodore Maury: "When principle is involved, be deaf to expediency." The Navy gets hundreds of new officers every year who have memorized these words and take them seriously. Indeed, Navy nuclear propulsion program management consists largely of such officers, making financial considerations less important than the basic principles that they consider to be critical to the success of their program. Their concepts of success are based on safety and reliability first, although they are willing to expend an extraordinary level of energy getting things done on time and meeting schedules.
Also, the Navy nuclear propulsion safety culture is such that repairs are demanded rather than requested. If money appears to be "no object," it is largely because everyone knows that there would be hell to pay if someone tried to start up a reactor plant that was not on the edge of perfection. In my experience, Navy propulsion plants seldom had more a few minor deficiencies (less than ten) at startup. In the commercial nuclear power industry, the list of deferred problems often includes several hundred items. Important work not completed in the current outage is likely to be postponed to the next outage, usually about 18 months later.
A recent example (1999) at a commercial nuclear plant was the deferral
of the replacement of degraded (biologically fouled) cooling water piping
to one of two emergency diesel generators. The outage managers got one
of the cooling systems repaired, but when they "ran out of time," they
arbitrarily decided to defer the other one until the next outage. The non-repaired
cooling system could not be relied on to provide adequate flow over the
next 18 months, as was pointed out during an audit by the Nuclear Regulatory
Commission. This was only one of several issues at the plant that indicated
a poor nuclear safety culture. Management was creating obstacles for the
workers rather than removing obstacles.
Nuclear safety culture is really just the reflection of the principles and philosophies (good or bad) of the boss as implemented by the workers. Thus, a good nuclear safety culture can be promoted by managers, but it can not be implemented without the constant and enlightened participation of the plant workers and operators. Nothing gets done unless a trained and motivated worker is on the job doing each of thousands of tasks properly.
Few modern managers truly understand such notions, so managers of many
commercial nuclear plants continue to falter in their very difficult task
of ensuring nuclear safety in conjunction with reliability and profitability.
The same can be said of many of the managers of the nuclear facilities
that fall under the Department of Energy. Nevertheless, those who understand
and are willing to apply these fundamental ideas are well on their way
to achieving a good nuclear safety culture within their organization.
With the increased use of computer technology, while there is often some hope that the administrative burden will ease, things can also get more complex and less understandable. Many senior managers do not have the luxury of truly understanding the computer technology and software upon which they are becoming increasingly reliant. Even "simple" data bases can become overly complex (geometrically) when they are combined. Indeed, at least one commercial nuclear plant that is currently (1999) having lots of problems has "simplified" its databases so much by combining them that the aggregate environment has become error prone and difficult for anyone to understand and use properly.
The nuclear plant administrative environment is naturally complex and is getting more so at some plants. The increased complexity requires closer management attention rather than less if plant administrative processes are to be consistent with a strong nuclear safety culture. In the past, managers were able to largely ignore routine administrative procedures and policies, but they do so now only at great risk of losing control of what is really going on at the plant.
During commercial nuclear plant inspections, I have often found a great deal of confusion regarding which design documents were up to date and considered to be valid. Also, "approved" documents are sometimes based on those that are "unapproved" or "superseded." While it may now be easier to manage the administrative complexities of a nuclear plant, it is also easier to create confusion when the managers and workers have to deal with such complexities on an infrequent basis. This is true even if the managers and workers have received training.
Again, if we think in terms of "maintaining control of everything" at
a nuclear plant, it is a bit easier to understand how administrative processes
can get us into trouble. Such processes deserve to have system experts
assigned just as much as do the plant's nuclear safety systems. Managers
must aggressively understand and manage the administrative environment
(a safety system in its own right) so that the organization promotes excellence
rather than inhibiting it.
Most commercial nuclear power plants have a visitor center and provide a lot of information to the public such that there is at least some understand and trust. For nuclear facilities involving classified information, especially facilities that support nuclear weapons programs, there is likely to be less openness and more closed gates. While it is often mandatory to keep classified information under tight control, there is no reason to physically exclude local citizens and officials from visiting the facilities and seeing "what really goes on inside that fence."
At one Department of Energy facility, managers were so secretive and the gates were so tight that the local citizens had only the "anti-nuke" perspectives to go on. The news media particularly magnified the problem by creating horrible scenarios and consequences, most of which were not connected at all to reality. The plant managers did little or nothing to dissuade reporters from their perceptions, so the local community eventually started calling for plant shutdown based on safety issues. It got so bad that the Federal Bureau of Investigation actually "raided" the plant in an effort to catch bad things in progress.
Since I subsequently participated in the comprehensive inspection and evaluation of all of the allegations, I can verify that much of the problems was simply a lack of proper communication within the plant as well as with the local citizens. While there was much more to it, one significant step that was very useful in allaying citizen concerns was simply conducting plant tours so that "everybody could see" the plant as it really was. Most nuclear plants are far more safe and impressive than the average person can perceive without actually visiting the facility.
So far as dealing with the professional anti-nuke elements that are constantly seeking nuclear plant shutdowns, it is usually best to increase communications at this interface as well. It does little good to have even an excellent nuclear safety culture when the plant is constantly being distracted defending against spurious charges raised by those who are informed yet uninformed. In some cases these nuclear plant detractors actually have useful ideas to offer and should have an opportunity to state their case.
There is also often much to be gained by including anti-nuclear people in the membership of inspection and assessment teams. In some cases they will participate quite effectively and promote a hard look at the plant nuclear safety culture. In other cases they will become quickly overloaded with technical information and the stress of the work, and they will drop out of the team. Most are willing to acknowledge the professionalism of plant managers or at least the ability of the remaining inspectors to do a good job.
Thus, it is usually best to include rather than exclude as many non-plant people as may be feasible in plant activities. When I was on a Navy nuclear propulsion plant inspection team that went from ship to ship, the best commanding officers were those who insisted that I come to their ship. The not-so-good commanding officers were those who avoided outside inspection teams. The condition of their nuclear propulsion plants and their standing as effective leaders in the Navy reflected their openness or lack of openness. In one case, at the request of an aggressive and open commanding officer, I was tasked to meet a nuclear powered cruiser in Manila and ride it back to San Diego, inspecting and teaching full time for the entire two week transit.
Likewise, in the commercial nuclear industry, there are some plant managers who volunteer for additional scrutiny and there are others who hide out and avoid and even inhibit inspections. Having been on about 12 commercial plant safety system inspections, I have seen both open and closed doors when it comes to openness. Some plant cultures are very cooperative and responsive at each step of the inspection. Some plants set up obstacles and drag their feet in the hope that the inspection team will run out of time before anything significant is found. In other cases the resistance to having a good inspection comes from only one or two middle managers.
In an ideal environment, it would be enough just to determine that the nuclear safety culture at a plant is either adequate or inadequate. It only requires a relatively low level of effort to determine this. Also, there is no way that outside inspectors can ensure success in identifying problems if the plant managers are not cooperative. In my experience, the Navy places a high priority on a plant's nuclear safety culture, while the Nuclear Regulatory Commission usually ignores commercial plant safety culture issues and even management issues in general. The Department of Energy falls somewhere in between these two extremes, having a mix of Navy and commercial inspectors, not to mention a wide range of nuclear facility types.
Without placing emphasis on nuclear safety culture "up front," the results of regulatory and other inspection activities often suggest cultural weaknesses on the back side of the process. This is when a plant experiences an actual emergency or accident, or just before the plant must be shut down for other safety reasons. When the regulators fail to appreciate and assess for nuclear safety culture, regardless of the reasons for this failure, a nuclear plant is left to its own devices and internal leadership. As that leadership changes, the culture will change, resulting in cyclic performance.
Cyclic performance has historically resulted in cyclic replacement of management, and a cyclic reputation for the plant. For a commercial nuclear plant, such cycles expose the plant to early shutdowns and decommissioning, or at least prolonged shutdowns and recovery processes that can be very costly to everyone concerned. In cases where the plant is in trouble such that it is forced to shutdown, being open with the public is no longer likely to dispel negative attitudes.