Nuclear Regulation: NRC Needs to More Aggressively and Comprehensively Resolve Issues Related to the Davis-Besse Nuclear Power Plant's Shutdown
Published: 2004-05-17T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: In March 2002, the most serious safety issue confronting the nation's commercial nuclear power industry since Three Mile Island in 1979 was identified at the Davis- Besse plant in Ohio. After the Nuclear Regulatory Commission (NRC) allowed Davis-Besse to delay shutting down to inspect its reactor vessel for cracked tubing, the plant found that leakage from these tubes had caused extensive corrosion on the vessel head--a vital barrier preventing a radioactive release. GAO determined (1) why NRC did not identify and prevent the corrosion, (2) whether the process NRC used in deciding to delay the shutdown was credible, and (3) whether NRC is taking sufficient action in the wake of the incident to prevent similar problems from developing at other plants.
section_title: What GAO Found
paragraphs: NRC should have but did not identify or prevent the corrosion at Davis- Besse because its oversight did not generate accurate information on plant conditions. NRC inspectors were aware of indications of leaking tubes and corrosion; however, the inspectors did not recognize the indications' importance and did not fully communicate information about them. NRC also considered FirstEnergy--Davis-Besse's owner--a good performer, which resulted in fewer NRC inspections and questions about plant conditions. NRC was aware of the potential for cracked tubes and corrosion at plants like Davis-Besse but did not view them as an immediate concern. Thus, NRC did not modify its inspections to identify these conditions. NRC's process for deciding to allow Davis-Besse to delay its shutdown lacks credibility. Because NRC had no guidance specifically for making a decision on whether a plant should shut down, it used guidance for deciding whether a plant should be allowed to modify its operating license. NRC did not always follow this guidance and generally did not document how it applied the guidance. The risk estimate NRC used to help decide whether the plant should shut down was also flawed and underestimated the amount of risk that Davis-Besse posed. Further, even though underestimated, the estimate still exceeded risk levels generally accepted by the agency. NRC has taken several significant actions to help prevent reactor vessel corrosion from recurring at nuclear power plants. NRC has required more extensive vessel examinations and augmented inspector training. However, NRC has not yet completed all of its planned actions and, more importantly, has no plans to address three systemic weaknesses underscored by the incident. Specifically, NRC has proposed no actions to help it better (1) identify early indications of deteriorating safety conditions at plants, (2) decide whether to shut down a plant, or (3) monitor actions taken in response to incidents at plants. Both NRC and GAO had previously identified problems in NRC programs that contributed to the Davis-Besse incident, yet these problems continue to persist.

section_title: Letter
paragraphs: In 2002, the most serious safety issue confronting the nation’s commercial  nuclear power industry since the accident at Three Mile Island in 1979 was  identified at the Davis-Besse nuclear power plant in northwestern Ohio. On  March 7, 2002, during shutdown for inspection and refueling, the owner of  the Davis-Besse plant—FirstEnergy Nuclear Operating Company— discovered a pineapple-sized cavity in the plant’s carbon steel reactor  vessel head. The reactor vessel head is an 18-foot-diameter, 6-inch-thick,  80-ton cap that is bolted to the reactor vessel. The vessel head is an integral  part of the reactor coolant pressure boundary that serves as a vital barrier  for protecting the environment from any release of radiation from the  reactor core. In pressurized water reactors such as the one at Davis-Besse,  the reactor vessel contains the nuclear fuel, as well as water with diluted  boric acid that cools the fuel and helps control the nuclear reaction. At the  Davis-Besse plant, vertical tubes had cracked that penetrate the reactor  vessel head and that contain this water as well as drive mechanisms used to  lower and raise the fuel, thus allowing leaked boric acid to corrode the  reactor vessel head. The corrosion had extended through the vessel head to  a thin stainless steel lining and had likely occurred over a period of several  years. The lining, which is less than one-third of an inch thick and was not  designed as a pressure barrier, was found to have a slight bulge with  evidence of cracking. Had this lining given way, the water within the  reactor vessel would have escaped, triggering a loss-of-coolant accident,  which—if back-up safety systems had failed to operate—likely would have  resulted in the melting of the radioactive core and a subsequent release of  radioactive materials into the environment. In March 2004, after 2 years of  increased NRC oversight and considerable repairs by FirstEnergy, NRC  approved the restart of Davis-Besse’s operations.
Under the Atomic Energy Act of 1954, as amended, and the Energy  Reorganization Act of 1974, as amended, the Nuclear Regulatory  Commission (NRC) and the operators of nuclear power plants share the  responsibility for ensuring that nuclear reactors are operated safely. NRC is  responsible for issuing regulations, licensing and inspecting plants, and  requiring action, as necessary, to protect public health and safety; plant  operators have the primary responsibility for safely operating the plants in  accordance with their licenses. NRC has the authority to order plant  operators to take actions, up to and including shutting down a plant, if  licensing conditions are not being met and the plant poses an undue risk to  public health and safety. In carrying out its responsibilities, NRC relies on,  among other things, on-site NRC resident inspectors to assess plant  conditions and quality assurance programs, such as those for maintenance  and operations, that operators establish to ensure safety at the plant.
Before the discovery of the cavity in the Davis-Besse reactor vessel head,  NRC had requested that operators of Davis-Besse and other similar  pressurized water reactors (1) thoroughly inspect the vertical tubing on  their reactor vessel heads by December 31, 2001, for possible cracking, or  (2) justify why their tubing and reactor vessel heads were sufficiently safe  without being inspected. This request was a reaction to cracked vertical  tubing found on a pressurized water reactor vessel head at another plant.  Such thorough inspections require that the reactor be shut down.  FirstEnergy, believing that its reactor vessel head was safe, asked NRC if its  shutdown could be delayed until the end of March 2002 to coincide with an  already scheduled shutdown for refueling—during which time it would  conduct the requested inspection. FirstEnergy provided evidence  supporting its assertion that the reactor could continue operating safely.  After considerable discussion, and after NRC developed a risk assessment  estimate for deciding that Davis-Besse would not pose an unacceptable  level of risk, NRC and FirstEnergy compromised, and FirstEnergy agreed  to shut down the reactor in mid-February 2002 for inspection. Soon after  Davis-Besse was shut down, the cracked tubes and the significant reactor  vessel head corrosion were discovered.
You asked us to determine (1) why NRC did not identify and prevent the  vessel head corrosion at Davis-Besse, (2) whether the process NRC used  when deciding to allow FirstEnergy to delay its shutdown was credible,  and (3) whether NRC is taking sufficient action in the wake of the Davis- Besse incident to prevent similar problems from developing in the future at  Davis-Besse and other nuclear power plants. As agreed with your offices,  our review focused on NRC’s role in the events leading up to Davis-Besse’s  shutdown, NRC’s response to the problems discovered, and NRC’s  management controls over programs and processes that may have  contributed to the Davis-Besse incident. We did not evaluate the role of  FirstEnergy because, at the time of our review, NRC’s Office of  Investigations and the Department of Justice were conducting separate  inquiries into the potential liability of FirstEnergy concerning its  knowledge of conditions at Davis-Besse, including the condition of the  reactor vessel head. We also did not review NRC’s March 2004 decision to  allow the plant to restart.
subsections: section_title: Scope and Methodology
paragraphs: To determine why NRC did not identify and prevent the vessel head  corrosion at the Davis-Besse nuclear power plant, we reviewed NRC’s  lessons-learned task force report; FirstEnergy’s root cause analysis  reports; NRC’s Office of the Inspector General reports on Davis-Besse;  NRC’s augmented inspection team report; and NRC’s inspection reports  and licensee assessments from 1998 through 2001. We also reviewed NRC  generic communications issued on boric acid corrosion and on nozzle  cracking. In addition, we interviewed NRC regional officials who were  involved in overseeing Davis-Besse at the time corrosion was occurring,  and when the reactor vessel head cavity was found, to learn what  information they had, their knowledge of plant activities, and how they  communicated information to headquarters. We also held discussions with  the resident inspector who was at Davis-Besse at the time that corrosion  was occurring to determine what information he had and how this  information was communicated to the regional office. Further, we met with  FirstEnergy and NRC officials at Davis-Besse and walked through the  facility, including the containment building, to understand the nature and  extent of NRC’s oversight of licensees. Additionally, we met with NRC  headquarters officials to discuss the oversight process as it related to  Davis-Besse, and the extent of their knowledge of conditions at Davis- Besse. We also met with county officials from Ottawa County, Ohio, to  discuss their views on NRC and Davis-Besse plant safety. Further, we met  with representatives from a variety of public interest groups to obtain their  thoughts on NRC’s oversight and the agency’s proposed changes in the  wake of Davis-Besse.
To determine whether the process NRC used was credible when deciding  to allow Davis-Besse to delay its shutdown, we evaluated NRC guidelines  for reviewing licensee requests for temporary and permanent license  changes, or amendments to their licenses. We also reviewed NRC guidance  for making and documenting agency decisions, such as those on whether to  accept licensee responses to generic communications, as well as NRC’s  policies and procedures for taking enforcement action. We supplemented  these reviews with an analysis of internal NRC correspondence related to  the decision-making process, including e-mail correspondence, notes, and  briefing slides. We also reviewed NRC’s request for additional information  to FirstEnergy following the issuance of NRC’s generic bulletin for  conducting reactor vessel head and nozzle inspections, as well as  responses provided by FirstEnergy. In addition, we reviewed the draft  shutdown order that NRC prepared before accepting FirstEnergy’s  proposal to conduct its inspection in mid-February 2002. We reviewed  these documents to determine whether the basis for NRC’s decision was  clearly laid out, persuasive, and defensible to a party outside of NRC.
As part of our analysis for determining whether NRC’s process was  credible, we also obtained and reviewed NRC’s probabilistic risk  assessment (PRA) calculations that it developed to guide its decision  making. To conduct this analysis, we relied on the advice of consultants  who, collectively, have an extensive background in nuclear engineering,  PRA, and metallurgy. These consultants included Dr. John C. Lee, Professor  and Chair, Nuclear Engineering and Radiological Sciences at the University  of Michigan’s College of Engineering; Dr. Thomas H. Pigford, Professor  Emeritus, at the University of California-Berkeley’s College of Engineering;  and Dr. Gary S. Was, Associate Dean for Research in the College of  Engineering, and Professor, Nuclear Engineering and Radiological Sciences  at the University of Michigan’s College of Engineering. These consultants  reviewed internal NRC correspondence relating to NRC’s PRA estimate,  NRC’s calculations, and the basis for these calculations. These consultants  also discussed the basis for NRC’s estimates with NRC officials and outside  contractors who provided information to NRC as it developed its estimates.  These consultants were selected on the basis of recommendations made by  other nuclear engineering experts, their résumés, their collective  experience, lack of a conflict of interest, and previous experience with  assessing incidents at nuclear power plants such as Three Mile Island.
To determine whether NRC is taking sufficient action in the wake of the  Davis-Besse incident to prevent similar problems from developing in the  future, we reviewed NRC’s lessons-learned task force recommendations,  NRC’s analysis of the underlying causes for failing to identify the corrosion  of the reactor vessel head, and NRC’s action plan developed in response to  the task force recommendations. We also reviewed other NRC lessons- learned task force reports and their recommendations, our prior reports to  identify issues related to those at Davis-Besse, and NRC’s Office of the  Inspector General reports. We met with NRC officials responsible for  implementing task force recommendations to obtain a clear understanding  of the actions they were taking and the status of their efforts, and discussed  NRC’s recommendations with NRC regional officials, on-site inspectors,  and representatives from public interest groups. We conducted our review  from November 2002 through May 2004 in accordance with generally  accepted government auditing standards.
section_title: Background
subsections: section_title: NRC’s Role and Responsibilities
paragraphs: NRC, as an independent federal agency, regulates the commercial uses of  nuclear material to ensure adequate protection of public health and safety  and the environment. NRC is headed by a five-member commission  appointed by the President and confirmed by the Senate; one  commissioner is appointed as chairman. NRC has about 2,900 employees  who work in its headquarters office in Rockville, Maryland, and its four  regional offices. NRC is financed primarily by fees that it imposes on  commercial users of the nuclear material that it regulates. For fiscal year  2004, NRC’s appropriated budget of $626 million includes about $546  million financed by these fees.
NRC regulates the nation’s commercial nuclear power plants by  establishing requirements for plant owners and operators to follow in the  design, construction, and operation of the nuclear reactors. NRC also  licenses the reactors and individuals who operate them. Currently, 104  commercial nuclear reactors at 65 locations are licensed to operate. Many  of these reactors have been in service since the early to mid-1970s. NRC  initially licensed the reactors to operate for 40 years, but as these licenses  approach their expiration dates, NRC has been granting 20-year extensions.
To ensure the reactors are operated within their licensing requirements and  technical specifications, NRC oversees them by both inspecting activities  at the plants and assessing plant performance. NRC’s inspections consist  of both routine, or baseline, inspections and supplemental inspections to  assess particular licensee programs or issues that arise at a power plant.  Inspections may also occur in response to a specific operational problem  or event that has occurred at a plant. NRC maintains inspectors at every  operating nuclear power plant in the United States and supplements the  inspections conducted by these resident inspectors with inspections  conducted by staff from its regional offices and from headquarters.  Generally, inspectors verify that the plant’s operator qualifications and  operations, engineering, maintenance, fuel handling, emergency  preparedness, and environmental and radiation protection programs are  adequate and comply with NRC safety requirements. NRC also oversees  licensees by requesting information on their activities. NRC requires that  information provided by licensees be complete and accurate and,  according to NRC officials, this is an important aspect of the agency’s  oversight. While we have added information to this report on the  requirement that licensees provide NRC with complete and accurate  information, we believe that NRC’s oversight program should not place  undue reliance on this requirement.
Nuclear power plants have many physical structures, systems, and  components, and licensees have numerous activities under way, 24-hours a  day, to ensure the plants operate safely. Programs to ensure quality  assurance and safe operations include monitoring, maintenance, and  inspection. To carry out these programs, licensees typically prepare several  thousand reports per year describing conditions at the plant that need to be  addressed to ensure continued safe operations. Because of the large  number of activities and physical structures, systems, and components,  NRC focuses its inspections on those activities and pieces of equipment or  systems that are considered to be most significant for protecting public  health and safety. NRC terms this a “risk-informed” approach for regulating  nuclear power plants. Under this risk-informed approach, some systems  and activities that NRC considers to have relatively less safety significance  receive little NRC oversight. NRC has adopted a risk-informed approach  because it believes it can focus its regulatory resources on those areas of  the plant that the agency considers to be most important to safety. In  addition, it was able to adopt this approach because, according to NRC,  safety performance at nuclear power plants has improved as a result of  more than 25 years of operating experience.
To decide whether inspection findings are minor or major, NRC uses a  process it began in 2000 to determine the extent to which violations  compromise plant safety. Under this process, NRC characterizes the  significance of its inspection findings by using a significance determination  process to evaluate how an inspection finding impacts the margin of safety  at a power plant. NRC has a range of enforcement actions it can take,  depending on how much the safety of the plant had been compromised. For  findings that have low safety significance, NRC can choose to take no  formal enforcement action. In these instances, nonetheless, licensees  remain responsible for addressing the identified problems. For more  serious findings, NRC may take more formal action, such as issuing  enforcement orders. Orders can be used to modify, suspend, or even revoke  an operating license. NRC has issued one enforcement order to shut down  an operating power plant in its 28-year history—in 1987, after NRC  discovered control room personnel sleeping while on duty at the Peach  Bottom nuclear power plant in Pennsylvania. In addition to enforcement  orders, NRC can issue civil penalties of up to $120,000 per violation per day.  Although NRC does not normally use civil penalties for violations  associated with its Reactor Oversight Process, NRC will consider using  them for issues that are willful, have the potential for impacting the  agency’s regulatory process, or have actual public health and safety  consequences. In fiscal year 2003, NRC proposed imposing civil penalties  totaling $120,000 against two power plant licensees for the failure to  provide complete and accurate information to the agency.
NRC uses generic communications—such as bulletins, generic letters, and  information notices—to provide information to and request information  from the nuclear industry at large or specific groups of licensees. Bulletins  and generic letters both usually request information from licensees  regarding their compliance with specific regulations. They do not require  licensees to take any specific actions, but do require licensees to provide  responses to the information requests. In general, NRC uses bulletins, as  opposed to generic letters, to address significant issues of greater urgency.  NRC uses information notices to transmit significant recently identified  information about safety, safeguards, or environmental issues. Licensees  are expected to review the information to determine whether it is  applicable to their operations and consider action to avoid similar  problems.
section_title: Operation of Pressurized Water Nuclear Power Plants and Events Leading to the March 2002 Discovery of Serious Corrosion
paragraphs: The Davis-Besse Nuclear Power Station, owned and operated by  FirstEnergy Nuclear Operating Company, is an 882-megawatt electric  pressurized water reactor located on Lake Erie in Oak Harbor, Ohio, about  20 miles east of Toledo. The power plant is under NRC’s Region III  oversight, which is located in Lisle, Illinois. Like other pressurized water  reactors, Davis-Besse is designed with multiple barriers between the  radioactive heat-producing core and the outside environment—a design  concept called “defense-in-depth.” Three main design components provide  defense-in-depth. First, the reactor core is designed to retain radioactive  material within the uranium oxide fuel, which is also covered with a layer  of metal tubing. Second, a 6-inch-thick carbon steel vessel, lined with three- sixteenth-inch-thick stainless steel, surrounds the reactor core. Third, a  steel containment structure, surrounded by a thick reinforced concrete  building, encloses the reactor vessel and other systems and components  important for maintaining safety. The containment structure and concrete  building are intended to help not only prevent a release of radioactivity to  the environment, but also shield the reactor from external hazards like  tornados and missiles. The reactor vessel, in addition to housing the  reactor core, contains highly pressurized water to cool the radioactive  heat-producing core and transfer heat to a steam generator. Consequently,  the vessel is referred to as the reactor pressure vessel. From the vessel, hot  pressurized water is piped to the steam generator, where a separate supply  of water is turned to steam to drive turbines that generate electricity. (See  fig. 1.)
The top portion of the Davis-Besse reactor pressure vessel consisted of an  18-foot-diameter vessel head that was bolted to the lower portion of the  pressure vessel. At Davis-Besse, 69 vertical tubes penetrated and were  welded to the vessel head. These tubes, called vessel head penetration  nozzles, contained control rods that, when raised or lowered, were used to  moderate or shut down the nuclear reaction in the reactor. Because  control rods attach to control rod drive mechanisms, these types of nozzles  are referred to as control rod drive mechanism nozzles. A platform, known  as the service structure, sat above the reactor vessel head and the control  rod drive mechanism nozzles. Inside the service structure and above the  pressure vessel head was a layer of insulation to help contain the heat  emanating from the reactor. The sides of the lower portion of the service  structure were perforated with 18 5- by 7-inch rectangular openings,  termed “mouse-holes,” that were used for vessel head inspections. In  pressurized water reactors such as Davis-Besse, the reactor vessel, the  vessel head, the nozzles, and other equipment used to ensure a continuous  supply of pressurized water in the reactor vessel are collectively referred to  as the reactor coolant pressure boundary. (See fig. 2.)
To better control the nuclear reaction at nuclear power plants, boron in the  form of boric acid crystals is dissolved in the cooling water contained  within the reactor vessel and pressure boundary. Boric acid, under certain  conditions, can cause corrosion of carbon steel. For about 3 decades, NRC  and the nuclear power industry have known that boric acid had the  potential to corrode reactor components. In general, if leakage occurs from  the reactor coolant system, the escaping coolant will flash to steam and  leave behind a concentration of impurities, including noncorrosive dry  boric acid crystals. However, under certain conditions, the coolant will not  flash to steam, and the boric acid will remain in a liquid state where it can  cause extensive and rapid degradation of any carbon steel components it  contacts. Such extensive degradation, in both domestic and foreign  pressurized water reactor plants, has been well documented and led NRC  to issue a generic letter in 1988 requesting information from pressurized  water reactor licensees to ensure they had implemented programs to  control boric acid corrosion. NRC was primarily concerned that boric acid  corrosion could compromise the reactor coolant pressure boundary. This  concern also led NRC to develop a procedure for inspecting licensees’  boric acid corrosion control programs and led the Electric Power Research  Institute to issue guidance on boric acid corrosion control.
NRC and the nuclear power industry have also known that nozzles made of  alloy 600, used in several areas within nuclear power plants, were prone  to cracking. Cracking had become an increasingly topical issue as the  nuclear power plant fleet has aged. In 1986, operators at domestic and  foreign pressurized water reactors began reporting leaks in various types of  alloy 600 nozzles. In 1989, after leakage was detected at a domestic plant,  NRC identified the cause of the leakage as cracking due to primary water  stress corrosion. However, NRC concluded that the cracking was not an  immediate safety concern for a few reasons. For example, the cracks had a  low growth rate, were in a material with an extremely high flaw tolerance  and, accordingly, were unlikely to spread. Also, the cracks were axial—that  is, they ran the length of the nozzle rather than its circumference. NRC and  the nuclear power industry were more concerned that circumferential  cracks could result in broken or snapped nozzles. NRC did, however, issue  a generic information notice in 1990 to inform the industry of alloy 600  cracking. Through the early 1990s, NRC, the Nuclear Energy Institute, and  others continued to monitor alloy 600 cracking. In 1997, continued concern  over cracking led NRC to issue a generic letter to pressurized water reactor  licensees requesting information on their plans to monitor and manage  cracking in vessel head penetration nozzles as well as to examine these  nozzles.
In the spring of 2001, licensee inspections led to the discovery of large  circumferential cracking in several vessel head penetration nozzles at the  Oconee Nuclear Station, in South Carolina. As a result of the discovery, the  nuclear power industry and NRC categorized the 69 operating pressurized  water reactors in the United States into different groups on the basis of (1)  whether cracking had already been found and (2) how similar they were to  Oconee in terms of the amount of time and the temperature at which the  reactors had operated. The industry had developed information indicating  that greater operating time and temperature were related to cracking. In  total, five reactors at three locations were categorized as having already  identified cracking, while seven reactors at five locations were categorized  as being highly susceptible, given their similarity to Oconee.
In August 2001, NRC issued a bulletin requesting that licensees of these  reactors provide, within 30 days, information on their plans for conducting  nozzle inspections before December 31, 2001. In lieu of this information,  NRC stated that licensees could provide the agency with a reasoned basis  for their conclusions that their reactor vessel pressure boundaries would  continue to meet regulatory requirements for ensuring the structural  integrity of the reactor coolant pressure boundary until the licensees  conducted their inspections. NRC used a bulletin, as opposed to a generic  letter, to request this information because cracking was considered a  significant and urgent issue. All of the licensees of the highly susceptible  reactors, except Davis-Besse and D.C. Cook reactor unit 2, provided NRC  with plans for conducting inspections by December 31, 2001.
In September 2001, FirstEnergy proposed conducting the requested  inspection in April 2002, following its planned March 31, 2002, shutdown to  replace fuel. In making this proposal, FirstEnergy contended that the  reactor coolant pressure boundary at Davis-Besse met and would continue  to meet regulatory requirements until its inspection. NRC and FirstEnergy  exchanged information throughout the fall of 2001 regarding when  FirstEnergy would conduct the inspection at Davis-Besse. NRC drafted an  enforcement order that would have shut down Davis-Besse by December  2001 for the requested inspection in the event that FirstEnergy could not  provide an adequate justification for safe operation beyond December 31,  2001, but ultimately compromised on a mid-February 2002 shutdown date.  NRC, in deciding when FirstEnergy had to shut down Davis-Besse for the  inspection, used a risk-informed decision-making process, including  probabilistic risk assessment (PRA), to conclude that the risk that Davis- Besse would have an accident in the interim was relatively low. PRA is an  analytical tool for estimating the probability that a potential accident might  occur by examining how physical structures, systems, and components,  along with employees, work together to ensure plant safety.
Following the mid-February 2002 shutdown and in the course of its  inspection in March 2002, FirstEnergy removed about 900 pounds of boric  acid crystals and powder from the reactor vessel head, and subsequently  discovered three cracked nozzles. The number of nozzles that had cracked,  as well as the extent of cracking, was consistent with analyses that NRC  staff had conducted prior to the shutdown. However, in examining the  extent of cracking, FirstEnergy also discovered that corrosion had caused  a pineapple-sized cavity in the reactor vessel head. (See figs. 3 and 4.)
After this discovery, NRC directed FirstEnergy to, among other things,  determine the root cause of the corrosion and obtain NRC approval before  restarting Davis-Besse. NRC also dispatched an augmented inspection  team consisting of NRC resident, regional, and headquarters officials. The  inspection team concluded that the cavity was caused by boric acid  corrosion from leaks through the control rod drive mechanism nozzles in  the reactor vessel head. Primary water stress corrosion cracking of the  nozzles caused through-wall cracks, which led to the leakage and eventual  corrosion of the vessel head. NRC’s inspection team also concluded, among  other things, that this corrosion had gone undetected for an extended  period of time—at least 4 years—and significantly compromised the plant’s  safety margins. As of May 2004, NRC had not yet completed other analyses,  including how long Davis-Besse could have continued to operate with the  corrosion it had experienced before a vessel head loss-of-coolant accident  would have occurred. However, on May 4, 2004, NRC released preliminary  results of its analysis of the vessel head and cracked cladding. Based on its  analysis of conditions that existed on February 16, 2002, NRC estimated  that Davis-Besse could have operated for another 2 to 13 months without  the vessel head failing. However, the agency cautioned that this estimate  was based on several uncertainties associated with the complex network of  cracks on the cladding and the lack of knowledge about corrosion and  cracking rates. NRC plans to use this data in preparing its preliminary  analysis of how, and the likelihood that, the events at Davis-Besse could  have led to core damage. NRC plans to complete this preliminary analysis  in the summer of 2004.
NRC also established a special oversight panel to (1) coordinate NRC’s  efforts to assess FirstEnergy’s performance problems that resulted in the  corrosion damage, (2) monitor Davis-Besse’s corrective actions, and (3)  evaluate the plant’s readiness to resume operations. The panel, which is  referred to as the Davis-Besse Oversight Panel, comprises officials from  NRC’s Region III office in Lisle, Illinois; NRC headquarters; and the resident  inspector office at Davis-Besse. In addition to overseeing FirstEnergy’s  performance during the shutdown and through restart of Davis-Besse, the  panel holds public meetings in Oak Harbor, Ohio, where the plant is  located, and nearby Port Clinton, Ohio, to inform the public about its  oversight of Davis-Besse’s restart efforts and its views on the adequacy of  these efforts. The panel developed a checklist of issues that FirstEnergy  had to resolve prior to restarting:  (1) replacing the vessel head and  ensuring the adequacy of other equipment important for safety, (2)  correcting FirstEnergy programs that led to the corrosion, and (3) ensuring  FirstEnergy’s readiness to restart. To restart the plant, FirstEnergy, among  other things, removed the damaged reactor vessel head, purchased and  installed a new head, replaced management at the plant, and took steps to  improve key programs that should have prevented or detected the  corrosion. As of March 2004, when NRC gave its approval for Davis-Besse  to resume operations, the shutdown and preparations for restart had cost FirstEnergy  approximately $640 million.
In addition, NRC established a task force to evaluate its regulatory  processes for assuring reactor pressure vessel head integrity and to identify  and recommend areas for improvement that may be applicable to either  NRC or the nuclear power industry. The task force’s report, which was  issued in September 2002, contains 51 recommendations aimed primarily at  improving NRC’s process for inspecting and overseeing licensees,  communicating with industry, and identifying potential emerging technical  issues that could impact plant safety. NRC developed an action plan to  implement the report’s recommendations.
section_title: NRC’s Actions to Oversee Davis-Besse Did Not Provide an Accurate Assessment of Safety at the Plant
paragraphs: NRC’s inspections and assessments of FirstEnergy’s operations should  have but did not provide the agency with an accurate understanding of  safety conditions at Davis-Besse, and thus NRC failed to identify or prevent  the vessel head corrosion. Some NRC inspectors were aware of the  indications of corrosion and leakage that could have alerted NRC to  corrosion problems at the plant, but they did not have the knowledge to  recognize the significance of this information. These problems were  compounded by NRC’s assessments of FirstEnergy that led the agency to  believe FirstEnergy was a good performer and could or would successfully  resolve problems before they became significant safety issues. More  broadly, NRC had a range of information that could have identified and  prevented the incident at Davis-Besse but did not effectively integrate it  into its oversight.
subsections: section_title: Several Factors Contributed to the Inadequacy of NRC’s Inspections for Determining Plant Conditions
paragraphs: Three separate, but related, NRC inspection program factors contributed to  the development of the corrosion problems at Davis-Besse. First, resident  inspectors did not know that the boric acid, rust, and unidentified leaking  indicated that the reactor vessel head might be degrading. Second, these  inspectors thought they understood the cause for the indications, based on  licensee actions to address them. Therefore, resident inspectors, as well as  regional and headquarters officials, did not fully communicate information  on the indications or decide how to address them, and therefore took no  action. Third, because the significance of the symptoms was not fully  recognized, NRC did not direct sufficient inspector resources to  aggressively investigate the indicators. NRC might have taken a different  approach to the Davis-Besse situation if its program to identify emerging  issues important to safety had pursued earlier concerns about boric acid  corrosion and cracking and recognized how they could affect safety.
subsections: section_title: Inspectors Did Not Know Safety Significance of Observed Problems
paragraphs: NRC limits the amount of unidentified leakage from the reactor coolant  system to no more than 1 gallon per minute. When this limit is exceeded,  NRC requires that licensees identify and correct any sources of  unidentified leakage. NRC also prohibits any leakage from the reactor  coolant pressure boundary, of which the reactor vessel is a key component.  Such leakage is prohibited because the pressure boundary is key to  maintaining adequate coolant around the reactor fuel and thus protects  public health and safety. Because of this, NRC’s technical specification  states that licensees are to monitor reactor coolant leakage and shut down  within 36 hours if leakage is found in the pressure boundary.
In the years leading up to FirstEnergy’s March 2002 discovery that Davis- Besse’s vessel head had corroded extensively, NRC had several indications  of potential leakage problems. First, NRC knew that the rates of leakage in  the reactor coolant system had increased. Between 1995 and mid-1998, the  unidentified leakage rate was about 0.06 gallon per minute or less,  according to FirstEnergy’s monitoring. In mid-1998, the unidentified  reactor coolant system leakage rate increased significantly—to as much as  0.8 gallon per minute. The elevated leakage rate was dominated by a known  problem with a leaking relief valve on the reactor coolant system  pressurizer tank, which masked the ongoing leak on the reactor pressure  vessel head. However, the elevated leak rate should have raised concerns.
To investigate this leakage, as well as to repair other equipment,  FirstEnergy shut down the plant in mid-1999. It then identified a faulty  relief valve that accounted for much of the leakage and repaired the valve.
However, after restarting Davis-Besse, the unidentified leakage rate  remained significantly higher than the historical average. Specifically, the  unidentified leakage rate varied between 0.15 and 0.25 gallon per minute as  opposed to the historical low of about 0.06 gallon or less. While NRC was  aware that the rate was higher than before, NRC did not aggressively  pursue the difference because the rate was well below NRC’s limit of no  more than 1 gallon per minute, and thus the leak was not viewed as being a  significant safety concern. Following the repair in 1999, NRC’s inspection  report concluded that FirstEnergy’s efforts to reduce the leak rate during  the outage were effective.
Second, NRC was aware of increased levels of boric acid in the  containment building—an indication that components containing reactor  coolant were leaking. So much boric acid was being deposited that  FirstEnergy officials had to repeatedly clean the containment air cooling  system and radiation monitor filters. For example, before 1998, the  containment air coolers seldom needed cleaning, but FirstEnergy had to  clean them 28 times between late 1998 and May 2001. Between May 2001  and the mid-February 2002 shutdown, the containment air coolers were not  cleaned, but at shutdown, FirstEnergy removed 15 5-gallon buckets of  boric acid from the coolers—which is almost as much as was found on the  reactor pressure vessel head. Rather than seeing these repeated cleanings  as an indication of a problem that needed to be addressed, FirstEnergy  made cleaning the coolers a routine maintenance activity, which NRC did  not consider significant enough to require additional inspections.  Furthermore, the radiation monitors, used to sample air from the  containment building to detect radiation, typically required new filters  every month. However, from 1998 to 2002, these monitors became clogged  and inoperable hundreds of times because of boric acid, despite  FirstEnergy’s efforts to fix the problem.
Third, NRC was aware that FirstEnergy found rust in the containment  building. The radiation monitor filters had accumulated dark colored iron  oxide particles—a product of carbon steel corrosion—that were likely to  have resulted from a very small steam leak. NRC inspection reports during  the summer and fall of 1999 noted these indications and, while recognizing  FirstEnergy’s aggressive attempts to identify the reasons for the  phenomenon, concluded that they were a “distraction to plant personnel.”  Several NRC inspection reports noted indications of leakage, boric acid,  and rust before the agency adopted its new Reactor Oversight Process in  2000, but because the leakage was within NRC’s technical specifications  and NRC officials thought that the licensee understood and would fix the  problem, NRC did not aggressively pursue the indications. NRC’s new  oversight process, implemented in the spring of 2000, limited the issues  that could be discussed in NRC inspection reports to those that the agency  considers to have more than minor significance. Because the leakage rates  were below NRC’s limits, NRC’s inspection reports following the  implementation of NRC’s new oversight process did not identify any  discussion of these problems at the plant.
Fourth, NRC was aware that FirstEnergy found rust on the Davis-Besse  reactor vessel head, but it did not recognize its significance. For instance,  during the 2000 refueling outage, a FirstEnergy official said he showed one  of the two NRC resident inspectors a report that included photographs of  rust-colored boric acid on the vessel head. (See fig. 5.)
According to this resident inspector, he did not recall seeing the report or  photographs but had no reason to doubt the FirstEnergy official’s  statement. Regardless, he stated that had he seen the photographs, he  would not have considered the condition to be significant at the time. He  said that he did not know what the rust and boric acid might have  indicated, and he assumed that FirstEnergy would take care of the vessel  head before restarting. The second resident inspector said he reviewed all  such reports at Davis-Besse but did not recall seeing the photographs or  this particular report. He stated that it was quite possible that he had read  the report, but because the licensee had a plan to clean the vessel head, he  would have concluded that the licensee would correct the matter before  plant restart. However, FirstEnergy did not accomplish this, even though  work orders and subsequent licensee reports indicated that this was done.  According to the NRC resident inspector and NRC regional officials,  because of the large number of licensee activities that occur during a  refueling outage, NRC inspectors do not have the time to investigate or  follow up on every issue, particularly when the issue is not viewed as being  important to safety. While the resident inspector informed regional officials  about conditions at Davis-Besse, the regional office did not direct more  inspection resources to the plant, or instruct the resident inspector to  conduct more focused oversight. Some NRC regional officials were aware  of indications of boric acid corrosion at the plant; others were not.  According to the Office of the Inspector General’s investigation and 2003  report on Davis-Besse, the NRC regional branch chief—who supervised  the staff responsible for overseeing FirstEnergy’s vessel head inspection  activities during the 2000 refueling outage—said that he was unaware of  the boric acid leakage issues at Davis-Besse, including its effects on the  containment air coolers and the radiation monitor filters. Had his staff been  requested to look at these specific issues, he might have directed  inspection resources to that area. (App. I provides a time line showing  significant events of interest.)
section_title: NRC Did Not Fully Communicate Indications
paragraphs: NRC was not fully aware of the indications of a potential problem at Davis- Besse because NRC’s process for transmitting information from resident  inspectors to regional offices and headquarters did not ensure that  information was fully communicated, evaluated, or used. NRC staff  communicated information about plant operations through inspection  reports, licensee assessments, and daily conference calls that included  resident, regional, and headquarters officials. According to regional  officials, information that is not considered important is not routinely  communicated to NRC management and technical specialists. For  example, while the resident inspectors at Davis-Besse knew all of the  indications of leakage, and there was some level of knowledge about these  indications at the regional office level, the knowledge was not sufficiently  widespread within NRC to alert a technical specialist who might have  recognized their safety significance. According to NRC Region III officials,  the region uses an informal means—memorandums sent to other regions  and headquarters—of communicating information identified at plants that  it considers to be important to safety. However, because the indications at  Davis-Besse were not considered important, officials did not transmit this  information to headquarters. Further, because the process is informal,  these officials said they did not know whether—and if so, how—other NRC  regions or headquarters used this information.
Similarly, NRC officials said that NRC headquarters had no systematic  process for communicating information, such as on boric acid corrosion,  cracking, and small amounts of unidentified leakage, that had not yet risen  to a relatively high level of concern within the agency, in a timely manner to  its regions or on-site inspectors. For example, the regional inspector that  oversaw FirstEnergy’s activities during the 2000 refueling outage, including  the reactor vessel head inspection, stated that he was not aware of NRC’s  generic bulletins and letters pertaining to boric acid and corrosion, even  though NRC issues only a few of these bulletins and generic letters each  year. In addition, according to NRC regional officials and the resident  inspector at Davis-Besse, there is little time to review technical reports  about emerging safety issues that NRC compiles because they are too  lengthy and detailed. Ineffective communication, both within the region  and between NRC headquarters and the region, was a primary factor cited  by NRC’s Office of the Inspector General in its investigation of NRC’s  oversight of Davis-Besse boric acid leakage and corrosion. For example,  it found that ineffective communication resulted in senior regional  management being largely unaware of repeated reports of boric acid  leakage at Davis-Besse. It also found that headquarters, in communications  with the regions, did not emphasize the issues discussed in its generic  letters or bulletins on boric acid corrosion or cracking. NRC programs for  informing its inspectors about issues that can reduce safety at nuclear  power plants were not effective. As a result, NRC inspectors did not  recognize the significance of the indications at Davis-Besse, fully  communicate information about the indications, or spend additional effort  to follow up on the indications.
section_title: Resource Constraints Affected NRC Oversight
paragraphs: NRC also did not focus on the indications that the vessel head was  corroding because of several staff constraints. Region III was directing  resources to other plants that had experienced problems throughout the  region, and these plants thus were the subject of increased regulatory  oversight. For example, during the refueling outages in 1998 and 2000,  while NRC oversaw FirstEnergy’s inspection of the reactor vessel head, the  region lacked senior project engineers to devote to Davis-Besse. A vacancy  existed for a senior project engineer responsible for Davis-Besse from June  1997 until June 1998, except for a one month period, and from September  1999 until May 2000, which resulted in fewer inspection hours at the facility  than would have been normal. Other regional staff were also occupied with  other plants in the region that were having difficulties, and NRC had  unfilled vacancies for resident and regional inspector positions that  strained resources for overseeing Davis-Besse.
Even if the inspector positions had been filled, it is not certain that the  inspectors would have aggressively followed up on any of the indications.  According to our discussions with resident and regional inspectors and our  on-site review of plant activities, because nuclear power plants are so large,  with many physical structures, systems, and components, an inspector  could miss problems that were potentially significant for safety. Licensees  typically prepare several hundred reports per month for identifying and  resolving problems, and NRC inspectors have only a limited amount of time  to follow up on these licensee reports. Consequently, NRC selects and  oversees the most safety significant structures, systems, and components.
section_title: NRC’s Assessment Process Did Not Indicate Deteriorating Performance
paragraphs: Under NRC’s Reactor Oversight Process, NRC assesses licensees’  performance using two distinct types of information:  (1) NRC’s inspection  results and (2) performance indicators reported by the licensees. These  indicators, which reflect various aspects of a plant’s operations, include  data on, for example, the failure or unavailability of certain important  operating systems, the number of unplanned power changes, and the  amount of reactor coolant system leakage. NRC evaluates both the  inspection results and the performance indicators to arrive at licensee  assessments, which it then color codes to reflect their safety significance.  Green assessments indicate that performance is acceptable, and thus  connote a very low risk significance and impact on safety. White, yellow,  and red assessments each represent a greater degree of safety significance.  After NRC adopted its Reactor Oversight Process in April 2000, FirstEnergy  never received anything but green designations for its operations at Davis- Besse and was viewed by NRC as a good performer until the 2002 discovery  of the vessel head corrosion. Similarly, prior to adopting the Reactor  Oversight Process, NRC consistently assessed FirstEnergy as generally  being a good performer. NRC officials stated, however, that significant  issues were identified and addressed as warranted throughout this period,  such as when the agency took enforcement action in response to  FirstEnergy’s failure to properly repair important components in 1999—a  failure caused by weaknesses in FirstEnergy’s boric acid corrosion control  program.
Key Davis-Besse programs for ensuring the quality and safe operation of  the plant’s engineered structures, systems, and components include, for  example,   a corrective action program to ensure that problems at the plant that are  relevant to safety are identified and resolved in a timely manner,  an operating experience program to ensure that experiences or  problems that occur are appropriately identified and analyzed to  determine their significance and relevance to operations, and   a plant modification program to ensure that modifications important to  safety are implemented in a timely manner.
As at other commercial nuclear power plants, NRC conducted routine,  baseline inspections of Davis-Besse to determine the effectiveness of these  programs. Reports documenting these inspections noted incidences of  boric acid leakage, corrosion, and deposits. However, between February  1997 and March 2000, the regional office’s assessment of the licensee’s  performance addressed leakage in the reactor coolant system only once  and never noted the other indications. Furthermore, Davis-Besse was not  the subject of intense scrutiny in regional plant assessment meetings  because plants perceived as good performers—such as Davis-Besse— received substantially less attention. Between April 2000—when NRC’s  revised assessment process took effect—until the corrosion was  discovered in March 2002, none of NRC’s assessments of Davis-Besse’s  performance noted leakage or other indications of corrosion at the plant.  As a result, NRC may have missed opportunities to identify weaknesses in  the Davis-Besse programs intended to detect or prevent the corrosion.
After the corrosion was discovered, NRC analyzed the problems that led to  the corrosion on the reactor vessel head and concluded that FirstEnergy’s  programs for overseeing safety at Davis-Besse were weak, as seen in the  following examples:   Davis-Besse’s corrective action program did not result in timely or  effective actions to prevent indications of leakage from reoccurring in  the reactor coolant system.
FirstEnergy officials did not always enter equipment problems into the  corrective action program because individuals who had identified the  problem were often responsible for resolving it.
For over a decade, FirstEnergy had delayed plant modifications to its  service structure platform, primarily because of cost. These  modifications would have improved its ability to inspect the reactor  vessel head nozzles. As a result, FirstEnergy could conduct only limited  visual inspections and cleaning of the reactor pressure vessel head  through the small “mouse-holes” that perforated the service structure.
NRC was also unaware of the extent to which various aspects of  FirstEnergy’s safety culture had degraded—that is, FirstEnergy’s  organization and performance related to ensuring safety at Davis-Besse.   This degradation had allowed the incident to occur with no forewarning  because NRC’s inspections and performance indicators do not directly  assess safety culture. Safety culture is a group of characteristics and  attitudes within an organization that establish, as an overriding priority,  that issues affecting nuclear plant safety receive the attention their  significance warrants. Following FirstEnergy’s March 2002 discovery, NRC  found numerous indications that FirstEnergy emphasized production over  plant safety. First, Davis-Besse routinely restarted the plant following an  outage, even though reactor pressure vessel valves and control rod drive  mechanisms leaked. Second, staff was unable to remove all of the boric  acid deposits from the reactor pressure vessel head because FirstEnergy’s  schedule to restart the plant dictated the amount of work that could be  performed. Third, FirstEnergy management was willing to accept degraded  equipment, which indicated a lack of commitment to resolve issues that  could potentially compromise safety. Fourth, Davis-Besse’s program that  was intended to ensure that employees feel free to raise safety concerns  without fear of retaliation had several weaknesses. For example, in one  instance, a worker assigned to repair the containment air conditioner was  not provided a respirator in spite of his concerns that he would inhale boric  acid residue. According to NRC’s lessons-learned task force report, NRC  was not aware of weaknesses in this program because its inspections did  not adequately assess it.
Given that FirstEnergy concluded that one of the causes for the Davis- Besse incident was human performance and management failures, the  panel overseeing FirstEnergy’s efforts to restart Davis-Besse requested that  FirstEnergy assess its safety culture before allowing the plant to restart. To  oversee FirstEnergy’s efforts to improve its safety culture, NRC (1)  reviewed whether FirstEnergy had adequately identified all of the root  causes for management and human performance failures at Davis-Besse,  (2) assessed whether FirstEnergy had identified and implemented  appropriate corrective actions to resolve these failures, and (3) assessed  whether FirstEnergy’s corrective actions were effective. As late as  February 2004, NRC had concerns about whether FirstEnergy’s actions  would be adequate in the long term. As a result, the Davis-Besse safety  culture was one of the issues contributing to the delay in restarting the  plant. In March 2004, NRC’s panel concluded that FirstEnergy’s efforts to  improve its safety culture were sufficient to allow the plant to restart. In  doing so, however, NRC officials stated that one of the conditions the panel  imposed was for FirstEnergy to conduct an independent assessment of the  safety culture at Davis-Besse annually over the course of the next 5 years.
section_title: NRC Did Not Effectively Incorporate Long-Standing Knowledge about Corrosion, Nozzle Cracking, and Leak Detection into Its Oversight
paragraphs: NRC has been aware of boric acid corrosion and its potential to affect  safety since at least 1979. It issued several notices to the nuclear power  industry about boric acid corrosion and, specifically, the potential for it to  degrade the reactor coolant pressure boundary. In 1987, two licensees  found significant corrosion on their reactor pressure vessel heads, which  heightened NRC’s concern. A subsequent industry study concluded that  concentrated solutions of boric acid could result in unacceptably high  corrosion rates—up to 4 inches per year—when primary coolant leaks onto  surfaces and concentrates at temperatures found on the surface of the  reactor vessel. After considering this information and several more  instances of boric acid corrosion at plants, NRC issued a generic letter in  1988 requesting licensees to implement boric acid corrosion control  programs.
In 1990, NRC visited Davis-Besse to assess the adequacy of the plant’s boric  acid corrosion control program. At that time, NRC concluded that the  program was acceptable. However, in 1999, NRC became aware that  FirstEnergy’s boric acid corrosion control program was inadequate  because boric acid had corroded several bolts on a valve, and NRC issued a  violation. As a result of the violation, FirstEnergy agreed to review its boric  acid corrosion procedures and enhance its program. NRC inspectors  evaluated FirstEnergy’s completed and planned actions to improve the  boric acid corrosion control program and found them to be adequate.  According to NRC officials, they never inspected the remaining actions— assuming that the planned actions had been implemented effectively. In  2000, NRC adopted its new Reactor Oversight Process and discontinued its  inspection procedure for plants’ corrosion control programs because these  inspections had rarely been conducted due to higher priorities. Thus, NRC  had no reliable or routine way to ensure that the nuclear power industry  fully implemented boric acid corrosion control programs.
NRC also did not routinely review operating experiences at reactors, both  in the United States and abroad, to keep abreast of boric acid  developments and determine the need to emphasize this problem. Indeed,  NRC did not fully understand the circumstances in which boric acid would  result in corrosion, rather than flash to steam. Similarly, NRC did not know  the rate at which carbon steel would corrode under different conditions.  This lack of knowledge may be linked to shortcomings in its program to  review operating experiences at reactors, which could have been  exacerbated by the 1999 elimination of the office specifically responsible  for reviewing operating experiences. This office was responsible for,  among other things, (1) coordinating operational data collection, (2)  systematically analyzing and evaluating operational experience, (3)  providing feedback on operational experience to improve safety, (4)  assessing the effectiveness of the agencywide program, and (5) acting as a  focal point for interaction with outside organizations on issues pertaining  to operational safety data analysis and evaluation. According to NRC  officials who had overseen Davis-Besse at the time of the incident, they  would not have suspected the reactor vessel head or cracked head  penetration nozzles as the source of the filter clogging and unidentified  leakage because they had not been informed that these could be potential  problems. According to these officials, the vessel head was “not on the  radar screen.”
With regard to nozzle cracking, NRC, for more than two decades, was  aware of the potential for nozzles and other components made of alloy 600  to crack. While cracks were found at nuclear power plants, NRC  considered their safety significance to be low because the cracks were not  developing rapidly. In contrast, other countries considered the safety  significance of such cracks to be much higher. For example, concern over  alloy 600 cracking led France, as a preventive measure, to institute  requirements for an extensive nondestructive examination inspection  program for vessel head penetration nozzles, including the removal of  insulation, during every fuel outage. When any indications of cracking were  observed, even more frequent inspections were required, which, because of  economic considerations, resulted in the replacement of vessel heads when  indications were found. The effort to replace the vessel heads is still under  way. Japan replaced those vessel heads whose nozzles it considered most  susceptible to cracking, even though no cracks had yet been found. Both  France and Sweden also installed enhanced leakage monitoring systems to  detect leaks early. However, according to NRC, such systems cannot detect  the small amounts of leakage that may be typical from cracked nozzles.
NRC recognized that an integrated, long-term program, including periodic  inspections and monitoring of vessel heads to check for nozzle cracking,  was necessary. In 1997, it issued a generic letter that summarized NRC’s  efforts to address cracking of control rod drive mechanism nozzles and  requested information on licensees’ plans to inspect nozzles at their  reactors. More specifically, this letter asked licensees to provide NRC with  descriptions of their inspections of these nozzles and any plans for  enhanced inspections to detect cracks. At that time, NRC was planning to  review this information to determine if enhanced licensee inspections were  warranted. Based on its review of this information, NRC concluded that the  current inspection program was sufficient. As a result, between 1998 and  2001, NRC did not issue or solicit additional information on nozzle cracking  or assess its requirements for inspecting reactor vessels to determine  whether they were sufficient to detect cracks. At Davis-Besse, NRC also did  not determine if FirstEnergy had plans or was implementing any plans for  enhanced nozzle inspections, as noted in the 1997 generic letter. NRC took  no further action until the cracks were found in 2001 at the Oconee plant, in  South Carolina. NRC attributed its lack of focus on nozzle cracking, in part,  to the agency’s inability to effectively review, assess, and follow up on  industry operating experience events. Furthermore, as with boric acid  corrosion, NRC did not obtain or analyze any new data about cracking that  would have supported making changes in either its regulations or  inspections to better identify or prevent corrosion on the vessel head at  Davis-Besse.
NRC’s technical specifications regarding allowable leakage rates also  contributed to the corrosion at Davis-Besse because the amount of leakage  that can cause extensive corrosion can be significantly less than the level  that NRC’s specifications allow. According to NRC officials, NRC’s  requirements, established in 1973, were based on the best available  technology at that time. The task of measuring identified and unidentified  leakage from the reactor coolant system is not precise. It requires licensees  to estimate the amount of coolant that the reactor is supposed to contain  and identify any difference in coolant levels. They then have to account for  the estimated difference in the actual amount of coolant to arrive at a  leakage rate; to do this, they identify all sources and amounts of leakage by,  among other things, measuring the amount of water contained in various  sump collection systems. If these sources do not account for the difference,  licensees know they have an unidentified source of leakage. This estimate  can vary significantly from day to day between negative and positive  numbers.
According to analyses that FirstEnergy conducted after it identified the  corrosion in March 2002, the leakage rates from the nozzle cracks were  significantly below NRC’s reactor coolant system unidentified leakage rate  of 1 gallon per minute. Specifically, the leakage from the nozzle around  which the vessel head corrosion occurred was predicted to be 0.025 gallon  per minute. If such small leakage can result in such extensive corrosion,  identifying if and where such leakage occurs is important. NRC staff  recognized as early as 1993 it would be prudent for the nuclear power  industry to consider implementing an enhanced method for detecting small  leaks during plant operation, but NRC did not require this action, and the  industry has not taken steps to do so. Furthermore, NRC has not  consistently enforced its requirement for reactor coolant pressure  boundary leakage. As a result, the NRC Davis-Besse task force concluded  that inconsistent enforcement may have reinforced a belief that alloy 600  nozzle leakage was not actually or potentially a safety significant issue.
section_title: NRC’s Process for Deciding Whether to Allow a Delayed Davis- Besse Shutdown Lacked Credibility
paragraphs: Although FirstEnergy operated Davis-Besse without incident until shutting  it down in February 2002, certain aspects of NRC’s deliberations allowing  the delayed shutdown raise questions about the credibility of the agency’s  decision making, if not about the Davis-Besse decision itself. NRC does not  have specific guidance for deciding on plant shutdowns. Instead, agency  officials turned to guidance developed for a different purpose—reviewing  requests to amend license operating conditions—and even then did not  always adhere to this guidance. In addition, NRC did not document its  decision-making process, as called for by its guidance, and its letter to  FirstEnergy to lay out the basis for the decision—sent a year after the  decision—did not fully explain the decision. NRC’s lack of guidance,  coupled with the lack of documentation, precludes us from independently  judging whether NRC’s decision was reasonable. Finally, some NRC  officials stated that the shutdown decision was based, in part, on the  agency’s probabilistic risk assessment (PRA) calculations of the risk that  Davis-Besse would pose if it delayed its shutdown and inspection.  However, as noted by our consultants, the calculations were flawed, and  NRC’s decision makers did not always follow the agency’s guidance for  developing and using such calculations.
subsections: section_title: NRC Did Not Have Specific Guidance for Deciding on Plant Shutdowns
paragraphs: NRC believed that Davis-Besse could have posed a potential safety risk  because it was, in all likelihood, failing to comply with NRC’s technical  specification that no leakage occur in the reactor coolant pressure  boundary. Its belief was based on the following indicators of probable  leakage:  All six of the other reactors manufactured by the same company as  Davis-Besse’s reactor had cracked nozzles and identified leakage.
Three of these six reactors had identified circumferential cracking.
FirstEnergy had not performed a recent visual examination of all of its  nozzles.
Furthermore, a FirstEnergy manager agreed that cracks and leakage were  likely.
NRC has the authority to shut down a plant when it is clear that the plant is  in violation of important safety requirements, and it is clear that the plant  poses a risk to public health and safety. Thus, if a licensee is not  complying with technical specifications, such as those for no allowable  reactor vessel pressure boundary leakage, NRC can order a plant to shut  down. However, NRC decided that it could not require Davis-Besse to shut  down on the basis of other plants’ cracked nozzles and identified leakage or  the manager’s acknowledgement of a probable leak. Instead, it believed it  needed more direct, or absolute, proof of a leak to order a shutdown. This  standard of proof has been questioned. According to the Union of  Concerned Scientists, for example, if NRC needed irrefutable proof in  every case of suspected problems, the agency would probably never issue a  shutdown order. In effect, in this case NRC created a Catch-22:  It needed  irrefutable proof to order a shutdown but could not get this proof without  shutting down the plant and requiring that the reactor be inspected.
Despite NRC’s responsibility for ensuring that the public is adequately  protected from accidents at commercial nuclear power plants, NRC does  not have specific guidance for shutting down a plant when the plant may  pose a risk to public health and safety, even though it may be complying  with NRC requirements. It also has no specific guidance or standards for  quality of evidence needed to determine that a plant may pose an undue  risk. Lacking direct or absolute proof of leakage at Davis-Besse, NRC  instead drafted a shutdown order on the basis that a potentially hazardous  condition may have existed at the plant. NRC had no guidance for  developing such a shutdown order, and therefore, it used its guidance for  reviewing license amendment requests. NRC officials recognized that this  guidance was not specifically designed to determine whether NRC should  shut down a power plant such as Davis-Besse. However, NRC officials  stated that this guidance was the best available for deciding on a shutdown  because, although the review was not to amend a license, the factors that  NRC needed to consider in making the decision and that were contained in  the guidance were applicable to the Davis-Besse situation.
To use its guidance for reviewing license amendment requests, NRC first  determined that the situation at Davis-Besse posed a special circumstance  because new information revealed a substantially greater potential for a  known hazard to occur, even if Davis-Besse was in compliance with the  technical specification for leakage from the reactor coolant pressure  boundary. The special circumstance stemmed from NRC’s determination  that requirements for conducting vessel head inspections were not  sufficient to detect nozzle cracking and, thus, small leaks. According to  NRC officials, this determination allowed NRC to use its guidance for  reviewing license amendment requests when deciding whether to order a  shutdown.
section_title: The Extent of NRC’s Reliance on License Amendment Guidance Is Not Clear
paragraphs: Under NRC’s license amendment guidance, NRC considers how the license  change affects risk, but not how it has previously assessed licensee  performance, such as whether the licensee was viewed as a good  performer. With regard to the Davis-Besse decision, the guidance directed  NRC to determine whether the plant would comply with five NRC safety  principles if it operated beyond December 2001 without inspecting the  reactor vessel head. As applied to Davis-Besse, these principles were  whether the plant would (1) continue to meet requirements for vessel head  inspections, (2) maintain sufficient defense-in-depth, (3) maintain  sufficient safety margins, (4) have little increase in the likelihood of a core  damage accident, and (5) monitor the vessel head and nozzles. The  guidance, however, does not specify how to apply these safety principles,  how NRC can demonstrate it has followed the principles and ensured they  are met, or whether any one principle takes precedence over the others.  The guidance also does not indicate what actions NRC or licensees should  take if some or all of the principles are not met.
In mid-September 2001, NRC staff concluded that Davis-Besse complied  with the first safety principle but did not meet the remaining four.  According to the staff, Davis-Besse did not meet three safety principles  because the requirements for vessel head inspections were not adequate.  Specifically, the requirements do not require the inspector to remove the  insulation above the vessel head, and thus allow all of the nozzles to be  visually inspected. NRC therefore could not ensure that FirstEnergy was  maintaining defense-in-depth and adequate safety margins or sufficiently  monitoring the vessel head and nozzles. The staff believed that Davis-Besse  did not meet the fourth safety principle because the risk estimate of core  damage approached an unacceptable level and the estimate itself was  highly uncertain.
Between early October and the end of November 2001, NRC requested and  received additional information from FirstEnergy regarding its risk  estimate of core damage—its PRA estimate—and met with the company to  determine the basis for the estimate. NRC was also developing its own risk  estimate, although its numbers kept changing. At some point during this  time, NRC staff also concluded that the first safety principle was probably  not being met, although the basis for this conclusion is not known.
At the end of November 2001, NRC contacted FirstEnergy and informed it  that a shutdown order had been forwarded to the NRC commissioners and  asked if FirstEnergy could take any actions that would persuade NRC to  not issue the shutdown order. The following day, FirstEnergy proposed  measures to mitigate the potential for and consequences of an accident.  These measures included, among other things, lowering the operating  temperature from 605 degrees Fahrenheit to 598 degrees Fahrenheit to  reduce the driving force for stress corrosion cracking on the nozzles,  identifying a specific operator to initiate emergency cooling in response to  an accident, and moving the scheduled refueling outage up from March 31,  2002, to no later than February 16, 2002. NRC staff discussed these  measures, and NRC management asked the staff if they were concerned  about extending Davis-Besse’s operations until mid-February 2002. While  some of the staff were concerned about continued operations, none  indicated to NRC management that cracking in control rod drive  mechanism nozzles was likely extensive enough to cause a nozzle to eject  from the vessel head, thus making it unsafe to operate. NRC formally  accepted FirstEnergy’s compromise proposal within several days, thus  abandoning its shutdown order.
section_title: NRC Did Not Fully Explain or Document the Basis for Its Decision
paragraphs: We could not fully assess NRC’s basis for accepting FirstEnergy’s proposal.  NRC did not document its deliberations, even though its guidance requires  that it do so. This documentation is to include the data, methods, and  assessment criteria used; the basis for the decisions made; and essential  correspondence sufficient to document the persons, places, and matters  dealt with by NRC. Specifically, the guidance requires that the  documentation contain sufficient detail to make possible a “proper  scrutiny” of NRC decisions by authorized outside agencies and provide  evidence of how basic decisions were formed, including oral decisions.  NRC’s guidance also states that NRC should document all important staff  meetings.
In reviewing NRC’s documentation on the Davis-Besse decision, we found  no evidence of an in-depth or formal analysis of how Davis-Besse’s  proposed measures would affect the plant’s ability to satisfy the five safety  principles. Thus, it is unclear whether the safety principles contained in the  guidance were met by the measures that FirstEnergy proposed. However,  several NRC officials stated that FirstEnergy’s proposed measures had no  impact on plant operations or safety. For example, according to one NRC  official, FirstEnergy’s proposal to reduce the operating temperature would  have had little impact on safety because the small drop in operating  temperature over a 7-week period would have had little effect on the  growth rate of any cracks in a nozzle. As such, this official considered the  measures as “window dressing.” A proposed measure that NRC staff did  consider as having a significant impact on the risk was for FirstEnergy to  dedicate an operator for manually turning on safety equipment in the event  that a nozzle was ejected. Subsequent to approving the delayed shutdown,  NRC learned that FirstEnergy had not, in fact, planned to dedicate an  operator for this task—rather, FirstEnergy planned to have an operator do  this task in addition to other regularly assigned duties.
According to an NRC official, once NRC decided not to issue a shutdown  order for December 2001, NRC staff needed to discuss how NRC’s  assessment of whether the five safety principles had been met had changed  in the course of the staff’s deliberations. However, there was no evidence in  the agency’s records to support that this discussion was held, and other key  meetings, such as the one in which the agency made its decision to allow  Davis-Besse to operate past December 31, 2001, were not documented.  Without documentation, it is not clear what factors influenced NRC’s  decision. For example, according to the NRC Office of the Inspector  General’s December 2002 report that examined the Davis-Besse incident,  NRC’s decision was driven in large part by a desire to lessen the financial  impact on FirstEnergy that would result from an early shutdown. While  NRC disputed this finding, we found no evidence in the agency’s records to  support or refute its position.
In December 2001, when NRC informed FirstEnergy that it accepted the  company’s proposed measures and the February 16, 2002, shutdown date, it  also said that the company would receive NRC’s assessment in the near  future. However, NRC did not provide the assessment until a full year  later—in December 2002. In addition, the December 2002 assessment,  which includes a four-page evaluation, does not fully explain how the  safety principles were used or met—other than by stating that if the  likelihood of nozzle failure were judged to be small, then adequate  protection would be ensured. Even though NRC’s regulations regarding the  reactor coolant pressure boundary dictate that the reactor have an  extremely low probability of failing, NRC stated it did not believe that  Davis-Besse needed to demonstrate strict conformance with this  regulation. As evidence of the small likelihood of failure, NRC cited the  small size of cracks found at other power plants, as well as its preliminary  assessment of nozzle cracking, which projected crack growth rates. NRC  concluded that 7 weeks of additional operation would not result in an  appreciable increase in the size of the cracks. While NRC included its  calculated estimates of the risk that Davis-Besse would pose, it did not  detail how it calculated its estimates.
section_title: NRC’s PRA Estimate Was Flawed and Its Use in Deciding to Delay the Shutdown Is Unclear
paragraphs: In moving forward with its more risk-informed regulatory approach, NRC  has established a policy to increase the use of PRA methods as a means to  promote regulatory stability and efficiency. Using PRA methods, NRC and  the nuclear power industry can estimate the likelihood that different  accident scenarios at nuclear power plants will result in reactor core  damage and a release of radioactive materials. For example, one of these  accident scenarios begins with a “medium break” loss-of-coolant accident  in which the reactor coolant system is breached and a midsize—about 2- to  4-inch—hole is formed that allows coolant to escape from the reactor  pressure boundary. The probability of such an accident scenario occurring  and the consequences of that accident take into account key engineering  safety system failure rates and human error probabilities that influence  how well the engineered systems would be able to mitigate the  consequences of an accident and ensure no radioactive release from the  plant.
For Davis-Besse, NRC needed two estimates: one for the frequency of a  nozzle ejecting and causing a loss-of-coolant accident and one for the  probability that a loss-of-coolant accident would result in core damage.  NRC first established an estimate, based partially on information provided  by FirstEnergy, for the frequency of a plant developing a cracked nozzle  that would initiate a medium break loss-of-coolant accident. NRC  estimated that the frequency of this occurring would be about 2x10-2, or 1  chance in 50, per year. NRC then used an estimate, which FirstEnergy  provided, for the probability of core damage given a medium break loss-of- coolant accident. This probability estimate was 2.7x10-3, or about 1 chance  in 370. Multiplying these two numbers, NRC estimated that the potential  for a nozzle to crack and cause a loss-of-coolant accident would increase  the frequency of core damage at Davis-Besse by about 5.4x10-5 per year, or  about 1 in 18,500 per year. Converting this frequency to a probability  associated with continued operation for 7 weeks, NRC calculated that the  increase in the probability of core damage was approximately 5x10-6, or 1  chance in 200,000. While NRC officials currently disagree that this was the  number it used, this is the number that it included in its December 2002  assessment provided to FirstEnergy. Further, we found no evidence in the  agency’s records to support NRC’s current assertion.
According to our consultants, the way NRC calculated and used the PRA  estimate was inadequate in several respects. (See app. II for the  consultants’ detailed report.) First, NRC’s calculations did not take into  account several factors, such as the possibility of corrosion and axial  cracking that could lead to leakage. For example, the consultants  concluded that NRC’s estimate of risk was incorrectly too small, primarily  because the calculation did not consider corrosion of the vessel head. In  reviewing how NRC developed and used its PRA estimates for Davis-Besse,  our consultants noted that the calculated risk was smaller than it should  have been because the calculations did not consider corrosion of the  reactor vessel from the boric acid coolant leaking through cracks in the  nozzles. According to the consultants, apparently all NRC staff involved in  the Davis-Besse decision were aware that coolant under high pressure was  leaking from valves, flanges, and possibly from cracks but evidently  thought that the coolant would immediately flash into steam and  noncorrosive compounds of boric acid. Our consultants, however, stated  that because boric acid could potentially cause corrosion, except at  temperatures much higher than 600 degrees Fahrenheit, NRC should have  anticipated that corrosion could occur. Our consultants further stated that  as evaporation occurs, boric acid becomes more concentrated in the  remaining liquid—making it far more corrosive—and as vapor pressure  decreases, evaporation is further slowed. They said it should be expected  that some of the boric acid in the escaping coolant could reach the metal  surfaces as wet or moist, highly corrosive material underlying the surface  layers of dry noncorrosive boric acid, which is evidently what happened at  Davis-Besse.
Our consultants concluded that NRC staff should have been aware of the  experience at French nuclear power plants, where boric acid corrosion  from leaking reactor coolant had been identified during the previous  decade, the safety significance had been recognized, and safety procedures  to mitigate the problem had been implemented. Furthermore, tests had  been conducted by the nuclear power industry and in government  laboratories on boric acid corrosion that were widely available to NRC.  They stated that keeping abreast of safety issues at similar plants, whether  domestic or foreign, and conveying relevant safety information to licensees  are important functions of NRC’s safety program. According to NRC, the  agency was aware of the experience at French nuclear power plants. For  example, NRC concluded, in a December 15, 1994, internal NRC memo,  that primary coolant leakage from a through-wall crack could cause boric  acid corrosion of the vessel head. However, because it concluded that some  analyses indicated that it would take at least 6 to 9 years before any  corrosion would challenge the structural integrity of the head, NRC  concluded that cracking was not a short-term safety issue.
Our consultants also stated that NRC’s risk analysis was inadequate  because the analysis concerned only the formation and propagation of  circumferential cracks that could result in nozzle failure, loss of coolant,  and even control rod ejection. Although there is less chance of axial cracks  causing complete nozzle failure, these cracks open additional pathways for  coolant leakage. In addition, their long crevices provide considerably  greater opportunity for the coolant to concentrate near the surface of the  vessel head. However, according to our consultants, NRC was convinced  that the boric acid they saw resulted from leaking flanges above the reactor  vessel head, as opposed to axial cracks in the nozzles.
Second, NRC’s analysis was inadequate because it did not include the  uncertainty of its risk estimate and use the uncertainty analysis in the  Davis-Besse decision-making process, although NRC staff should have  recognized large uncertainties associated with its risk estimate. Our  consultants also concluded that NRC failed to take into account the large  uncertainties associated with estimates of the frequency of core damage  resulting from the failure of nozzles. PRA estimates for nuclear power  plants are subject to significant uncertainties associated with human errors  and other common causes of system component failures, and it is  important that proper uncertainty analyses be performed for any PRA  study. NRC guidance and other NRC reports on advancing PRA technology  for risk-informed decisions emphasize the need to understand and  characterize uncertainties in PRA estimates. Our consultants stated that  had the NRC staff estimated the margin of error or uncertainty associated  with its PRA estimate for Davis-Besse, the uncertainty would likely have  been so high as to render the estimate of questionable value.
Third, NRC’s analysis was inadequate because the risk estimates were  higher than generally considered acceptable under NRC guidance. Despite  PRA’s important role in the decision, our consultants found that NRC did  not follow its own guidance for ensuring that the estimated risk was within  levels acceptable to the agency. NRC required the nuclear power  industry  to develop a baseline estimate for how frequently a core damage accident  could occur at every nuclear power plant in the United States. This baseline  estimate is used as a basis for deciding whether changes at a plant that  affect the core damage frequency are acceptable. The baseline core  damage frequency estimate for the Davis-Besse plant was between 4x10-5  and 6.6x10-5 per year (which is between 1 chance in 25,000 per year and  about 1 chance in 15,150 per year). NRC guidance for reviewing and  approving license amendment requests indicates that any plant-specific  change resulting in an increase in the frequency of core damage of 1x10-5  per year (which is 1 chance in 100,000 per year) or more would fall within  the highest risk zone: In this case, NRC would generally not approve the  change because the risk criterion would not be met. If a license change  would result in a core damage frequency change of 1x10-5 per year to 1x10-6  per year (which is 1 chance in 100,000 per year to 1 chance in 1 million per  year), the risk criterion would be considered marginally met and NRC  would consider approving the change but would require additional  analysis. Finally, if a license change would result in a core damage  frequency change of 1x10-6 per year (which is 1 chance in 1 million per  year) or less, the risk would fall within the lowest risk zone and NRC would  consider the risk criterion to be met and would generally consider  approving the change without requiring additional analysis. (See fig. 6.)
However, NRC’s PRA estimate for Davis-Besse—an increase in the  frequency of core damage of 5.4x10-5, or 1 chance in about 18,500 per  year—was higher than the acceptable level. While an NRC official who  helped develop the risk estimate said that additional NRC and industry  guidance was used to evaluate whether its PRA estimate was acceptable,  this guidance also suggests that NRC’s estimate was too high. NRC’s  estimate of the increase in the frequency of core damage of 5.4x10-5 per  year equates to an increase in the probability of core damage of 5x10-6 , or 1  chance in 200,000, for the 7-week period December 31, 2001, to February  16, 2002. NRC’s guidance for evaluating requests to relax NRC technical  specifications suggests that a probability increase higher than 5x10-7, or 1  chance in 2 million, is considered unacceptable for relaxing the  specifications. Thus, NRC’s estimate would not be considered acceptable  under this guidance. NRC’s estimate would also not be considered  acceptable under Electric Power Research Institute or Nuclear Energy  Institute guidance unless further action were taken to evaluate or manage  risk. According to NRC officials, NRC viewed its PRA estimate as being  within acceptable bounds because it was a temporary situation—7  weeks—and NRC had, at other times, allowed much higher levels of risk at  other plants. However, at the time that NRC made its decision, it did not  document the basis for accepting this risk estimate, even though NRC’s  guidance explicitly states that the decision on whether PRA results are  acceptable must be based on a full understanding of the contributors to the  PRA results and the reasoning must be well documented. In defense of its  decision, NRC officials said that the process they used to arrive at the  decision is used to make about 1,500 licensing decisions such as this each  year.
Lastly, NRC’s analysis was inadequate because the agency does not have  clear guidance for how PRA estimates are to be used in the decision- making process. Our consultants concluded that NRC’s process for risk- informed decision making is ill-defined, lacks guidelines for how it is  supposed to work, and is not uniformly transparent within NRC. According  to NRC officials involved in the Davis-Besse decision, NRC’s guidance is  not clear on the use of PRA in the decision-making process. For example,  while NRC has extensive guidance, this guidance does not outline to what  extent or how the resultant PRA risk number and uncertainty should be  weighed with respect to the ultimate decision. One factor complicating this  issue is the lack of a predetermined methodology to weigh risks expressed  in PRA numbers against traditional deterministic results and other  factors. Absent this guidance, the value assigned to the PRA analysis is  largely at the discretion of the decision maker. The process, which NRC  stated is robust, can result in a decision in which PRA played no role, a  partial role, or one in which it was the sole deciding factor. According to  our consultants, this situation is made worse by the lack of guidelines for  how, or by whom, decisions in general are made at NRC.
It is not clear how NRC staff used the PRA risk estimate in the Davis-Besse  decision-making process. For example, according to one NRC official who  was familiar with some of the data on nozzle cracking, these data were not  sufficient for making a good probabilistic decision. He stated that he  favored issuing an order requiring that Davis-Besse be shut down by the  end of December 2001 because he believed the available data were not  sufficient to assure a low enough probability for a nozzle to be ejected.  Other officials indicated that they accepted FirstEnergy’s proposed  February 16, 2002, shutdown date based largely on NRC’s PRA estimate for  a nozzle to crack and be ejected. According to one of these officials,  allowing the additional 7 weeks of operating time was not sufficiently risk  significant under NRC’s guidance. He stated that safety margins at the plant  were preserved and the PRA number was within an acceptable range. Still  another official said he discounted the PRA estimate and did not use it at all  when recommending that NRC accept FirstEnergy’s compromise proposal.  This official also stated that it was likely that many of the staff did base  their conclusions on the PRA estimate. According to our consultants,  although the extent to which the PRA risk analysis influenced the decision  making will probably never be known, it is apparent that it did play an  important role in the decision to allow the shutdown delay.
section_title: NRC Has Made Progress in Implementing Recommended Changes, but Is Not Addressing Important Systemic Issues
paragraphs: NRC has made significant progress in implementing the actions  recommended by the Davis-Besse lessons-learned task force. While NRC  has implemented slightly less than half—21 of the 51—recommendations  as of March 2004, it is scheduled to have more than 70 percent of them  implemented by the end of 2004. For example, NRC has already taken  actions to improve staff training and inspections that would appear to help  address the concern that NRC inspectors viewed FirstEnergy as a good  performer and thus did not subject Davis-Besse to the level of scrutiny or  questioning that they should have. It is not certain when actions to  implement the remaining recommendations will occur, in part because of  resource constraints. NRC also faces challenges in fully implementing the  recommendations, also in part because of resource constraints, both in the  staff needed to develop specific corrective actions and in the additional  staff responsibilities and duties to carry them out. Further, while NRC is  making progress, the agency is not addressing three systemic issues  highlighted by the Davis-Besse experience:  (1) an inability to detect  weakness or deterioration in FirstEnergy’s safety culture, (2) deficiencies  in NRC’s process for deciding on a shutdown, and (3) lack of management  controls to track, on a longer-term basis, the effectiveness of actions  implemented in response to incidents such as Davis-Besse, so that they do  not occur at another power plant.
subsections: section_title: NRC Does Not Expect to Complete Its Actions until 2006, in Part Because of Resource Constraints
paragraphs: NRC’s lessons-learned task force for Davis-Besse developed 51  recommendations to address the weaknesses that contributed to the Davis- Besse incident. Of these 51 recommendations, NRC rejected 2 because it  concluded that agency processes or procedures already provided for the  recommendations’ intent to be effectively carried out. To address the  remaining 49 recommendations, NRC developed a plan in March 2003 that  included, for each recommendation, the actions to be taken, the  responsible NRC office, and the schedule for completing the actions. When  developing its schedule, NRC placed the highest priority on implementing  recommendations that were most directly related to the underlying causes  of the Davis-Besse incident as well as those recommendations responding  to vessel head corrosion. NRC assigned a lower priority to the remaining  recommendations, which were to be integrated into the planning activities  of those NRC offices assigned responsibility for taking action on the  recommendations. In assigning these differing priorities, NRC officials  stated they recognized that the agency has many other pressing matters to  address that are not related to the Davis-Besse incident, such as renewing  operating licenses, and they did not want to divert resources away from  these activities. (App. III contains a complete list of the task force’s  recommendations, NRC actions, and the status of the recommendations as  of March 2004.)
To better track the status of the agency’s actions to implement the  recommendations, we split two of the 49 recommendations that NRC  accepted into 4; therefore, our analysis reflects NRC’s response to 51  recommendations. As shown in table 1, as of March 2004, NRC had made  progress in implementing the recommendations, although some  completion dates have slipped.
As the table shows, as of March 2004, NRC had implemented 21  recommendations and scheduled another 17 for completion by December  2004. However, some slippage has already occurred in this schedule— primarily because of resource constraints—and NRC has rescheduled  completion of some recommendations. NRC’s time frames for completing  the recommendations depend on several factors—the recommendations’  priority, the amount of work required to develop and implement actions,  and the need to first complete actions on other related recommendations.
Of the 21 implemented recommendations, 10 called upon NRC to revise or  enhance its inspection guidance or training. For example, NRC revised the  guidance it uses to assess the implementation of licensees’ programs to  identify and resolve problems before they affect operations. It took this  action because the task force had concluded that FirstEnergy’s weak  corrective action program implementation was a major contributor to the  Davis-Besse incident. NRC has also developed Web-based training modules  to improve NRC inspectors’ knowledge of boric acid corrosion and nozzle  cracking. The other 11 completed recommendations concerned actions  such as   collecting and analyzing foreign and domestic information on alloy 600   fully implementing and revising guidance to better assure that licensees  carry out their commitments to make operational changes, and   establishing measurements for resident inspector staffing levels and  requirements.
By the end of 2004, NRC expects to complete another 17 recommendations,  12 of which generally address broad oversight or programmatic issues, and  5 of which provide for additional inspection guidance and training. On the  broader issues, for example, NRC is scheduled to complete a review of the  effectiveness of its response to past NRC lessons-learned task force reports  by April 2004. By December 2004, NRC expects to have a framework  established for moving forward with implementing recommended  improvements to its agencywide operating experience program.
In 2005, 4 of the 6 recommendations scheduled for completion concern  leakage from the reactor coolant system. For example, NRC is to (1)  develop guidance and criteria for assessing licensees’ responses to  increasing leakage levels and (2) determine whether licensees should  install enhanced systems to detect leakage from the reactor coolant  system. The fifth recommendation calls for NRC to inspect the adequacy of  licensees’ programs for controlling boric acid corrosion, and the final  recommendation calls on NRC to assess the basis for canceling a series of  inspection procedures in 2001.
NRC did not assign completion dates to 7 recommendations because,  among other things, their completion depends on completing other  recommendations or because of limited resources. Even though it has not  assigned completion dates for these recommendations, NRC has begun to  work on 5 of the 7:   Two recommendations will be addressed when requirements for vessel  head inspections are revised. To date, NRC has taken some related, but  temporary, actions. For example, since February 2003, it has required  licensees to more extensively examine their reactor vessel heads. NRC  has also issued a series of temporary instructions for NRC inspectors to  oversee the enhanced examinations. NRC expects to replace these  temporary steps with revised requirements for vessel head inspections.
Two recommendations call upon NRC to revise requirements for  detecting leaks in the reactor coolant pressure boundary. In response,  NRC has, for example, begun to review its barrier integrity requirements  and has contracted for research on enhanced detection capabilities.
One recommendation is directed at improving follow-up of licensee  actions taken in response to NRC generic communications. NRC is  currently developing a temporary inspection procedure to assess the  effectiveness of licensee actions taken in response to generic  communications. Additionally, as a long-term change in the operating  experience program, the agency plans to improve the verification of  how effective its generic communications are.
The remaining two recommendations address NRC’s need to (1) evaluate  the adequacy of methods for analyzing the risks posed by passive  components, such as reactor vessels, and integrate these methods and risks  into NRC’s decision-making process and (2) review a sample of plant  assessments conducted between 1998 and 2000 to determine if any  identified plant safety issues have not been adequately assessed. NRC has  not yet taken action on these recommendations.
Some recommendations will require substantial resources to develop and  implement. As a result, some implementation dates have slipped and some  plans in response to the recommendations have changed in scope. For  example, owing to resource constraints, NRC has postponed indefinitely  the evaluation of methods to analyze the risk associated with passive  reactor components such as the vessel head. Also, in part due to resource  constraints, NRC has reconceptualized its plan to review licensee actions  in response to previous generic communications, such as bulletins and  letters.
Staff resources will be strained because implementing the  recommendations adds additional responsibilities or duties—that is, more  inspections, training, and reviews of licensee reports. For example, NRC’s  revised inspection guidance for more thorough examinations of reactor  vessel heads and nozzles, as well as new requirements for NRC oversight of  licensees’ corrective action programs, will require at least an additional 200  hours of inspection per reactor per year. As of February 2004, NRC was  also revising other inspection requirements that are likely to place  additional demands on inspectors’ time. Thus, to respond to these  increased demands, NRC will either need to add inspectors or reduce  oversight of other licensee activities.
To its credit, in its 2004 budget plan, NRC increased the level of resources  for some inspection activities. However, it is not certain that these  increases will be maintained. The number of inspection hours has fallen by  more than one-third between 1995 and 2001. In addition, NRC is aware that  resident inspector vacancies are filled with staff having varying levels of  experience—from the basic level that would be expected from a newly  qualified inspector to the advanced level that is achieved after several  years’ experience. According to the latest available data, as of May 2003,  about 12 percent of sites had only one resident inspector; the remaining 88  percent had two inspectors of varying levels of experience. Because of this  situation, NRC augments these inspection resources with regional  inspectors and contractors to ensure that, at a minimum, its baseline  inspection program can be implemented throughout the year. Because of  surges in the demand for inspections, NRC in 2003 increased its use of  contractors and temporarily pulled qualified inspectors from other jobs to  help complete the baseline inspection program for every plant. According  to NRC, it did not expect to require such measures in 2004.
Similarly, NRC may require additional staff to identify and evaluate plants’  operating experiences and communicate the results to licensees, as the  task force recommended. NRC has currently budgeted an increase of three  full-time staff in fiscal year 2006 to implement a centralized system, or  clearinghouse, for managing the operating experience program. However,  according to an NRC official, questions remain about the level of resources  needed to fully implement the task force recommendations. NRC’s  operating experience office, before it was disbanded in 1999, had about 33  staff whose primary responsibility was to collect, evaluate, and  communicate activities associated with safety performance trends, as  reflected in licensees’ operating experiences, and participate in developing  rulemakings. However, it is too early to know the effectiveness of this  clearinghouse approach and the adequacy of resources in the other offices  available for collecting and analyzing operating experience information.  Neither the operating experience office before it was disbanded nor the  other offices flagged boric acid corrosion, cracking, or leakage as problems  warranting significantly greater oversight by NRC, licensees, or the nuclear  power industry.
section_title: NRC Has Not Proposed Any Specific Actions to Correct Systemic Weaknesses in Oversight and Decision- Making Processes
paragraphs: NRC’s Davis-Besse task force did not make any recommendations to  address two systemic problems:  evaluating licensees’ commitment to  safety and improving the agency’s process for deciding on a shutdown.
subsections: section_title: NRC’s Task Force Recommendations Did Not Address Licensee Safety Culture
paragraphs: NRC’s task force identified numerous problems at Davis-Besse that  indicated human performance and management failures and concluded  that FirstEnergy did not foster an environment that was fully conducive to  ensuring that plant safety issues received appropriate attention. Although  the task force report did not use the term safety culture, as evidence of  FirstEnergy’s safety culture problems, the task force pointed to   an imbalance between production and safety, as evidenced by  FirstEnergy’s efforts to address symptoms (such as regular cleanup of  boric acid deposits) rather than  causes (finding the source of the leaks  during refueling outages);  a lack of management involvement in or oversight of work at Davis- Besse that was important for maintaining safety;  a lack of a questioning attitude by senior FirstEnergy managers with  regard to vessel head inspections and cleaning activities;  ineffective and untimely corrective action;  a long-standing acceptance of degraded equipment; and  inadequate engineering rigor.
The task force concluded that NRC’s implementation of guidance for  inspecting and assessing a safety-conscious work environment and  employee concerns programs failed to identify significant safety problems.  Although the task force did not make any specific recommendations that  NRC develop a means to assess licensees’ safety culture, it did recommend  changes to focus more effort on assessing programs to promote a safety- conscious work environment.
NRC has taken little direct action in response to this task force  recommendation. However, to help enhance NRC’s capability to assess  licensee safety culture by indirect means, NRC modified the wording in,  and revised its inspection procedure for, assessing licensees’ ability to  identify and resolve problems, such as malfunctioning plant equipment.  These revisions included requiring inspectors to   review all licensee reports on plant conditions,  analyze trends in plant conditions to determine the existence of  potentially significant safety issues, and  expand the scope of their reviews to the prior 5 years in order to identify  recurring issues.
This problem identification and resolution inspection procedure is  intended to assess the end results of management’s safety commitment  rather than the commitment itself. However, by measuring only the end  results, early signs of a deteriorating safety culture and declining  management performance may not be readily visible and may be hard to  interpret until clear violations of NRC’s regulations occur. Furthermore,  because NRC directs its inspections at problems that it recognizes as being  more important to safety, NRC may overlook other problems until they  develop into significant and immediate safety problems. Conditions at a  plant can quickly degrade to the extent that they can compromise public  health and safety.
The International Atomic Energy Agency and its member nations have  developed guidance and procedures for assessing safety culture at nuclear  power plants, and today several countries, such as Brazil, Canada, Finland,  Sweden, and the United Kingdom, assess plant safety culture or licensees’  own assessments of their safety culture. In assessing safety culture, an  advisory group to the agency suggests that regulatory agencies examine  whether, for example, (1) employee workloads are not excessive, (2) staff  training is sufficient, (3) responsibility for safety has been clearly assigned  within the organization, (4) the corporation has clearly communicated its  safety policy, and (5) managers sufficiently emphasize safety during plant  meetings. One reason for assessing safety culture, according to the  Canadian Nuclear Safety Commission, is because management and human  performance aspects are among the leading causes of unplanned events at  licensed nuclear facilities, particularly in light of pressures such as  deregulation of the electricity market. Finland specifically requires that  nuclear power plants maintain an advanced safety culture and its  inspections target the importance that has been embedded in factors  affecting safety, including management. NRC had begun considering  methods for assessing organizational factors, including safety culture, but  in 1998, NRC’s commissioners decided that the agency should have a  performance-based inspection program of overall plant performance and  should infer licensee management performance and competency from the  results of that program. They chose this approach instead of one of four  other options:   conduct performance-based inspections in all areas of facility operation  and design, but not infer or articulate conclusions regarding the  performance of licensee management;  assess the performance of licensee management through targeted  operations-based inspections using specific inspection procedures,  trained staff, and contractors to assess licensee management—a task  that would require the development of inspection procedures and  significant training—and to document inspection results;  assess the performance of licensee management as part of the routine  inspection program by specifically evaluating and documenting  management performance attributes—a larger effort that would require  the development of assessment tools to evaluate safety culture as well  as additional resources; or   assess the competency of licensee management by evaluating  management competency attributes—an even larger effort that would  require that implementation options and their impacts be assessed.
When adopting the proposal to infer licensee management performance  from the results of its performance-based inspection program, NRC  eliminated any resource expenditures specifically directed at developing a  systematic method of inferring management performance and competency.  NRC stated that it currently has a number of means to assess safety culture  that provide indirect insights into licensee safety culture. These means  include, for example, (1) insights from augmented inspection teams, (2)  lessons-learned reviews, and (3) information obtained in the course of  conducting inspections under the Reactor Oversight Process. However,  insights from augmented inspection teams and lessons-learned reviews are  reactionary and do not prevent problems such as those that occurred at  Davis-Besse. Further, before the Davis-Besse incident, NRC assumed its  oversight process would adequately identify problems with licensees’  safety culture. However, NRC has no formalized process for collectively  assessing information obtained in the course of its problem identification  and resolution inspection to ensure that individual inspection results would  identify poor management performance. NRC stated that its licensee  assessments consider inputs such as inspection results and insights,  correspondence to licensees related to inspection observations, input from  resident inspectors, and the results of any special investigations. However,  this information may not be sufficient to inform NRC of problems at a plant  in advance of these problems becoming safety significant.
In part because of Davis-Besse, NRC’s Advisory Committee on Reactor  Safeguards recommended that NRC again pursue the development of a  methodology for assessing safety culture. It also asked NRC to consider  expanding research to identify leading indicators of degradation in human  performance and work to develop a consistent comprehensive  methodology for quantifying human performance. During an October 2003  public meeting of the advisory committee’s Human Performance  Subcommittee, the subcommittee’s members again reiterated the need for  NRC to assess safety culture. Specifically, the members recognized that  certain aspects of safety culture, such as beliefs, perceptions, and  management philosophies, are ultimately the nuclear power industry’s  responsibility but stated that NRC should deal with patterns of behavior  and human performance, as well as organizational structures and  processes. At this meeting, NRC officials discussed potential safety culture  indicators that NRC could use, including, among other things, how many  times a problem recurs at a plant, timeliness in correcting problems,  number of temporary modifications, and individual program and process  error rates. Committee members recommended that NRC test various  safety culture indicators to determine whether (1) such indicators should  ultimately be incorporated into the Reactor Oversight Process and (2) a  significance determination process could be developed for safety culture.  As of March 2004, NRC had yet to respond to the advisory committee’s  recommendation.
Despite the lack of action to address safety culture issues, NRC’s concern  over FirstEnergy’s safety culture at Davis-Besse was one of the last issues  resolved before the agency approved Davis-Besse’s restart. NRC undertook  a series of inspections to examine Davis-Besse’s safety culture and  determine whether FirstEnergy had (1) correctly identified the underlying  causes associated with its declining safety culture, (2) implemented  appropriate actions to correct safety culture problems, and (3) developed a  process for monitoring to ensure that actions taken were effective for  resolving safety culture problems. In December 2003, NRC noted  significant improvements in the safety culture at Davis-Besse, but  expressed concern with the sustainability of Davis-Besse’s performance in  this area. For example, a survey of FirstEnergy and contract employees  conducted by FirstEnergy in November 2003 indicated that about 17  percent of employees believed that management cared more about cost  and schedule than resolving safety and quality issues—again, production  over safety.
section_title: NRC’s Task Force Recommendations Did Not Address NRC’s Decision-Making Process
paragraphs: NRC’s task force also did not analyze NRC’s process for deciding not to  order a shutdown of the Davis-Besse plant. It noted that NRC’s written  rationale for accepting FirstEnergy’s justification for continued plant  operation had not yet been prepared and recommended that NRC change  guidance requiring NRC to adequately document such decisions. It also  made a recommendation to strengthen guidance for verifying information  provided by licensees. According to an NRC official on the task force, the  task force did not assess the decision-making process in detail because the  task force was charged with determining why the degradation at Davis- Besse was not prevented and because NRC had coordinated with NRC’s  Office of the Inspector General, which was reviewing NRC’s decision  making.
section_title: NRC’s Failure to Track the Resolution of Identified Problems May Allow the Problems to Recur
paragraphs: The NRC task force conducted a preliminary review of prior lessons- learned task force reports to determine whether they suggested any  recurring or similar problems. As a result of this preliminary review, the  task force recommended that a more detailed review be conducted to  determine if actions that NRC took as a result of those reviews were  effective. These previous task force reports included:  Indian Point 2 in  Buchanan, New York, in February 2000; Millstone in Waterford,  Connecticut, in October 1993; and South Texas Project in Wadsworth,  Texas, from 1988 to 1994. NRC’s more detailed review, as of May 2004, was  still under way. We also reviewed these reports to determine whether they  suggested any recurring problems and found that they highlighted broad  areas of continuing programmatic weaknesses, as seen in the following  examples:   Inspector training and information sharing. All three of the other task  forces also identified inspector training issues and problems with  information collection and sharing. The Indian Point task force called  upon NRC to develop a process for promptly disseminating technical  information to NRC inspectors so that they can review and apply the  information in their inspection program.
Oversight of licensee corrective action programs. Two of the three task  forces also identified inadequate oversight of licensee corrective action  programs. The South Texas task force recommended improving  assessments of licensees’ corrective action programs to ensure that  NRC identifies broader licensee problems.
Better identification of problems. Two of the three task force reports  also noted the need for NRC to develop a better process for identifying  problem plants, and one report noted the need for NRC inspectors to  more aggressively question licensees’ activities.
Over the past two decades, we have also reported on underlying causes  similar to those that contributed, in part, to the incident at Davis-Besse.  (See Related GAO Products.) For example, with respect to the safety  culture at nuclear power plants, in 1986, 1995, and 1997, we reported on  issues relevant to NRC assessing plant management so that significant  problems could be detected and corrected before they led to incidents such  as the one that later occurred at Davis-Besse. Regardless of our 1997  recommendation that NRC require that the assessment of management’s  competency and performance be a mandatory component of NRC’s  inspection process, NRC subsequently withdrew funding to accomplish  this. In terms of inspections, in 1995 we reported that NRC, itself, had  concluded that the agency was not effectively integrating information on  previously identified and long-standing issues to determine if the issues  indicated systemic weaknesses in plant operations. This report further  noted that NRC was not using such information to focus future inspection  activities. In 1997 and 2001, we reported on weaknesses in NRC’s  inspections of licensees’ corrective action programs. Finally, with respect  to learning from plants’ operating experiences, in 1984 we noted that NRC  needed to improve its methods for consolidating information so that it  could evaluate safety trends and ensure that generic issues are resolved at  individual plants. These recurring issues indicate that NRC’s actions, in  response to individual plant incidents and recommendations to improve  oversight, are not always institutionalized.
NRC guidance requires that resolutions to action plans be described and  documented, and while NRC is monitoring the status of actions taken in  response to Davis-Besse task force recommendations and preparing  quarterly and semiannual reports on the status of actions taken, the Davis- Besse action plan does not specify how long NRC will monitor them. It also  does not describe how long NRC will prepare quarterly and semiannual  status reports, even though, according to NRC officials, these semiannual  status reports will continue until all items are completed and the agency is  required to issue a final summary report. The plan also does not specify  what criteria the agency will use to determine when the actions in response  to specific task force recommendations are completed. Furthermore,  NRC’s action plan does not require NRC to assess the long-term  effectiveness of recommended actions, even though, according to NRC  officials, some activities already have an effectiveness review included. As  in the past and in response to prior lessons-learned task force reports and  recommendations, NRC has no management control in place for assessing  the long-term effectiveness of efforts resulting from the recommendations.  NRC officials acknowledged the need for a management control, such as an  agencywide tracking system, to ensure that actions taken in response to  task force recommendations effectively resolve the underlying issue over  the long term, but the officials have no plans to establish such a system.
section_title: Conclusions
paragraphs: It is unlikely, given the actions that NRC has taken to date, that extensive  reactor vessel corrosion will occur any time soon at another domestic  nuclear power plant. However, we do not yet have adequate assurances  from NRC that many of the factors that contributed to the incident at Davis- Besse will be fully addressed. These factors include NRC’s failure to keep  abreast of safety significant issues by collecting information on operating  experiences at plants, assessing their relative safety significance, and  effectively communicating information within the agency to ensure that  oversight is fully informed. The underlying causes of the Davis-Besse  incident underscore the potential for another incident unrelated to boric  acid corrosion or cracked control rod drive mechanism nozzles to occur.  This potential is reinforced by the fact that both prior NRC lessons-learned  task forces and we have found similar weaknesses in many of the same  NRC programs that led to the Davis-Besse incident. NRC has not followed  up on prior task force recommendations to assess whether the lessons  learned were institutionalized. NRC’s actions to implement the Davis-Besse  lessons-learned task force recommendations, to be fully effective, will  require an extensive effort on NRC’s part to ensure that these are  effectively incorporated into the agency’s processes. However, NRC has not  estimated the amount of resources necessary to carry out these  recommendations, and we are concerned that resource limitations could  constrain their effectiveness. For this reason, it is important for NRC to not  only monitor the implementation of Davis-Besse task force  recommendations, but also determine their effectiveness, in the long term,  and the impact that resource constraints may have on them. These actions  are even more important because the nation’s fleet of nuclear power plants  is aging.
Because the Davis-Besse task force did not address NRC’s unwillingness to  directly assess licensee safety culture, we are concerned that NRC’s  oversight will continue to be reactive rather than proactive. NRC’s  oversight can result in NRC making a determination that a licensee’s  performance is good one day, yet the next day NRC discovers the  performance to be unacceptably risky to public health and safety. Such a  situation does not occur overnight:  Long-standing action or inaction on the  part of the licensee causes unacceptably risky and degraded conditions.  NRC needs better information to preclude such conditions. Given the  complexity of nuclear power plants, the number of physical structures,  systems, and components, and the manner in which NRC inspectors must  sample to assess whether licensees are complying with NRC requirements  and license specifications, it is possible that NRC will not identify licensees  that value production over safety. While we recognize the difficulty in  assessing licensee safety culture, we believe it is sufficiently important to  develop a means to do so.
Given the limited information NRC had at the time and that an accident did  not occur during the delay in Davis-Besse’s shutdown, we do not  necessarily question the decision the agency made. However, we are  concerned about NRC’s process for making that decision. It used guidance  intended to make decisions for another purpose, did not rigorously apply  the guidance, established an unrealistically high standard of evidence to  issue a shutdown order, relied on incomplete and faulty PRA analyses and  licensee evidence, and did not document key decisions and data. It is  extremely unusual for NRC to order a nuclear power plant to shut down.  Given this fact, it is more imperative that NRC have guidance to use when  technical specifications or requirements may be met, yet questions arise  over whether sufficient safety is being maintained. This guidance does not  need to be a risk-based approach, but rather a more structured risk- informed approach that is sufficiently flexible to ensure that the guidance  is applicable under different circumstances. This is important because NRC  annually makes about 1,500 licensing decisions relating to operating  commercial nuclear power plants. While we recognize the challenges NRC  will face in developing such guidance, the large number and wide variety of  decisions strongly highlight the need for NRC to ensure that its decision- making process and decisions are sound and defensible.
section_title: Recommendations for Executive Action
paragraphs: To ensure that NRC aggressively and comprehensively addresses the  weaknesses that contributed to the Davis-Besse incident and could  contribute to problems at nuclear power plants in the future, we are  recommending that the NRC commissioners take the following five  actions:  Determine the resource implications of the task force’s  recommendations and reallocate the agency’s resources, as appropriate,  to better ensure that NRC effectively implements the recommendations.
Develop a management control approach to track, on a long-term basis,  implementation of the recommendations made by the Davis-Besse  lessons-learned task force and future task forces. This approach, at a  minimum, should assign accountability for implementing each  recommendation and include information on the status of major actions,  how each recommendation will be judged as completed, and how its  effectiveness will be assessed. The approach should also provide for  regular—quarterly or semiannual—reports to the NRC commissioners  on the status of and obstacles to full implementation of the  recommendations.
Develop a methodology to assess licensees’ safety culture that includes  indicators of and inspection information on patterns of licensee  performance, as well as on licensees’ organization and processes. NRC  should collect and analyze this data either during the course of the  agency’s routine inspection program or during separate targeted  assessments, or during both routine and targeted inspections and  assessments, to provide an early warning of deteriorating or declining  performance and future safety problems.
Develop specific guidance and a well-defined process for deciding on  when to shut down a nuclear power plant. The guidance should clearly  set out the process to be used, the safety-related factors to be  considered, the weight that should be assigned to each factor, and the  standards for judging the quality of the evidence considered.
Improve NRC’s use of probabilistic risk assessment estimates in  decision making by (1) ensuring that the risk estimates, uncertainties,  and assumptions made in developing the estimates are fully defined,  documented, and communicated to NRC decision makers; and (2)  providing guidance to decision makers on how to consider the relative  importance, validity, and reliability of quantitative risk estimates in  conjunction with other qualitative safety-related factors.
section_title: Agency Comments and Our Evaluation
paragraphs: We provided a draft of this report to NRC for review and comment. We  received written comments from the agency’s Executive Director for  Operations. In its written comments, NRC generally addressed only those  findings and recommendations with which it disagreed. Although  commenting that it agreed with many of the report’s findings, NRC  expressed an overall concern that the report does not appropriately  characterize or provide a balanced perspective on NRC’s actions  surrounding the discovery of the Davis-Besse reactor vessel head condition  or NRC’s actions to incorporate the lessons learned from that experience  into its processes. Specifically, NRC stated that the report does not  acknowledge that NRC must rely heavily on its licensees to provide it with  complete and accurate information, as required by its regulations. NRC  also expressed concern about the report’s characterization of its use of risk  estimates—specifically the report’s statement that NRC’s estimate of risk  exceeded the risk levels generally accepted by the agency. In addition, NRC  disagreed with two of our recommendations: (1) to develop specific  guidance and a well-defined process for deciding on when to shut down a  plant and (2) to develop a methodology to assess licensees’ safety culture.
With respect to NRC’s overall concern, we believe that the report  accurately captures NRC’s performance. Our draft report, in discussing  NRC’s regulatory and oversight role and responsibilities, stated that  according to NRC, the completeness and accuracy of the information  provided by licensees is an important aspect of the agency’s oversight. To  respond further to NRC’s concern, we added a statement to the effect that  licensees are required under NRC’s regulations to provide the agency with  complete and accurate information. While we do not want to diminish the  importance of this responsibility on the part of the licensees, we believe  that NRC also has a responsibility, in designing its oversight program, to  implement management controls, including inspection and enforcement, to  ensure that it has accurate information on and is sufficiently aware of plant  conditions. In this respect, it was NRC’s decision to rely on the premise that  the information provided by FirstEnergy was complete and accurate. As we  point out in the report, the degradation of the vessel head at Davis-Besse  occurred over several years. NRC knew about several indications that  problems were occurring at the plant, and the agency could have requested  and obtained additional information about the vessel head condition.
We also believe that the report’s characterization of NRC’s use of risk  estimates is accurate. The NRC risk estimate that we and our consultants  found for the period leading up to the December 2001 decision on Davis- Besse’s shutdown, including the risk estimate used by the staff during key  briefings of NRC management, indicated that the estimate for core damage  frequency was 5.4x10-5, as used in the report. The 5x10-6 referenced in  NRC’s December 2002 safety evaluation is for core damage probability,  which equates to a core damage frequency of approximately 5x10-5—a level  that is in excess of the level generally accepted by the agency. The  impression of our consultants is that some confusion about the differences  in these terms may exist among NRC staff.
Concerning NRC’s disagreement with our recommendation to develop  specific guidance for making plant shutdown decisions, NRC stated that its  regulations, guidance, and processes are robust and do provide sufficient  guidance in the vast majority of situations. The agency added that from  time to time a unique situation may present itself wherein sufficient  information may not exist or the information available may not be  sufficiently clear to apply existing rules and regulations definitively.  According to NRC, in these unique instances, the agency’s most senior  managers, after consultation with staff experts and given all of the  information available at the time, decide whether to require a plant  shutdown. While we agree that NRC has an array of guidance for making  decisions, we continue to believe that NRC needs specific guidance and a  well-defined process for deciding when to shut down a plant. As discussed  in our report, the agency used its guidance for approving license change  requests to make the decision on when to shut down Davis-Besse. Although  NRC’s array of guidance provides flexibility, we do not believe that it  provides the structure, direction, and accountability needed for important  decisions such as the one on Davis-Besse’s shutdown.
In disagreeing with our recommendation concerning the need for a  methodology to assess licensees’ safety culture, NRC said that the  Commission, to date, has specifically decided not to conduct direct  evaluations or inspections of safety culture as a routine part of assessing  licensee performance due to the subjective nature of such evaluations.  According to NRC, as regulators, agency officials are not charged with  managing licensees’ facilities, and direct involvement with organizational  structure and processes crosses over to a management function. We  understand NRC’s position that it is not charged with managing  licensees’  facilities, and we are not suggesting that NRC should prescribe or regulate  the licensees’ organizational structure or processes. Our recommendation  is aimed at NRC monitoring trends in licensees’ safety culture as an early  warning of declining performance and safety problems. Such early  warnings can help preclude NRC from assessing a licensee as being a good  performer one day, and the next day being faced with a situation that it  considers a potentially significant safety risk. As discussed in the report,  considerable guidance is available on safety culture assessment, and other  countries have established safety culture programs.
NRC’s written response also contained technical comments, which we have  incorporated into the report, as appropriate. (NRC’s comments and our  responses are presented in app. IV.)
As arranged with your staff, unless you publicly announce its contents  earlier, we plan no further distribution of this report until 30 days from its  issue date. At that time, we plan to provide copies of this report to the  appropriate congressional committees; the Chairman, NRC; the Director,  Office of Management and Budget; and other interested parties. We will  also make copies available to others upon request. In addition, this report  will be available at no charge on the GAO Web site at http://www.gao.gov. If  you or your staff have any questions, please call me at (202) 512-3841. Key  contributors to this report are listed in appendix V.
section_title: Time Line Relating Significant Events of Interest
section_title: Analysis of the Nuclear Regulatory Commission’s Probabilistic Risk Assessment for Davis-Besse
section_title: Davis-Besse Task Force Recommendations to NRC and Their Status, as of March 2004
paragraphs: Either fully implement or revise guidance to manage licensee  commitments. Determine whether the periodic report on  commitment changes submitted by licensees should continue.
Revised instructions for these submittals and reviews to ensure  that these tasks are accomplished. Completed in May 2003.
Determine if stress corrosion cracking models are appropriate for  predicting susceptibility of vessel head penetration nozzles to  pressurized water stress corrosion cracking. Determine if additional  analysis and testing is needed to reduce modeling uncertainties for  their continued applicability in regulatory decision making.
Evaluated existing stress corrosion cracking models for their  continuing use in determining susceptibility. Completed in July  2003.
Revise the problem identification and resolution approach so that  safety problems noted in daily licensee reports are reviewed and  assessed. Enhance guidance to prescribe the format of information  that is screened when deciding which problems to review.
Revised inspection procedure for determining licensee ability to  promptly identify and resolve conditions adverse to quality or  safety. Completed in September 2003.
Provide enhanced inspection guidance to pursue issues and  problems identified during reviews of plant operations.
Revised inspection procedure for determining licensee capability  to promptly identify and resolve conditions adverse to quality or  safety. Completed in September 2003.
Revise inspection guidance to provide for longer-term follow-up of  previously identified issues that have not progressed to an  inspection finding.
Revised inspection procedure for determining licensee capability  to promptly identify and resolve conditions adverse to quality or  safety. Completed in September 2003.
Revise inspection guidance to assess (1) the safety implications of  long-standing unresolved licensee equipment problems, (2) the  impact of phased in corrective actions, and (3) the implications of  deferred plant modifications.
Revised inspection procedure for determining licensee capability  to identify and resolve conditions adverse to quality or safety.  Completed in September 2003.
Revise inspection guidance to allow for establishing reactor  oversight panels even when a significant performance problem, as  defined under NRC's Reactor Oversight Process, does not exist.
Revised inspection guidance for establishing reactor oversight  panels. Completed in October 2003.
Assess the scope and adequacy of requirements for licensees to  review operating experience.
Included in NRC’s recommendation to develop a program for  collecting, analyzing, and disseminating information on  experiences at operating reactors. Completed in November 2003.
Ensure inspector training includes (1) boric acid corrosion effects  and control, and (2) pressurized water stress corrosion cracking of  nickel-based alloy nozzles.
Developed and implemented Web-based training and a means for  ensuring training is completed. Completed in December 2003.
Provide training and reinforce expectations to managers and staff to  (1) maintain a questioning attitude during inspection activities, (2)  develop inspection insights from Davis-Besse on symptoms of  reactor coolant leakage, (3) communicate expectations to follow up  recurring and unresolved problems, and (4) maintain an awareness  of surroundings while conducting inspections. Establish  mechanisms to perpetuate this training.
Developed Web-based inspector training and a means for ensuring  that training has been completed. NRC headquarters provided an  overview of the training to NRC regional offices. (Training modules  will be added and updated as needed.) Completed in December  2003.
Reinforce expectations that regional management should make  every effort to visit each reactor at least once every 2 years.
Discussed at regional counterparts meeting. Completed in  December 2003.
Develop guidance to address impacts of regional oversight panels  on regional resource allocations and organizational alignment.
Evaluated past and present oversight panels. Developed  enhanced inspection approaches for oversight panels and issued  revised procedures. Completed in December 2003.
Evaluate (1) the capacity to retain operating experience information  and perform long-term operating experience reviews; (2) thresholds,  criteria, and guidance for initiating generic communications; (3)  opportunities for more gains in effectiveness and efficiency by  realigning the organization (i.e., feasibility of a centralized operating  experience "clearinghouse"); (4) effectiveness of the generic Issues  program; and (5) effectiveness of internal dissemination of operating  experience information to end users.
Developed program objectives and attributes and obtained  management endorsement of a plan to implement the  recommendation. Developed specific recommendations to improve  program. Evaluation completed in November 2003.  (Implementation of recommendations resulting from this evaluation  expected to be completed in December 2004.)
Ensure that generic requirements or guidance are not  inappropriately affected when making unrelated changes to other  programs, processes, guidance, etc.
Revised inspection guidance. Completed in February  2004.
Develop inspection guidance to assess scheduler influences on  amount of work performed during refueling outages.
Revised the appropriate inspection procedure. Completed in  February 2004.
Establish guidance to ensure that NRC decisions allowing licensees  to deviate from guidelines and recommendations issued in generic  communications are adequately documented.
Update guidance to address documentation. Develop training and  distribute to NRC offices and regions to emphasize compliance  with the updated guidance. Follow up to assess the effectiveness  of the training. Completed follow-up in February 2004.
Develop or revise inspection guidance to ensure that NRC reviews  vessel head penetration nozzles and the reactor vessel head during  licensee inspection activities.
Develop or revise inspection guidance to ensure that nozzles and  the vessel head are reviewed during licensee inspection. Issued  interim guidance in August 2003 and a temporary inspection  procedure in September 2003. Additional guidance expected in  March 2004.
Develop inspection guidance to assess (1) repetitive or multiple  technical specification actions in NRC inspection or licensee reports,  and (2) radiation dose implications for conducting repetitive tasks.
Revise the appropriate inspection procedure to reflect this need.  Completion expected in March 2004.
Develop guidance to periodically inspect licensees’ boric acid  corrosion control programs.
Issued temporary guidance in November 2003. Completion of  further inspection guidance changes expected in March 2004.
Reinforce expectations for managers responsible for overseeing  operations at nuclear power plants regarding site visits, coordination  with resident inspectors, and assignment duration. Reinforce  expectations to question information about operating conditions and  strengthen guidance for reviewing license amendments to  emphasize consideration of current system conditions, reliability,  and performance data in safety evaluation reports. Strengthen  guidance for verifying licensee-provided information.
Update project manager handbook that provides guidance on  activities to be conducted during site visits and interactions with  NRC regional staff. Also, revise guidance for considering plant  conditions during licensing action and amendment reviews.  Completion expected in March 2004.
Assemble and analyze foreign and domestic information on Alloy  600 nozzle cracking. If additional regulatory action is warranted,  propose a course of action and implement a schedule to address  the results.
Assemble and analyze alloy 600 cracking data. Completion  expected in March 2004.
Recommendations due to be completed between April and December 2004 Conduct an effectiveness review of actions taken in response to past  NRC lessons-learned reviews.
Review past lessons-learned actions. Completion expected in April  2004.
Provide inspection and oversight refresher training to managers and  staff.
Develop a training module. Completion expected in June 2004.
Establish guidance for accepting owners group and industry  recommended resolutions for generic communications and generic  issues, including guidance for verifying that actions are taken.
Revise office instructions to provide recommended guidance.  Completion expected in June 2004.
Review inspection guidance to determine the inspection level that is  sufficient during refueling outages, including inspecting reactor  areas inaccessible during normal operations and passive  components.
Revised an inspection procedure to reflect these changes. Some  inspection procedure changes were completed in November 2003,  and additional changes are expected in August 2004.
Evaluate, and revise as necessary, guidance for proposing  candidate generic issues.
Assemble and analyze foreign and domestic information on boric  acid corrosion of carbon steel. If additional regulatory action is  warranted, propose a course of action and implement a schedule to  address the results.
Review Argonne National Laboratory study on boric acid  corrosion. Analyze data to revise inspection requirements.  Completion expected in October 2004.
Conduct a follow-on verification of licensee actions to implement a  sample of significant generic communications with emphasis on  those that are programmatic in nature.
Screen candidate generic communications to identify those most  appropriate for follow-up using management-approved criteria.  Develop and approve verification plan. Completion expected in  November 2004.
Strengthen inspection guidance for periodically reviewing licensee  operating experience.
Incorporated into the recommendation pertaining to NRC’s  capacity to retain operating experience information. Completion  expected in December 2004.
Enhance the effectiveness of processes for collecting, reviewing,  assessing, storing, retrieving, and disseminating foreign operating  experience.
Incorporated into the recommendation pertaining to NRC’s  capacity to retain operating experience information. Completion  expected in December 2004.
Update operating experience guidance to reflect the changes  implemented in response to recommendations for operating  experience.
Incorporated into the recommendation pertaining to NRC’s  capacity to retain operating experience information. Completion  expected in December 2004.
Review a sample of NRC evaluations of licensee actions made in  response to owners groups’ commitments to identify whether  intended actions were effectively implemented.
Conduct the recommended review. Completion expected in  December 2004.
Develop general inspection guidance to periodically verify that  licensees implement owners groups’ commitments.
Develop inspection procedure to provide a mechanism for regions  to support project managers’ ability to verify that licensees  implement commitments. Completion expected in December 2004.
Conduct follow-on verification of licensee actions pertaining to a  sample of resolved generic issues.
No specific actions have been identified. Completion expected in  December 2004.
Review the range of baseline inspections and plant assessment  processes to determine sufficiency to identify and dispose of  problems like those at Davis-Besse.
No specific actions have been identified. Completion expected in  December 2004.
Identify alternative mechanisms to independently assess licensee  plant performance for self-assessing NRC oversight processes and  determine the feasibility of such mechanisms.
No specific actions have been identified. Completion expected in  December 2004.
Establish measurements for resident inspector staffing levels and  requirements, including standards for satisfying minimum staffing  levels.
Develop standardized staffing measures and implement details.  Metrics were developed in December 2003. Completion expected  in December 2004.
Structure and focus inspections to assess licensee employee  concerns and a "safety conscious work environment.”
No specific actions have been identified. Completion expected in  December 2004.
Recommendations due to be completed in calendar year 2005 Develop inspection guidance and criteria for addressing licensee  response to increasing leakage levels and/or adverse trends in  unidentified reactor coolant system leakage.
Develop recommendations for guidance with action levels to  trigger greater NRC interaction with licensees in response to  increased leakage. Completion expected in January 2005.
Reassess the basis for the cancellation, in 2001, of certain  inspection procedures (i.e., boric acid control programs and  operational experience feedback) to assess if these procedures are  still applicable.
Review revised procedures and reactivate as necessary.  Completion expected in March 2005.
Assess requirements for licensee procedures to respond to plant  alarms for leakage to determine whether requirements are sufficient  to identify reactor coolant pressure boundary leakage.
Review and assess adequacy of requirements and develop  recommendations to (1) improve procedures to identify leakage  from boundary, (2) establish consistent technical specifications for  leakage, and (3) use enhanced leakage detection systems.  Completion expected in March 2005.
Determine whether licensees should install enhanced systems to  detect leakage from the reactor coolant system.
Inspect the adequacy of licensee’s programs to control boric acid  corrosion, including effectiveness of implementation.
Develop guidance to assess adequacy of corrosion control  programs, including implementation and effectiveness, and  evaluate the status of this effort after the first year of inspections.  Guidance expected to be developed by March 2004. Follow-up  scheduled for completion in March 2005.
Continue ongoing efforts to review and improve the usefulness of  barrier integrity performance indicators and evaluate the use of  primary system leakage that licensees have identified but not yet  corrected as a potential indicator.
Develop and implement improved performance indicators based  on current requirements and measurements. Explore the use of  additional performance indicators to track the number, duration,  and rate of system leakage. Determine the feasibility of  establishing a risk-informed performance indicator for barrier  integrity. Completion expected in December 2005.
Recommendations whose completion dates have yet to be determined Encourage the American Society of Mechanical Engineers to revise  inspection requirements for nickel-based alloy nozzles. Encourage  changes to requirements for nonvisual, nondestructive inspections  of vessel head penetration nozzles. Alternatively, revise NRC  regulations to address the nature and scope of these inspections.
Monitor and provide input to industry efforts to develop revised  inspection requirements. Participate in American Society of  Mechanical Engineers’ meetings and communicate with  appropriate stakeholders. Decide whether to endorse the revised  American Society of Mechanical Engineers’ code requirements.  These actions parallel a larger NRC rulemaking effort. Completion  date yet to be determined.
Revise processes to require short- and long-term verification of  licensee actions to respond to significant NRC generic  communications before closing out issues.
Target date to be set upon completion of review of NRC’s generic  communications program. Completion date yet to be determined.
Determine whether licensee reactor vessel head inspection  summary reports should be submitted to NRC and, if so, revise  submission requirements and report disposition guidance, as  appropriate.
Will be included as part of revised American Society of Mechanical  Engineers’ requirements for inspection of reactor vessel heads and  vessel head penetration nozzles. Completion date yet to be  determined.
Evaluate the adequacy of methods for analyzing the risk of passive  component degradation and integrate these methods and risks into  NRC’s decision-making processes.
No specific actions have been identified. Completion date yet to be  determined.
Review pressurized water reactor technical specifications to identify  plants that have nonstandard reactor coolant pressure boundary  leakage requirements and change specifications to make them  consistent among all plants.
Assessed plants for nonstandard technical specifications.  Completed in July 2003. Change leakage detection specifications  in coordination with other changes in leakage detection  requirements. Completion date yet to be determined.
Improve requirements for unidentified leakage in reactor coolant  system to ensure they are sufficient to (1) discriminate between  unidentified leaks from the coolant system and leaks from the  reactor coolant pressure boundary and (2) ensure that plants do not  operate with pressure boundary leakage.
Issue regulations implementing the improved requirements when  these requirements are determined. Completion date yet to be  determined.
NRC should review a sample of plant assessments conducted  between 1998 and 2000 to determine if any identified plant safety  issues have not been adequately assessed.
No specific actions have been identified. Completion expected in  March 2004.
Recommendations rejected by NRC management Review industry approaches licensees use to consider economic  factors for inspection and repair and consider this information in  formulating future positions on the performance of non-visual  inspections of vessel head penetration nozzles.
Recommendation rejected by NRC management. No completion  date.
Revise the criteria for review of industry topical reports to allow for  NRC staff review of safety-significant reports that have generic  implications but have not been formally submitted for NRC review in  accordance with the existing criteria.
Recommendation rejected by NRC management. No completion  date.
section_title: Comments from the Nuclear Regulatory Commission
paragraphs: The following are GAO’s comments on the Nuclear Regulatory  Commission’s letter dated May 5, 2004.
subsections: section_title: GAO Comments
paragraphs: 1. We agree with NRC that 10 C.F.R. § 50.9 requires that information  provided to NRC by a licensee be complete and accurate in all material  respects, and we have added this information to the report. NRC also  states that in carrying out its oversight responsibilities, NRC must “rely  heavily” on licensees providing accurate information. However, we  believe that NRC’s oversight program should not place undue reliance  on applicants providing complete and accurate information. NRC also  recognizes that it cannot rely solely on information from licensees, as  evidenced by its inspection program and process for determining the  significance of licensee violations. Under this process, NRC considers  whether there are any willful aspects associated with the violation— including the deliberate intent to violate a license requirement or  regulation or falsify information. We believe that management controls,  including inspection and enforcement, should be implemented by NRC  so as to verify whether licensee-submitted information considered to  be important for ensuring safety is complete and accurate as required  by the regulation. In this regard, as stated in NRC’s enforcement policy  guidance, NRC is authorized to conduct inspections and investigations  (Atomic Energy Act § 161); revoke licenses for, among other things, a  licensee’s making material false statements or failing to build or  operate a facility in accordance with the terms of the license (Atomic  Energy Act § 186); and impose civil penalties for a licensee’s knowing  failure to provide certain safety information to NRC (Energy  Reorganization Act § 206).
With regard to the draft report conveying the expectation that NRC  should have known about the thick layer of boron on the reactor vessel  head, we note in the draft report that since at least 1998, NRC was  aware that (1) FirstEnergy’s boric acid corrosion control program was  inadequate, (2) radiation monitors within the containment area were  continuously being clogged by boric acid deposits, (3) the containment  air cooling system had to be cleaned repeatedly because of boric acid  buildup, (4) corrosion was occurring within containment as evidenced  by rust particles being found, and (5) the unidentified leakage rate had  increased above the level that historically had been found at the plant.  NRC was also aware of the repeated but ineffective attempts by  FirstEnergy to correct many of these recurring problems—evidence  that the licensee’s programs to identify and correct problems were not  effective. Given these indications at Davis-Besse, NRC could have  taken more aggressive follow-up action to determine the underlying  causes. For example, NRC could have taken action during the fuel  outage in 1998, the shutdown to repair valves in mid-1999, or the fuel  outage in 2000 to ensure that staff with sufficient knowledge  appropriately investigated the types of conditions that could cause  these indications, or followed up to ensure that FirstEnergy had fully  investigated and successfully resolved the cause of the indications.  2. With respect to the responsibility of the licensee to provide complete  and accurate information, see comment 1. As to the Davis-Besse  lessons-learned task force finding, we agree that some information  provided by FirstEnergy in response to Bulletin 2001-01 may have been  inconsistent with some information subsequently identified by NRC’s  lessons-learned task force, and that had some of this information been  known in the fall of 2001, the vessel head leakage and degradation may  have been identified sooner than March 2002. This information  included (1) the boric acid accumulations found on the vessel head by  FirstEnergy in 1998 and 2000, (2) FirstEnergy’s limited ability to  visually inspect the vessel head, (3) FirstEnergy’s boric acid corrosion  control procedures relative to the vessel head, (4) FirstEnergy’s  program to address the corrosive effects of small amounts of reactor  coolant leakage, (5) previous nozzle inspection results, (6) the bases for  FirstEnergy’s conclusion that another source of leakage—control rod  drive mechanism flanges—was the source of boric acid deposits on the  vessel head that obscured multiple nozzles, and (7) photographs of  vessel head penetration nozzles. However, various NRC officials knew  some of this information, other information should have been known  by NRC, and the remaining information could have been obtained had  NRC requested it from FirstEnergy. For example, according to the  senior resident inspector, he reviewed every Davis-Besse condition  report on a daily basis to determine whether the licensee properly  categorized the safety significance of the conditions. Vessel head  conditions found by FirstEnergy in 1998 and 2000 were noted in such  condition reports or in potential-condition-adverse-to-quality reports.  According to a FirstEnergy official, photographs of the pressure vessel  head nozzles were specifically provided to NRC’s resident inspector,  who, although he did not specifically recall seeing the photographs,  stated that he had no reason to doubt the FirstEnergy official’s  statement. NRC had been aware, in 1999, of limitations in FirstEnergy’s  boric acid corrosion control program and, while it cited FirstEnergy for  its failure to adequately implement the program, NRC officials did not  follow up to determine if the program had improved. Lastly, while NRC  questioned the information provided by FirstEnergy in its submissions  to NRC in response to Bulletin 2001-01 (regarding vessel head  penetration nozzle inspections), NRC staff did not independently  review and assess information pertaining to the results of past reactor  pressure vessel head inspections and vessel head penetration nozzle  inspections. Similarly, NRC did not independently assess the  information concerning the extent and nature of the boric acid  accumulations found on the vessel head by the licensee during past  inspections. “The NRC staff estimated that, giving credit only to the  inspection  performed in 1996, the probability of a  nozzle  ejection during the period of operation from December 31, 2001, to February 16,  2002, was in the range of 2E-3 and was an increase in the overall [loss of coolant  accident] probability for the plant. The increase in core damage probability and  large early release probability were estimated as approximately 5E-6 and 5E-08,  respectively.”
The probability of a large early release—5E-6—equates to a frequency  of 5x10-5 per year. As we note in the report, according to NRC’s  regulatory guide 1.174, this frequency would be in the highest risk zone  and NRC would generally not approve the requested change.
On several occasions, we met with the NRC staff that developed the  risk estimate in an attempt to understand how it was calculated. We  obtained from NRC staff the risk estimate information provided to  senior management in late November 2001, as well as several  explanations of how the staff developed its calculations. We were  provided with no evidence that NRC estimated the frequency of core  damage as being 5x10-6 per year until February 2004, after our  consultants and we had challenged NRC’s estimate as being in the  highest risk zone under NRC’s regulatory guide 1.174. Furthermore,  several NRC staff involved in deciding whether to issue the order to  shut down Davis-Besse, or to allow it to continue operating until  February 16, 2002, stated that the risk estimate they used was relatively  high.   4. We agree that existing regulations provide a spectrum of conditions  under which a plant shutdown could occur and that could be  interpreted as covering the vast majority of situations. However, we  continue to believe that NRC lacks sufficient guidance for making plant  shutdown decisions. We disagree on two grounds: First, the decision- making guidance used by NRC to shut down Davis-Besse was guidance  for approving license change requests. This guidance provides general  direction on how to make risk-informed decisions when licensees  request license changes. It does not address important aspects of  decision-making involved in deciding whether to shut down a plant. It  also does not provide direction on how NRC should weigh  deterministic factors in relation to probabilistic factors in making  shutdown decisions. Secondly, while NRC views the flexibility afforded  by its existing array of guidance as a strength, we are concerned that,  even on the basis of the same information or circumstances, staff can  arrive at very different decisions. Without more specific guidance, NRC  will continue to lack accountability and the degree of credibility needed  to convince the industry and the public that its shutdown decisions are  sufficiently sound and reasoned for protecting public health and safety.   5. We are aware that the commissioners have specifically decided not to  conduct direct evaluations or inspections of safety culture. We agree  that as regulators, NRC is not charged with managing licensees’  facilities, but disagree that any direct NRC involvement with safety  culture crosses over to a management function. Management is an  embodiment of corporate beliefs and perceptions that affect  management strategies, goals, and philosophies. These, in turn, impact  licensee programs and processes and employee behaviors that have  safety outcomes. We believe that NRC should not assess corporate  beliefs and perceptions or management strategies, goals, or  philosophies. Rather, we believe that NRC has a responsibility to assess  licensee programs and processes, as well as employee behaviors. We  cite several areas of safety culture in the report as being examples of  various aspects of safety culture that NRC can assess which do not  constitute “management functions.” The International Atomic Energy  Agency has extensive guidance on assessing additional aspects of  licensee performance and indicators of safety culture. Such  assessments can provide early indications of declining safety culture  prior to when negative safety outcomes occur, such as at Davis-Besse.
We also agree that NRC has indirect means by which it attempts to  assess safety culture. For example, NRC’s problem identification and  resolution inspection procedure’s stated objective is to provide an early  warning of potential performance issues and insight into whether  licensees have established safety conscious work environments.  However, we do not believe that the implementation of the inspection  procedure has been demonstrated to be effective in meeting its stated  objectives. The inspection procedure directs inspectors to screen and  analyze trends in all reported power plant issues. In doing so, the  procedure directs that inspectors annually review 3 to 6 issues out of  potentially thousands of issues that can arise and that are related to  various structures, systems, and components necessary for the safe  operation of the plant. This requires that inspectors judgmentally  sample 3 to 6 issues on which they will focus their inspection  resources. While we do not necessarily question inspector judgment  when sampling for these 3 to 6 issues, NRC inspectors stated that due  to the large number of issues that they can sample from, they try to  focus on those issues that they believe have the most relevance for  safety. Thus, if an issue is not yet perceived as being important to  safety, it is less likely to be selected for follow up. Further, even if an  issue were selected for follow up and this indicated that the licensee  did not properly identify and resolve underlying problems that  contributed to the issue, according to NRC officials, it is highly unlikely  that this one issue would rise to a high enough level of significance for  it to be noted under NRC’s Reactor Oversight Process. Additionally, the  procedure is dependant on the inspector being aware of, and having the  capability to, identify issues or trends in the area of safety culture.  According to NRC officials, inspectors are not trained in what to look  for when assessing licensee safety culture because they are, by and  large, nuclear engineers. While they may have an intuition that  something is wrong, they may not know how to assess it in terms of  safety culture.
Additional specific examples NRC cites for indirectly assessing a  selected number of safety culture aspects have the following  limitations:   NRC’s inspection procedure for assessing licensees’ employee  concerns program is not frequently used. According to NRC Region  III officials, approval to conduct such an inspection must be given by  the regional administrator and the justification for the inspection to  be performed has to be based on a very high level of evidence that a  problem exists. Because of this, these officials said that the  inspection procedure has only been implemented twice in Region III.
NRC’s allegation program provides a way for individuals working at  NRC-regulated plants and the public to provide safety and regulatory  concerns directly to NRC. It is a reactive program by nature because  it is dependent upon licensees’ employees feeling free and able to  come forward to NRC with information about potential licensee  misconduct. While NRC follows up on those plants that have a much  higher number of allegations than other plants to determine what  actions licensees are taking to address any trends in the nature of the  allegations, the number of allegations may not always provide an  indication of a poor safety culture, and in fact, may be the reverse.  For example, the number of allegations at Davis-Besse prior to the  discovery of the cavity in the reactor head in March 2002 was  relatively small. Between 1997 and 2001, NRC received 10 allegations  from individuals at the plant. In contrast, NRC received an average of  31 allegations per plant over the same 5-year period from individuals  at other plants.
NRC’s lessons-learned reviews, such as the one conducted for Davis- Besse, are generally conducted when an incident having potentially  serious safety consequences has already occurred.
With respect to NRC’s enforcement of employee protection  regulations, NRC, under its current enforcement policy, would  normally only take enforcement action when violations are of very  significant or significant regulatory concern. This regulatory concern  pertains to NRC’s primary responsibility for ensuring safety and  safeguards and protecting the environment. Examples of such  violations would include the failure of a system designed to prevent a  serious safety incident not working when it is needed, a licensed  operator being inebriated while at the control of a nuclear reactor,  and the failure to obtain prior NRC approval for a license change that  has implications for safety. If violations of employee protection  regulations do not pose very significant or significant safety,  safeguards, or environmental concerns, NRC may consider such  violations minor. In such cases, NRC would not normally document  such violations in inspection reports or records, and would not take  enforcement action.
NRC’s Reactor Oversight Process, instituted in April 2000, focuses on  seven specific “cornerstones” that support the safety of plant  operations to ensure reactor safety, radiation safety, and security.  These cornerstones are: (1) the occurrence of operations and events  that could lead to a possible accident if safety systems did not work,  (2) the ability of safety systems to function as intended, (3) the  integrity of the three safety barriers, (4) the effectiveness of  emergency preparedness, (5) the effectiveness of occupational  radiation safety, (6) the ability to protect the public from radioactive  releases, and (7) the ability to physically protect the plant. NRC’s  process also includes three elements that cut across these seven  cornerstones: (1) human performance, (2) a licensee’s safety- conscious work environment, and (3) problem identification and  resolution. NRC assumes that problems in any of these three  crosscutting areas will be evidenced in one or more of the seven  cornerstones in advance of any serious compromise in the safety of a  plant. However, as evidenced by the Davis-Besse incident, this  assumption has not proved to be true.
NRC also cites lessons-learned task force recommendations to improve  NRC’s ability to detect problems in licensee’s safety culture, as a means  to achieve our recommendation to directly assess licensee safety  culture. These lessons-learned task force recommendations include (1)  developing inspection guidance to assess the effect that a licensee’s  fuel outage shutdown schedule has on the scope of work conducted  during a shutdown; (2) revising inspection guidance to provide for  assessing the safety implications of long-standing, unresolved  problems; corrective actions being phased in over the course of several  years or refueling outages; and deferred plant modifications; (3)  revising the problem identification and resolution inspection approach  and guidance; and (4) reviewing the range of NRC’s inspections and  assessment processes and other NRC programs to determine whether  they are sufficient to identify and dispose of the types of problems  experienced at Davis-Besse. While we commend these  recommendations, we do not believe that revising such guidance will  necessarily alert NRC inspectors to early declines in licensee safety  culture before they result in negative safety outcomes. Further, because  of the nature of NRC’s process for determining the relative safety  significance of violations under NRC’s new Reactor Oversight Process,  we do not believe that any indications of such declines will result in a  cited violation.   6. We have revised the report to reflect that boron in the form of boric  acid crystals is dissolved in the cooling water. (See p. 13.) 7. On page 41 of the report, we recognize that NRC also relied on  information provided by FirstEnergy regarding the condition of the  vessel head. For example, in developing its risk estimate, NRC credited  FirstEnergy with a vessel head inspection conducted in 1996. However,  NRC decided that the information provided by FirstEnergy  documenting vessel head inspections in 1998 and 2000 was of such  poor quality that it did not credit FirstEnergy with having conducted  them. As a result, NRC’s risk estimate was higher than had these  inspections been given credit.  8. The statement made by the NRC regional branch chief was taken  directly from NRC’s Office of the Inspector General report on NRC’s  oversight of Davis-Besse during the April 2000 refueling outage.9. We agree that up until the Davis-Besse event, NRC had not concluded  that boric acid corrosion was a high priority issue. We clarified the text  of the report to reflect this comment. (See p. 25.)  10. We agree that plant operators in France decided to replace their vessel  heads in lieu of performing the extensive inspections instituted by the  French regulatory authority. The report has been revised to add these  details. (See p. 31.) 11. We agree that caked-on boron, in combination with leakage, could  accelerate corrosion rates under certain conditions. However, even  without caked-on boron, corrosion rates could be quite high.  Westinghouse’s 1987 report on the corrosive effects of boric acid  leakage concluded that the general corrosion rate of carbon steel can  be unacceptably high under conditions that can prevail when primary  coolant leaks onto surfaces and concentrates at the temperatures that  are found on reactor surfaces. In one series of tests that it performed,  boric acid solutions corroded carbon steel at a rate of about 0.4 inches  per month, or about 4.8 inches a year. This was irrespective of any  caked-on boron. In 1987, as a result of that report and extensive boric  acid corrosion found at two other nuclear reactors that year—Salem  unit 2 and San Onofre unit 2—NRC concluded that a review of existing  inspection programs may be warranted to ensure that adequate  monitoring procedures are in place to detect boric acid leakage and  corrosion before it can result in significant degradation of the reactor  coolant pressure boundary. However, NRC did not take any additional  action.  12. We agree that NRC has requirements and processes that provide a  number of circumstances in which a plant shutdown would or could be  required. We also recognize that there were no legal objections to the  draft enforcement order to shut down the plant, and that the basis for  not issuing the order was NRC’s belief that the plant did not pose an  unacceptable risk to public health and safety. The statement in our  report that NRC is referring to is discussing one of these  circumstances—the licensee’s failure to meet NRC’s technical  specification—and whether NRC believed that it had enough proof that  the technical specification was not being met. The statement is not  discussing the basis for NRC issuing an enforcement order. We revised  the report to clarify this point. (See p. 34.) 13. The basis for our statement that NRC staff concluded that the first  safety principle was probably not met was its November 29, 2001,  briefing to NRC’s Executive Director’s Office and its November 30,  2001, briefing to the NRC commissioners’ technical assistants. These  briefings, the basis for which are included in documented briefing  slides, took place shortly before NRC formally notified FirstEnergy on  December 4, 2001, that it would accept its compromise shutdown date. 14. We are referring to the same document that NRC is referring to—NRC’s  December 3, 2002, response to FirstEnergy (NRC’s ADAMS accession  number ML023300539). The response consists of a 2-page transmittal  letter and an 7.3-page enclosure. The 7.3-page enclosure is 3 pages of  background and 4.3 pages of the agency’s assessment. The assessment  includes statements that the safety principles were met but does not  provide an explanation of how NRC considered or weighed  deterministic and probabilistic information in concluding that each of  the safety factors were met. For example, NRC concluded that the  likelihood of a loss-of-coolant accident was acceptably small because  of the (1) staff’s preliminary technical assessment for control rod drive  mechanism cracking, (2) evidence of cracking found at other plants  similar to Davis-Besse, (3) analytical work performed by NRC’s  research staff in support of the effort, and (4) information provided by  FirstEnergy regarding past inspections at Davis-Besse. However, the  assessment does not explain how these four pieces of information  successfully demonstrated if and how each of the safety principles was  met. The assessment also states that NRC examined the five safety  principles, the fifth of which is the ability to monitor the effects of a  risk-informed decision. The assessment is silent on whether this  principle is met. However, in NRC’s November 29, 2001, briefing to  NRC’s Executive Director’s Office and in its November 30, 2001,  briefing to the NRC commissioners’ technical assistants, NRC  concluded that this safety principle was not met. As noted above, NRC  formally notified FirstEnergy on December 4, 2001, that it would accept  FirstEnergy’s February 16, 2002, shutdown date. 15. See comment 3. We do not agree that the report statements  mischaracterize the facts. Rather, we are concerned that NRC is  misusing basic quantitative mathematics. In addition, with regard to  NRC’s concept of an annual average change in the frequency of core  damage, NRC stated that the agency averaged the frequency of core  damage that would exist for the 7-week period of time (representing  the period of time between December 31, 2001, and February 16, 2002)  over the entire 1-year period, using the assumption that the frequency  of core damage would be zero for the remainder of the year—February  17, 2002, to December 31, 2002. According to our consultants, this  calculation artificially reduced NRC’s risk estimate to a level that is  acceptable under NRC’s guidance. By this logic, our consultants stated,  risks can always be reduced by spreading them over time; by assuming  another 10 years of plant operation (or even longer) NRC could find  that its calculated “risks” are completely negligible. They further stated  that NRC’s approach is akin to arguing that an individual, who drives  100 miles per hour 10 percent of the time, with his car otherwise  garaged, should not be cited because his time-average speed is only 10  miles per hour.
Further, our consultants concluded that the “annual-average” core  damage frequency approach was also clearly unnecessary, since one  need only convert a core damage frequency to a core damage  probability to handle part-year cases like the Davis-Besse case. Lastly,  we find no basis for the calculation in any NRC guidance. According to  our consultants, this new interpretation of NRC’s guidance is at best  unusual and certainly is inconsistent with NRC’s guidelines regarding  the use of an incremental core damage frequency. This interpretation  also reinforces our consultants’ impression that perhaps there was, in  November 2001 and possibly is still today, some confusion among the  NRC staff regarding basic quantitative metrics that should be  considered in evaluating regulatory and safety issues. As noted in  comment 3, we found no evidence of this calculation prior to February  2004.  16. While we agree that vessel head corrosion as extensive as later found at  Davis-Besse was not anticipated, NRC had known that leakage of the  primary coolant from a through-wall crack could cause boric acid  corrosion of the vessel head, as evidenced by the Westinghouse work  cited above. Regardless of information provided to NRC by individual  licensees, such as FirstEnergy, NRC’s model should account for known  risks, including the potential for corrosion.  17. We agree that NRC was aware of control rod drive mechanism nozzle  cracking at French nuclear power plants. NRC provided us additional  information consisting of a December 15, 1994, internal memo, in which  NRC concluded that primary coolant leakage from a through-wall crack  could cause boric acid corrosion of the vessel head. However, because  some analyses indicated that it would take at least 6 to 9 years before  any corrosion would challenge the structural integrity of the head, NRC  concluded that cracking was not a short-term safety issue. We revised  the report to include this additional information. (See p. 40.) 18. See comment 15. 19. We agree that while not directly relevant to the Davis-Besse situation,  NRC uses regulatory guide 1.177 to make decisions on whether certain  equipment can be inoperable while a nuclear reactor is operating,  which can pose very high instantaneous risks for very short periods of  time. However, we include the reference to this particular guidance in  the report because it was cited by an NRC official involved in the Davis- Besse decision-making process as another piece of guidance used in  judging whether the risk that Davis-Besse posed was acceptable.  20. While regulatory guide 1.174 comprises 25 pages of guidance on how to  use risk in making decisions on whether to allow license changes, it  does not lay out how NRC staff are to use quantitative estimates of risk  or probabilistic factors, or how robust these estimates must be in order  to be considered along with more deterministic factors. The regulatory  guide, which was first issued in mid-1998, had been in effect for only  about 1.5 years when NRC staff was tasked with making their decision  on Davis-Besse. According to the Deputy Executive Director of Nuclear  Reactor Programs at the time the decision was being made, the agency  was trying to bring the staff through the risk-informed decision-making  process because Davis-Besse was a learning tool. He further stated that  it was really the first time the agency had used the risk-informed  decision-making process on operational decisions as opposed to  programmatic decisions for licensing. At the time the decision was  made, and currently, NRC has no guidance or criteria for use in  assessing the quality of risk estimates or clear guidance or criteria for  how risk estimates are to be weighed against other risk factors.  21. The December 3, 2002, safety assessment or evaluation did state that  the estimated increase in core damage frequency was consistent with  NRC’s regulatory guidelines. However, as noted in comment 3, we  disagree with this conclusion. In addition, while we agree that NRC has  staff with risk assessment disciplines, we found no reference to these  staff in NRC’s safety evaluation. We also found no reference to NRC’s  statement that these staff gave more weight to deterministic factors in  arriving at the agency’s decision. While we endorse NRC’s  consideration of deterministic as well as probabilistic factors and the  use of a risk-informed decision-making process, we continue to  maintain that NRC needs clear guidance and criteria for the quality of  risk estimates, standards of evidence, and how to apply deterministic  as well as probabilistic factors in plant shutdown decisions. As the  agency continues to incorporate a risk-informed process into much of  its regulatory guidance and programs, such criteria will be increasingly  important when making shutdown as well as other types of decisions  regarding nuclear power plants. 22. The information that NRC provided us indicates that completion dates  for 2 of the 22 high priority recommendations have slipped. One, the  completion date for encouraging the American Society of Mechanical  Engineers to revise vessel head penetration nozzle inspection  requirements or, alternatively, for revising NRC’s regulations for vessel  head inspections has slipped from June 2004 to June 2006. Two, the  completion date for assessing NRC’s requirements that licensees have  procedures for responding to plant leakage alarms to determine if the  requirements are sufficient for identifying reactor coolant pressure  boundary leakage has slipped from March 2004 to March 2005. 23. We agree with this comment and have revised the report to reflect this  clarification. (See p. 49.) 24. Our estimate of at least an additional 200 hours of inspection per  reactor per year is based on:  NRC’s new requirement that its resident inspectors review all  licensee corrective action items on a daily basis (approximately 30  minutes per day). Given that reactors are intended to operate  continuously throughout the year, this results in about 3.5 hours per  week for reviewing corrective action items, or about 182 hours per  year. In addition, resident inspections are now required to determine,  on a semi-annual basis, whether such corrective action items reflect  any trends in licensee performance (16 to 24 hours per year).  The  total increase for these new requirements is about 198 to 206 hours  per reactor per year.
A new NRC requirement that its resident inspectors validate that  licensees comply with additional inspection commitments made in  response to NRC’s 2002 generic bulletin regarding reactor pressure  vessel head and vessel head penetration nozzles. This requirement  results in an additional 15 to 50 hours per reactor per fuel outage. 25. Our draft report included a discussion that NRC management’s failure  to recognize the scope or breadth of actions and resources necessary to  fully implement task force recommendations could adversely affect  how effective the actions may be. We made this statement based on  NRC’s initial response to the Office of the Inspector General’s October  2003 report on Davis-Besse. That report concluded that ineffective  communication within NRC’s Region III and between Region III and  NRC headquarters contributed to the Davis-Besse incident. NRC, in its  January 2004 response to the report, stated that among other things, it  had developed training on boric acid corrosion and revised its  inspection program to require semi-annual trend reviews. In February  2004, the Office of the Inspector General criticized NRC for limiting the  agency’s efforts in responding to its findings. Specifically, it stated that  NRC did not address underlying and generic communication failures  identified in the Office’s report. In response to the criticism, on April 19,  2004 (while our draft report was with NRC for review and comment),  NRC provided the Office of the Inspector General with additional  information to demonstrate that its actions to improve communication  within the agency were broader than indicated in the agency’s January  2004 response. Based on NRC’s April 19, 2004, response and the Office’s  agreement that NRC’s actions appropriately address its concerns about  communication within the agency, we deleted this discussion in the  report.  26. We recognize that the lessons-learned task force did not make a  recommendation for improving the agency’s decision-making process  because the task force coordinated with the Office of the Inspector  General regarding the scope of their respective review activities and  because the task force was primarily charged with determining why the  vessel head degradation was not prevented. (See p. 55.)  27. We agree that NRC’s December 3, 2002, documentation of its decision  was prepared in response to a finding by the Davis-Besse lessons-  learned task force. We revised our report to incorporate this fact. (See  p. 55.)  28. We agree that NRC’s lessons-learned task force conducted a  preliminary review of reports from previous lessons-learned task forces  and, as a result of that review, made a recommendation that the agency  perform a more detailed effectiveness review of the actions taken in  response to those reviews. We revised the report to reflect that NRC’s  detailed review is currently underway. (See p. 55.)
section_title: GAO Contacts and Staff Acknowledgments
subsections: section_title: GAO Contacts
section_title: Staff Acknowledgments
paragraphs: In addition, Heather L. Barker, David L. Brack, William F. Fenzel, Michael L.  Krafve, William J. Lanouette, Marcia Brouns McWreath, Judy K. Pagano,  Keith A. Rhodes, and Carol Hernstadt Shulman made key contributions to  this report.
section_title: Related GAO Products
paragraphs: Management Weaknesses Affect Nuclear Regulatory Commission Efforts  to Address Safety Issues Common to Nuclear Power Plants. GAO-RCED- 84-149.Washington, D.C.: September 19, 1984.
Probabilistic Risk Assessment: An Emerging Aid to Nuclear Power Plant  Safety Regulation. GAO-RCED-85-11. Washington, D.C.: June 19, 1985.
The Nuclear Regulatory Commission Should Report on Progress in  Implementing Lessons Learned from the Three Mile Island Accident.  GAO-RCED-85-72. Washington, D.C.: July 19, 1985.
Nuclear Regulation: Oversight of Quality Assurance at Nuclear Power  Plants Needs Improvement. GAO-RCED-86-41.Washington, D.C.: January  23, 1986.
Nuclear Regulation: Efforts to Ensure Nuclear Power Plant Safety Can Be  Strengthened. GAO-RCED-87-141. Washington, D.C.: August 13, 1987.
Nuclear Regulation: NRC’s Restart Actions Appear Reasonable—but  Criteria Needed. GAO-RCED-89-95.Washington, D.C.: May 4, 1989.
Nuclear Regulation: NRC’s Efforts to Ensure Effective Plant Maintenance  Are Incomplete. GAO-RCED-91-36. Washington, D.C.: December 17, 1990.
Nuclear Regulation: NRC’s Relationship with the Institute of Nuclear  Power Operations. GAO-RCED-91-122. Washington, D.C.: May 16, 1991.
Nuclear Regulation: Weaknesses in NRC’s Inspection Program at a South  Texas Nuclear Power Plant. GAO-RCED-96-10. Washington, D.C.: October  3, 1995.
Nuclear Regulation:  Preventing Problem Plants Requires More Effective  NRC Action. GAO-RCED-97-145. Washington, D.C.: May 30, 1997.
Nuclear Regulatory Commission: Preventing Problem Plants Requires  More Effective Action by NRC. GAO-T-RCED-98-252. Washington, D.C.:  July 30, 1998.
Nuclear Regulatory Commission: Strategy Needed to Develop a Risk- Informed Safety Approach. GAO-T-RCED-99-71. Washington, D.C.:  February 4, 1999.
Nuclear Regulation: Strategy Needed to Regulate Safety Using  Information on Risk. GAO-RCED-99-95. Washington, D.C.: March 19, 1999.
Nuclear Regulation: Regulatory and Cultural Changes Challenge NRC.  GAO/T-RCED-00-115. Washington, D.C.: March 9, 2000.
Major Management Challenges and Performance Risks at the Nuclear  Regulatory Commission. GAO-01-259. Washington, D.C.: January 2001.
Nuclear Regulation: Progress Made in Emergency Preparedness at  Indian Point 2, but Additional Improvements Needed. GAO-01-605.  Washington, D.C.: July 30, 2001.
Nuclear Regulation: Challenges Confronting NRC in a Changing  Regulatory Environment. GAO-01-707T. Washington, D.C.: May 8, 2001.
Nuclear Regulatory Commission: Status of Achieving Key Outcomes and  Addressing Major Management Challenges. GAO-01-760. Washington,  D.C.: June 29, 2001.
Managing for Results: Efforts to Strengthen the Link between Resources  and Results at the Nuclear Regulatory Commission. GAO-03-258.  Washington, D.C.: December 10, 2002.
Nuclear Regulatory Commission: Oversight of Security at Commercial  Nuclear Power Plants Needs to Be Strengthened. GAO-03-752. Washington,  D.C.:  September 4, 2003.
subsections: section_title: GAO’s Mission
paragraphs: The General Accounting Office, the audit, evaluation and investigative arm of  Congress, exists to support Congress in meeting its constitutional responsibilities  and to help improve the performance and accountability of the federal government  for the American people. GAO examines the use of public funds; evaluates federal  programs and policies; and provides analyses, recommendations, and other  assistance to help Congress make informed oversight, policy, and funding  decisions. GAO’s commitment to good government is reflected in its core values of  accountability, integrity, and reliability.
section_title: Obtaining Copies of GAO Reports and Testimony
paragraphs: The fastest and easiest way to obtain copies of GAO documents at no cost is  through the Internet. GAO’s Web site (www.gao.gov) contains abstracts and full- text files of current reports and testimony and an expanding archive of older  products. The Web site features a search engine to help you locate documents  using key words and phrases. You can print these documents in their entirety,  including charts and other graphics.
Each day, GAO issues a list of newly released reports, testimony, and  correspondence. GAO posts this list, known as “Today’s Reports,” on its Web site  daily. The list contains links to the full-text document files. To have GAO e-mail this  list to you every afternoon, go to www.gao.gov and select “Subscribe to   e-mail alerts” under the “Order GAO Products” heading.
subsections: section_title: Order by Mail or Phone
section_title: To Report Fraud, Waste, and Abuse in Federal Programs
section_title: Public Affairs