Nuclear Regulatory Commission: Preliminary Observations on Its Process to Oversee the Safe Operation of Nuclear Power Plants
Released: 2006-06-19T00:00:00

Letter

Background

NRC is an independent agency of over 3,200 employees established by the Energy Reorganization Act of 1974 to regulate civilian—that is, commercial, industrial, academic, and medical—use of nuclear materials. NRC is headed by a five-member Commission. The President appoints the Commission members, who are confirmed by the Senate, and designates one of them to serve as Chairman and official spokesperson. The Commission as a whole formulates policies and regulations governing nuclear reactor and materials safety, issues orders to licensees, and adjudicates legal matters brought before it.

NRC and the licensees of nuclear power plants share the responsibility for ensuring that commercial nuclear power reactors are operated safely. NRC is responsible for issuing regulations, licensing and inspecting plants, and requiring action, as necessary, to protect public health and safety. Plant licensees have the primary responsibility for safely operating their plants in accordance with their licenses and NRC regulations. NRC has the authority to take actions, up to and including shutting down a plant, if licensing conditions are not being met and the plant poses an undue risk to public health and safety.

Nuclear power plants have many physical structures, systems, and components, and licensees have numerous activities under way, 24-hours a day, to ensure that plants operate safely. NRC relies on, among other things, its on-site resident inspectors to assess plant conditions and the licensees’ quality assurance programs such as those required for maintenance and problem identification and resolution. With its current resources, NRC can inspect only a relatively small sample of the numerous activities going on during complex plant operations. According to NRC, its focus on the more safety significant activities is made possible by the fact that safety performance at plants has improved as a result of more than 25 years of operating experience.

Commercial nuclear power plants are designed according to a “defense in depth” philosophy revolving around redundant, diverse, and reliable safety systems. For example, two or more key components are put in place so that if one fails, there is another to back it up. Plants have numerous built- in sensors to monitor important indicators such as water temperature and pressure. Plants also have physical barriers to contain the radiation and provide emergency protection. For example, the nuclear fuel is contained in a ceramic pellet to lock in the radioactive byproducts and then the fuel pellets are sealed inside rods made of special material designed to contain fission products, and the fuel rods are placed in reactors housed in containment buildings made of several feet of concrete and steel.

Furthermore, the nuclear power industry formed an organization, the Institute of Nuclear Power Operations (INPO) with the mission to “promote the highest levels of safety and reliability-to promote excellence- in the operation of nuclear electric generating plants.” INPO provides a system of personnel training and qualification for all key positions at nuclear power plants and workers undergo both periodic training and assessment. INPO also conducts periodic evaluations of operating nuclear plants, focusing on plant safety and reliability, in the areas of operations, maintenance, engineering, radiological protection, chemistry, and training. Licensees make these evaluations available to the NRC for review, and the NRC staff uses the evaluations as a means to determine whether its oversight process has missed any performance issues.

NRC Uses Various Tools and Takes a Graded and Risk- Informed Approach to Ensuring the Safety of Nuclear Power Plants

NRC uses various tools to oversee the safe operation of nuclear power plants, generally consisting of physical plant inspections of equipment and records and objective indicators of plant performance. These tools are risk-informed in that they are focused on the issues considered most important to plant safety. Based on the results of the information it collects through these efforts, NRC takes a graded approach to its oversight, increasing the level of regulatory attention to plants based on the severity of identified performance issues. NRC bases its regulatory oversight process on the principle and requirement that plant licensees routinely identify and address performance issues without NRC’s direct involvement. An important aspect of NRC’s inspections is ensuring the effectiveness of licensee quality assurance programs. NRC assesses overall plant performance and communicates these results to licensees on a semi- annual basis.

During fiscal year 2005, NRC inspectors spent a total of 411,490 hours on plant inspection activities (an average of 77 hours per week at each plant). The majority of these inspection efforts were spent on baseline inspections, which all plants receive on an almost continuous basis. Baseline inspections, which are mostly conducted by the two to three NRC inspectors located at each nuclear power plant site, evaluate the safety performance of plant operations and review plant effectiveness at identifying and resolving its safety problems. There are more than 30 baseline inspection procedures, conducted at varying intervals, ranging from quarterly to triennially, and involving both physical observation of plant activities and reviews of plant reports and data. The inspection procedures are risk-informed to focus inspectors’ efforts on the most important areas of plant safety in four ways: 1) areas of inspection are included in the set of baseline procedures based on, in part, their risk importance, 2) risk information is used to help determine the frequency and scope of inspections, 3) the selection of activities to inspect within each procedure is informed with plant-specific risk information, and 4) the inspectors are trained in the use of risk information in planning their inspections.

For inspection findings found to be more than minor, NRC uses its significance determination process (SDP) to assign each finding one of four colors to reflect its risk significance. Green findings equate to very low risk significance, while white, yellow, and red colors represent increasing levels of risk, respectively. Throughout its application of the SDP, NRC incorporates information from the licensee, and the licensee has the opportunity to formally appeal the final determination that is made.

In addition to assigning each finding a color based on its risk significance, all findings are evaluated to determine if certain aspects of plant performance, referred to as cross-cutting issues, were a contributing cause to the performance problem. The cross-cutting issues are comprised of (1) problem identification and resolution, (2) human performance, and (3) safety consciousness in the work environment. To illustrate, in analyzing the failure of a valve to operate properly, NRC inspectors determined that the plant licensee had not followed the correct procedures when performing maintenance on the valve, and thus NRC concluded the finding was associated with the human performance cross-cutting area. If NRC determines that there are multiple findings during the 12-month assessment period with documented cross-cutting aspects, more than three findings with the same causal theme, and NRC has a concern about the licensee’s progress in addressing these areas, it may determine that the licensee has a “substantive” cross-cutting issue. Opening a substantive cross-cutting issue serves as a way for NRC to notify the plant licensee that problems have been identified in one of the areas and that NRC will focus its inspection efforts in the cross-cutting area of concern.

When NRC becomes aware of one or more performance problems at a plant that are assigned a risk color greater-than-green (white, yellow, or red), it conducts supplemental inspections. Supplemental inspections, which are performed by regional staff, expand the scope beyond baseline inspection procedures and are designed to focus on diagnosing the cause of the specific performance deficiency. NRC increases the scope of its supplemental inspection procedures based on the number of greater-than- green findings identified, the area where the performance problem was identified, and the risk color assigned. For example, if one white finding is identified, NRC conducts a follow-up inspection directed at assessing the licensee’s corrective actions to ensure they were sufficient in both correcting the specific problem identified and identifying and addressing the root and contributing causes to prevent recurrence of a similar problem. If multiple yellow findings or a single red finding is identified, NRC conducts a much more comprehensive inspection which includes obtaining information to determine whether continued operation of the plant is acceptable and whether additional regulatory actions are necessary to address declining plant performance. This type of more extensive inspection is usually conducted by a multi-disciplinary team of NRC inspectors and may take place over a period of several months. NRC inspectors assess the adequacy of the licensee’s programs and processes such as those for identifying, evaluating, and correcting performance issues and the overall root and contributing causes of identified performance deficiencies.

NRC conducts special inspections when specific events occur at plants that are of particular interest to NRC because of their potential safety significance. Special inspections are conducted to determine the cause of the event and assess the licensee’s response. For special inspections, a team of experts is formed and an inspection charter issued that describes the scope of the inspection efforts. At one plant we reviewed, for example, a special inspection was conducted to investigate the circumstances surrounding the discovery of leakage from a spent fuel storage pool. Among the objectives of this inspection were to assess the adequacy of the plant licensee’s determination of the source and cause of the leak, the risk significance of the leakage, and the proposed strategies to mitigate leakage that had already occurred and repair the problem to prevent further leakage.

In addition to its various inspections, NRC also collects plant performance information through a performance indicator program, which it maintains in cooperation with the nuclear power industry. On a quarterly basis, each plant submits data for 15 separate performance indicators. These objective numeric measures of plant operations are designed to measure plant performance related to safety in various aspects of plant operations. For example, one indicator measures the number of unplanned reactor shutdowns during the previous four quarters while another measures the capability of alert and notification system sirens, which notify residents living near the plant in the event of an accident. Working with the nuclear power industry, NRC established specific criteria for acceptable performance with thresholds set and assigned colors to reflect increasing risk according to established safety margins for each of the indicators. Green indicators reflect performance within the acceptable range while white, yellow, and red colors represent decreasing plant performance, respectively. NRC inspectors review and verify the data submitted for each performance indicator annually through the baseline inspection process. If questions arise about how to calculate a particular indicator or what the correct value should be, there is a formal feedback process in place to resolve the issue. When performance indicator thresholds are exceeded, NRC responds in a graded fashion by performing supplemental inspections that range in scope depending on the significance of the performance issue.

Under the ROP, NRC places each plant into a performance category on the agency’s action matrix, which corresponds to increasing levels of oversight based on the number and risk significance of inspection findings and performance indicators. The action matrix is NRC’s formal method of determining what additional oversight procedures—mostly supplemental inspections—are required. Greater-than-green inspection findings are included in the action matrix for a minimum of four quarters to allow sufficient time for additional findings to accumulate that may indicate more pervasive performance problems requiring additional NRC oversight. If a licensee fails to correct the performance problems within the initial four quarters, the finding may be held open and considered for additional oversight for more than the minimum four quarters.

At the end of each 6-month period, NRC issues an assessment letter to each plant licensee. This letter describes what level of oversight the plant will receive according to its placement in the action matrix performance categories, what actions NRC is expecting the plant licensee to take as a result of the performance issues identified, and any documented substantive cross-cutting issues. NRC also holds an annual public meeting at or near each plant site to review performance and address questions about the plant’s performance from members of the public and other interested stakeholders. Most inspection reports, assessment letters and other materials related to NRC’s oversight processes are made publicly available through a NRC website devoted to the ROP. The website also includes plant-specific quarterly summaries of green or greater inspection findings and all the performance indicators.

NRC Has Continually Identified Problems at Nuclear Power Plants but Few Have Been Considered Significant to Safe Operation of the Plants

The ROP has identified numerous performance deficiencies as inspection findings at nuclear power plants since it was first implemented, but most of these were considered to be of very low risk to safe plant operations. Similarly, there have been very few instances in which performance indicator data exceeded acceptable standards. As a result, few plants have been subjected to high levels of oversight.

Of more than 4,000 inspection findings identified between 2001 and 2005, 97 percent were green. While green findings are considered to be of “very low” safety significance, they represent a performance deficiency on the part of the plant licensee and thus are important to correct. Green findings consist of such things as finding that a worker failed to wear the proper radiation detector or finding that a licensee did not properly evaluate and approve the storage of flammable materials in the vicinity of safety-related equipment. NRC does not follow-up on the corrective action taken for every green finding identified; rather, it relies on the licensee to address and track their resolution through the plant’s corrective action program. NRC does, however, periodically follow-up on some of the actions taken by the licensee to address green findings through an inspection specifically designed to evaluate the effectiveness of the licensee’s corrective action program. NRC officials stated that green findings provide useful information on plant performance and NRC inspectors use the findings to identify performance trends in certain areas and help inform their selection of areas to focus on during future inspections. In contrast to the many green findings, NRC has identified 12 findings of the highest risk significance (7 yellow and 5 red), accounting for less than 1 percent of the findings since 2001. For example, one plant was issued a red finding— the highest risk significance—after a steam generator tube failed, causing an increased risk in the release of radioactive material.

Similar to the inspection findings, most performance indicator reports have shown the indicators to be within the acceptable levels of performance. Only 156, or less than one percent of over 30,000 indicator reports from 2001 to 2005, exceeded the acceptable performance threshold. Four of the 15 performance indicators have always been reported to be within acceptable performance levels. In addition, 46 plants have never had a performance indicator fall outside of the acceptable level and only three plants reported having a yellow indicator for one performance measure; no red indicators have ever been reported.

On the basis of its inspection findings and performance indicators, NRC has subjected more than three quarters of the 103 operating plants to at least some level of increased oversight (beyond the baseline inspections) for varying amounts of time. Most of these plants received the lowest level of increased oversight, consisting of a supplemental inspection, to follow- up on the identification of one or two white inspection findings or performance indicators. Five plants have received the highest level of plant oversight for which NRC allows plants to continue operations, due to the identification of multiple white or yellow findings and/or the identification of a red finding. One plant received this level of oversight because NRC determined that the licensee failed to address the common causes of two white findings and held them open for more than four quarters. One of these findings involved the recurrent failure of a service water pump because the licensee failed to take adequate corrective action after the first failure.

NRC inspectors at the plants we reviewed indicated that, when plant performance declines, it is often the result of ineffective corrective action programs, problems related to human performance, or complacent management, which often results in deficiencies in one or more of the cross-cutting areas. In assessing the results of the ROP data, we found that all plants subjected to NRC’s highest level of oversight also had a substantive cross-cutting issue open either prior to or during the time that it was subjected to increased oversight inspections.

Overall, NRC’s oversight process shows mostly consistent results from 2001 to 2005. For example, the total number of green findings at all plants ranged from 657 to 889 per year and the total number of other findings ranged from 10 to 30 per year with no strong trend (see fig. 1).

Only in the area of cross-cutting issues—or inspection findings for which one or more cross-cutting issues was associated—is an increasing trend evident (see fig. 2). According to NRC, the reason for this increase is due in part to the development of guidance on the identification and documentation of cross-cutting issues and its increased emphasis in more recent years.

According to NRC officials, the results of its oversight process at an industry or summary level serve as an indicator of industry performance, which to date indicates good safety performance. On an annual basis, NRC analyzes the overall results of its inspection and performance indicator programs and compares them with industry level performance metrics to ensure all metrics are consistent and takes action if adverse trends are identified. While NRC communicates the results of its oversight process on a plant-specific basis to plant managers, members of the public, and other government agencies through annual public meetings held at or near each site and an internet Web site, it does not publicly summarize the overall results of its oversight process, such as the total number and types of inspection findings and performance indicators falling outside of acceptable performance categories, on a regular basis.

NRC Continues to Make Improvements to its Reactor Oversight Process in Key Areas

NRC has taken a proactive approach to improving its reactor oversight process. It has several mechanisms in place to incorporate feedback from both external and internal stakeholders and is currently working on improvements in key areas of the process, including better focusing inspections on areas most important to safety, improving its timeliness in determining the risk significance of its inspection findings, and modifying the way that it measures some performance indicators. NRC is also working to address what we believe is a significant shortcoming in its oversight process by improving its ability to address plants’ safety culture, allowing it to better identify and address early indications of deteriorating safety at plants before performance problems develop.

According to NRC officials, the ROP was implemented with the understanding that it would be an evolving process and improvements would be made as lessons-learned were identified. Each fall NRC solicits feedback from external stakeholders, including industry organizations, public interest groups, and state and local officials, through a survey published in the Federal Register. NRC also conducts an internal survey of its site, regional, and headquarters program and management staff every other year to obtain their opinions on the effectiveness of the ROP. Additionally, NRC has in place a formal feedback mechanism whereby NRC staff can submit recommendations for improving various oversight components and NRC staff meet with industry officials on a monthly basis—in addition to various meetings, workshops, and conferences—to discuss oversight implementation issues and concerns. NRC staff also incorporates direction provided by the NRC Commissioners and recommendations from independent evaluations such as from GAO and the NRC Inspector General. The results of these efforts are pulled together in the form of an annual self-assessment report, which outlines the overall results of its outreach and the changes it intends to make in the year ahead.

According to NRC officials, the changes made to the ROP since its implementation in 2000—including those made in response to the Davis- Besse incident—have generally been refinements to the existing process rather than significant changes to how it conducts its oversight. In the case of Davis-Besse, NRC formed a task force to review the agency’s regulatory processes. The task force’s report, issued in September 2002, contained more than 50 recommendations, many associated with the ROP. Among the more significant ROP-related recommendations were those to enhance the performance indicator that monitors unidentified leakage to be more accurate, develop specific guidance to inspect boric acid control programs and vessel head penetration nozzles, modify the inspection program to provide for better follow-up of longstanding issues, and enhance the guidance for managing plants that are in an extended shutdown condition as a result of significant performance problems. NRC program officials told us that the task force’s most significant recommendations were in areas outside of the ROP, such as improving the agency’s operating experience program. According to NRC, it has implemented almost all of the task force’s recommendations.

Other modifications that NRC has recently made or is in the process of making include the following: NRC recently revised seven of its baseline inspection procedures to better focus the level and scope of its inspection efforts on those areas most important to safety. These revisions resulted from a detailed analysis in 2005 of its more than 30 baseline inspection procedures. The effort involved analyzing the number of findings resulting from each of its inspection procedures and the time spent directly observing plant activities or reviewing licensee paperwork, among other things.

NRC has efforts underway to improve what it refers to as its significance determination process (SDP). An audit by the NRC Inspector General, a review by a special task group formed by NRC, and feedback from other stakeholders have pointed to several significant weaknesses with the SDP. For example, internal and external stakeholders raised concerns about the amount of time, level of effort, and knowledge and resources required to determine the risk significance of some findings. Industry officials commented that because most inspection findings are green, one white finding at a plant can place it in the “bottom quartile” of plants from a performance perspective. Therefore, industry officials explained, licensees try to avoid this placement and will expend a great deal of effort and resources to provide additional data to NRC to ensure the risk level of a finding is appropriately characterized. This can add significant time to the process because different technical tools may be used that then must be incorporated with NRC’s tools and processes. The delay in assigning a color to a finding while the new information is being considered could also affect a plant’s placement on NRC’s action matrix, essentially delaying the increased oversight called for if the finding is determined to be greater- than-green. NRC developed a SDP Improvement Plan in order to address these and other concerns and track its progress in implementing key changes. For example, NRC introduced a new process aimed at improving timeliness by engaging decision-makers earlier in the process to more quickly identify the scope of the evaluation, the resources needed, and the schedule to complete the evaluation.

NRC is also taking actions to improve its performance indicators. These actions are partly to address concerns that the indicators have not contributed to the early identification of poorly performing plants to the degree originally envisioned as they are almost always within acceptable performance levels (green). There have been several cases where plants reported an acceptable performance indicator and performance problems were subsequently identified. For example, NRC inspectors at one plant noted that while performance indicator data related to its alert and notification system in place for emergency preparedness had always been reported green, the system had not always been verified to be functioning properly. On the other hand, industry officials believe that the high percentage of indicators that are green is indicative of plants’ good performance. Several plant managers told us that they closely monitor and manage to the acceptable performance thresholds established for each indicator, and will often take action to address performance issues well before the indicator crosses the acceptable performance threshold. Because NRC inspectors verify indicator data once a year, a potential disagreement over the data might not surface for up to a year after it is reported, and it may take even longer to resolve the disagreement with the licensee. Similar to delays with the SDP, a delay in assigning a color while the disagreement is resolved could affect a plant’s placement on NRC’s action matrix, and delay the increased oversight called for if the indicator is determined to be greater-than-green. NRC plans to work with the industry to review selected indicator definitions to make interpretation more concise and reduce the number of discrepancies. To date, NRC has focused significant effort on developing a key indicator to address known problems with the performance indicators measuring the unavailability of safety systems. NRC is also in the process of changing the definition for several other indicators, in addition to considering the feasibility of new indicators.

I would now like to discuss what we believe is one of NRC’s most important efforts to improve its oversight process by increasing its ability to identify and address deteriorating safety culture at plants. NRC and others have long recognized that safety culture and the attributes that make up safety culture, such as attention to detail, adherence to procedures, and effective corrective and preventative action, have a significant impact on a plant’s performance. Despite this recognition and several external groups’ recommendations to better incorporate safety culture aspects into its oversight process, it did not include specific measures to explicitly address plant safety culture when it developed the ROP in 2000. The 2002 Davis-Besse reactor vessel head incident highlighted that this was a significant weakness in the ROP. In investigating this event, we and others found that NRC did not have an effective means to identify and address early indications of deteriorating safety at plants before performance problems develop. Largely as a result of this event, in August 2004, the NRC Commission directed the NRC staff to enhance the ROP by more fully addressing safety culture.

In response to the Commission’s directive, the NRC staff formed a safety culture working group in early 2005. The working group incorporated the input of its stakeholders through a series of public meetings held in late 2005 and early 2006. In February 2006, NRC issued its proposed approach to better incorporate safety culture into the ROP. NRC officials expect to fully implement all changes effective in July 2006.

NRC’s proposed safety culture changes largely consist of two main approaches: first, clarifying the identification and treatment of cross- cutting issues in its inspection processes and second, developing a structured way for NRC to determine the need for a safety culture evaluation of plants. NRC has developed new definitions for each of its cross-cutting issues to more fully address safety culture aspects and additional guidance on their treatment once they are identified. For example, the problem identification and resolution cross-cutting area is now comprised of several components—corrective action program, self and independent assessments, and operating experience. NRC inspectors are to assess every inspection finding to determine if it is associated with one or more of the components that make up each of the cross-cutting areas. Inspectors then determine, on a semi-annual basis, if a substantive cross-cutting issue exists on the basis of the number and areas of cross- cutting components identified. If the same substantive cross-cutting issue is identified in three consecutive assessment periods, NRC may request that the licensee perform an assessment of its safety culture. The intent is to provide an opportunity to diagnose a potentially declining safety culture before significant safety performance problems occur.

Under its approach, NRC would expect the licensees of plants with more than one white color finding or one yellow finding to evaluate whether the performance issues were in any way caused by any safety culture components, and NRC might request the licensee to complete an independent assessment of its safety culture, if the licensee did not identify an important safety culture component. For plants where more significant or multiple findings have been identified, the NRC would not only independently evaluate the adequacy of the independent assessment of the licensee’s safety culture, but it might also conduct its own independent assessment of the licensee’s safety culture.

Some of NRC’s proposed actions regarding safety culture have been controversial, and not all stakeholders completely agree with the agency’s approach. For example, the nuclear power industry has expressed concern that the changes could introduce undue subjectivity to NRC’s oversight, given the difficulty in measuring these often intangible and complex concepts. Several of the nuclear power plant managers at the sites we reviewed said that it is not always clear why a cross-cutting issue was associated with finding, or what it will take to clear themselves once they’ve been identified as having a substantive cross-cutting issue open. Some industry officials worry that this initiative will further increase the number of findings that have cross-cutting elements associated with them and if all of the findings have them they will lose their value. Industry officials also warn that if it is not implemented carefully, it could divert resources away from other important safety issues. Other external stakeholders, on the other hand, suggest that this effort is an important step in improving NRC’s ability to identify performance issues at plants before they result in performance problems. Importantly, there will be additional tools in place for NRC to use when it identifies potential safety culture concerns. NRC officials view this effort as the beginning step in an incremental approach and acknowledge that continual monitoring, improvements, and oversight will be needed in order to better allow inspectors to detect deteriorating safety conditions at plants before events occur. NRC plans to evaluate stakeholder feedback and make changes based on lessons learned from its initial implementation of its changes as part of its annual self-assessment process for calendar year 2007.

Mr. Chairman, this completes my prepared statement, I would be happy to respond to any questions you or the other Members of the Subcommittee may have at this time.

GAO Contact and Staff Acknowledgments

For further information about this testimony, please contact me at (202) 512-3841 (or at wellsj@gao.gov). Raymond H. Smith, Jr. (Assistant Director), Alyssa M. Hundrup, Alison O’Neill, and Dave Stikkers made key contributions to this testimony.

This is a work of the U.S. government and is not subject to copyright protection in the United States. It may be reproduced and distributed in its entirety without further permission from GAO. However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately.