To determine why NRC did not identify and prevent the vessel head corrosion at the Davis-Besse nuclear power plant, we reviewed NRC’s lessons-learned task force report; FirstEnergy’s root cause analysis reports; NRC’s Office of the Inspector General reports on Davis-Besse; NRC’s augmented inspection team report; and NRC’s inspection reports and licensee assessments from 1998 through 2001. We also reviewed NRC generic communications issued on boric acid corrosion and on nozzle cracking. In addition, we interviewed NRC regional officials who were involved in overseeing Davis-Besse at the time corrosion was occurring, and when the reactor vessel head cavity was found, to learn what information they had, their knowledge of plant activities, and how they communicated information to headquarters. We also held discussions with the resident inspector who was at Davis-Besse at the time that corrosion was occurring to determine what information he had and how this information was communicated to the regional office. Further, we met with FirstEnergy and NRC officials at Davis-Besse and walked through the facility, including the containment building, to understand the nature and extent of NRC’s oversight of licensees. Additionally, we met with NRC headquarters officials to discuss the oversight process as it related to Davis-Besse, and the extent of their knowledge of conditions at Davis- Besse. We also met with county officials from Ottawa County, Ohio, to discuss their views on NRC and Davis-Besse plant safety. Further, we met with representatives from a variety of public interest groups to obtain their thoughts on NRC’s oversight and the agency’s proposed changes in the wake of Davis-Besse. To determine whether the process NRC used was credible when deciding to allow Davis-Besse to delay its shutdown, we evaluated NRC guidelines for reviewing licensee requests for temporary and permanent license changes, or amendments to their licenses. We also reviewed NRC guidance for making and documenting agency decisions, such as those on whether to accept licensee responses to generic communications, as well as NRC’s policies and procedures for taking enforcement action. We supplemented these reviews with an analysis of internal NRC correspondence related to the decision-making process, including e-mail correspondence, notes, and briefing slides. We also reviewed NRC’s request for additional information to FirstEnergy following the issuance of NRC’s generic bulletin for conducting reactor vessel head and nozzle inspections, as well as responses provided by FirstEnergy. In addition, we reviewed the draft shutdown order that NRC prepared before accepting FirstEnergy’s proposal to conduct its inspection in mid-February 2002. We reviewed these documents to determine whether the basis for NRC’s decision was clearly laid out, persuasive, and defensible to a party outside of NRC. As part of our analysis for determining whether NRC’s process was credible, we also obtained and reviewed NRC’s probabilistic risk assessment (PRA) calculations that it developed to guide its decision making. To conduct this analysis, we relied on the advice of consultants who, collectively, have an extensive background in nuclear engineering, PRA, and metallurgy. These consultants included Dr. John C. Lee, Professor and Chair, Nuclear Engineering and Radiological Sciences at the University of Michigan’s College of Engineering; Dr. Thomas H. Pigford, Professor Emeritus, at the University of California-Berkeley’s College of Engineering; and Dr. Gary S. Was, Associate Dean for Research in the College of Engineering, and Professor, Nuclear Engineering and Radiological Sciences at the University of Michigan’s College of Engineering. These consultants reviewed internal NRC correspondence relating to NRC’s PRA estimate, NRC’s calculations, and the basis for these calculations. These consultants also discussed the basis for NRC’s estimates with NRC officials and outside contractors who provided information to NRC as it developed its estimates. These consultants were selected on the basis of recommendations made by other nuclear engineering experts, their résumés, their collective experience, lack of a conflict of interest, and previous experience with assessing incidents at nuclear power plants such as Three Mile Island. To determine whether NRC is taking sufficient action in the wake of the Davis-Besse incident to prevent similar problems from developing in the future, we reviewed NRC’s lessons-learned task force recommendations, NRC’s analysis of the underlying causes for failing to identify the corrosion of the reactor vessel head, and NRC’s action plan developed in response to the task force recommendations. We also reviewed other NRC lessons- learned task force reports and their recommendations, our prior reports to identify issues related to those at Davis-Besse, and NRC’s Office of the Inspector General reports. We met with NRC officials responsible for implementing task force recommendations to obtain a clear understanding of the actions they were taking and the status of their efforts, and discussed NRC’s recommendations with NRC regional officials, on-site inspectors, and representatives from public interest groups. We conducted our review from November 2002 through May 2004 in accordance with generally accepted government auditing standards. NRC, as an independent federal agency, regulates the commercial uses of nuclear material to ensure adequate protection of public health and safety and the environment. NRC is headed by a five-member commission appointed by the President and confirmed by the Senate; one commissioner is appointed as chairman. NRC has about 2,900 employees who work in its headquarters office in Rockville, Maryland, and its four regional offices. NRC is financed primarily by fees that it imposes on commercial users of the nuclear material that it regulates. For fiscal year 2004, NRC’s appropriated budget of $626 million includes about $546 million financed by these fees. NRC regulates the nation’s commercial nuclear power plants by establishing requirements for plant owners and operators to follow in the design, construction, and operation of the nuclear reactors. NRC also licenses the reactors and individuals who operate them. Currently, 104 commercial nuclear reactors at 65 locations are licensed to operate. Many of these reactors have been in service since the early to mid-1970s. NRC initially licensed the reactors to operate for 40 years, but as these licenses approach their expiration dates, NRC has been granting 20-year extensions. To ensure the reactors are operated within their licensing requirements and technical specifications, NRC oversees them by both inspecting activities at the plants and assessing plant performance. NRC’s inspections consist of both routine, or baseline, inspections and supplemental inspections to assess particular licensee programs or issues that arise at a power plant. Inspections may also occur in response to a specific operational problem or event that has occurred at a plant. NRC maintains inspectors at every operating nuclear power plant in the United States and supplements the inspections conducted by these resident inspectors with inspections conducted by staff from its regional offices and from headquarters. Generally, inspectors verify that the plant’s operator qualifications and operations, engineering, maintenance, fuel handling, emergency preparedness, and environmental and radiation protection programs are adequate and comply with NRC safety requirements. NRC also oversees licensees by requesting information on their activities. NRC requires that information provided by licensees be complete and accurate and, according to NRC officials, this is an important aspect of the agency’s oversight. While we have added information to this report on the requirement that licensees provide NRC with complete and accurate information, we believe that NRC’s oversight program should not place undue reliance on this requirement. Nuclear power plants have many physical structures, systems, and components, and licensees have numerous activities under way, 24-hours a day, to ensure the plants operate safely. Programs to ensure quality assurance and safe operations include monitoring, maintenance, and inspection. To carry out these programs, licensees typically prepare several thousand reports per year describing conditions at the plant that need to be addressed to ensure continued safe operations. Because of the large number of activities and physical structures, systems, and components, NRC focuses its inspections on those activities and pieces of equipment or systems that are considered to be most significant for protecting public health and safety. NRC terms this a “risk-informed” approach for regulating nuclear power plants. Under this risk-informed approach, some systems and activities that NRC considers to have relatively less safety significance receive little NRC oversight. NRC has adopted a risk-informed approach because it believes it can focus its regulatory resources on those areas of the plant that the agency considers to be most important to safety. In addition, it was able to adopt this approach because, according to NRC, safety performance at nuclear power plants has improved as a result of more than 25 years of operating experience. To decide whether inspection findings are minor or major, NRC uses a process it began in 2000 to determine the extent to which violations compromise plant safety. Under this process, NRC characterizes the significance of its inspection findings by using a significance determination process to evaluate how an inspection finding impacts the margin of safety at a power plant. NRC has a range of enforcement actions it can take, depending on how much the safety of the plant had been compromised. For findings that have low safety significance, NRC can choose to take no formal enforcement action. In these instances, nonetheless, licensees remain responsible for addressing the identified problems. For more serious findings, NRC may take more formal action, such as issuing enforcement orders. Orders can be used to modify, suspend, or even revoke an operating license. NRC has issued one enforcement order to shut down an operating power plant in its 28-year history—in 1987, after NRC discovered control room personnel sleeping while on duty at the Peach Bottom nuclear power plant in Pennsylvania. In addition to enforcement orders, NRC can issue civil penalties of up to $120,000 per violation per day. Although NRC does not normally use civil penalties for violations associated with its Reactor Oversight Process, NRC will consider using them for issues that are willful, have the potential for impacting the agency’s regulatory process, or have actual public health and safety consequences. In fiscal year 2003, NRC proposed imposing civil penalties totaling $120,000 against two power plant licensees for the failure to provide complete and accurate information to the agency. NRC uses generic communications—such as bulletins, generic letters, and information notices—to provide information to and request information from the nuclear industry at large or specific groups of licensees. Bulletins and generic letters both usually request information from licensees regarding their compliance with specific regulations. They do not require licensees to take any specific actions, but do require licensees to provide responses to the information requests. In general, NRC uses bulletins, as opposed to generic letters, to address significant issues of greater urgency. NRC uses information notices to transmit significant recently identified information about safety, safeguards, or environmental issues. Licensees are expected to review the information to determine whether it is applicable to their operations and consider action to avoid similar problems. The Davis-Besse Nuclear Power Station, owned and operated by FirstEnergy Nuclear Operating Company, is an 882-megawatt electric pressurized water reactor located on Lake Erie in Oak Harbor, Ohio, about 20 miles east of Toledo. The power plant is under NRC’s Region III oversight, which is located in Lisle, Illinois. Like other pressurized water reactors, Davis-Besse is designed with multiple barriers between the radioactive heat-producing core and the outside environment—a design concept called “defense-in-depth.” Three main design components provide defense-in-depth. First, the reactor core is designed to retain radioactive material within the uranium oxide fuel, which is also covered with a layer of metal tubing. Second, a 6-inch-thick carbon steel vessel, lined with three- sixteenth-inch-thick stainless steel, surrounds the reactor core. Third, a steel containment structure, surrounded by a thick reinforced concrete building, encloses the reactor vessel and other systems and components important for maintaining safety. The containment structure and concrete building are intended to help not only prevent a release of radioactivity to the environment, but also shield the reactor from external hazards like tornados and missiles. The reactor vessel, in addition to housing the reactor core, contains highly pressurized water to cool the radioactive heat-producing core and transfer heat to a steam generator. Consequently, the vessel is referred to as the reactor pressure vessel. From the vessel, hot pressurized water is piped to the steam generator, where a separate supply of water is turned to steam to drive turbines that generate electricity. (See fig. 1.) The top portion of the Davis-Besse reactor pressure vessel consisted of an 18-foot-diameter vessel head that was bolted to the lower portion of the pressure vessel. At Davis-Besse, 69 vertical tubes penetrated and were welded to the vessel head. These tubes, called vessel head penetration nozzles, contained control rods that, when raised or lowered, were used to moderate or shut down the nuclear reaction in the reactor. Because control rods attach to control rod drive mechanisms, these types of nozzles are referred to as control rod drive mechanism nozzles. A platform, known as the service structure, sat above the reactor vessel head and the control rod drive mechanism nozzles. Inside the service structure and above the pressure vessel head was a layer of insulation to help contain the heat emanating from the reactor. The sides of the lower portion of the service structure were perforated with 18 5- by 7-inch rectangular openings, termed “mouse-holes,” that were used for vessel head inspections. In pressurized water reactors such as Davis-Besse, the reactor vessel, the vessel head, the nozzles, and other equipment used to ensure a continuous supply of pressurized water in the reactor vessel are collectively referred to as the reactor coolant pressure boundary. (See fig. 2.) To better control the nuclear reaction at nuclear power plants, boron in the form of boric acid crystals is dissolved in the cooling water contained within the reactor vessel and pressure boundary. Boric acid, under certain conditions, can cause corrosion of carbon steel. For about 3 decades, NRC and the nuclear power industry have known that boric acid had the potential to corrode reactor components. In general, if leakage occurs from the reactor coolant system, the escaping coolant will flash to steam and leave behind a concentration of impurities, including noncorrosive dry boric acid crystals. However, under certain conditions, the coolant will not flash to steam, and the boric acid will remain in a liquid state where it can cause extensive and rapid degradation of any carbon steel components it contacts. Such extensive degradation, in both domestic and foreign pressurized water reactor plants, has been well documented and led NRC to issue a generic letter in 1988 requesting information from pressurized water reactor licensees to ensure they had implemented programs to control boric acid corrosion. NRC was primarily concerned that boric acid corrosion could compromise the reactor coolant pressure boundary. This concern also led NRC to develop a procedure for inspecting licensees’ boric acid corrosion control programs and led the Electric Power Research Institute to issue guidance on boric acid corrosion control. NRC and the nuclear power industry have also known that nozzles made of alloy 600, used in several areas within nuclear power plants, were prone to cracking. Cracking had become an increasingly topical issue as the nuclear power plant fleet has aged. In 1986, operators at domestic and foreign pressurized water reactors began reporting leaks in various types of alloy 600 nozzles. In 1989, after leakage was detected at a domestic plant, NRC identified the cause of the leakage as cracking due to primary water stress corrosion. However, NRC concluded that the cracking was not an immediate safety concern for a few reasons. For example, the cracks had a low growth rate, were in a material with an extremely high flaw tolerance and, accordingly, were unlikely to spread. Also, the cracks were axial—that is, they ran the length of the nozzle rather than its circumference. NRC and the nuclear power industry were more concerned that circumferential cracks could result in broken or snapped nozzles. NRC did, however, issue a generic information notice in 1990 to inform the industry of alloy 600 cracking. Through the early 1990s, NRC, the Nuclear Energy Institute, and others continued to monitor alloy 600 cracking. In 1997, continued concern over cracking led NRC to issue a generic letter to pressurized water reactor licensees requesting information on their plans to monitor and manage cracking in vessel head penetration nozzles as well as to examine these nozzles. In the spring of 2001, licensee inspections led to the discovery of large circumferential cracking in several vessel head penetration nozzles at the Oconee Nuclear Station, in South Carolina. As a result of the discovery, the nuclear power industry and NRC categorized the 69 operating pressurized water reactors in the United States into different groups on the basis of (1) whether cracking had already been found and (2) how similar they were to Oconee in terms of the amount of time and the temperature at which the reactors had operated. The industry had developed information indicating that greater operating time and temperature were related to cracking. In total, five reactors at three locations were categorized as having already identified cracking, while seven reactors at five locations were categorized as being highly susceptible, given their similarity to Oconee. In August 2001, NRC issued a bulletin requesting that licensees of these reactors provide, within 30 days, information on their plans for conducting nozzle inspections before December 31, 2001. In lieu of this information, NRC stated that licensees could provide the agency with a reasoned basis for their conclusions that their reactor vessel pressure boundaries would continue to meet regulatory requirements for ensuring the structural integrity of the reactor coolant pressure boundary until the licensees conducted their inspections. NRC used a bulletin, as opposed to a generic letter, to request this information because cracking was considered a significant and urgent issue. All of the licensees of the highly susceptible reactors, except Davis-Besse and D.C. Cook reactor unit 2, provided NRC with plans for conducting inspections by December 31, 2001. In September 2001, FirstEnergy proposed conducting the requested inspection in April 2002, following its planned March 31, 2002, shutdown to replace fuel. In making this proposal, FirstEnergy contended that the reactor coolant pressure boundary at Davis-Besse met and would continue to meet regulatory requirements until its inspection. NRC and FirstEnergy exchanged information throughout the fall of 2001 regarding when FirstEnergy would conduct the inspection at Davis-Besse. NRC drafted an enforcement order that would have shut down Davis-Besse by December 2001 for the requested inspection in the event that FirstEnergy could not provide an adequate justification for safe operation beyond December 31, 2001, but ultimately compromised on a mid-February 2002 shutdown date. NRC, in deciding when FirstEnergy had to shut down Davis-Besse for the inspection, used a risk-informed decision-making process, including probabilistic risk assessment (PRA), to conclude that the risk that Davis- Besse would have an accident in the interim was relatively low. PRA is an analytical tool for estimating the probability that a potential accident might occur by examining how physical structures, systems, and components, along with employees, work together to ensure plant safety. Following the mid-February 2002 shutdown and in the course of its inspection in March 2002, FirstEnergy removed about 900 pounds of boric acid crystals and powder from the reactor vessel head, and subsequently discovered three cracked nozzles. The number of nozzles that had cracked, as well as the extent of cracking, was consistent with analyses that NRC staff had conducted prior to the shutdown. However, in examining the extent of cracking, FirstEnergy also discovered that corrosion had caused a pineapple-sized cavity in the reactor vessel head. (See figs. 3 and 4.) After this discovery, NRC directed FirstEnergy to, among other things, determine the root cause of the corrosion and obtain NRC approval before restarting Davis-Besse. NRC also dispatched an augmented inspection team consisting of NRC resident, regional, and headquarters officials. The inspection team concluded that the cavity was caused by boric acid corrosion from leaks through the control rod drive mechanism nozzles in the reactor vessel head. Primary water stress corrosion cracking of the nozzles caused through-wall cracks, which led to the leakage and eventual corrosion of the vessel head. NRC’s inspection team also concluded, among other things, that this corrosion had gone undetected for an extended period of time—at least 4 years—and significantly compromised the plant’s safety margins. As of May 2004, NRC had not yet completed other analyses, including how long Davis-Besse could have continued to operate with the corrosion it had experienced before a vessel head loss-of-coolant accident would have occurred. However, on May 4, 2004, NRC released preliminary results of its analysis of the vessel head and cracked cladding. Based on its analysis of conditions that existed on February 16, 2002, NRC estimated that Davis-Besse could have operated for another 2 to 13 months without the vessel head failing. However, the agency cautioned that this estimate was based on several uncertainties associated with the complex network of cracks on the cladding and the lack of knowledge about corrosion and cracking rates. NRC plans to use this data in preparing its preliminary analysis of how, and the likelihood that, the events at Davis-Besse could have led to core damage. NRC plans to complete this preliminary analysis in the summer of 2004. NRC also established a special oversight panel to (1) coordinate NRC’s efforts to assess FirstEnergy’s performance problems that resulted in the corrosion damage, (2) monitor Davis-Besse’s corrective actions, and (3) evaluate the plant’s readiness to resume operations. The panel, which is referred to as the Davis-Besse Oversight Panel, comprises officials from NRC’s Region III office in Lisle, Illinois; NRC headquarters; and the resident inspector office at Davis-Besse. In addition to overseeing FirstEnergy’s performance during the shutdown and through restart of Davis-Besse, the panel holds public meetings in Oak Harbor, Ohio, where the plant is located, and nearby Port Clinton, Ohio, to inform the public about its oversight of Davis-Besse’s restart efforts and its views on the adequacy of these efforts. The panel developed a checklist of issues that FirstEnergy had to resolve prior to restarting: (1) replacing the vessel head and ensuring the adequacy of other equipment important for safety, (2) correcting FirstEnergy programs that led to the corrosion, and (3) ensuring FirstEnergy’s readiness to restart. To restart the plant, FirstEnergy, among other things, removed the damaged reactor vessel head, purchased and installed a new head, replaced management at the plant, and took steps to improve key programs that should have prevented or detected the corrosion. As of March 2004, when NRC gave its approval for Davis-Besse to resume operations, the shutdown and preparations for restart had cost FirstEnergy approximately $640 million. In addition, NRC established a task force to evaluate its regulatory processes for assuring reactor pressure vessel head integrity and to identify and recommend areas for improvement that may be applicable to either NRC or the nuclear power industry. The task force’s report, which was issued in September 2002, contains 51 recommendations aimed primarily at improving NRC’s process for inspecting and overseeing licensees, communicating with industry, and identifying potential emerging technical issues that could impact plant safety. NRC developed an action plan to implement the report’s recommendations. NRC’s inspections and assessments of FirstEnergy’s operations should have but did not provide the agency with an accurate understanding of safety conditions at Davis-Besse, and thus NRC failed to identify or prevent the vessel head corrosion. Some NRC inspectors were aware of the indications of corrosion and leakage that could have alerted NRC to corrosion problems at the plant, but they did not have the knowledge to recognize the significance of this information. These problems were compounded by NRC’s assessments of FirstEnergy that led the agency to believe FirstEnergy was a good performer and could or would successfully resolve problems before they became significant safety issues. More broadly, NRC had a range of information that could have identified and prevented the incident at Davis-Besse but did not effectively integrate it into its oversight. Three separate, but related, NRC inspection program factors contributed to the development of the corrosion problems at Davis-Besse. First, resident inspectors did not know that the boric acid, rust, and unidentified leaking indicated that the reactor vessel head might be degrading. Second, these inspectors thought they understood the cause for the indications, based on licensee actions to address them. Therefore, resident inspectors, as well as regional and headquarters officials, did not fully communicate information on the indications or decide how to address them, and therefore took no action. Third, because the significance of the symptoms was not fully recognized, NRC did not direct sufficient inspector resources to aggressively investigate the indicators. NRC might have taken a different approach to the Davis-Besse situation if its program to identify emerging issues important to safety had pursued earlier concerns about boric acid corrosion and cracking and recognized how they could affect safety. NRC limits the amount of unidentified leakage from the reactor coolant system to no more than 1 gallon per minute. When this limit is exceeded, NRC requires that licensees identify and correct any sources of unidentified leakage. NRC also prohibits any leakage from the reactor coolant pressure boundary, of which the reactor vessel is a key component. Such leakage is prohibited because the pressure boundary is key to maintaining adequate coolant around the reactor fuel and thus protects public health and safety. Because of this, NRC’s technical specification states that licensees are to monitor reactor coolant leakage and shut down within 36 hours if leakage is found in the pressure boundary. In the years leading up to FirstEnergy’s March 2002 discovery that Davis- Besse’s vessel head had corroded extensively, NRC had several indications of potential leakage problems. First, NRC knew that the rates of leakage in the reactor coolant system had increased. Between 1995 and mid-1998, the unidentified leakage rate was about 0.06 gallon per minute or less, according to FirstEnergy’s monitoring. In mid-1998, the unidentified reactor coolant system leakage rate increased significantly—to as much as 0.8 gallon per minute. The elevated leakage rate was dominated by a known problem with a leaking relief valve on the reactor coolant system pressurizer tank, which masked the ongoing leak on the reactor pressure vessel head. However, the elevated leak rate should have raised concerns. To investigate this leakage, as well as to repair other equipment, FirstEnergy shut down the plant in mid-1999. It then identified a faulty relief valve that accounted for much of the leakage and repaired the valve. However, after restarting Davis-Besse, the unidentified leakage rate remained significantly higher than the historical average. Specifically, the unidentified leakage rate varied between 0.15 and 0.25 gallon per minute as opposed to the historical low of about 0.06 gallon or less. While NRC was aware that the rate was higher than before, NRC did not aggressively pursue the difference because the rate was well below NRC’s limit of no more than 1 gallon per minute, and thus the leak was not viewed as being a significant safety concern. Following the repair in 1999, NRC’s inspection report concluded that FirstEnergy’s efforts to reduce the leak rate during the outage were effective. Second, NRC was aware of increased levels of boric acid in the containment building—an indication that components containing reactor coolant were leaking. So much boric acid was being deposited that FirstEnergy officials had to repeatedly clean the containment air cooling system and radiation monitor filters. For example, before 1998, the containment air coolers seldom needed cleaning, but FirstEnergy had to clean them 28 times between late 1998 and May 2001. Between May 2001 and the mid-February 2002 shutdown, the containment air coolers were not cleaned, but at shutdown, FirstEnergy removed 15 5-gallon buckets of boric acid from the coolers—which is almost as much as was found on the reactor pressure vessel head. Rather than seeing these repeated cleanings as an indication of a problem that needed to be addressed, FirstEnergy made cleaning the coolers a routine maintenance activity, which NRC did not consider significant enough to require additional inspections. Furthermore, the radiation monitors, used to sample air from the containment building to detect radiation, typically required new filters every month. However, from 1998 to 2002, these monitors became clogged and inoperable hundreds of times because of boric acid, despite FirstEnergy’s efforts to fix the problem. Third, NRC was aware that FirstEnergy found rust in the containment building. The radiation monitor filters had accumulated dark colored iron oxide particles—a product of carbon steel corrosion—that were likely to have resulted from a very small steam leak. NRC inspection reports during the summer and fall of 1999 noted these indications and, while recognizing FirstEnergy’s aggressive attempts to identify the reasons for the phenomenon, concluded that they were a “distraction to plant personnel.” Several NRC inspection reports noted indications of leakage, boric acid, and rust before the agency adopted its new Reactor Oversight Process in 2000, but because the leakage was within NRC’s technical specifications and NRC officials thought that the licensee understood and would fix the problem, NRC did not aggressively pursue the indications. NRC’s new oversight process, implemented in the spring of 2000, limited the issues that could be discussed in NRC inspection reports to those that the agency considers to have more than minor significance. Because the leakage rates were below NRC’s limits, NRC’s inspection reports following the implementation of NRC’s new oversight process did not identify any discussion of these problems at the plant. Fourth, NRC was aware that FirstEnergy found rust on the Davis-Besse reactor vessel head, but it did not recognize its significance. For instance, during the 2000 refueling outage, a FirstEnergy official said he showed one of the two NRC resident inspectors a report that included photographs of rust-colored boric acid on the vessel head. (See fig. 5.) According to this resident inspector, he did not recall seeing the report or photographs but had no reason to doubt the FirstEnergy official’s statement. Regardless, he stated that had he seen the photographs, he would not have considered the condition to be significant at the time. He said that he did not know what the rust and boric acid might have indicated, and he assumed that FirstEnergy would take care of the vessel head before restarting. The second resident inspector said he reviewed all such reports at Davis-Besse but did not recall seeing the photographs or this particular report. He stated that it was quite possible that he had read the report, but because the licensee had a plan to clean the vessel head, he would have concluded that the licensee would correct the matter before plant restart. However, FirstEnergy did not accomplish this, even though work orders and subsequent licensee reports indicated that this was done. According to the NRC resident inspector and NRC regional officials, because of the large number of licensee activities that occur during a refueling outage, NRC inspectors do not have the time to investigate or follow up on every issue, particularly when the issue is not viewed as being important to safety. While the resident inspector informed regional officials about conditions at Davis-Besse, the regional office did not direct more inspection resources to the plant, or instruct the resident inspector to conduct more focused oversight. Some NRC regional officials were aware of indications of boric acid corrosion at the plant; others were not. According to the Office of the Inspector General’s investigation and 2003 report on Davis-Besse, the NRC regional branch chief—who supervised the staff responsible for overseeing FirstEnergy’s vessel head inspection activities during the 2000 refueling outage—said that he was unaware of the boric acid leakage issues at Davis-Besse, including its effects on the containment air coolers and the radiation monitor filters. Had his staff been requested to look at these specific issues, he might have directed inspection resources to that area. (App. I provides a time line showing significant events of interest.) NRC was not fully aware of the indications of a potential problem at Davis- Besse because NRC’s process for transmitting information from resident inspectors to regional offices and headquarters did not ensure that information was fully communicated, evaluated, or used. NRC staff communicated information about plant operations through inspection reports, licensee assessments, and daily conference calls that included resident, regional, and headquarters officials. According to regional officials, information that is not considered important is not routinely communicated to NRC management and technical specialists. For example, while the resident inspectors at Davis-Besse knew all of the indications of leakage, and there was some level of knowledge about these indications at the regional office level, the knowledge was not sufficiently widespread within NRC to alert a technical specialist who might have recognized their safety significance. According to NRC Region III officials, the region uses an informal means—memorandums sent to other regions and headquarters—of communicating information identified at plants that it considers to be important to safety. However, because the indications at Davis-Besse were not considered important, officials did not transmit this information to headquarters. Further, because the process is informal, these officials said they did not know whether—and if so, how—other NRC regions or headquarters used this information. Similarly, NRC officials said that NRC headquarters had no systematic process for communicating information, such as on boric acid corrosion, cracking, and small amounts of unidentified leakage, that had not yet risen to a relatively high level of concern within the agency, in a timely manner to its regions or on-site inspectors. For example, the regional inspector that oversaw FirstEnergy’s activities during the 2000 refueling outage, including the reactor vessel head inspection, stated that he was not aware of NRC’s generic bulletins and letters pertaining to boric acid and corrosion, even though NRC issues only a few of these bulletins and generic letters each year. In addition, according to NRC regional officials and the resident inspector at Davis-Besse, there is little time to review technical reports about emerging safety issues that NRC compiles because they are too lengthy and detailed. Ineffective communication, both within the region and between NRC headquarters and the region, was a primary factor cited by NRC’s Office of the Inspector General in its investigation of NRC’s oversight of Davis-Besse boric acid leakage and corrosion. For example, it found that ineffective communication resulted in senior regional management being largely unaware of repeated reports of boric acid leakage at Davis-Besse. It also found that headquarters, in communications with the regions, did not emphasize the issues discussed in its generic letters or bulletins on boric acid corrosion or cracking. NRC programs for informing its inspectors about issues that can reduce safety at nuclear power plants were not effective. As a result, NRC inspectors did not recognize the significance of the indications at Davis-Besse, fully communicate information about the indications, or spend additional effort to follow up on the indications. NRC also did not focus on the indications that the vessel head was corroding because of several staff constraints. Region III was directing resources to other plants that had experienced problems throughout the region, and these plants thus were the subject of increased regulatory oversight. For example, during the refueling outages in 1998 and 2000, while NRC oversaw FirstEnergy’s inspection of the reactor vessel head, the region lacked senior project engineers to devote to Davis-Besse. A vacancy existed for a senior project engineer responsible for Davis-Besse from June 1997 until June 1998, except for a one month period, and from September 1999 until May 2000, which resulted in fewer inspection hours at the facility than would have been normal. Other regional staff were also occupied with other plants in the region that were having difficulties, and NRC had unfilled vacancies for resident and regional inspector positions that strained resources for overseeing Davis-Besse. Even if the inspector positions had been filled, it is not certain that the inspectors would have aggressively followed up on any of the indications. According to our discussions with resident and regional inspectors and our on-site review of plant activities, because nuclear power plants are so large, with many physical structures, systems, and components, an inspector could miss problems that were potentially significant for safety. Licensees typically prepare several hundred reports per month for identifying and resolving problems, and NRC inspectors have only a limited amount of time to follow up on these licensee reports. Consequently, NRC selects and oversees the most safety significant structures, systems, and components. Under NRC’s Reactor Oversight Process, NRC assesses licensees’ performance using two distinct types of information: (1) NRC’s inspection results and (2) performance indicators reported by the licensees. These indicators, which reflect various aspects of a plant’s operations, include data on, for example, the failure or unavailability of certain important operating systems, the number of unplanned power changes, and the amount of reactor coolant system leakage. NRC evaluates both the inspection results and the performance indicators to arrive at licensee assessments, which it then color codes to reflect their safety significance. Green assessments indicate that performance is acceptable, and thus connote a very low risk significance and impact on safety. White, yellow, and red assessments each represent a greater degree of safety significance. After NRC adopted its Reactor Oversight Process in April 2000, FirstEnergy never received anything but green designations for its operations at Davis- Besse and was viewed by NRC as a good performer until the 2002 discovery of the vessel head corrosion. Similarly, prior to adopting the Reactor Oversight Process, NRC consistently assessed FirstEnergy as generally being a good performer. NRC officials stated, however, that significant issues were identified and addressed as warranted throughout this period, such as when the agency took enforcement action in response to FirstEnergy’s failure to properly repair important components in 1999—a failure caused by weaknesses in FirstEnergy’s boric acid corrosion control program. Key Davis-Besse programs for ensuring the quality and safe operation of the plant’s engineered structures, systems, and components include, for example, a corrective action program to ensure that problems at the plant that are relevant to safety are identified and resolved in a timely manner, an operating experience program to ensure that experiences or problems that occur are appropriately identified and analyzed to determine their significance and relevance to operations, and a plant modification program to ensure that modifications important to safety are implemented in a timely manner. As at other commercial nuclear power plants, NRC conducted routine, baseline inspections of Davis-Besse to determine the effectiveness of these programs. Reports documenting these inspections noted incidences of boric acid leakage, corrosion, and deposits. However, between February 1997 and March 2000, the regional office’s assessment of the licensee’s performance addressed leakage in the reactor coolant system only once and never noted the other indications. Furthermore, Davis-Besse was not the subject of intense scrutiny in regional plant assessment meetings because plants perceived as good performers—such as Davis-Besse— received substantially less attention. Between April 2000—when NRC’s revised assessment process took effect—until the corrosion was discovered in March 2002, none of NRC’s assessments of Davis-Besse’s performance noted leakage or other indications of corrosion at the plant. As a result, NRC may have missed opportunities to identify weaknesses in the Davis-Besse programs intended to detect or prevent the corrosion. After the corrosion was discovered, NRC analyzed the problems that led to the corrosion on the reactor vessel head and concluded that FirstEnergy’s programs for overseeing safety at Davis-Besse were weak, as seen in the following examples: Davis-Besse’s corrective action program did not result in timely or effective actions to prevent indications of leakage from reoccurring in the reactor coolant system. FirstEnergy officials did not always enter equipment problems into the corrective action program because individuals who had identified the problem were often responsible for resolving it. For over a decade, FirstEnergy had delayed plant modifications to its service structure platform, primarily because of cost. These modifications would have improved its ability to inspect the reactor vessel head nozzles. As a result, FirstEnergy could conduct only limited visual inspections and cleaning of the reactor pressure vessel head through the small “mouse-holes” that perforated the service structure. NRC was also unaware of the extent to which various aspects of FirstEnergy’s safety culture had degraded—that is, FirstEnergy’s organization and performance related to ensuring safety at Davis-Besse. This degradation had allowed the incident to occur with no forewarning because NRC’s inspections and performance indicators do not directly assess safety culture. Safety culture is a group of characteristics and attitudes within an organization that establish, as an overriding priority, that issues affecting nuclear plant safety receive the attention their significance warrants. Following FirstEnergy’s March 2002 discovery, NRC found numerous indications that FirstEnergy emphasized production over plant safety. First, Davis-Besse routinely restarted the plant following an outage, even though reactor pressure vessel valves and control rod drive mechanisms leaked. Second, staff was unable to remove all of the boric acid deposits from the reactor pressure vessel head because FirstEnergy’s schedule to restart the plant dictated the amount of work that could be performed. Third, FirstEnergy management was willing to accept degraded equipment, which indicated a lack of commitment to resolve issues that could potentially compromise safety. Fourth, Davis-Besse’s program that was intended to ensure that employees feel free to raise safety concerns without fear of retaliation had several weaknesses. For example, in one instance, a worker assigned to repair the containment air conditioner was not provided a respirator in spite of his concerns that he would inhale boric acid residue. According to NRC’s lessons-learned task force report, NRC was not aware of weaknesses in this program because its inspections did not adequately assess it. Given that FirstEnergy concluded that one of the causes for the Davis- Besse incident was human performance and management failures, the panel overseeing FirstEnergy’s efforts to restart Davis-Besse requested that FirstEnergy assess its safety culture before allowing the plant to restart. To oversee FirstEnergy’s efforts to improve its safety culture, NRC (1) reviewed whether FirstEnergy had adequately identified all of the root causes for management and human performance failures at Davis-Besse, (2) assessed whether FirstEnergy had identified and implemented appropriate corrective actions to resolve these failures, and (3) assessed whether FirstEnergy’s corrective actions were effective. As late as February 2004, NRC had concerns about whether FirstEnergy’s actions would be adequate in the long term. As a result, the Davis-Besse safety culture was one of the issues contributing to the delay in restarting the plant. In March 2004, NRC’s panel concluded that FirstEnergy’s efforts to improve its safety culture were sufficient to allow the plant to restart. In doing so, however, NRC officials stated that one of the conditions the panel imposed was for FirstEnergy to conduct an independent assessment of the safety culture at Davis-Besse annually over the course of the next 5 years. NRC has been aware of boric acid corrosion and its potential to affect safety since at least 1979. It issued several notices to the nuclear power industry about boric acid corrosion and, specifically, the potential for it to degrade the reactor coolant pressure boundary. In 1987, two licensees found significant corrosion on their reactor pressure vessel heads, which heightened NRC’s concern. A subsequent industry study concluded that concentrated solutions of boric acid could result in unacceptably high corrosion rates—up to 4 inches per year—when primary coolant leaks onto surfaces and concentrates at temperatures found on the surface of the reactor vessel. After considering this information and several more instances of boric acid corrosion at plants, NRC issued a generic letter in 1988 requesting licensees to implement boric acid corrosion control programs. In 1990, NRC visited Davis-Besse to assess the adequacy of the plant’s boric acid corrosion control program. At that time, NRC concluded that the program was acceptable. However, in 1999, NRC became aware that FirstEnergy’s boric acid corrosion control program was inadequate because boric acid had corroded several bolts on a valve, and NRC issued a violation. As a result of the violation, FirstEnergy agreed to review its boric acid corrosion procedures and enhance its program. NRC inspectors evaluated FirstEnergy’s completed and planned actions to improve the boric acid corrosion control program and found them to be adequate. According to NRC officials, they never inspected the remaining actions— assuming that the planned actions had been implemented effectively. In 2000, NRC adopted its new Reactor Oversight Process and discontinued its inspection procedure for plants’ corrosion control programs because these inspections had rarely been conducted due to higher priorities. Thus, NRC had no reliable or routine way to ensure that the nuclear power industry fully implemented boric acid corrosion control programs. NRC also did not routinely review operating experiences at reactors, both in the United States and abroad, to keep abreast of boric acid developments and determine the need to emphasize this problem. Indeed, NRC did not fully understand the circumstances in which boric acid would result in corrosion, rather than flash to steam. Similarly, NRC did not know the rate at which carbon steel would corrode under different conditions. This lack of knowledge may be linked to shortcomings in its program to review operating experiences at reactors, which could have been exacerbated by the 1999 elimination of the office specifically responsible for reviewing operating experiences. This office was responsible for, among other things, (1) coordinating operational data collection, (2) systematically analyzing and evaluating operational experience, (3) providing feedback on operational experience to improve safety, (4) assessing the effectiveness of the agencywide program, and (5) acting as a focal point for interaction with outside organizations on issues pertaining to operational safety data analysis and evaluation. According to NRC officials who had overseen Davis-Besse at the time of the incident, they would not have suspected the reactor vessel head or cracked head penetration nozzles as the source of the filter clogging and unidentified leakage because they had not been informed that these could be potential problems. According to these officials, the vessel head was “not on the radar screen.” With regard to nozzle cracking, NRC, for more than two decades, was aware of the potential for nozzles and other components made of alloy 600 to crack. While cracks were found at nuclear power plants, NRC considered their safety significance to be low because the cracks were not developing rapidly. In contrast, other countries considered the safety significance of such cracks to be much higher. For example, concern over alloy 600 cracking led France, as a preventive measure, to institute requirements for an extensive nondestructive examination inspection program for vessel head penetration nozzles, including the removal of insulation, during every fuel outage. When any indications of cracking were observed, even more frequent inspections were required, which, because of economic considerations, resulted in the replacement of vessel heads when indications were found. The effort to replace the vessel heads is still under way. Japan replaced those vessel heads whose nozzles it considered most susceptible to cracking, even though no cracks had yet been found. Both France and Sweden also installed enhanced leakage monitoring systems to detect leaks early. However, according to NRC, such systems cannot detect the small amounts of leakage that may be typical from cracked nozzles. NRC recognized that an integrated, long-term program, including periodic inspections and monitoring of vessel heads to check for nozzle cracking, was necessary. In 1997, it issued a generic letter that summarized NRC’s efforts to address cracking of control rod drive mechanism nozzles and requested information on licensees’ plans to inspect nozzles at their reactors. More specifically, this letter asked licensees to provide NRC with descriptions of their inspections of these nozzles and any plans for enhanced inspections to detect cracks. At that time, NRC was planning to review this information to determine if enhanced licensee inspections were warranted. Based on its review of this information, NRC concluded that the current inspection program was sufficient. As a result, between 1998 and 2001, NRC did not issue or solicit additional information on nozzle cracking or assess its requirements for inspecting reactor vessels to determine whether they were sufficient to detect cracks. At Davis-Besse, NRC also did not determine if FirstEnergy had plans or was implementing any plans for enhanced nozzle inspections, as noted in the 1997 generic letter. NRC took no further action until the cracks were found in 2001 at the Oconee plant, in South Carolina. NRC attributed its lack of focus on nozzle cracking, in part, to the agency’s inability to effectively review, assess, and follow up on industry operating experience events. Furthermore, as with boric acid corrosion, NRC did not obtain or analyze any new data about cracking that would have supported making changes in either its regulations or inspections to better identify or prevent corrosion on the vessel head at Davis-Besse. NRC’s technical specifications regarding allowable leakage rates also contributed to the corrosion at Davis-Besse because the amount of leakage that can cause extensive corrosion can be significantly less than the level that NRC’s specifications allow. According to NRC officials, NRC’s requirements, established in 1973, were based on the best available technology at that time. The task of measuring identified and unidentified leakage from the reactor coolant system is not precise. It requires licensees to estimate the amount of coolant that the reactor is supposed to contain and identify any difference in coolant levels. They then have to account for the estimated difference in the actual amount of coolant to arrive at a leakage rate; to do this, they identify all sources and amounts of leakage by, among other things, measuring the amount of water contained in various sump collection systems. If these sources do not account for the difference, licensees know they have an unidentified source of leakage. This estimate can vary significantly from day to day between negative and positive numbers. According to analyses that FirstEnergy conducted after it identified the corrosion in March 2002, the leakage rates from the nozzle cracks were significantly below NRC’s reactor coolant system unidentified leakage rate of 1 gallon per minute. Specifically, the leakage from the nozzle around which the vessel head corrosion occurred was predicted to be 0.025 gallon per minute. If such small leakage can result in such extensive corrosion, identifying if and where such leakage occurs is important. NRC staff recognized as early as 1993 it would be prudent for the nuclear power industry to consider implementing an enhanced method for detecting small leaks during plant operation, but NRC did not require this action, and the industry has not taken steps to do so. Furthermore, NRC has not consistently enforced its requirement for reactor coolant pressure boundary leakage. As a result, the NRC Davis-Besse task force concluded that inconsistent enforcement may have reinforced a belief that alloy 600 nozzle leakage was not actually or potentially a safety significant issue. Although FirstEnergy operated Davis-Besse without incident until shutting it down in February 2002, certain aspects of NRC’s deliberations allowing the delayed shutdown raise questions about the credibility of the agency’s decision making, if not about the Davis-Besse decision itself. NRC does not have specific guidance for deciding on plant shutdowns. Instead, agency officials turned to guidance developed for a different purpose—reviewing requests to amend license operating conditions—and even then did not always adhere to this guidance. In addition, NRC did not document its decision-making process, as called for by its guidance, and its letter to FirstEnergy to lay out the basis for the decision—sent a year after the decision—did not fully explain the decision. NRC’s lack of guidance, coupled with the lack of documentation, precludes us from independently judging whether NRC’s decision was reasonable. Finally, some NRC officials stated that the shutdown decision was based, in part, on the agency’s probabilistic risk assessment (PRA) calculations of the risk that Davis-Besse would pose if it delayed its shutdown and inspection. However, as noted by our consultants, the calculations were flawed, and NRC’s decision makers did not always follow the agency’s guidance for developing and using such calculations. NRC believed that Davis-Besse could have posed a potential safety risk because it was, in all likelihood, failing to comply with NRC’s technical specification that no leakage occur in the reactor coolant pressure boundary. Its belief was based on the following indicators of probable leakage: All six of the other reactors manufactured by the same company as Davis-Besse’s reactor had cracked nozzles and identified leakage. Three of these six reactors had identified circumferential cracking. FirstEnergy had not performed a recent visual examination of all of its nozzles. Furthermore, a FirstEnergy manager agreed that cracks and leakage were likely. NRC has the authority to shut down a plant when it is clear that the plant is in violation of important safety requirements, and it is clear that the plant poses a risk to public health and safety. Thus, if a licensee is not complying with technical specifications, such as those for no allowable reactor vessel pressure boundary leakage, NRC can order a plant to shut down. However, NRC decided that it could not require Davis-Besse to shut down on the basis of other plants’ cracked nozzles and identified leakage or the manager’s acknowledgement of a probable leak. Instead, it believed it needed more direct, or absolute, proof of a leak to order a shutdown. This standard of proof has been questioned. According to the Union of Concerned Scientists, for example, if NRC needed irrefutable proof in every case of suspected problems, the agency would probably never issue a shutdown order. In effect, in this case NRC created a Catch-22: It needed irrefutable proof to order a shutdown but could not get this proof without shutting down the plant and requiring that the reactor be inspected. Despite NRC’s responsibility for ensuring that the public is adequately protected from accidents at commercial nuclear power plants, NRC does not have specific guidance for shutting down a plant when the plant may pose a risk to public health and safety, even though it may be complying with NRC requirements. It also has no specific guidance or standards for quality of evidence needed to determine that a plant may pose an undue risk. Lacking direct or absolute proof of leakage at Davis-Besse, NRC instead drafted a shutdown order on the basis that a potentially hazardous condition may have existed at the plant. NRC had no guidance for developing such a shutdown order, and therefore, it used its guidance for reviewing license amendment requests. NRC officials recognized that this guidance was not specifically designed to determine whether NRC should shut down a power plant such as Davis-Besse. However, NRC officials stated that this guidance was the best available for deciding on a shutdown because, although the review was not to amend a license, the factors that NRC needed to consider in making the decision and that were contained in the guidance were applicable to the Davis-Besse situation. To use its guidance for reviewing license amendment requests, NRC first determined that the situation at Davis-Besse posed a special circumstance because new information revealed a substantially greater potential for a known hazard to occur, even if Davis-Besse was in compliance with the technical specification for leakage from the reactor coolant pressure boundary. The special circumstance stemmed from NRC’s determination that requirements for conducting vessel head inspections were not sufficient to detect nozzle cracking and, thus, small leaks. According to NRC officials, this determination allowed NRC to use its guidance for reviewing license amendment requests when deciding whether to order a shutdown. Under NRC’s license amendment guidance, NRC considers how the license change affects risk, but not how it has previously assessed licensee performance, such as whether the licensee was viewed as a good performer. With regard to the Davis-Besse decision, the guidance directed NRC to determine whether the plant would comply with five NRC safety principles if it operated beyond December 2001 without inspecting the reactor vessel head. As applied to Davis-Besse, these principles were whether the plant would (1) continue to meet requirements for vessel head inspections, (2) maintain sufficient defense-in-depth, (3) maintain sufficient safety margins, (4) have little increase in the likelihood of a core damage accident, and (5) monitor the vessel head and nozzles. The guidance, however, does not specify how to apply these safety principles, how NRC can demonstrate it has followed the principles and ensured they are met, or whether any one principle takes precedence over the others. The guidance also does not indicate what actions NRC or licensees should take if some or all of the principles are not met. In mid-September 2001, NRC staff concluded that Davis-Besse complied with the first safety principle but did not meet the remaining four. According to the staff, Davis-Besse did not meet three safety principles because the requirements for vessel head inspections were not adequate. Specifically, the requirements do not require the inspector to remove the insulation above the vessel head, and thus allow all of the nozzles to be visually inspected. NRC therefore could not ensure that FirstEnergy was maintaining defense-in-depth and adequate safety margins or sufficiently monitoring the vessel head and nozzles. The staff believed that Davis-Besse did not meet the fourth safety principle because the risk estimate of core damage approached an unacceptable level and the estimate itself was highly uncertain. Between early October and the end of November 2001, NRC requested and received additional information from FirstEnergy regarding its risk estimate of core damage—its PRA estimate—and met with the company to determine the basis for the estimate. NRC was also developing its own risk estimate, although its numbers kept changing. At some point during this time, NRC staff also concluded that the first safety principle was probably not being met, although the basis for this conclusion is not known. At the end of November 2001, NRC contacted FirstEnergy and informed it that a shutdown order had been forwarded to the NRC commissioners and asked if FirstEnergy could take any actions that would persuade NRC to not issue the shutdown order. The following day, FirstEnergy proposed measures to mitigate the potential for and consequences of an accident. These measures included, among other things, lowering the operating temperature from 605 degrees Fahrenheit to 598 degrees Fahrenheit to reduce the driving force for stress corrosion cracking on the nozzles, identifying a specific operator to initiate emergency cooling in response to an accident, and moving the scheduled refueling outage up from March 31, 2002, to no later than February 16, 2002. NRC staff discussed these measures, and NRC management asked the staff if they were concerned about extending Davis-Besse’s operations until mid-February 2002. While some of the staff were concerned about continued operations, none indicated to NRC management that cracking in control rod drive mechanism nozzles was likely extensive enough to cause a nozzle to eject from the vessel head, thus making it unsafe to operate. NRC formally accepted FirstEnergy’s compromise proposal within several days, thus abandoning its shutdown order. We could not fully assess NRC’s basis for accepting FirstEnergy’s proposal. NRC did not document its deliberations, even though its guidance requires that it do so. This documentation is to include the data, methods, and assessment criteria used; the basis for the decisions made; and essential correspondence sufficient to document the persons, places, and matters dealt with by NRC. Specifically, the guidance requires that the documentation contain sufficient detail to make possible a “proper scrutiny” of NRC decisions by authorized outside agencies and provide evidence of how basic decisions were formed, including oral decisions. NRC’s guidance also states that NRC should document all important staff meetings. In reviewing NRC’s documentation on the Davis-Besse decision, we found no evidence of an in-depth or formal analysis of how Davis-Besse’s proposed measures would affect the plant’s ability to satisfy the five safety principles. Thus, it is unclear whether the safety principles contained in the guidance were met by the measures that FirstEnergy proposed. However, several NRC officials stated that FirstEnergy’s proposed measures had no impact on plant operations or safety. For example, according to one NRC official, FirstEnergy’s proposal to reduce the operating temperature would have had little impact on safety because the small drop in operating temperature over a 7-week period would have had little effect on the growth rate of any cracks in a nozzle. As such, this official considered the measures as “window dressing.” A proposed measure that NRC staff did consider as having a significant impact on the risk was for FirstEnergy to dedicate an operator for manually turning on safety equipment in the event that a nozzle was ejected. Subsequent to approving the delayed shutdown, NRC learned that FirstEnergy had not, in fact, planned to dedicate an operator for this task—rather, FirstEnergy planned to have an operator do this task in addition to other regularly assigned duties. According to an NRC official, once NRC decided not to issue a shutdown order for December 2001, NRC staff needed to discuss how NRC’s assessment of whether the five safety principles had been met had changed in the course of the staff’s deliberations. However, there was no evidence in the agency’s records to support that this discussion was held, and other key meetings, such as the one in which the agency made its decision to allow Davis-Besse to operate past December 31, 2001, were not documented. Without documentation, it is not clear what factors influenced NRC’s decision. For example, according to the NRC Office of the Inspector General’s December 2002 report that examined the Davis-Besse incident, NRC’s decision was driven in large part by a desire to lessen the financial impact on FirstEnergy that would result from an early shutdown. While NRC disputed this finding, we found no evidence in the agency’s records to support or refute its position. In December 2001, when NRC informed FirstEnergy that it accepted the company’s proposed measures and the February 16, 2002, shutdown date, it also said that the company would receive NRC’s assessment in the near future. However, NRC did not provide the assessment until a full year later—in December 2002. In addition, the December 2002 assessment, which includes a four-page evaluation, does not fully explain how the safety principles were used or met—other than by stating that if the likelihood of nozzle failure were judged to be small, then adequate protection would be ensured. Even though NRC’s regulations regarding the reactor coolant pressure boundary dictate that the reactor have an extremely low probability of failing, NRC stated it did not believe that Davis-Besse needed to demonstrate strict conformance with this regulation. As evidence of the small likelihood of failure, NRC cited the small size of cracks found at other power plants, as well as its preliminary assessment of nozzle cracking, which projected crack growth rates. NRC concluded that 7 weeks of additional operation would not result in an appreciable increase in the size of the cracks. While NRC included its calculated estimates of the risk that Davis-Besse would pose, it did not detail how it calculated its estimates. In moving forward with its more risk-informed regulatory approach, NRC has established a policy to increase the use of PRA methods as a means to promote regulatory stability and efficiency. Using PRA methods, NRC and the nuclear power industry can estimate the likelihood that different accident scenarios at nuclear power plants will result in reactor core damage and a release of radioactive materials. For example, one of these accident scenarios begins with a “medium break” loss-of-coolant accident in which the reactor coolant system is breached and a midsize—about 2- to 4-inch—hole is formed that allows coolant to escape from the reactor pressure boundary. The probability of such an accident scenario occurring and the consequences of that accident take into account key engineering safety system failure rates and human error probabilities that influence how well the engineered systems would be able to mitigate the consequences of an accident and ensure no radioactive release from the plant. For Davis-Besse, NRC needed two estimates: one for the frequency of a nozzle ejecting and causing a loss-of-coolant accident and one for the probability that a loss-of-coolant accident would result in core damage. NRC first established an estimate, based partially on information provided by FirstEnergy, for the frequency of a plant developing a cracked nozzle that would initiate a medium break loss-of-coolant accident. NRC estimated that the frequency of this occurring would be about 2x10-2, or 1 chance in 50, per year. NRC then used an estimate, which FirstEnergy provided, for the probability of core damage given a medium break loss-of- coolant accident. This probability estimate was 2.7x10-3, or about 1 chance in 370. Multiplying these two numbers, NRC estimated that the potential for a nozzle to crack and cause a loss-of-coolant accident would increase the frequency of core damage at Davis-Besse by about 5.4x10-5 per year, or about 1 in 18,500 per year. Converting this frequency to a probability associated with continued operation for 7 weeks, NRC calculated that the increase in the probability of core damage was approximately 5x10-6, or 1 chance in 200,000. While NRC officials currently disagree that this was the number it used, this is the number that it included in its December 2002 assessment provided to FirstEnergy. Further, we found no evidence in the agency’s records to support NRC’s current assertion. According to our consultants, the way NRC calculated and used the PRA estimate was inadequate in several respects. (See app. II for the consultants’ detailed report.) First, NRC’s calculations did not take into account several factors, such as the possibility of corrosion and axial cracking that could lead to leakage. For example, the consultants concluded that NRC’s estimate of risk was incorrectly too small, primarily because the calculation did not consider corrosion of the vessel head. In reviewing how NRC developed and used its PRA estimates for Davis-Besse, our consultants noted that the calculated risk was smaller than it should have been because the calculations did not consider corrosion of the reactor vessel from the boric acid coolant leaking through cracks in the nozzles. According to the consultants, apparently all NRC staff involved in the Davis-Besse decision were aware that coolant under high pressure was leaking from valves, flanges, and possibly from cracks but evidently thought that the coolant would immediately flash into steam and noncorrosive compounds of boric acid. Our consultants, however, stated that because boric acid could potentially cause corrosion, except at temperatures much higher than 600 degrees Fahrenheit, NRC should have anticipated that corrosion could occur. Our consultants further stated that as evaporation occurs, boric acid becomes more concentrated in the remaining liquid—making it far more corrosive—and as vapor pressure decreases, evaporation is further slowed. They said it should be expected that some of the boric acid in the escaping coolant could reach the metal surfaces as wet or moist, highly corrosive material underlying the surface layers of dry noncorrosive boric acid, which is evidently what happened at Davis-Besse. Our consultants concluded that NRC staff should have been aware of the experience at French nuclear power plants, where boric acid corrosion from leaking reactor coolant had been identified during the previous decade, the safety significance had been recognized, and safety procedures to mitigate the problem had been implemented. Furthermore, tests had been conducted by the nuclear power industry and in government laboratories on boric acid corrosion that were widely available to NRC. They stated that keeping abreast of safety issues at similar plants, whether domestic or foreign, and conveying relevant safety information to licensees are important functions of NRC’s safety program. According to NRC, the agency was aware of the experience at French nuclear power plants. For example, NRC concluded, in a December 15, 1994, internal NRC memo, that primary coolant leakage from a through-wall crack could cause boric acid corrosion of the vessel head. However, because it concluded that some analyses indicated that it would take at least 6 to 9 years before any corrosion would challenge the structural integrity of the head, NRC concluded that cracking was not a short-term safety issue. Our consultants also stated that NRC’s risk analysis was inadequate because the analysis concerned only the formation and propagation of circumferential cracks that could result in nozzle failure, loss of coolant, and even control rod ejection. Although there is less chance of axial cracks causing complete nozzle failure, these cracks open additional pathways for coolant leakage. In addition, their long crevices provide considerably greater opportunity for the coolant to concentrate near the surface of the vessel head. However, according to our consultants, NRC was convinced that the boric acid they saw resulted from leaking flanges above the reactor vessel head, as opposed to axial cracks in the nozzles. Second, NRC’s analysis was inadequate because it did not include the uncertainty of its risk estimate and use the uncertainty analysis in the Davis-Besse decision-making process, although NRC staff should have recognized large uncertainties associated with its risk estimate. Our consultants also concluded that NRC failed to take into account the large uncertainties associated with estimates of the frequency of core damage resulting from the failure of nozzles. PRA estimates for nuclear power plants are subject to significant uncertainties associated with human errors and other common causes of system component failures, and it is important that proper uncertainty analyses be performed for any PRA study. NRC guidance and other NRC reports on advancing PRA technology for risk-informed decisions emphasize the need to understand and characterize uncertainties in PRA estimates. Our consultants stated that had the NRC staff estimated the margin of error or uncertainty associated with its PRA estimate for Davis-Besse, the uncertainty would likely have been so high as to render the estimate of questionable value. Third, NRC’s analysis was inadequate because the risk estimates were higher than generally considered acceptable under NRC guidance. Despite PRA’s important role in the decision, our consultants found that NRC did not follow its own guidance for ensuring that the estimated risk was within levels acceptable to the agency. NRC required the nuclear power industry to develop a baseline estimate for how frequently a core damage accident could occur at every nuclear power plant in the United States. This baseline estimate is used as a basis for deciding whether changes at a plant that affect the core damage frequency are acceptable. The baseline core damage frequency estimate for the Davis-Besse plant was between 4x10-5 and 6.6x10-5 per year (which is between 1 chance in 25,000 per year and about 1 chance in 15,150 per year). NRC guidance for reviewing and approving license amendment requests indicates that any plant-specific change resulting in an increase in the frequency of core damage of 1x10-5 per year (which is 1 chance in 100,000 per year) or more would fall within the highest risk zone: In this case, NRC would generally not approve the change because the risk criterion would not be met. If a license change would result in a core damage frequency change of 1x10-5 per year to 1x10-6 per year (which is 1 chance in 100,000 per year to 1 chance in 1 million per year), the risk criterion would be considered marginally met and NRC would consider approving the change but would require additional analysis. Finally, if a license change would result in a core damage frequency change of 1x10-6 per year (which is 1 chance in 1 million per year) or less, the risk would fall within the lowest risk zone and NRC would consider the risk criterion to be met and would generally consider approving the change without requiring additional analysis. (See fig. 6.) However, NRC’s PRA estimate for Davis-Besse—an increase in the frequency of core damage of 5.4x10-5, or 1 chance in about 18,500 per year—was higher than the acceptable level. While an NRC official who helped develop the risk estimate said that additional NRC and industry guidance was used to evaluate whether its PRA estimate was acceptable, this guidance also suggests that NRC’s estimate was too high. NRC’s estimate of the increase in the frequency of core damage of 5.4x10-5 per year equates to an increase in the probability of core damage of 5x10-6 , or 1 chance in 200,000, for the 7-week period December 31, 2001, to February 16, 2002. NRC’s guidance for evaluating requests to relax NRC technical specifications suggests that a probability increase higher than 5x10-7, or 1 chance in 2 million, is considered unacceptable for relaxing the specifications. Thus, NRC’s estimate would not be considered acceptable under this guidance. NRC’s estimate would also not be considered acceptable under Electric Power Research Institute or Nuclear Energy Institute guidance unless further action were taken to evaluate or manage risk. According to NRC officials, NRC viewed its PRA estimate as being within acceptable bounds because it was a temporary situation—7 weeks—and NRC had, at other times, allowed much higher levels of risk at other plants. However, at the time that NRC made its decision, it did not document the basis for accepting this risk estimate, even though NRC’s guidance explicitly states that the decision on whether PRA results are acceptable must be based on a full understanding of the contributors to the PRA results and the reasoning must be well documented. In defense of its decision, NRC officials said that the process they used to arrive at the decision is used to make about 1,500 licensing decisions such as this each year. Lastly, NRC’s analysis was inadequate because the agency does not have clear guidance for how PRA estimates are to be used in the decision- making process. Our consultants concluded that NRC’s process for risk- informed decision making is ill-defined, lacks guidelines for how it is supposed to work, and is not uniformly transparent within NRC. According to NRC officials involved in the Davis-Besse decision, NRC’s guidance is not clear on the use of PRA in the decision-making process. For example, while NRC has extensive guidance, this guidance does not outline to what extent or how the resultant PRA risk number and uncertainty should be weighed with respect to the ultimate decision. One factor complicating this issue is the lack of a predetermined methodology to weigh risks expressed in PRA numbers against traditional deterministic results and other factors. Absent this guidance, the value assigned to the PRA analysis is largely at the discretion of the decision maker. The process, which NRC stated is robust, can result in a decision in which PRA played no role, a partial role, or one in which it was the sole deciding factor. According to our consultants, this situation is made worse by the lack of guidelines for how, or by whom, decisions in general are made at NRC. It is not clear how NRC staff used the PRA risk estimate in the Davis-Besse decision-making process. For example, according to one NRC official who was familiar with some of the data on nozzle cracking, these data were not sufficient for making a good probabilistic decision. He stated that he favored issuing an order requiring that Davis-Besse be shut down by the end of December 2001 because he believed the available data were not sufficient to assure a low enough probability for a nozzle to be ejected. Other officials indicated that they accepted FirstEnergy’s proposed February 16, 2002, shutdown date based largely on NRC’s PRA estimate for a nozzle to crack and be ejected. According to one of these officials, allowing the additional 7 weeks of operating time was not sufficiently risk significant under NRC’s guidance. He stated that safety margins at the plant were preserved and the PRA number was within an acceptable range. Still another official said he discounted the PRA estimate and did not use it at all when recommending that NRC accept FirstEnergy’s compromise proposal. This official also stated that it was likely that many of the staff did base their conclusions on the PRA estimate. According to our consultants, although the extent to which the PRA risk analysis influenced the decision making will probably never be known, it is apparent that it did play an important role in the decision to allow the shutdown delay. NRC has made significant progress in implementing the actions recommended by the Davis-Besse lessons-learned task force. While NRC has implemented slightly less than half—21 of the 51—recommendations as of March 2004, it is scheduled to have more than 70 percent of them implemented by the end of 2004. For example, NRC has already taken actions to improve staff training and inspections that would appear to help address the concern that NRC inspectors viewed FirstEnergy as a good performer and thus did not subject Davis-Besse to the level of scrutiny or questioning that they should have. It is not certain when actions to implement the remaining recommendations will occur, in part because of resource constraints. NRC also faces challenges in fully implementing the recommendations, also in part because of resource constraints, both in the staff needed to develop specific corrective actions and in the additional staff responsibilities and duties to carry them out. Further, while NRC is making progress, the agency is not addressing three systemic issues highlighted by the Davis-Besse experience: (1) an inability to detect weakness or deterioration in FirstEnergy’s safety culture, (2) deficiencies in NRC’s process for deciding on a shutdown, and (3) lack of management controls to track, on a longer-term basis, the effectiveness of actions implemented in response to incidents such as Davis-Besse, so that they do not occur at another power plant. NRC’s lessons-learned task force for Davis-Besse developed 51 recommendations to address the weaknesses that contributed to the Davis- Besse incident. Of these 51 recommendations, NRC rejected 2 because it concluded that agency processes or procedures already provided for the recommendations’ intent to be effectively carried out. To address the remaining 49 recommendations, NRC developed a plan in March 2003 that included, for each recommendation, the actions to be taken, the responsible NRC office, and the schedule for completing the actions. When developing its schedule, NRC placed the highest priority on implementing recommendations that were most directly related to the underlying causes of the Davis-Besse incident as well as those recommendations responding to vessel head corrosion. NRC assigned a lower priority to the remaining recommendations, which were to be integrated into the planning activities of those NRC offices assigned responsibility for taking action on the recommendations. In assigning these differing priorities, NRC officials stated they recognized that the agency has many other pressing matters to address that are not related to the Davis-Besse incident, such as renewing operating licenses, and they did not want to divert resources away from these activities. (App. III contains a complete list of the task force’s recommendations, NRC actions, and the status of the recommendations as of March 2004.) To better track the status of the agency’s actions to implement the recommendations, we split two of the 49 recommendations that NRC accepted into 4; therefore, our analysis reflects NRC’s response to 51 recommendations. As shown in table 1, as of March 2004, NRC had made progress in implementing the recommendations, although some completion dates have slipped. As the table shows, as of March 2004, NRC had implemented 21 recommendations and scheduled another 17 for completion by December 2004. However, some slippage has already occurred in this schedule— primarily because of resource constraints—and NRC has rescheduled completion of some recommendations. NRC’s time frames for completing the recommendations depend on several factors—the recommendations’ priority, the amount of work required to develop and implement actions, and the need to first complete actions on other related recommendations. Of the 21 implemented recommendations, 10 called upon NRC to revise or enhance its inspection guidance or training. For example, NRC revised the guidance it uses to assess the implementation of licensees’ programs to identify and resolve problems before they affect operations. It took this action because the task force had concluded that FirstEnergy’s weak corrective action program implementation was a major contributor to the Davis-Besse incident. NRC has also developed Web-based training modules to improve NRC inspectors’ knowledge of boric acid corrosion and nozzle cracking. The other 11 completed recommendations concerned actions such as collecting and analyzing foreign and domestic information on alloy 600 fully implementing and revising guidance to better assure that licensees carry out their commitments to make operational changes, and establishing measurements for resident inspector staffing levels and requirements. By the end of 2004, NRC expects to complete another 17 recommendations, 12 of which generally address broad oversight or programmatic issues, and 5 of which provide for additional inspection guidance and training. On the broader issues, for example, NRC is scheduled to complete a review of the effectiveness of its response to past NRC lessons-learned task force reports by April 2004. By December 2004, NRC expects to have a framework established for moving forward with implementing recommended improvements to its agencywide operating experience program. In 2005, 4 of the 6 recommendations scheduled for completion concern leakage from the reactor coolant system. For example, NRC is to (1) develop guidance and criteria for assessing licensees’ responses to increasing leakage levels and (2) determine whether licensees should install enhanced systems to detect leakage from the reactor coolant system. The fifth recommendation calls for NRC to inspect the adequacy of licensees’ programs for controlling boric acid corrosion, and the final recommendation calls on NRC to assess the basis for canceling a series of inspection procedures in 2001. NRC did not assign completion dates to 7 recommendations because, among other things, their completion depends on completing other recommendations or because of limited resources. Even though it has not assigned completion dates for these recommendations, NRC has begun to work on 5 of the 7: Two recommendations will be addressed when requirements for vessel head inspections are revised. To date, NRC has taken some related, but temporary, actions. For example, since February 2003, it has required licensees to more extensively examine their reactor vessel heads. NRC has also issued a series of temporary instructions for NRC inspectors to oversee the enhanced examinations. NRC expects to replace these temporary steps with revised requirements for vessel head inspections. Two recommendations call upon NRC to revise requirements for detecting leaks in the reactor coolant pressure boundary. In response, NRC has, for example, begun to review its barrier integrity requirements and has contracted for research on enhanced detection capabilities. One recommendation is directed at improving follow-up of licensee actions taken in response to NRC generic communications. NRC is currently developing a temporary inspection procedure to assess the effectiveness of licensee actions taken in response to generic communications. Additionally, as a long-term change in the operating experience program, the agency plans to improve the verification of how effective its generic communications are. The remaining two recommendations address NRC’s need to (1) evaluate the adequacy of methods for analyzing the risks posed by passive components, such as reactor vessels, and integrate these methods and risks into NRC’s decision-making process and (2) review a sample of plant assessments conducted between 1998 and 2000 to determine if any identified plant safety issues have not been adequately assessed. NRC has not yet taken action on these recommendations. Some recommendations will require substantial resources to develop and implement. As a result, some implementation dates have slipped and some plans in response to the recommendations have changed in scope. For example, owing to resource constraints, NRC has postponed indefinitely the evaluation of methods to analyze the risk associated with passive reactor components such as the vessel head. Also, in part due to resource constraints, NRC has reconceptualized its plan to review licensee actions in response to previous generic communications, such as bulletins and letters. Staff resources will be strained because implementing the recommendations adds additional responsibilities or duties—that is, more inspections, training, and reviews of licensee reports. For example, NRC’s revised inspection guidance for more thorough examinations of reactor vessel heads and nozzles, as well as new requirements for NRC oversight of licensees’ corrective action programs, will require at least an additional 200 hours of inspection per reactor per year. As of February 2004, NRC was also revising other inspection requirements that are likely to place additional demands on inspectors’ time. Thus, to respond to these increased demands, NRC will either need to add inspectors or reduce oversight of other licensee activities. To its credit, in its 2004 budget plan, NRC increased the level of resources for some inspection activities. However, it is not certain that these increases will be maintained. The number of inspection hours has fallen by more than one-third between 1995 and 2001. In addition, NRC is aware that resident inspector vacancies are filled with staff having varying levels of experience—from the basic level that would be expected from a newly qualified inspector to the advanced level that is achieved after several years’ experience. According to the latest available data, as of May 2003, about 12 percent of sites had only one resident inspector; the remaining 88 percent had two inspectors of varying levels of experience. Because of this situation, NRC augments these inspection resources with regional inspectors and contractors to ensure that, at a minimum, its baseline inspection program can be implemented throughout the year. Because of surges in the demand for inspections, NRC in 2003 increased its use of contractors and temporarily pulled qualified inspectors from other jobs to help complete the baseline inspection program for every plant. According to NRC, it did not expect to require such measures in 2004. Similarly, NRC may require additional staff to identify and evaluate plants’ operating experiences and communicate the results to licensees, as the task force recommended. NRC has currently budgeted an increase of three full-time staff in fiscal year 2006 to implement a centralized system, or clearinghouse, for managing the operating experience program. However, according to an NRC official, questions remain about the level of resources needed to fully implement the task force recommendations. NRC’s operating experience office, before it was disbanded in 1999, had about 33 staff whose primary responsibility was to collect, evaluate, and communicate activities associated with safety performance trends, as reflected in licensees’ operating experiences, and participate in developing rulemakings. However, it is too early to know the effectiveness of this clearinghouse approach and the adequacy of resources in the other offices available for collecting and analyzing operating experience information. Neither the operating experience office before it was disbanded nor the other offices flagged boric acid corrosion, cracking, or leakage as problems warranting significantly greater oversight by NRC, licensees, or the nuclear power industry. NRC’s Davis-Besse task force did not make any recommendations to address two systemic problems: evaluating licensees’ commitment to safety and improving the agency’s process for deciding on a shutdown. NRC’s task force identified numerous problems at Davis-Besse that indicated human performance and management failures and concluded that FirstEnergy did not foster an environment that was fully conducive to ensuring that plant safety issues received appropriate attention. Although the task force report did not use the term safety culture, as evidence of FirstEnergy’s safety culture problems, the task force pointed to an imbalance between production and safety, as evidenced by FirstEnergy’s efforts to address symptoms (such as regular cleanup of boric acid deposits) rather than causes (finding the source of the leaks during refueling outages); a lack of management involvement in or oversight of work at Davis- Besse that was important for maintaining safety; a lack of a questioning attitude by senior FirstEnergy managers with regard to vessel head inspections and cleaning activities; ineffective and untimely corrective action; a long-standing acceptance of degraded equipment; and inadequate engineering rigor. The task force concluded that NRC’s implementation of guidance for inspecting and assessing a safety-conscious work environment and employee concerns programs failed to identify significant safety problems. Although the task force did not make any specific recommendations that NRC develop a means to assess licensees’ safety culture, it did recommend changes to focus more effort on assessing programs to promote a safety- conscious work environment. NRC has taken little direct action in response to this task force recommendation. However, to help enhance NRC’s capability to assess licensee safety culture by indirect means, NRC modified the wording in, and revised its inspection procedure for, assessing licensees’ ability to identify and resolve problems, such as malfunctioning plant equipment. These revisions included requiring inspectors to review all licensee reports on plant conditions, analyze trends in plant conditions to determine the existence of potentially significant safety issues, and expand the scope of their reviews to the prior 5 years in order to identify recurring issues. This problem identification and resolution inspection procedure is intended to assess the end results of management’s safety commitment rather than the commitment itself. However, by measuring only the end results, early signs of a deteriorating safety culture and declining management performance may not be readily visible and may be hard to interpret until clear violations of NRC’s regulations occur. Furthermore, because NRC directs its inspections at problems that it recognizes as being more important to safety, NRC may overlook other problems until they develop into significant and immediate safety problems. Conditions at a plant can quickly degrade to the extent that they can compromise public health and safety. The International Atomic Energy Agency and its member nations have developed guidance and procedures for assessing safety culture at nuclear power plants, and today several countries, such as Brazil, Canada, Finland, Sweden, and the United Kingdom, assess plant safety culture or licensees’ own assessments of their safety culture. In assessing safety culture, an advisory group to the agency suggests that regulatory agencies examine whether, for example, (1) employee workloads are not excessive, (2) staff training is sufficient, (3) responsibility for safety has been clearly assigned within the organization, (4) the corporation has clearly communicated its safety policy, and (5) managers sufficiently emphasize safety during plant meetings. One reason for assessing safety culture, according to the Canadian Nuclear Safety Commission, is because management and human performance aspects are among the leading causes of unplanned events at licensed nuclear facilities, particularly in light of pressures such as deregulation of the electricity market. Finland specifically requires that nuclear power plants maintain an advanced safety culture and its inspections target the importance that has been embedded in factors affecting safety, including management. NRC had begun considering methods for assessing organizational factors, including safety culture, but in 1998, NRC’s commissioners decided that the agency should have a performance-based inspection program of overall plant performance and should infer licensee management performance and competency from the results of that program. They chose this approach instead of one of four other options: conduct performance-based inspections in all areas of facility operation and design, but not infer or articulate conclusions regarding the performance of licensee management; assess the performance of licensee management through targeted operations-based inspections using specific inspection procedures, trained staff, and contractors to assess licensee management—a task that would require the development of inspection procedures and significant training—and to document inspection results; assess the performance of licensee management as part of the routine inspection program by specifically evaluating and documenting management performance attributes—a larger effort that would require the development of assessment tools to evaluate safety culture as well as additional resources; or assess the competency of licensee management by evaluating management competency attributes—an even larger effort that would require that implementation options and their impacts be assessed. When adopting the proposal to infer licensee management performance from the results of its performance-based inspection program, NRC eliminated any resource expenditures specifically directed at developing a systematic method of inferring management performance and competency. NRC stated that it currently has a number of means to assess safety culture that provide indirect insights into licensee safety culture. These means include, for example, (1) insights from augmented inspection teams, (2) lessons-learned reviews, and (3) information obtained in the course of conducting inspections under the Reactor Oversight Process. However, insights from augmented inspection teams and lessons-learned reviews are reactionary and do not prevent problems such as those that occurred at Davis-Besse. Further, before the Davis-Besse incident, NRC assumed its oversight process would adequately identify problems with licensees’ safety culture. However, NRC has no formalized process for collectively assessing information obtained in the course of its problem identification and resolution inspection to ensure that individual inspection results would identify poor management performance. NRC stated that its licensee assessments consider inputs such as inspection results and insights, correspondence to licensees related to inspection observations, input from resident inspectors, and the results of any special investigations. However, this information may not be sufficient to inform NRC of problems at a plant in advance of these problems becoming safety significant. In part because of Davis-Besse, NRC’s Advisory Committee on Reactor Safeguards recommended that NRC again pursue the development of a methodology for assessing safety culture. It also asked NRC to consider expanding research to identify leading indicators of degradation in human performance and work to develop a consistent comprehensive methodology for quantifying human performance. During an October 2003 public meeting of the advisory committee’s Human Performance Subcommittee, the subcommittee’s members again reiterated the need for NRC to assess safety culture. Specifically, the members recognized that certain aspects of safety culture, such as beliefs, perceptions, and management philosophies, are ultimately the nuclear power industry’s responsibility but stated that NRC should deal with patterns of behavior and human performance, as well as organizational structures and processes. At this meeting, NRC officials discussed potential safety culture indicators that NRC could use, including, among other things, how many times a problem recurs at a plant, timeliness in correcting problems, number of temporary modifications, and individual program and process error rates. Committee members recommended that NRC test various safety culture indicators to determine whether (1) such indicators should ultimately be incorporated into the Reactor Oversight Process and (2) a significance determination process could be developed for safety culture. As of March 2004, NRC had yet to respond to the advisory committee’s recommendation. Despite the lack of action to address safety culture issues, NRC’s concern over FirstEnergy’s safety culture at Davis-Besse was one of the last issues resolved before the agency approved Davis-Besse’s restart. NRC undertook a series of inspections to examine Davis-Besse’s safety culture and determine whether FirstEnergy had (1) correctly identified the underlying causes associated with its declining safety culture, (2) implemented appropriate actions to correct safety culture problems, and (3) developed a process for monitoring to ensure that actions taken were effective for resolving safety culture problems. In December 2003, NRC noted significant improvements in the safety culture at Davis-Besse, but expressed concern with the sustainability of Davis-Besse’s performance in this area. For example, a survey of FirstEnergy and contract employees conducted by FirstEnergy in November 2003 indicated that about 17 percent of employees believed that management cared more about cost and schedule than resolving safety and quality issues—again, production over safety. NRC’s task force also did not analyze NRC’s process for deciding not to order a shutdown of the Davis-Besse plant. It noted that NRC’s written rationale for accepting FirstEnergy’s justification for continued plant operation had not yet been prepared and recommended that NRC change guidance requiring NRC to adequately document such decisions. It also made a recommendation to strengthen guidance for verifying information provided by licensees. According to an NRC official on the task force, the task force did not assess the decision-making process in detail because the task force was charged with determining why the degradation at Davis- Besse was not prevented and because NRC had coordinated with NRC’s Office of the Inspector General, which was reviewing NRC’s decision making. The NRC task force conducted a preliminary review of prior lessons- learned task force reports to determine whether they suggested any recurring or similar problems. As a result of this preliminary review, the task force recommended that a more detailed review be conducted to determine if actions that NRC took as a result of those reviews were effective. These previous task force reports included: Indian Point 2 in Buchanan, New York, in February 2000; Millstone in Waterford, Connecticut, in October 1993; and South Texas Project in Wadsworth, Texas, from 1988 to 1994. NRC’s more detailed review, as of May 2004, was still under way. We also reviewed these reports to determine whether they suggested any recurring problems and found that they highlighted broad areas of continuing programmatic weaknesses, as seen in the following examples: Inspector training and information sharing. All three of the other task forces also identified inspector training issues and problems with information collection and sharing. The Indian Point task force called upon NRC to develop a process for promptly disseminating technical information to NRC inspectors so that they can review and apply the information in their inspection program. Oversight of licensee corrective action programs. Two of the three task forces also identified inadequate oversight of licensee corrective action programs. The South Texas task force recommended improving assessments of licensees’ corrective action programs to ensure that NRC identifies broader licensee problems. Better identification of problems. Two of the three task force reports also noted the need for NRC to develop a better process for identifying problem plants, and one report noted the need for NRC inspectors to more aggressively question licensees’ activities. Over the past two decades, we have also reported on underlying causes similar to those that contributed, in part, to the incident at Davis-Besse. (See Related GAO Products.) For example, with respect to the safety culture at nuclear power plants, in 1986, 1995, and 1997, we reported on issues relevant to NRC assessing plant management so that significant problems could be detected and corrected before they led to incidents such as the one that later occurred at Davis-Besse. Regardless of our 1997 recommendation that NRC require that the assessment of management’s competency and performance be a mandatory component of NRC’s inspection process, NRC subsequently withdrew funding to accomplish this. In terms of inspections, in 1995 we reported that NRC, itself, had concluded that the agency was not effectively integrating information on previously identified and long-standing issues to determine if the issues indicated systemic weaknesses in plant operations. This report further noted that NRC was not using such information to focus future inspection activities. In 1997 and 2001, we reported on weaknesses in NRC’s inspections of licensees’ corrective action programs. Finally, with respect to learning from plants’ operating experiences, in 1984 we noted that NRC needed to improve its methods for consolidating information so that it could evaluate safety trends and ensure that generic issues are resolved at individual plants. These recurring issues indicate that NRC’s actions, in response to individual plant incidents and recommendations to improve oversight, are not always institutionalized. NRC guidance requires that resolutions to action plans be described and documented, and while NRC is monitoring the status of actions taken in response to Davis-Besse task force recommendations and preparing quarterly and semiannual reports on the status of actions taken, the Davis- Besse action plan does not specify how long NRC will monitor them. It also does not describe how long NRC will prepare quarterly and semiannual status reports, even though, according to NRC officials, these semiannual status reports will continue until all items are completed and the agency is required to issue a final summary report. The plan also does not specify what criteria the agency will use to determine when the actions in response to specific task force recommendations are completed. Furthermore, NRC’s action plan does not require NRC to assess the long-term effectiveness of recommended actions, even though, according to NRC officials, some activities already have an effectiveness review included. As in the past and in response to prior lessons-learned task force reports and recommendations, NRC has no management control in place for assessing the long-term effectiveness of efforts resulting from the recommendations. NRC officials acknowledged the need for a management control, such as an agencywide tracking system, to ensure that actions taken in response to task force recommendations effectively resolve the underlying issue over the long term, but the officials have no plans to establish such a system. It is unlikely, given the actions that NRC has taken to date, that extensive reactor vessel corrosion will occur any time soon at another domestic nuclear power plant. However, we do not yet have adequate assurances from NRC that many of the factors that contributed to the incident at Davis- Besse will be fully addressed. These factors include NRC’s failure to keep abreast of safety significant issues by collecting information on operating experiences at plants, assessing their relative safety significance, and effectively communicating information within the agency to ensure that oversight is fully informed. The underlying causes of the Davis-Besse incident underscore the potential for another incident unrelated to boric acid corrosion or cracked control rod drive mechanism nozzles to occur. This potential is reinforced by the fact that both prior NRC lessons-learned task forces and we have found similar weaknesses in many of the same NRC programs that led to the Davis-Besse incident. NRC has not followed up on prior task force recommendations to assess whether the lessons learned were institutionalized. NRC’s actions to implement the Davis-Besse lessons-learned task force recommendations, to be fully effective, will require an extensive effort on NRC’s part to ensure that these are effectively incorporated into the agency’s processes. However, NRC has not estimated the amount of resources necessary to carry out these recommendations, and we are concerned that resource limitations could constrain their effectiveness. For this reason, it is important for NRC to not only monitor the implementation of Davis-Besse task force recommendations, but also determine their effectiveness, in the long term, and the impact that resource constraints may have on them. These actions are even more important because the nation’s fleet of nuclear power plants is aging. Because the Davis-Besse task force did not address NRC’s unwillingness to directly assess licensee safety culture, we are concerned that NRC’s oversight will continue to be reactive rather than proactive. NRC’s oversight can result in NRC making a determination that a licensee’s performance is good one day, yet the next day NRC discovers the performance to be unacceptably risky to public health and safety. Such a situation does not occur overnight: Long-standing action or inaction on the part of the licensee causes unacceptably risky and degraded conditions. NRC needs better information to preclude such conditions. Given the complexity of nuclear power plants, the number of physical structures, systems, and components, and the manner in which NRC inspectors must sample to assess whether licensees are complying with NRC requirements and license specifications, it is possible that NRC will not identify licensees that value production over safety. While we recognize the difficulty in assessing licensee safety culture, we believe it is sufficiently important to develop a means to do so. Given the limited information NRC had at the time and that an accident did not occur during the delay in Davis-Besse’s shutdown, we do not necessarily question the decision the agency made. However, we are concerned about NRC’s process for making that decision. It used guidance intended to make decisions for another purpose, did not rigorously apply the guidance, established an unrealistically high standard of evidence to issue a shutdown order, relied on incomplete and faulty PRA analyses and licensee evidence, and did not document key decisions and data. It is extremely unusual for NRC to order a nuclear power plant to shut down. Given this fact, it is more imperative that NRC have guidance to use when technical specifications or requirements may be met, yet questions arise over whether sufficient safety is being maintained. This guidance does not need to be a risk-based approach, but rather a more structured risk- informed approach that is sufficiently flexible to ensure that the guidance is applicable under different circumstances. This is important because NRC annually makes about 1,500 licensing decisions relating to operating commercial nuclear power plants. While we recognize the challenges NRC will face in developing such guidance, the large number and wide variety of decisions strongly highlight the need for NRC to ensure that its decision- making process and decisions are sound and defensible. To ensure that NRC aggressively and comprehensively addresses the weaknesses that contributed to the Davis-Besse incident and could contribute to problems at nuclear power plants in the future, we are recommending that the NRC commissioners take the following five actions: Determine the resource implications of the task force’s recommendations and reallocate the agency’s resources, as appropriate, to better ensure that NRC effectively implements the recommendations. Develop a management control approach to track, on a long-term basis, implementation of the recommendations made by the Davis-Besse lessons-learned task force and future task forces. This approach, at a minimum, should assign accountability for implementing each recommendation and include information on the status of major actions, how each recommendation will be judged as completed, and how its effectiveness will be assessed. The approach should also provide for regular—quarterly or semiannual—reports to the NRC commissioners on the status of and obstacles to full implementation of the recommendations. Develop a methodology to assess licensees’ safety culture that includes indicators of and inspection information on patterns of licensee performance, as well as on licensees’ organization and processes. NRC should collect and analyze this data either during the course of the agency’s routine inspection program or during separate targeted assessments, or during both routine and targeted inspections and assessments, to provide an early warning of deteriorating or declining performance and future safety problems. Develop specific guidance and a well-defined process for deciding on when to shut down a nuclear power plant. The guidance should clearly set out the process to be used, the safety-related factors to be considered, the weight that should be assigned to each factor, and the standards for judging the quality of the evidence considered. Improve NRC’s use of probabilistic risk assessment estimates in decision making by (1) ensuring that the risk estimates, uncertainties, and assumptions made in developing the estimates are fully defined, documented, and communicated to NRC decision makers; and (2) providing guidance to decision makers on how to consider the relative importance, validity, and reliability of quantitative risk estimates in conjunction with other qualitative safety-related factors. We provided a draft of this report to NRC for review and comment. We received written comments from the agency’s Executive Director for Operations. In its written comments, NRC generally addressed only those findings and recommendations with which it disagreed. Although commenting that it agreed with many of the report’s findings, NRC expressed an overall concern that the report does not appropriately characterize or provide a balanced perspective on NRC’s actions surrounding the discovery of the Davis-Besse reactor vessel head condition or NRC’s actions to incorporate the lessons learned from that experience into its processes. Specifically, NRC stated that the report does not acknowledge that NRC must rely heavily on its licensees to provide it with complete and accurate information, as required by its regulations. NRC also expressed concern about the report’s characterization of its use of risk estimates—specifically the report’s statement that NRC’s estimate of risk exceeded the risk levels generally accepted by the agency. In addition, NRC disagreed with two of our recommendations: (1) to develop specific guidance and a well-defined process for deciding on when to shut down a plant and (2) to develop a methodology to assess licensees’ safety culture. With respect to NRC’s overall concern, we believe that the report accurately captures NRC’s performance. Our draft report, in discussing NRC’s regulatory and oversight role and responsibilities, stated that according to NRC, the completeness and accuracy of the information provided by licensees is an important aspect of the agency’s oversight. To respond further to NRC’s concern, we added a statement to the effect that licensees are required under NRC’s regulations to provide the agency with complete and accurate information. While we do not want to diminish the importance of this responsibility on the part of the licensees, we believe that NRC also has a responsibility, in designing its oversight program, to implement management controls, including inspection and enforcement, to ensure that it has accurate information on and is sufficiently aware of plant conditions. In this respect, it was NRC’s decision to rely on the premise that the information provided by FirstEnergy was complete and accurate. As we point out in the report, the degradation of the vessel head at Davis-Besse occurred over several years. NRC knew about several indications that problems were occurring at the plant, and the agency could have requested and obtained additional information about the vessel head condition. We also believe that the report’s characterization of NRC’s use of risk estimates is accurate. The NRC risk estimate that we and our consultants found for the period leading up to the December 2001 decision on Davis- Besse’s shutdown, including the risk estimate used by the staff during key briefings of NRC management, indicated that the estimate for core damage frequency was 5.4x10-5, as used in the report. The 5x10-6 referenced in NRC’s December 2002 safety evaluation is for core damage probability, which equates to a core damage frequency of approximately 5x10-5—a level that is in excess of the level generally accepted by the agency. The impression of our consultants is that some confusion about the differences in these terms may exist among NRC staff. Concerning NRC’s disagreement with our recommendation to develop specific guidance for making plant shutdown decisions, NRC stated that its regulations, guidance, and processes are robust and do provide sufficient guidance in the vast majority of situations. The agency added that from time to time a unique situation may present itself wherein sufficient information may not exist or the information available may not be sufficiently clear to apply existing rules and regulations definitively. According to NRC, in these unique instances, the agency’s most senior managers, after consultation with staff experts and given all of the information available at the time, decide whether to require a plant shutdown. While we agree that NRC has an array of guidance for making decisions, we continue to believe that NRC needs specific guidance and a well-defined process for deciding when to shut down a plant. As discussed in our report, the agency used its guidance for approving license change requests to make the decision on when to shut down Davis-Besse. Although NRC’s array of guidance provides flexibility, we do not believe that it provides the structure, direction, and accountability needed for important decisions such as the one on Davis-Besse’s shutdown. In disagreeing with our recommendation concerning the need for a methodology to assess licensees’ safety culture, NRC said that the Commission, to date, has specifically decided not to conduct direct evaluations or inspections of safety culture as a routine part of assessing licensee performance due to the subjective nature of such evaluations. According to NRC, as regulators, agency officials are not charged with managing licensees’ facilities, and direct involvement with organizational structure and processes crosses over to a management function. We understand NRC’s position that it is not charged with managing licensees’ facilities, and we are not suggesting that NRC should prescribe or regulate the licensees’ organizational structure or processes. Our recommendation is aimed at NRC monitoring trends in licensees’ safety culture as an early warning of declining performance and safety problems. Such early warnings can help preclude NRC from assessing a licensee as being a good performer one day, and the next day being faced with a situation that it considers a potentially significant safety risk. As discussed in the report, considerable guidance is available on safety culture assessment, and other countries have established safety culture programs. NRC’s written response also contained technical comments, which we have incorporated into the report, as appropriate. (NRC’s comments and our responses are presented in app. IV.) As arranged with your staff, unless you publicly announce its contents earlier, we plan no further distribution of this report until 30 days from its issue date. At that time, we plan to provide copies of this report to the appropriate congressional committees; the Chairman, NRC; the Director, Office of Management and Budget; and other interested parties. We will also make copies available to others upon request. In addition, this report will be available at no charge on the GAO Web site at http://www.gao.gov. If you or your staff have any questions, please call me at (202) 512-3841. Key contributors to this report are listed in appendix V. Either fully implement or revise guidance to manage licensee commitments. Determine whether the periodic report on commitment changes submitted by licensees should continue. Revised instructions for these submittals and reviews to ensure that these tasks are accomplished. Completed in May 2003. Determine if stress corrosion cracking models are appropriate for predicting susceptibility of vessel head penetration nozzles to pressurized water stress corrosion cracking. Determine if additional analysis and testing is needed to reduce modeling uncertainties for their continued applicability in regulatory decision making. Evaluated existing stress corrosion cracking models for their continuing use in determining susceptibility. Completed in July 2003. Revise the problem identification and resolution approach so that safety problems noted in daily licensee reports are reviewed and assessed. Enhance guidance to prescribe the format of information that is screened when deciding which problems to review. Revised inspection procedure for determining licensee ability to promptly identify and resolve conditions adverse to quality or safety. Completed in September 2003. Provide enhanced inspection guidance to pursue issues and problems identified during reviews of plant operations. Revised inspection procedure for determining licensee capability to promptly identify and resolve conditions adverse to quality or safety. Completed in September 2003. Revise inspection guidance to provide for longer-term follow-up of previously identified issues that have not progressed to an inspection finding. Revised inspection procedure for determining licensee capability to promptly identify and resolve conditions adverse to quality or safety. Completed in September 2003. Revise inspection guidance to assess (1) the safety implications of long-standing unresolved licensee equipment problems, (2) the impact of phased in corrective actions, and (3) the implications of deferred plant modifications. Revised inspection procedure for determining licensee capability to identify and resolve conditions adverse to quality or safety. Completed in September 2003. Revise inspection guidance to allow for establishing reactor oversight panels even when a significant performance problem, as defined under NRC's Reactor Oversight Process, does not exist. Revised inspection guidance for establishing reactor oversight panels. Completed in October 2003. Assess the scope and adequacy of requirements for licensees to review operating experience. Included in NRC’s recommendation to develop a program for collecting, analyzing, and disseminating information on experiences at operating reactors. Completed in November 2003. Ensure inspector training includes (1) boric acid corrosion effects and control, and (2) pressurized water stress corrosion cracking of nickel-based alloy nozzles. Developed and implemented Web-based training and a means for ensuring training is completed. Completed in December 2003. Provide training and reinforce expectations to managers and staff to (1) maintain a questioning attitude during inspection activities, (2) develop inspection insights from Davis-Besse on symptoms of reactor coolant leakage, (3) communicate expectations to follow up recurring and unresolved problems, and (4) maintain an awareness of surroundings while conducting inspections. Establish mechanisms to perpetuate this training. Developed Web-based inspector training and a means for ensuring that training has been completed. NRC headquarters provided an overview of the training to NRC regional offices. (Training modules will be added and updated as needed.) Completed in December 2003. Reinforce expectations that regional management should make every effort to visit each reactor at least once every 2 years. Discussed at regional counterparts meeting. Completed in December 2003. Develop guidance to address impacts of regional oversight panels on regional resource allocations and organizational alignment. Evaluated past and present oversight panels. Developed enhanced inspection approaches for oversight panels and issued revised procedures. Completed in December 2003. Evaluate (1) the capacity to retain operating experience information and perform long-term operating experience reviews; (2) thresholds, criteria, and guidance for initiating generic communications; (3) opportunities for more gains in effectiveness and efficiency by realigning the organization (i.e., feasibility of a centralized operating experience "clearinghouse"); (4) effectiveness of the generic Issues program; and (5) effectiveness of internal dissemination of operating experience information to end users. Developed program objectives and attributes and obtained management endorsement of a plan to implement the recommendation. Developed specific recommendations to improve program. Evaluation completed in November 2003. (Implementation of recommendations resulting from this evaluation expected to be completed in December 2004.) Ensure that generic requirements or guidance are not inappropriately affected when making unrelated changes to other programs, processes, guidance, etc. Revised inspection guidance. Completed in February 2004. Develop inspection guidance to assess scheduler influences on amount of work performed during refueling outages. Revised the appropriate inspection procedure. Completed in February 2004. Establish guidance to ensure that NRC decisions allowing licensees to deviate from guidelines and recommendations issued in generic communications are adequately documented. Update guidance to address documentation. Develop training and distribute to NRC offices and regions to emphasize compliance with the updated guidance. Follow up to assess the effectiveness of the training. Completed follow-up in February 2004. Develop or revise inspection guidance to ensure that NRC reviews vessel head penetration nozzles and the reactor vessel head during licensee inspection activities. Develop or revise inspection guidance to ensure that nozzles and the vessel head are reviewed during licensee inspection. Issued interim guidance in August 2003 and a temporary inspection procedure in September 2003. Additional guidance expected in March 2004. Develop inspection guidance to assess (1) repetitive or multiple technical specification actions in NRC inspection or licensee reports, and (2) radiation dose implications for conducting repetitive tasks. Revise the appropriate inspection procedure to reflect this need. Completion expected in March 2004. Develop guidance to periodically inspect licensees’ boric acid corrosion control programs. Issued temporary guidance in November 2003. Completion of further inspection guidance changes expected in March 2004. Reinforce expectations for managers responsible for overseeing operations at nuclear power plants regarding site visits, coordination with resident inspectors, and assignment duration. Reinforce expectations to question information about operating conditions and strengthen guidance for reviewing license amendments to emphasize consideration of current system conditions, reliability, and performance data in safety evaluation reports. Strengthen guidance for verifying licensee-provided information. Update project manager handbook that provides guidance on activities to be conducted during site visits and interactions with NRC regional staff. Also, revise guidance for considering plant conditions during licensing action and amendment reviews. Completion expected in March 2004. Assemble and analyze foreign and domestic information on Alloy 600 nozzle cracking. If additional regulatory action is warranted, propose a course of action and implement a schedule to address the results. Assemble and analyze alloy 600 cracking data. Completion expected in March 2004. Recommendations due to be completed between April and December 2004 Conduct an effectiveness review of actions taken in response to past NRC lessons-learned reviews. Review past lessons-learned actions. Completion expected in April 2004. Provide inspection and oversight refresher training to managers and staff. Develop a training module. Completion expected in June 2004. Establish guidance for accepting owners group and industry recommended resolutions for generic communications and generic issues, including guidance for verifying that actions are taken. Revise office instructions to provide recommended guidance. Completion expected in June 2004. Review inspection guidance to determine the inspection level that is sufficient during refueling outages, including inspecting reactor areas inaccessible during normal operations and passive components. Revised an inspection procedure to reflect these changes. Some inspection procedure changes were completed in November 2003, and additional changes are expected in August 2004. Evaluate, and revise as necessary, guidance for proposing candidate generic issues. Assemble and analyze foreign and domestic information on boric acid corrosion of carbon steel. If additional regulatory action is warranted, propose a course of action and implement a schedule to address the results. Review Argonne National Laboratory study on boric acid corrosion. Analyze data to revise inspection requirements. Completion expected in October 2004. Conduct a follow-on verification of licensee actions to implement a sample of significant generic communications with emphasis on those that are programmatic in nature. Screen candidate generic communications to identify those most appropriate for follow-up using management-approved criteria. Develop and approve verification plan. Completion expected in November 2004. Strengthen inspection guidance for periodically reviewing licensee operating experience. Incorporated into the recommendation pertaining to NRC’s capacity to retain operating experience information. Completion expected in December 2004. Enhance the effectiveness of processes for collecting, reviewing, assessing, storing, retrieving, and disseminating foreign operating experience. Incorporated into the recommendation pertaining to NRC’s capacity to retain operating experience information. Completion expected in December 2004. Update operating experience guidance to reflect the changes implemented in response to recommendations for operating experience. Incorporated into the recommendation pertaining to NRC’s capacity to retain operating experience information. Completion expected in December 2004. Review a sample of NRC evaluations of licensee actions made in response to owners groups’ commitments to identify whether intended actions were effectively implemented. Conduct the recommended review. Completion expected in December 2004. Develop general inspection guidance to periodically verify that licensees implement owners groups’ commitments. Develop inspection procedure to provide a mechanism for regions to support project managers’ ability to verify that licensees implement commitments. Completion expected in December 2004. Conduct follow-on verification of licensee actions pertaining to a sample of resolved generic issues. No specific actions have been identified. Completion expected in December 2004. Review the range of baseline inspections and plant assessment processes to determine sufficiency to identify and dispose of problems like those at Davis-Besse. No specific actions have been identified. Completion expected in December 2004. Identify alternative mechanisms to independently assess licensee plant performance for self-assessing NRC oversight processes and determine the feasibility of such mechanisms. No specific actions have been identified. Completion expected in December 2004. Establish measurements for resident inspector staffing levels and requirements, including standards for satisfying minimum staffing levels. Develop standardized staffing measures and implement details. Metrics were developed in December 2003. Completion expected in December 2004. Structure and focus inspections to assess licensee employee concerns and a "safety conscious work environment.” No specific actions have been identified. Completion expected in December 2004. Recommendations due to be completed in calendar year 2005 Develop inspection guidance and criteria for addressing licensee response to increasing leakage levels and/or adverse trends in unidentified reactor coolant system leakage. Develop recommendations for guidance with action levels to trigger greater NRC interaction with licensees in response to increased leakage. Completion expected in January 2005. Reassess the basis for the cancellation, in 2001, of certain inspection procedures (i.e., boric acid control programs and operational experience feedback) to assess if these procedures are still applicable. Review revised procedures and reactivate as necessary. Completion expected in March 2005. Assess requirements for licensee procedures to respond to plant alarms for leakage to determine whether requirements are sufficient to identify reactor coolant pressure boundary leakage. Review and assess adequacy of requirements and develop recommendations to (1) improve procedures to identify leakage from boundary, (2) establish consistent technical specifications for leakage, and (3) use enhanced leakage detection systems. Completion expected in March 2005. Determine whether licensees should install enhanced systems to detect leakage from the reactor coolant system. Inspect the adequacy of licensee’s programs to control boric acid corrosion, including effectiveness of implementation. Develop guidance to assess adequacy of corrosion control programs, including implementation and effectiveness, and evaluate the status of this effort after the first year of inspections. Guidance expected to be developed by March 2004. Follow-up scheduled for completion in March 2005. Continue ongoing efforts to review and improve the usefulness of barrier integrity performance indicators and evaluate the use of primary system leakage that licensees have identified but not yet corrected as a potential indicator. Develop and implement improved performance indicators based on current requirements and measurements. Explore the use of additional performance indicators to track the number, duration, and rate of system leakage. Determine the feasibility of establishing a risk-informed performance indicator for barrier integrity. Completion expected in December 2005. Recommendations whose completion dates have yet to be determined Encourage the American Society of Mechanical Engineers to revise inspection requirements for nickel-based alloy nozzles. Encourage changes to requirements for nonvisual, nondestructive inspections of vessel head penetration nozzles. Alternatively, revise NRC regulations to address the nature and scope of these inspections. Monitor and provide input to industry efforts to develop revised inspection requirements. Participate in American Society of Mechanical Engineers’ meetings and communicate with appropriate stakeholders. Decide whether to endorse the revised American Society of Mechanical Engineers’ code requirements. These actions parallel a larger NRC rulemaking effort. Completion date yet to be determined. Revise processes to require short- and long-term verification of licensee actions to respond to significant NRC generic communications before closing out issues. Target date to be set upon completion of review of NRC’s generic communications program. Completion date yet to be determined. Determine whether licensee reactor vessel head inspection summary reports should be submitted to NRC and, if so, revise submission requirements and report disposition guidance, as appropriate. Will be included as part of revised American Society of Mechanical Engineers’ requirements for inspection of reactor vessel heads and vessel head penetration nozzles. Completion date yet to be determined. Evaluate the adequacy of methods for analyzing the risk of passive component degradation and integrate these methods and risks into NRC’s decision-making processes. No specific actions have been identified. Completion date yet to be determined. Review pressurized water reactor technical specifications to identify plants that have nonstandard reactor coolant pressure boundary leakage requirements and change specifications to make them consistent among all plants. Assessed plants for nonstandard technical specifications. Completed in July 2003. Change leakage detection specifications in coordination with other changes in leakage detection requirements. Completion date yet to be determined. Improve requirements for unidentified leakage in reactor coolant system to ensure they are sufficient to (1) discriminate between unidentified leaks from the coolant system and leaks from the reactor coolant pressure boundary and (2) ensure that plants do not operate with pressure boundary leakage. Issue regulations implementing the improved requirements when these requirements are determined. Completion date yet to be determined. NRC should review a sample of plant assessments conducted between 1998 and 2000 to determine if any identified plant safety issues have not been adequately assessed. No specific actions have been identified. Completion expected in March 2004. Recommendations rejected by NRC management Review industry approaches licensees use to consider economic factors for inspection and repair and consider this information in formulating future positions on the performance of non-visual inspections of vessel head penetration nozzles. Recommendation rejected by NRC management. No completion date. Revise the criteria for review of industry topical reports to allow for NRC staff review of safety-significant reports that have generic implications but have not been formally submitted for NRC review in accordance with the existing criteria. Recommendation rejected by NRC management. No completion date. The following are GAO’s comments on the Nuclear Regulatory Commission’s letter dated May 5, 2004. 1. We agree with NRC that 10 C.F.R. § 50.9 requires that information provided to NRC by a licensee be complete and accurate in all material respects, and we have added this information to the report. NRC also states that in carrying out its oversight responsibilities, NRC must “rely heavily” on licensees providing accurate information. However, we believe that NRC’s oversight program should not place undue reliance on applicants providing complete and accurate information. NRC also recognizes that it cannot rely solely on information from licensees, as evidenced by its inspection program and process for determining the significance of licensee violations. Under this process, NRC considers whether there are any willful aspects associated with the violation— including the deliberate intent to violate a license requirement or regulation or falsify information. We believe that management controls, including inspection and enforcement, should be implemented by NRC so as to verify whether licensee-submitted information considered to be important for ensuring safety is complete and accurate as required by the regulation. In this regard, as stated in NRC’s enforcement policy guidance, NRC is authorized to conduct inspections and investigations (Atomic Energy Act § 161); revoke licenses for, among other things, a licensee’s making material false statements or failing to build or operate a facility in accordance with the terms of the license (Atomic Energy Act § 186); and impose civil penalties for a licensee’s knowing failure to provide certain safety information to NRC (Energy Reorganization Act § 206). With regard to the draft report conveying the expectation that NRC should have known about the thick layer of boron on the reactor vessel head, we note in the draft report that since at least 1998, NRC was aware that (1) FirstEnergy’s boric acid corrosion control program was inadequate, (2) radiation monitors within the containment area were continuously being clogged by boric acid deposits, (3) the containment air cooling system had to be cleaned repeatedly because of boric acid buildup, (4) corrosion was occurring within containment as evidenced by rust particles being found, and (5) the unidentified leakage rate had increased above the level that historically had been found at the plant. NRC was also aware of the repeated but ineffective attempts by FirstEnergy to correct many of these recurring problems—evidence that the licensee’s programs to identify and correct problems were not effective. Given these indications at Davis-Besse, NRC could have taken more aggressive follow-up action to determine the underlying causes. For example, NRC could have taken action during the fuel outage in 1998, the shutdown to repair valves in mid-1999, or the fuel outage in 2000 to ensure that staff with sufficient knowledge appropriately investigated the types of conditions that could cause these indications, or followed up to ensure that FirstEnergy had fully investigated and successfully resolved the cause of the indications. 2. With respect to the responsibility of the licensee to provide complete and accurate information, see comment 1. As to the Davis-Besse lessons-learned task force finding, we agree that some information provided by FirstEnergy in response to Bulletin 2001-01 may have been inconsistent with some information subsequently identified by NRC’s lessons-learned task force, and that had some of this information been known in the fall of 2001, the vessel head leakage and degradation may have been identified sooner than March 2002. This information included (1) the boric acid accumulations found on the vessel head by FirstEnergy in 1998 and 2000, (2) FirstEnergy’s limited ability to visually inspect the vessel head, (3) FirstEnergy’s boric acid corrosion control procedures relative to the vessel head, (4) FirstEnergy’s program to address the corrosive effects of small amounts of reactor coolant leakage, (5) previous nozzle inspection results, (6) the bases for FirstEnergy’s conclusion that another source of leakage—control rod drive mechanism flanges—was the source of boric acid deposits on the vessel head that obscured multiple nozzles, and (7) photographs of vessel head penetration nozzles. However, various NRC officials knew some of this information, other information should have been known by NRC, and the remaining information could have been obtained had NRC requested it from FirstEnergy. For example, according to the senior resident inspector, he reviewed every Davis-Besse condition report on a daily basis to determine whether the licensee properly categorized the safety significance of the conditions. Vessel head conditions found by FirstEnergy in 1998 and 2000 were noted in such condition reports or in potential-condition-adverse-to-quality reports. According to a FirstEnergy official, photographs of the pressure vessel head nozzles were specifically provided to NRC’s resident inspector, who, although he did not specifically recall seeing the photographs, stated that he had no reason to doubt the FirstEnergy official’s statement. NRC had been aware, in 1999, of limitations in FirstEnergy’s boric acid corrosion control program and, while it cited FirstEnergy for its failure to adequately implement the program, NRC officials did not follow up to determine if the program had improved. Lastly, while NRC questioned the information provided by FirstEnergy in its submissions to NRC in response to Bulletin 2001-01 (regarding vessel head penetration nozzle inspections), NRC staff did not independently review and assess information pertaining to the results of past reactor pressure vessel head inspections and vessel head penetration nozzle inspections. Similarly, NRC did not independently assess the information concerning the extent and nature of the boric acid accumulations found on the vessel head by the licensee during past inspections. “The NRC staff estimated that, giving credit only to the inspection performed in 1996, the probability of a nozzle ejection during the period of operation from December 31, 2001, to February 16, 2002, was in the range of 2E-3 and was an increase in the overall [loss of coolant accident] probability for the plant. The increase in core damage probability and large early release probability were estimated as approximately 5E-6 and 5E-08, respectively.” The probability of a large early release—5E-6—equates to a frequency of 5x10-5 per year. As we note in the report, according to NRC’s regulatory guide 1.174, this frequency would be in the highest risk zone and NRC would generally not approve the requested change. On several occasions, we met with the NRC staff that developed the risk estimate in an attempt to understand how it was calculated. We obtained from NRC staff the risk estimate information provided to senior management in late November 2001, as well as several explanations of how the staff developed its calculations. We were provided with no evidence that NRC estimated the frequency of core damage as being 5x10-6 per year until February 2004, after our consultants and we had challenged NRC’s estimate as being in the highest risk zone under NRC’s regulatory guide 1.174. Furthermore, several NRC staff involved in deciding whether to issue the order to shut down Davis-Besse, or to allow it to continue operating until February 16, 2002, stated that the risk estimate they used was relatively high. 4. We agree that existing regulations provide a spectrum of conditions under which a plant shutdown could occur and that could be interpreted as covering the vast majority of situations. However, we continue to believe that NRC lacks sufficient guidance for making plant shutdown decisions. We disagree on two grounds: First, the decision- making guidance used by NRC to shut down Davis-Besse was guidance for approving license change requests. This guidance provides general direction on how to make risk-informed decisions when licensees request license changes. It does not address important aspects of decision-making involved in deciding whether to shut down a plant. It also does not provide direction on how NRC should weigh deterministic factors in relation to probabilistic factors in making shutdown decisions. Secondly, while NRC views the flexibility afforded by its existing array of guidance as a strength, we are concerned that, even on the basis of the same information or circumstances, staff can arrive at very different decisions. Without more specific guidance, NRC will continue to lack accountability and the degree of credibility needed to convince the industry and the public that its shutdown decisions are sufficiently sound and reasoned for protecting public health and safety. 5. We are aware that the commissioners have specifically decided not to conduct direct evaluations or inspections of safety culture. We agree that as regulators, NRC is not charged with managing licensees’ facilities, but disagree that any direct NRC involvement with safety culture crosses over to a management function. Management is an embodiment of corporate beliefs and perceptions that affect management strategies, goals, and philosophies. These, in turn, impact licensee programs and processes and employee behaviors that have safety outcomes. We believe that NRC should not assess corporate beliefs and perceptions or management strategies, goals, or philosophies. Rather, we believe that NRC has a responsibility to assess licensee programs and processes, as well as employee behaviors. We cite several areas of safety culture in the report as being examples of various aspects of safety culture that NRC can assess which do not constitute “management functions.” The International Atomic Energy Agency has extensive guidance on assessing additional aspects of licensee performance and indicators of safety culture. Such assessments can provide early indications of declining safety culture prior to when negative safety outcomes occur, such as at Davis-Besse. We also agree that NRC has indirect means by which it attempts to assess safety culture. For example, NRC’s problem identification and resolution inspection procedure’s stated objective is to provide an early warning of potential performance issues and insight into whether licensees have established safety conscious work environments. However, we do not believe that the implementation of the inspection procedure has been demonstrated to be effective in meeting its stated objectives. The inspection procedure directs inspectors to screen and analyze trends in all reported power plant issues. In doing so, the procedure directs that inspectors annually review 3 to 6 issues out of potentially thousands of issues that can arise and that are related to various structures, systems, and components necessary for the safe operation of the plant. This requires that inspectors judgmentally sample 3 to 6 issues on which they will focus their inspection resources. While we do not necessarily question inspector judgment when sampling for these 3 to 6 issues, NRC inspectors stated that due to the large number of issues that they can sample from, they try to focus on those issues that they believe have the most relevance for safety. Thus, if an issue is not yet perceived as being important to safety, it is less likely to be selected for follow up. Further, even if an issue were selected for follow up and this indicated that the licensee did not properly identify and resolve underlying problems that contributed to the issue, according to NRC officials, it is highly unlikely that this one issue would rise to a high enough level of significance for it to be noted under NRC’s Reactor Oversight Process. Additionally, the procedure is dependant on the inspector being aware of, and having the capability to, identify issues or trends in the area of safety culture. According to NRC officials, inspectors are not trained in what to look for when assessing licensee safety culture because they are, by and large, nuclear engineers. While they may have an intuition that something is wrong, they may not know how to assess it in terms of safety culture. Additional specific examples NRC cites for indirectly assessing a selected number of safety culture aspects have the following limitations: NRC’s inspection procedure for assessing licensees’ employee concerns program is not frequently used. According to NRC Region III officials, approval to conduct such an inspection must be given by the regional administrator and the justification for the inspection to be performed has to be based on a very high level of evidence that a problem exists. Because of this, these officials said that the inspection procedure has only been implemented twice in Region III. NRC’s allegation program provides a way for individuals working at NRC-regulated plants and the public to provide safety and regulatory concerns directly to NRC. It is a reactive program by nature because it is dependent upon licensees’ employees feeling free and able to come forward to NRC with information about potential licensee misconduct. While NRC follows up on those plants that have a much higher number of allegations than other plants to determine what actions licensees are taking to address any trends in the nature of the allegations, the number of allegations may not always provide an indication of a poor safety culture, and in fact, may be the reverse. For example, the number of allegations at Davis-Besse prior to the discovery of the cavity in the reactor head in March 2002 was relatively small. Between 1997 and 2001, NRC received 10 allegations from individuals at the plant. In contrast, NRC received an average of 31 allegations per plant over the same 5-year period from individuals at other plants. NRC’s lessons-learned reviews, such as the one conducted for Davis- Besse, are generally conducted when an incident having potentially serious safety consequences has already occurred. With respect to NRC’s enforcement of employee protection regulations, NRC, under its current enforcement policy, would normally only take enforcement action when violations are of very significant or significant regulatory concern. This regulatory concern pertains to NRC’s primary responsibility for ensuring safety and safeguards and protecting the environment. Examples of such violations would include the failure of a system designed to prevent a serious safety incident not working when it is needed, a licensed operator being inebriated while at the control of a nuclear reactor, and the failure to obtain prior NRC approval for a license change that has implications for safety. If violations of employee protection regulations do not pose very significant or significant safety, safeguards, or environmental concerns, NRC may consider such violations minor. In such cases, NRC would not normally document such violations in inspection reports or records, and would not take enforcement action. NRC’s Reactor Oversight Process, instituted in April 2000, focuses on seven specific “cornerstones” that support the safety of plant operations to ensure reactor safety, radiation safety, and security. These cornerstones are: (1) the occurrence of operations and events that could lead to a possible accident if safety systems did not work, (2) the ability of safety systems to function as intended, (3) the integrity of the three safety barriers, (4) the effectiveness of emergency preparedness, (5) the effectiveness of occupational radiation safety, (6) the ability to protect the public from radioactive releases, and (7) the ability to physically protect the plant. NRC’s process also includes three elements that cut across these seven cornerstones: (1) human performance, (2) a licensee’s safety- conscious work environment, and (3) problem identification and resolution. NRC assumes that problems in any of these three crosscutting areas will be evidenced in one or more of the seven cornerstones in advance of any serious compromise in the safety of a plant. However, as evidenced by the Davis-Besse incident, this assumption has not proved to be true. NRC also cites lessons-learned task force recommendations to improve NRC’s ability to detect problems in licensee’s safety culture, as a means to achieve our recommendation to directly assess licensee safety culture. These lessons-learned task force recommendations include (1) developing inspection guidance to assess the effect that a licensee’s fuel outage shutdown schedule has on the scope of work conducted during a shutdown; (2) revising inspection guidance to provide for assessing the safety implications of long-standing, unresolved problems; corrective actions being phased in over the course of several years or refueling outages; and deferred plant modifications; (3) revising the problem identification and resolution inspection approach and guidance; and (4) reviewing the range of NRC’s inspections and assessment processes and other NRC programs to determine whether they are sufficient to identify and dispose of the types of problems experienced at Davis-Besse. While we commend these recommendations, we do not believe that revising such guidance will necessarily alert NRC inspectors to early declines in licensee safety culture before they result in negative safety outcomes. Further, because of the nature of NRC’s process for determining the relative safety significance of violations under NRC’s new Reactor Oversight Process, we do not believe that any indications of such declines will result in a cited violation. 6. We have revised the report to reflect that boron in the form of boric acid crystals is dissolved in the cooling water. (See p. 13.) 7. On page 41 of the report, we recognize that NRC also relied on information provided by FirstEnergy regarding the condition of the vessel head. For example, in developing its risk estimate, NRC credited FirstEnergy with a vessel head inspection conducted in 1996. However, NRC decided that the information provided by FirstEnergy documenting vessel head inspections in 1998 and 2000 was of such poor quality that it did not credit FirstEnergy with having conducted them. As a result, NRC’s risk estimate was higher than had these inspections been given credit. 8. The statement made by the NRC regional branch chief was taken directly from NRC’s Office of the Inspector General report on NRC’s oversight of Davis-Besse during the April 2000 refueling outage.9. We agree that up until the Davis-Besse event, NRC had not concluded that boric acid corrosion was a high priority issue. We clarified the text of the report to reflect this comment. (See p. 25.) 10. We agree that plant operators in France decided to replace their vessel heads in lieu of performing the extensive inspections instituted by the French regulatory authority. The report has been revised to add these details. (See p. 31.) 11. We agree that caked-on boron, in combination with leakage, could accelerate corrosion rates under certain conditions. However, even without caked-on boron, corrosion rates could be quite high. Westinghouse’s 1987 report on the corrosive effects of boric acid leakage concluded that the general corrosion rate of carbon steel can be unacceptably high under conditions that can prevail when primary coolant leaks onto surfaces and concentrates at the temperatures that are found on reactor surfaces. In one series of tests that it performed, boric acid solutions corroded carbon steel at a rate of about 0.4 inches per month, or about 4.8 inches a year. This was irrespective of any caked-on boron. In 1987, as a result of that report and extensive boric acid corrosion found at two other nuclear reactors that year—Salem unit 2 and San Onofre unit 2—NRC concluded that a review of existing inspection programs may be warranted to ensure that adequate monitoring procedures are in place to detect boric acid leakage and corrosion before it can result in significant degradation of the reactor coolant pressure boundary. However, NRC did not take any additional action. 12. We agree that NRC has requirements and processes that provide a number of circumstances in which a plant shutdown would or could be required. We also recognize that there were no legal objections to the draft enforcement order to shut down the plant, and that the basis for not issuing the order was NRC’s belief that the plant did not pose an unacceptable risk to public health and safety. The statement in our report that NRC is referring to is discussing one of these circumstances—the licensee’s failure to meet NRC’s technical specification—and whether NRC believed that it had enough proof that the technical specification was not being met. The statement is not discussing the basis for NRC issuing an enforcement order. We revised the report to clarify this point. (See p. 34.) 13. The basis for our statement that NRC staff concluded that the first safety principle was probably not met was its November 29, 2001, briefing to NRC’s Executive Director’s Office and its November 30, 2001, briefing to the NRC commissioners’ technical assistants. These briefings, the basis for which are included in documented briefing slides, took place shortly before NRC formally notified FirstEnergy on December 4, 2001, that it would accept its compromise shutdown date. 14. We are referring to the same document that NRC is referring to—NRC’s December 3, 2002, response to FirstEnergy (NRC’s ADAMS accession number ML023300539). The response consists of a 2-page transmittal letter and an 7.3-page enclosure. The 7.3-page enclosure is 3 pages of background and 4.3 pages of the agency’s assessment. The assessment includes statements that the safety principles were met but does not provide an explanation of how NRC considered or weighed deterministic and probabilistic information in concluding that each of the safety factors were met. For example, NRC concluded that the likelihood of a loss-of-coolant accident was acceptably small because of the (1) staff’s preliminary technical assessment for control rod drive mechanism cracking, (2) evidence of cracking found at other plants similar to Davis-Besse, (3) analytical work performed by NRC’s research staff in support of the effort, and (4) information provided by FirstEnergy regarding past inspections at Davis-Besse. However, the assessment does not explain how these four pieces of information successfully demonstrated if and how each of the safety principles was met. The assessment also states that NRC examined the five safety principles, the fifth of which is the ability to monitor the effects of a risk-informed decision. The assessment is silent on whether this principle is met. However, in NRC’s November 29, 2001, briefing to NRC’s Executive Director’s Office and in its November 30, 2001, briefing to the NRC commissioners’ technical assistants, NRC concluded that this safety principle was not met. As noted above, NRC formally notified FirstEnergy on December 4, 2001, that it would accept FirstEnergy’s February 16, 2002, shutdown date. 15. See comment 3. We do not agree that the report statements mischaracterize the facts. Rather, we are concerned that NRC is misusing basic quantitative mathematics. In addition, with regard to NRC’s concept of an annual average change in the frequency of core damage, NRC stated that the agency averaged the frequency of core damage that would exist for the 7-week period of time (representing the period of time between December 31, 2001, and February 16, 2002) over the entire 1-year period, using the assumption that the frequency of core damage would be zero for the remainder of the year—February 17, 2002, to December 31, 2002. According to our consultants, this calculation artificially reduced NRC’s risk estimate to a level that is acceptable under NRC’s guidance. By this logic, our consultants stated, risks can always be reduced by spreading them over time; by assuming another 10 years of plant operation (or even longer) NRC could find that its calculated “risks” are completely negligible. They further stated that NRC’s approach is akin to arguing that an individual, who drives 100 miles per hour 10 percent of the time, with his car otherwise garaged, should not be cited because his time-average speed is only 10 miles per hour. Further, our consultants concluded that the “annual-average” core damage frequency approach was also clearly unnecessary, since one need only convert a core damage frequency to a core damage probability to handle part-year cases like the Davis-Besse case. Lastly, we find no basis for the calculation in any NRC guidance. According to our consultants, this new interpretation of NRC’s guidance is at best unusual and certainly is inconsistent with NRC’s guidelines regarding the use of an incremental core damage frequency. This interpretation also reinforces our consultants’ impression that perhaps there was, in November 2001 and possibly is still today, some confusion among the NRC staff regarding basic quantitative metrics that should be considered in evaluating regulatory and safety issues. As noted in comment 3, we found no evidence of this calculation prior to February 2004. 16. While we agree that vessel head corrosion as extensive as later found at Davis-Besse was not anticipated, NRC had known that leakage of the primary coolant from a through-wall crack could cause boric acid corrosion of the vessel head, as evidenced by the Westinghouse work cited above. Regardless of information provided to NRC by individual licensees, such as FirstEnergy, NRC’s model should account for known risks, including the potential for corrosion. 17. We agree that NRC was aware of control rod drive mechanism nozzle cracking at French nuclear power plants. NRC provided us additional information consisting of a December 15, 1994, internal memo, in which NRC concluded that primary coolant leakage from a through-wall crack could cause boric acid corrosion of the vessel head. However, because some analyses indicated that it would take at least 6 to 9 years before any corrosion would challenge the structural integrity of the head, NRC concluded that cracking was not a short-term safety issue. We revised the report to include this additional information. (See p. 40.) 18. See comment 15. 19. We agree that while not directly relevant to the Davis-Besse situation, NRC uses regulatory guide 1.177 to make decisions on whether certain equipment can be inoperable while a nuclear reactor is operating, which can pose very high instantaneous risks for very short periods of time. However, we include the reference to this particular guidance in the report because it was cited by an NRC official involved in the Davis- Besse decision-making process as another piece of guidance used in judging whether the risk that Davis-Besse posed was acceptable. 20. While regulatory guide 1.174 comprises 25 pages of guidance on how to use risk in making decisions on whether to allow license changes, it does not lay out how NRC staff are to use quantitative estimates of risk or probabilistic factors, or how robust these estimates must be in order to be considered along with more deterministic factors. The regulatory guide, which was first issued in mid-1998, had been in effect for only about 1.5 years when NRC staff was tasked with making their decision on Davis-Besse. According to the Deputy Executive Director of Nuclear Reactor Programs at the time the decision was being made, the agency was trying to bring the staff through the risk-informed decision-making process because Davis-Besse was a learning tool. He further stated that it was really the first time the agency had used the risk-informed decision-making process on operational decisions as opposed to programmatic decisions for licensing. At the time the decision was made, and currently, NRC has no guidance or criteria for use in assessing the quality of risk estimates or clear guidance or criteria for how risk estimates are to be weighed against other risk factors. 21. The December 3, 2002, safety assessment or evaluation did state that the estimated increase in core damage frequency was consistent with NRC’s regulatory guidelines. However, as noted in comment 3, we disagree with this conclusion. In addition, while we agree that NRC has staff with risk assessment disciplines, we found no reference to these staff in NRC’s safety evaluation. We also found no reference to NRC’s statement that these staff gave more weight to deterministic factors in arriving at the agency’s decision. While we endorse NRC’s consideration of deterministic as well as probabilistic factors and the use of a risk-informed decision-making process, we continue to maintain that NRC needs clear guidance and criteria for the quality of risk estimates, standards of evidence, and how to apply deterministic as well as probabilistic factors in plant shutdown decisions. As the agency continues to incorporate a risk-informed process into much of its regulatory guidance and programs, such criteria will be increasingly important when making shutdown as well as other types of decisions regarding nuclear power plants. 22. The information that NRC provided us indicates that completion dates for 2 of the 22 high priority recommendations have slipped. One, the completion date for encouraging the American Society of Mechanical Engineers to revise vessel head penetration nozzle inspection requirements or, alternatively, for revising NRC’s regulations for vessel head inspections has slipped from June 2004 to June 2006. Two, the completion date for assessing NRC’s requirements that licensees have procedures for responding to plant leakage alarms to determine if the requirements are sufficient for identifying reactor coolant pressure boundary leakage has slipped from March 2004 to March 2005. 23. We agree with this comment and have revised the report to reflect this clarification. (See p. 49.) 24. Our estimate of at least an additional 200 hours of inspection per reactor per year is based on: NRC’s new requirement that its resident inspectors review all licensee corrective action items on a daily basis (approximately 30 minutes per day). Given that reactors are intended to operate continuously throughout the year, this results in about 3.5 hours per week for reviewing corrective action items, or about 182 hours per year. In addition, resident inspections are now required to determine, on a semi-annual basis, whether such corrective action items reflect any trends in licensee performance (16 to 24 hours per year). The total increase for these new requirements is about 198 to 206 hours per reactor per year. A new NRC requirement that its resident inspectors validate that licensees comply with additional inspection commitments made in response to NRC’s 2002 generic bulletin regarding reactor pressure vessel head and vessel head penetration nozzles. This requirement results in an additional 15 to 50 hours per reactor per fuel outage. 25. Our draft report included a discussion that NRC management’s failure to recognize the scope or breadth of actions and resources necessary to fully implement task force recommendations could adversely affect how effective the actions may be. We made this statement based on NRC’s initial response to the Office of the Inspector General’s October 2003 report on Davis-Besse. That report concluded that ineffective communication within NRC’s Region III and between Region III and NRC headquarters contributed to the Davis-Besse incident. NRC, in its January 2004 response to the report, stated that among other things, it had developed training on boric acid corrosion and revised its inspection program to require semi-annual trend reviews. In February 2004, the Office of the Inspector General criticized NRC for limiting the agency’s efforts in responding to its findings. Specifically, it stated that NRC did not address underlying and generic communication failures identified in the Office’s report. In response to the criticism, on April 19, 2004 (while our draft report was with NRC for review and comment), NRC provided the Office of the Inspector General with additional information to demonstrate that its actions to improve communication within the agency were broader than indicated in the agency’s January 2004 response. Based on NRC’s April 19, 2004, response and the Office’s agreement that NRC’s actions appropriately address its concerns about communication within the agency, we deleted this discussion in the report. 26. We recognize that the lessons-learned task force did not make a recommendation for improving the agency’s decision-making process because the task force coordinated with the Office of the Inspector General regarding the scope of their respective review activities and because the task force was primarily charged with determining why the vessel head degradation was not prevented. (See p. 55.) 27. We agree that NRC’s December 3, 2002, documentation of its decision was prepared in response to a finding by the Davis-Besse lessons- learned task force. We revised our report to incorporate this fact. (See p. 55.) 28. We agree that NRC’s lessons-learned task force conducted a preliminary review of reports from previous lessons-learned task forces and, as a result of that review, made a recommendation that the agency perform a more detailed effectiveness review of the actions taken in response to those reviews. We revised the report to reflect that NRC’s detailed review is currently underway. (See p. 55.) In addition, Heather L. Barker, David L. Brack, William F. Fenzel, Michael L. Krafve, William J. Lanouette, Marcia Brouns McWreath, Judy K. Pagano, Keith A. Rhodes, and Carol Hernstadt Shulman made key contributions to this report. Management Weaknesses Affect Nuclear Regulatory Commission Efforts to Address Safety Issues Common to Nuclear Power Plants. GAO-RCED- 84-149.Washington, D.C.: September 19, 1984. Probabilistic Risk Assessment: An Emerging Aid to Nuclear Power Plant Safety Regulation. GAO-RCED-85-11. Washington, D.C.: June 19, 1985. The Nuclear Regulatory Commission Should Report on Progress in Implementing Lessons Learned from the Three Mile Island Accident. GAO-RCED-85-72. Washington, D.C.: July 19, 1985. Nuclear Regulation: Oversight of Quality Assurance at Nuclear Power Plants Needs Improvement. GAO-RCED-86-41.Washington, D.C.: January 23, 1986. Nuclear Regulation: Efforts to Ensure Nuclear Power Plant Safety Can Be Strengthened. GAO-RCED-87-141. Washington, D.C.: August 13, 1987. Nuclear Regulation: NRC’s Restart Actions Appear Reasonable—but Criteria Needed. GAO-RCED-89-95.Washington, D.C.: May 4, 1989. Nuclear Regulation: NRC’s Efforts to Ensure Effective Plant Maintenance Are Incomplete. GAO-RCED-91-36. Washington, D.C.: December 17, 1990. Nuclear Regulation: NRC’s Relationship with the Institute of Nuclear Power Operations. GAO-RCED-91-122. Washington, D.C.: May 16, 1991. Nuclear Regulation: Weaknesses in NRC’s Inspection Program at a South Texas Nuclear Power Plant. GAO-RCED-96-10. Washington, D.C.: October 3, 1995. Nuclear Regulation: Preventing Problem Plants Requires More Effective NRC Action. GAO-RCED-97-145. Washington, D.C.: May 30, 1997. Nuclear Regulatory Commission: Preventing Problem Plants Requires More Effective Action by NRC. GAO-T-RCED-98-252. Washington, D.C.: July 30, 1998. Nuclear Regulatory Commission: Strategy Needed to Develop a Risk- Informed Safety Approach. GAO-T-RCED-99-71. Washington, D.C.: February 4, 1999. Nuclear Regulation: Strategy Needed to Regulate Safety Using Information on Risk. GAO-RCED-99-95. Washington, D.C.: March 19, 1999. Nuclear Regulation: Regulatory and Cultural Changes Challenge NRC. GAO/T-RCED-00-115. Washington, D.C.: March 9, 2000. Major Management Challenges and Performance Risks at the Nuclear Regulatory Commission. GAO-01-259. Washington, D.C.: January 2001. Nuclear Regulation: Progress Made in Emergency Preparedness at Indian Point 2, but Additional Improvements Needed. GAO-01-605. Washington, D.C.: July 30, 2001. Nuclear Regulation: Challenges Confronting NRC in a Changing Regulatory Environment. GAO-01-707T. Washington, D.C.: May 8, 2001. Nuclear Regulatory Commission: Status of Achieving Key Outcomes and Addressing Major Management Challenges. GAO-01-760. Washington, D.C.: June 29, 2001. Managing for Results: Efforts to Strengthen the Link between Resources and Results at the Nuclear Regulatory Commission. GAO-03-258. Washington, D.C.: December 10, 2002. Nuclear Regulatory Commission: Oversight of Security at Commercial Nuclear Power Plants Needs to Be Strengthened. GAO-03-752. Washington, D.C.: September 4, 2003. The General Accounting Office, the audit, evaluation and investigative arm of Congress, exists to support Congress in meeting its constitutional responsibilities and to help improve the performance and accountability of the federal government for the American people. GAO examines the use of public funds; evaluates federal programs and policies; and provides analyses, recommendations, and other assistance to help Congress make informed oversight, policy, and funding decisions. GAO’s commitment to good government is reflected in its core values of accountability, integrity, and reliability. The fastest and easiest way to obtain copies of GAO documents at no cost is through the Internet. GAO’s Web site (www.gao.gov) contains abstracts and full- text files of current reports and testimony and an expanding archive of older products. The Web site features a search engine to help you locate documents using key words and phrases. You can print these documents in their entirety, including charts and other graphics. Each day, GAO issues a list of newly released reports, testimony, and correspondence. GAO posts this list, known as “Today’s Reports,” on its Web site daily. The list contains links to the full-text document files. To have GAO e-mail this list to you every afternoon, go to www.gao.gov and select “Subscribe to e-mail alerts” under the “Order GAO Products” heading.

Summary: In March 2002, the most serious safety issue confronting the nation's commercial nuclear power industry since Three Mile Island in 1979 was identified at the Davis- Besse plant in Ohio. After the Nuclear Regulatory Commission (NRC) allowed Davis-Besse to delay shutting down to inspect its reactor vessel for cracked tubing, the plant found that leakage from these tubes had caused extensive corrosion on the vessel head--a vital barrier preventing a radioactive release. GAO determined (1) why NRC did not identify and prevent the corrosion, (2) whether the process NRC used in deciding to delay the shutdown was credible, and (3) whether NRC is taking sufficient action in the wake of the incident to prevent similar problems from developing at other plants. NRC should have but did not identify or prevent the corrosion at Davis- Besse because its oversight did not generate accurate information on plant conditions. NRC inspectors were aware of indications of leaking tubes and corrosion; however, the inspectors did not recognize the indications' importance and did not fully communicate information about them. NRC also considered FirstEnergy--Davis-Besse's owner--a good performer, which resulted in fewer NRC inspections and questions about plant conditions. NRC was aware of the potential for cracked tubes and corrosion at plants like Davis-Besse but did not view them as an immediate concern. Thus, NRC did not modify its inspections to identify these conditions. NRC's process for deciding to allow Davis-Besse to delay its shutdown lacks credibility. Because NRC had no guidance specifically for making a decision on whether a plant should shut down, it used guidance for deciding whether a plant should be allowed to modify its operating license. NRC did not always follow this guidance and generally did not document how it applied the guidance. The risk estimate NRC used to help decide whether the plant should shut down was also flawed and underestimated the amount of risk that Davis-Besse posed. Further, even though underestimated, the estimate still exceeded risk levels generally accepted by the agency. NRC has taken several significant actions to help prevent reactor vessel corrosion from recurring at nuclear power plants. NRC has required more extensive vessel examinations and augmented inspector training. However, NRC has not yet completed all of its planned actions and, more importantly, has no plans to address three systemic weaknesses underscored by the incident. Specifically, NRC has proposed no actions to help it better (1) identify early indications of deteriorating safety conditions at plants, (2) decide whether to shut down a plant, or (3) monitor actions taken in response to incidents at plants. Both NRC and GAO had previously identified problems in NRC programs that contributed to the Davis-Besse incident, yet these problems continue to persist.