    Nuclear Regulation: NRC Needs to More Aggressively and
    Comprehensively Resolve Issues Related to the Davis-Besse Nuclear
    Power Plant's Shutdown (17-MAY-04, GAO-04-415).

    In March 2002, the most serious safety issue confronting the
    nation's commercial nuclear power industry since Three Mile
    Island in 1979 was identified at the Davis- Besse plant in Ohio.
    After the Nuclear Regulatory Commission (NRC) allowed Davis-Besse
    to delay shutting down to inspect its reactor vessel for cracked
    tubing, the plant found that leakage from these tubes had caused
    extensive corrosion on the vessel head--a vital barrier
    preventing a radioactive release. GAO determined (1) why NRC did
    not identify and prevent the corrosion, (2) whether the process
    NRC used in deciding to delay the shutdown was credible, and (3)
    whether NRC is taking sufficient action in the wake of the
    incident to prevent similar problems from developing at other
    plants.
    -------------------------Indexing Terms-------------------------
    REPORTNUM:   GAO-04-415
        ACCNO:   A10014
      TITLE:     Nuclear Regulation: NRC Needs to More Aggressively and
    Comprehensively Resolve Issues Related to the Davis-Besse Nuclear
    Power Plant's Shutdown
         DATE:   05/17/2004
      SUBJECT:   Inspection
    	     Nuclear powerplant safety
    	     Nuclear powerplants
    	     Nuclear reactors
    	     Safety regulation
    	     Regulatory agencies

    ******************************************************************
    ** This file contains an ASCII representation of the text of a  **
    ** GAO Product.                                                 **
    **                                                              **
    ** No attempt has been made to display graphic images, although **
    ** figure captions are reproduced.  Tables are included, but    **
    ** may not resemble those in the printed version.               **
    **                                                              **
    ** Please see the PDF (Portable Document Format) file, when     **
    ** available, for a complete electronic file of the printed     **
    ** document's contents.                                         **
    **                                                              **
    ******************************************************************
    GAO-04-415

    United States General Accounting Office

                         GAO Report to Congressional Requesters

    May 2004

    NUCLEAR REGULATION

    NRC Needs to More Aggressively and Comprehensively Resolve Issues Related to the
                       Davis-Besse Nuclear Power Plant's Shutdown

                                           a

    GAO-04-415

    Highlights of GAO-04-415, a report to congressional requesters

    In March 2002, the most serious safety issue confronting the nation's
    commercial nuclear power industry since Three Mile Island in 1979 was
    identified at the Davis-Besse plant in Ohio. After the Nuclear Regulatory
    Commission (NRC) allowed Davis-Besse to delay shutting down to inspect its
    reactor vessel for cracked tubing, the plant found that leakage from these
    tubes had caused extensive corrosion on the vessel head-a vital barrier
    preventing a radioactive release. GAO determined (1) why NRC did not
    identify and prevent the corrosion, (2) whether the process NRC used in
    deciding to delay the shutdown was credible, and (3) whether NRC is taking
    sufficient action in the wake of the incident to prevent similar problems
    from developing at other plants.

    Because the nation's nuclear power plants are aging, GAO is recommending
    that NRC take more aggressive actions to mitigate the risk of serious
    safety problems occurring at Davis-Besse and other nuclear power plants.

    NRC disagreed with two of the report's five recommendations- that it
    develop (1) additional means to better identify safety problems early and
    (2) guidance for making decisions whether to shut down a plant. GAO
    continues to believe these recommendations are appropriate and should be
    implemented.

    www.gao.gov/cgi-bin/getrpt?GAO-04-415.

    To view the full product, including the scope and methodology, click on
    the link above. For more information, contact Jim Wells at (202) 512-3841
    or wellsj@gao.gov.

    May 2004

    NUCLEAR REGULATION

    NRC Needs to More Aggressively and Comprehensively Resolve Issues Related to the
    Davis-Besse Nuclear Power Plant's Shutdown

    NRC should have but did not identify or prevent the corrosion at
    Davis-Besse because its oversight did not generate accurate information on
    plant conditions. NRC inspectors were aware of indications of leaking
    tubes and corrosion; however, the inspectors did not recognize the
    indications' importance and did not fully communicate information about
    them. NRC also considered FirstEnergy-Davis-Besse's owner-a good
    performer, which resulted in fewer NRC inspections and questions about
    plant conditions. NRC was aware of the potential for cracked tubes and
    corrosion at plants like Davis-Besse but did not view them as an immediate
    concern. Thus, NRC did not modify its inspections to identify these
    conditions.

    NRC's process for deciding to allow Davis-Besse to delay its shutdown
    lacks credibility. Because NRC had no guidance specifically for making a
    decision on whether a plant should shut down, it used guidance for
    deciding whether a plant should be allowed to modify its operating
    license. NRC did not always follow this guidance and generally did not
    document how it applied the guidance. The risk estimate NRC used to help
    decide whether the plant should shut down was also flawed and
    underestimated the amount of risk that Davis-Besse posed. Further, even
    though underestimated, the estimate still exceeded risk levels generally
    accepted by the agency.

    NRC has taken several significant actions to help prevent reactor vessel
    corrosion from recurring at nuclear power plants. For example, NRC has
    required more extensive vessel examinations and augmented inspector
    training. However, NRC has not yet completed all of its planned actions
    and, more importantly, has no plans to address three systemic weaknesses
    underscored by the incident. Specifically, NRC has proposed no actions to
    help it better (1) identify early indications of deteriorating safety
    conditions at plants, (2) decide whether to shut down a plant, or (3)
    monitor actions taken in response to incidents at plants. Both NRC and GAO
    had previously identified problems in NRC programs that contributed to the
    Davis-Besse incident, yet these problems continue to persist.

    The Davis-Besse Nuclear Power Plant in Oak Harbor, Ohio

    Contents

      Letter

    Scope and Methodology
    Results in Brief
    Background
    NRC's Actions to Oversee Davis-Besse Did Not Provide an Accurate

    Assessment of Safety at the Plant NRC's Process for Deciding Whether to
    Allow a Delayed Davis-Besse Shutdown Lacked Credibility NRC Has Made
    Progress in Implementing Recommended Changes,

    but Is Not Addressing Important Systemic Issues Conclusions
    Recommendations for Executive Action Agency Comments and Our Evaluation

    1 3 5 8

    20

    33

    45 57 59 60

    Appendixes

    Appendix I:

    Appendix II:

    Appendix III:

    Appendix IV:

    Appendix V:

    Time Line Relating Significant Events of Interest

    Analysis of the Nuclear Regulatory Commission's Probabilistic Risk
    Assessment for Davis-Besse

    Davis-Besse Task Force Recommendations to NRC and Their Status, as of
    March 2004

    Comments from the Nuclear Regulatory Commission

    GAO Comments

    GAO Contacts and Staff Acknowledgments

    GAO Contacts
    Staff Acknowledgments

    64

    65

    89

    94 114

    129 129 129

    Related GAO Products

        Table     Table 1: Status of Davis-Besse Lessons-Learned Task Force
                              Recommendations, as of March 2004                47
    Figures       Figure 1: Major Components of a Pressurized Water Reactor 12
                  Figure 2: Major Components of the Davis-Besse Reactor Vessel
                                 Head and Pressure Boundary                    13
               Figure 3: Diagram of the Cavity in Davis-Besse's Reactor Vessel
                                            Head                               17

    Contents

    Figure 4:	The Cavity in Davis-Besse's Reactor Vessel Head after Discovery
    18

    Figure 5:	Rust and Boric Acid on Davis-Besse's Vessel Head as Shown to
    Resident Inspector during the 2000 Refueling Outage 23

    Figure 6:	NRC's Acceptance Guidelines for Core Damage Frequency 43

    Abbreviations

    NRC Nuclear Regulatory Commission PRA Probabilistic risk assessment

    This is a work of the U.S. government and is not subject to copyright
    protection in the United States. It may be reproduced and distributed in
    its entirety without further permission from GAO. However, because this
    work may contain copyrighted images or other material, permission from the
    copyright holder may be necessary if you wish to reproduce this material
    separately.

    A

    United States General Accounting Office Washington, D.C. 20548

    May 17, 2004

    Congressional Requesters

    In 2002, the most serious safety issue confronting the nation's commercial
    nuclear power industry since the accident at Three Mile Island in 1979 was
    identified at the Davis-Besse nuclear power plant in northwestern Ohio. On
    March 7, 2002, during shutdown for inspection and refueling, the owner of
    the Davis-Besse plant-FirstEnergy Nuclear Operating Company- discovered a
    pineapple-sized cavity in the plant's carbon steel reactor vessel head.
    The reactor vessel head is an 18-foot-diameter, 6-inch-thick, 80-ton cap
    that is bolted to the reactor vessel. The vessel head is an integral part
    of the reactor coolant pressure boundary that serves as a vital barrier
    for protecting the environment from any release of radiation from the
    reactor core. In pressurized water reactors such as the one at
    Davis-Besse, the reactor vessel contains the nuclear fuel, as well as
    water with diluted boric acid that cools the fuel and helps control the
    nuclear reaction. At the Davis-Besse plant, vertical tubes had cracked
    that penetrate the reactor vessel head and that contain this water as well
    as drive mechanisms used to lower and raise the fuel, thus allowing leaked
    boric acid to corrode the reactor vessel head. The corrosion had extended
    through the vessel head to a thin stainless steel lining and had likely
    occurred over a period of several years. The lining, which is less than
    one-third of an inch thick and was not designed as a pressure barrier, was
    found to have a slight bulge with evidence of cracking. Had this lining
    given way, the water within the reactor vessel would have escaped,
    triggering a loss-of-coolant accident, which-if back-up safety systems had
    failed to operate-likely would have resulted in the melting of the
    radioactive core and a subsequent release of radioactive materials into
    the environment. In March 2004, after 2 years of increased NRC oversight
    and considerable repairs by FirstEnergy, NRC approved the restart of
    Davis-Besse's operations.

    Under the Atomic Energy Act of 1954, as amended, and the Energy
    Reorganization Act of 1974, as amended, the Nuclear Regulatory Commission
    (NRC) and the operators of nuclear power plants share the responsibility
    for ensuring that nuclear reactors are operated safely. NRC is responsible
    for issuing regulations, licensing and inspecting plants, and requiring
    action, as necessary, to protect public health and safety; plant operators
    have the primary responsibility for safely operating the plants in
    accordance with their licenses. NRC has the authority to order plant
    operators to take actions, up to and including shutting down a plant, if
    licensing conditions are not being met and the plant poses an undue risk
    to

    public health and safety. In carrying out its responsibilities, NRC relies
    on, among other things, on-site NRC resident inspectors to assess plant
    conditions and quality assurance programs, such as those for maintenance
    and operations, that operators establish to ensure safety at the plant.

    Before the discovery of the cavity in the Davis-Besse reactor vessel head,
    NRC had requested that operators of Davis-Besse and other similar
    pressurized water reactors (1) thoroughly inspect the vertical tubing on
    their reactor vessel heads by December 31, 2001, for possible cracking, or
    (2) justify why their tubing and reactor vessel heads were sufficiently
    safe without being inspected. This request was a reaction to cracked
    vertical tubing found on a pressurized water reactor vessel head at
    another plant. Such thorough inspections require that the reactor be shut
    down. FirstEnergy, believing that its reactor vessel head was safe, asked
    NRC if its shutdown could be delayed until the end of March 2002 to
    coincide with an already scheduled shutdown for refueling-during which
    time it would conduct the requested inspection. FirstEnergy provided
    evidence supporting its assertion that the reactor could continue
    operating safely. After considerable discussion, and after NRC developed a
    risk assessment estimate for deciding that Davis-Besse would not pose an
    unacceptable level of risk, NRC and FirstEnergy compromised, and
    FirstEnergy agreed to shut down the reactor in mid-February 2002 for
    inspection. Soon after Davis-Besse was shut down, the cracked tubes and
    the significant reactor vessel head corrosion were discovered.

    You asked us to determine (1) why NRC did not identify and prevent the
    vessel head corrosion at Davis-Besse, (2) whether the process NRC used
    when deciding to allow FirstEnergy to delay its shutdown was credible, and
    (3) whether NRC is taking sufficient action in the wake of the Davis-Besse
    incident to prevent similar problems from developing in the future at
    Davis-Besse and other nuclear power plants. As agreed with your offices,
    our review focused on NRC's role in the events leading up to Davis-Besse's
    shutdown, NRC's response to the problems discovered, and NRC's management
    controls over programs and processes that may have contributed to the
    Davis-Besse incident. We did not evaluate the role of FirstEnergy because,
    at the time of our review, NRC's Office of Investigations and the
    Department of Justice were conducting separate inquiries into the
    potential liability of FirstEnergy concerning its knowledge of conditions
    at Davis-Besse, including the condition of the reactor vessel head. We
    also did not review NRC's March 2004 decision to allow the plant to
    restart.

    Scope and Methodology

    To determine why NRC did not identify and prevent the vessel head
    corrosion at the Davis-Besse nuclear power plant, we reviewed NRC's
    lessons-learned task force report;1 FirstEnergy's root cause analysis
    reports;2 NRC's Office of the Inspector General reports on Davis-Besse;3
    NRC's augmented inspection team report;4 and NRC's inspection reports and
    licensee assessments from 1998 through 2001. We also reviewed NRC generic
    communications issued on boric acid corrosion and on nozzle cracking. In
    addition, we interviewed NRC regional officials who were involved in
    overseeing Davis-Besse at the time corrosion was occurring, and when the
    reactor vessel head cavity was found, to learn what information they had,
    their knowledge of plant activities, and how they communicated information
    to headquarters. We also held discussions with the resident inspector who
    was at Davis-Besse at the time that corrosion was occurring to determine
    what information he had and how this information was communicated to the
    regional office. Further, we met with FirstEnergy and NRC officials at
    Davis-Besse and walked through the facility, including the containment
    building, to understand the nature and extent of NRC's oversight of
    licensees. Additionally, we met with NRC headquarters officials to discuss
    the oversight process as it related to Davis-Besse, and the extent of
    their knowledge of conditions at Davis-Besse. We also met with county
    officials from Ottawa County, Ohio, to discuss their views on NRC and
    Davis-Besse plant safety. Further, we met with representatives from a
    variety of public interest groups to obtain their thoughts on NRC's
    oversight and the agency's proposed changes in the wake of Davis-Besse.

    1NRC, Degradation of Davis-Besse Nuclear Power Station Reactor Pressure
    Vessel Head Lessons-Learned Report (Washington, D.C.; Sept. 30, 2002).

    2FirstEnergy, Davis-Besse Nuclear Power Station, Root Cause Analysis
    Report: Significant Degradation of the Reactor Pressure Vessel Head, CR
    2002-089 (Oak Harbor, Ohio; Aug. 27, 2002) and Root Cause Analysis Report:
    Failure to Identify Significant Degradation of the Reactor Pressure Vessel
    Head, CR-02-0685, 02-0846, 02-0891, 02-1053, 02-1128, 021583, 02-1850,
    02-2584, and 02-2585 (Oak Harbor, Ohio; Aug. 13, 2002).

    3NRC, Office of the Inspector General, NRC's Regulation of Davis-Besse
    Regarding Damage to the Reactor Vessel Head (Washington, D.C.; Dec. 30,
    2002) and NRC's Oversight of Davis-Besse Boric Acid Leakage and Corrosion
    during the April 2000 Refueling Outage

    (Washington, D.C.: Oct. 17, 2003).

    4NRC, Davis-Besse Nuclear Power Station NRC Augmented Inspection Team-
    Degradation of the Reactor Pressure Vessel Head (Washington, D.C.; May 3,
    2002).

    To determine whether the process NRC used was credible when deciding to
    allow Davis-Besse to delay its shutdown, we evaluated NRC guidelines for
    reviewing licensee requests for temporary and permanent license changes,
    or amendments to their licenses. We also reviewed NRC guidance for making
    and documenting agency decisions, such as those on whether to accept
    licensee responses to generic communications, as well as NRC's policies
    and procedures for taking enforcement action. We supplemented these
    reviews with an analysis of internal NRC correspondence related to the
    decision-making process, including e-mail correspondence, notes, and
    briefing slides. We also reviewed NRC's request for additional information
    to FirstEnergy following the issuance of NRC's generic bulletin for
    conducting reactor vessel head and nozzle inspections, as well as
    responses provided by FirstEnergy. In addition, we reviewed the draft
    shutdown order that NRC prepared before accepting FirstEnergy's proposal
    to conduct its inspection in mid-February 2002. We reviewed these
    documents to determine whether the basis for NRC's decision was clearly
    laid out, persuasive, and defensible to a party outside of NRC.

    As part of our analysis for determining whether NRC's process was
    credible, we also obtained and reviewed NRC's probabilistic risk
    assessment (PRA) calculations that it developed to guide its decision
    making. To conduct this analysis, we relied on the advice of consultants
    who, collectively, have an extensive background in nuclear engineering,
    PRA, and metallurgy. These consultants included Dr. John C. Lee, Professor
    and Chair, Nuclear Engineering and Radiological Sciences at the University
    of Michigan's College of Engineering; Dr. Thomas H. Pigford, Professor
    Emeritus, at the University of California-Berkeley's College of
    Engineering; and Dr. Gary S. Was, Associate Dean for Research in the
    College of Engineering, and Professor, Nuclear Engineering and
    Radiological Sciences at the University of Michigan's College of
    Engineering. These consultants reviewed internal NRC correspondence
    relating to NRC's PRA estimate, NRC's calculations, and the basis for
    these calculations. These consultants also discussed the basis for NRC's
    estimates with NRC officials and outside contractors who provided
    information to NRC as it developed its estimates. These consultants were
    selected on the basis of recommendations made by other nuclear engineering
    experts, their resumes, their collective experience, lack of a conflict of
    interest, and previous experience with assessing incidents at nuclear
    power plants such as Three Mile Island.

    To determine whether NRC is taking sufficient action in the wake of the
    Davis-Besse incident to prevent similar problems from developing in the
    future, we reviewed NRC's lessons-learned task force recommendations,

    NRC's analysis of the underlying causes for failing to identify the
    corrosion of the reactor vessel head, and NRC's action plan developed in
    response to the task force recommendations. We also reviewed other NRC
    lessonslearned task force reports and their recommendations, our prior
    reports to identify issues related to those at Davis-Besse, and NRC's
    Office of the Inspector General reports. We met with NRC officials
    responsible for implementing task force recommendations to obtain a clear
    understanding of the actions they were taking and the status of their
    efforts, and discussed NRC's recommendations with NRC regional officials,
    on-site inspectors, and representatives from public interest groups. We
    conducted our review from November 2002 through May 2004 in accordance
    with generally accepted government auditing standards.

    Results in Brief	NRC should have but did not identify or prevent the
    vessel head corrosion at Davis-Besse because both its inspections at the
    plant and its assessments of the operator's performance yielded inaccurate
    and incomplete information on plant safety conditions. With respect to
    inspections, NRC resident inspectors had information revealing potential
    problems, such as boric acid deposits on the vessel head and air monitors
    clogged with boric acid deposits, but this information did not raise
    alarms about the plant's safety. NRC inspectors did not know that these
    indications could signal a potentially significant problem and therefore
    did not fully communicate their observations to other NRC staff, some of
    whom might have recognized the significance of the problem. However, even
    if these staff had been informed, according to NRC officials, the agency
    would have taken action only if these indications were considered
    significant safety concerns. Furthermore, NRC's assessments of
    Davis-Besse, which include inspection results as well as other data, did
    not provide complete and accurate information on FirstEnergy's
    performance. For example, NRC consistently assessed Davis-Besse's operator
    as a "good performer" during those years when the corrosion was likely
    occurring, and the operator was not correctly identifying the source of
    boric acid deposits. NRC had been aware for several years that corrosion
    and cracking were issues that could possibly affect safety, but did not
    view them as immediate safety concerns and therefore had not fully
    incorporated them into its oversight process.

    NRC's process for deciding whether Davis-Besse could delay its shutdown to
    inspect for nozzle cracking lacks credibility because the guidance NRC
    used was not intended for making such a decision and the basis for the
    decision was not fully documented. In the absence of written guidance
    specifically intended to direct the decision-making process for a
    shutdown,

    NRC used guidance designed for considering operator requests for license
    amendments. This guidance describes safety factors that NRC should
    consider in deciding whether to approve a license amendment, as well as a
    process for considering the relative risk the amendment could pose.
    However, the guidance does not specify how NRC should use the safety
    factors, and we could not determine if NRC appropriately followed this
    guidance because it did not clearly document the basis for its decision.
    For example, NRC initially decided that several safety factors were not
    met and considered issuing a shutdown order. Regardless, the agency
    allowed FirstEnergy to delay its shutdown, even though it is not clear
    whether- and if so, how-the safety factors were subsequently met. Further,
    NRC did not provide a rationale for its decision for more than a year. NRC
    also did not follow other aspects of its guidance. In the absence of
    specific guidance, and with little documentation of the decision-making
    process, we could not judge whether the agency's decision was reasonable.
    Our consultants identified substantial problems with how NRC developed and
    used its risk estimate when making the decision. For example, NRC did not
    perform an analysis of the uncertainty associated with the risk estimate;
    if it had, our consultants believe the uncertainty would have been so
    large as to render NRC's risk estimate of questionable value. Further, the
    risk estimate indicated that the likelihood of an accident occurring at
    Davis-Besse was greater than the level of risk generally accepted as being
    reasonable by NRC.

    Responding to the Davis-Besse incident, NRC has taken several significant
    actions to help prevent boric acid from corroding reactor vessel heads at
    nuclear power plants. NRC issued requirements that licensees more
    extensively examine their reactor vessel heads, revised NRC inspection
    guidance used to identify and resolve licensee problems before they affect
    operations, augmented training to keep its inspectors better informed
    about boric acid and cracking issues, and revised guidance to better
    ensure that licensees implement commitments to change their operations.
    However, NRC has not yet implemented more than half of its planned
    actions, and resource constraints could affect the agency's ability to
    fully and effectively implement the actions. More importantly, NRC is not
    addressing three systemic problems underscored by the Davis-Besse
    incident. First, its process for assessing safety at nuclear power plants
    is not adequate for detecting early indications of deteriorating safety.
    In this respect, the process does not effectively identify changes in the
    operator's performance or approach to safety before a more serious safety
    problem can develop. Second, NRC's decision-making guidance does not
    specifically address shutdown decisions or explain how different safety

    considerations, such as quantitative estimates of risk, should be weighed.
    Third, NRC does not have adequate management controls for systematically
    tracking actions that it has taken in response to incidents at plants to
    determine if the actions were sufficient to resolve underlying problems
    and thereby prevent future incidents. Analyses of earlier incidents at
    other plants identified several issues, such as inadequate communication,
    that contributed to the Davis-Besse incident. Such management controls may
    have helped to resolve these issues before the Davis-Besse incident
    occurred. While NRC is monitoring how it implements actions taken as a
    result of the Davis-Besse incident, the agency has not yet committed to a
    process for assessing the effectiveness of actions taken.

    Given NRC's actions in response to Davis-Besse, severe vessel head
    corrosion is unlikely to occur at a plant any time soon. However, in part
    because of unresolved systemic problems, another incident unrelated to
    vessel head corrosion could occur in the future. As a result, we are
    recommending that NRC take more aggressive and specific actions in several
    areas, such as revising how it assesses plant performance, establishing a
    more specific methodology for deciding to shut down a plant, and
    establishing management controls for monitoring and assessing the
    effectiveness of changes made in response to task force findings.

    In commenting on a draft of this report, NRC generally addressed only
    those findings and recommendations with which it disagreed. While
    commenting that it agreed with many of our findings, the agency said that
    the report overall does not appropriately characterize or provide a
    balanced perspective on NRC's actions surrounding the discovery of the
    reactor vessel head condition at Davis-Besse or its efforts to incorporate
    the lessons learned from that experience into its processes. More
    specifically, NRC stated that the report does not acknowledge that NRC
    must rely heavily on its licensees to provide complete and accurate
    information. NRC also expressed concern about the report's
    characterization of its use of risk estimates. We believe that the report
    fairly and accurately describes NRC's actions regarding the Davis-Besse
    incident. Nonetheless, we expanded our discussion of NRC's roles and
    responsibilities to point out that licensees are required to provide NRC
    with complete and accurate information.

    NRC disagreed with our recommendations to develop (1) specific guidance
    and a well-defined process for deciding when to shut down a plant and (2)
    a methodology to assess early indications of deteriorating safety at
    nuclear

    power plants. NRC stated that it has sufficient guidance to make plant
    shutdown decisions. NRC also stated that, as regulators, the agency is not
    charged with managing licensees' facilities and that direct involvement
    with those aspects of licensees' operations that could provide it with
    information on early indications of deteriorating safety crosses over to a
    management function. We continue to believe that NRC should develop
    specific guidance and a well-defined process to decide when to shut down a
    plant. In absence of such guidance for making the Davis-Besse shutdown
    decision, NRC used its guidance for considering operators' requests for
    amendments to their licenses. This guidance describes safety factors that
    NRC should consider in deciding whether to approve license changes, as
    well as a process for considering the relative risk the amendment would
    pose. This guidance does not specify how NRC should use the safety
    factors. We also continue to believe that NRC should develop a methodology
    to assess aspects of licensees' operations as a means to have an early
    warning of developing safety problems. In implementing this
    recommendation, we envision that NRC would be analyzing data for changes
    in operators' performance or approach to safety, not prescribing how the
    plants are managed.

                                       Background

    NRC's Role and NRC, as an independent federal agency, regulates the
    commercial uses of

    Responsibilities	nuclear material to ensure adequate protection of public
    health and safety and the environment. NRC is headed by a five-member
    commission appointed by the President and confirmed by the Senate; one
    commissioner is appointed as chairman.5 NRC has about 2,900 employees who
    work in its headquarters office in Rockville, Maryland, and its four
    regional offices. NRC is financed primarily by fees that it imposes on
    commercial users of the nuclear material that it regulates. For fiscal
    year 2004, NRC's appropriated budget of $626 million includes about $546
    million financed by these fees.

    NRC regulates the nation's commercial nuclear power plants by establishing
    requirements for plant owners and operators to follow in the design,
    construction, and operation of the nuclear reactors. NRC also

    5Two commissioner positions are currently vacant.

    licenses the reactors and individuals who operate them. Currently, 104
    commercial nuclear reactors at 65 locations are licensed to operate.6 Many
    of these reactors have been in service since the early to mid-1970s. NRC
    initially licensed the reactors to operate for 40 years, but as these
    licenses approach their expiration dates, NRC has been granting 20-year
    extensions.

    To ensure the reactors are operated within their licensing requirements
    and technical specifications, NRC oversees them by both inspecting
    activities at the plants and assessing plant performance.7 NRC's
    inspections consist of both routine, or baseline, inspections and
    supplemental inspections to assess particular licensee programs or issues
    that arise at a power plant. Inspections may also occur in response to a
    specific operational problem or event that has occurred at a plant. NRC
    maintains inspectors at every operating nuclear power plant in the United
    States and supplements the inspections conducted by these resident
    inspectors with inspections conducted by staff from its regional offices
    and from headquarters. Generally, inspectors verify that the plant's
    operator qualifications and operations, engineering, maintenance, fuel
    handling, emergency preparedness, and environmental and radiation
    protection programs are adequate and comply with NRC safety requirements.
    NRC also oversees licensees by requesting information on their activities.
    NRC requires that information provided by licensees be complete and
    accurate and, according to NRC officials, this is an important aspect of
    the agency's oversight.8 While we have added information to this report on
    the requirement that licensees provide NRC with complete and accurate
    information, we believe that NRC's oversight program should not place
    undue reliance on this requirement.

    Nuclear power plants have many physical structures, systems, and
    components, and licensees have numerous activities under way, 24-hours a

    6These licensed reactors include Browns Ferry Unit 1-one of three reactors
    owned by the Tennessee Valley Authority in Alabama-which was shut down in
    1985. The Tennessee Valley Authority plans to restart the reactor in 2007,
    which will require NRC approval.

    7NRC's oversight program has changed significantly since the beginning of
    1998. The third and most recent change occurred in mid-2000, when the
    agency adopted its Reactor Oversight Process. Under this process, NRC
    continues to rely on inspection results to assess licensee performance.
    However, it supplements this information with other indicators of
    self-reported licensee performance, such as how frequently unscheduled
    shutdowns occur.

    810 C.F.R. S: 50.9 requires that information provided by licensees be
    complete and accurate in all material respects.

    day, to ensure the plants operate safely. Programs to ensure quality
    assurance and safe operations include monitoring, maintenance, and
    inspection. To carry out these programs, licensees typically prepare
    several thousand reports per year describing conditions at the plant that
    need to be addressed to ensure continued safe operations. Because of the
    large number of activities and physical structures, systems, and
    components, NRC focuses its inspections on those activities and pieces of
    equipment or systems that are considered to be most significant for
    protecting public health and safety. NRC terms this a "risk-informed"
    approach for regulating nuclear power plants. Under this risk-informed
    approach, some systems and activities that NRC considers to have
    relatively less safety significance receive little NRC oversight. NRC has
    adopted a risk-informed approach because it believes it can focus its
    regulatory resources on those areas of the plant that the agency considers
    to be most important to safety. In addition, it was able to adopt this
    approach because, according to NRC, safety performance at nuclear power
    plants has improved as a result of more than 25 years of operating
    experience.

    To decide whether inspection findings are minor or major, NRC uses a
    process it began in 2000 to determine the extent to which violations
    compromise plant safety. Under this process, NRC characterizes the
    significance of its inspection findings by using a significance
    determination process to evaluate how an inspection finding impacts the
    margin of safety at a power plant. NRC has a range of enforcement actions
    it can take, depending on how much the safety of the plant had been
    compromised. For findings that have low safety significance, NRC can
    choose to take no formal enforcement action. In these instances,
    nonetheless, licensees remain responsible for addressing the identified
    problems. For more serious findings, NRC may take more formal action, such
    as issuing enforcement orders. Orders can be used to modify, suspend, or
    even revoke an operating license. NRC has issued one enforcement order to
    shut down an operating power plant in its 28-year history-in 1987, after
    NRC discovered control room personnel sleeping while on duty at the Peach
    Bottom nuclear power plant in Pennsylvania. In addition to enforcement
    orders, NRC can issue civil penalties of up to $120,000 per violation per
    day. Although NRC does not normally use civil penalties for violations
    associated with its Reactor Oversight Process, NRC will consider using
    them for issues that are willful, have the potential for impacting the
    agency's regulatory process, or have actual public health and safety
    consequences. In fiscal year 2003, NRC proposed imposing civil penalties
    totaling $120,000 against two power plant licensees for the failure to
    provide complete and accurate information to the agency.

    NRC uses generic communications-such as bulletins, generic letters, and
    information notices-to provide information to and request information from
    the nuclear industry at large or specific groups of licensees. Bulletins
    and generic letters both usually request information from licensees
    regarding their compliance with specific regulations. They do not require
    licensees to take any specific actions, but do require licensees to
    provide responses to the information requests. In general, NRC uses
    bulletins, as opposed to generic letters, to address significant issues of
    greater urgency. NRC uses information notices to transmit significant
    recently identified information about safety, safeguards, or environmental
    issues. Licensees are expected to review the information to determine
    whether it is applicable to their operations and consider action to avoid
    similar problems.

    Operation of Pressurized Water Nuclear Power Plants and Events Leading to
    the March 2002 Discovery of Serious Corrosion

    The Davis-Besse Nuclear Power Station, owned and operated by FirstEnergy
    Nuclear Operating Company, is an 882-megawatt electric pressurized water
    reactor located on Lake Erie in Oak Harbor, Ohio, about 20 miles east of
    Toledo. The power plant is under NRC's Region III oversight, which is
    located in Lisle, Illinois. Like other pressurized water reactors,
    Davis-Besse is designed with multiple barriers between the radioactive
    heat-producing core and the outside environment-a design concept called
    "defense-in-depth." Three main design components provide defense-in-depth.
    First, the reactor core is designed to retain radioactive material within
    the uranium oxide fuel, which is also covered with a layer of metal
    tubing. Second, a 6-inch-thick carbon steel vessel, lined with
    threesixteenth-inch-thick stainless steel, surrounds the reactor core.
    Third, a steel containment structure, surrounded by a thick reinforced
    concrete building, encloses the reactor vessel and other systems and
    components important for maintaining safety. The containment structure and
    concrete building are intended to help not only prevent a release of
    radioactivity to the environment, but also shield the reactor from
    external hazards like tornados and missiles. The reactor vessel, in
    addition to housing the reactor core, contains highly pressurized water to
    cool the radioactive heat-producing core and transfer heat to a steam
    generator. Consequently, the vessel is referred to as the reactor pressure
    vessel. From the vessel, hot pressurized water is piped to the steam
    generator, where a separate supply of water is turned to steam to drive
    turbines that generate electricity. (See fig. 1.)

    structure were perforated with 18 5-by 7-inch rectangular openings, termed
    "mouse-holes," that were used for vessel head inspections. In pressurized
    water reactors such as Davis-Besse, the reactor vessel, the vessel head,
    the nozzles, and other equipment used to ensure a continuous supply of
    pressurized water in the reactor vessel are collectively referred to as
    the reactor coolant pressure boundary. (See fig. 2.)

    Figure 2: Major Components of the Davis-Besse Reactor Vessel Head and
    Pressure Boundary

    Source: FirstEnergy.

    To better control the nuclear reaction at nuclear power plants, boron in
    the form of boric acid crystals is dissolved in the cooling water
    contained within the reactor vessel and pressure boundary. Boric acid,
    under certain

    conditions, can cause corrosion of carbon steel. For about 3 decades, NRC
    and the nuclear power industry have known that boric acid had the
    potential to corrode reactor components. In general, if leakage occurs
    from the reactor coolant system, the escaping coolant will flash to steam
    and leave behind a concentration of impurities, including noncorrosive dry
    boric acid crystals. However, under certain conditions, the coolant will
    not flash to steam, and the boric acid will remain in a liquid state where
    it can cause extensive and rapid degradation of any carbon steel
    components it contacts. Such extensive degradation, in both domestic and
    foreign pressurized water reactor plants, has been well documented and led
    NRC to issue a generic letter in 1988 requesting information from
    pressurized water reactor licensees to ensure they had implemented
    programs to control boric acid corrosion. NRC was primarily concerned that
    boric acid corrosion could compromise the reactor coolant pressure
    boundary. This concern also led NRC to develop a procedure for inspecting
    licensees' boric acid corrosion control programs and led the Electric
    Power Research Institute to issue guidance on boric acid corrosion
    control.10

    NRC and the nuclear power industry have also known that nozzles made of
    alloy 600,11 used in several areas within nuclear power plants, were prone
    to cracking. Cracking had become an increasingly topical issue as the
    nuclear power plant fleet has aged. In 1986, operators at domestic and
    foreign pressurized water reactors began reporting leaks in various types
    of alloy 600 nozzles. In 1989, after leakage was detected at a domestic
    plant, NRC identified the cause of the leakage as cracking due to primary
    water stress corrosion.12 However, NRC concluded that the cracking was not
    an immediate safety concern for a few reasons. For example, the cracks had
    a low growth rate, were in a material with an extremely high flaw
    tolerance and, accordingly, were unlikely to spread. Also, the cracks were
    axial-that is, they ran the length of the nozzle rather than its
    circumference. NRC and

    10The Electric Power Research Institute is a nonprofit energy research
    consortium whose members include utilities. It provides science and
    technology-based solutions to members through its scientific research,
    technology development, and product implementation program.

    11Alloy 600 is an alloy of nickel, chromium, iron, and minor amounts of
    other elements. The alloy is highly resistant to general corrosion but can
    be susceptible to cracking at high temperatures.

    12Primary water stress corrosion cracking refers to cracking under stress
    and in primary coolant water. The primary water coolant system is that
    portion of a nuclear power plant's coolant system that cools the reactor
    core in the reactor pressure vessel and deposits heat to the steam
    generator.

    the nuclear power industry were more concerned that circumferential cracks
    could result in broken or snapped nozzles. NRC did, however, issue a
    generic information notice in 1990 to inform the industry of alloy 600
    cracking. Through the early 1990s, NRC, the Nuclear Energy Institute,13
    and others continued to monitor alloy 600 cracking. In 1997, continued
    concern over cracking led NRC to issue a generic letter to pressurized
    water reactor licensees requesting information on their plans to monitor
    and manage cracking in vessel head penetration nozzles as well as to
    examine these nozzles.

    In the spring of 2001, licensee inspections led to the discovery of large
    circumferential cracking in several vessel head penetration nozzles at the
    Oconee Nuclear Station, in South Carolina. As a result of the discovery,
    the nuclear power industry and NRC categorized the 69 operating
    pressurized water reactors in the United States into different groups on
    the basis of (1) whether cracking had already been found and (2) how
    similar they were to Oconee in terms of the amount of time and the
    temperature at which the reactors had operated. The industry had developed
    information indicating that greater operating time and temperature were
    related to cracking. In total, five reactors at three locations were
    categorized as having already identified cracking, while seven reactors at
    five locations were categorized as being highly susceptible, given their
    similarity to Oconee.14

    In August 2001, NRC issued a bulletin requesting that licensees of these
    reactors provide, within 30 days, information on their plans for
    conducting nozzle inspections before December 31, 2001.15 In lieu of this
    information, NRC stated that licensees could provide the agency with a
    reasoned basis for their conclusions that their reactor vessel pressure
    boundaries would continue to meet regulatory requirements for ensuring the
    structural integrity of the reactor coolant pressure boundary until the
    licensees

    13The Nuclear Energy Institute comprises companies that operate commercial
    power plants and supports the commercial nuclear industry; and
    universities, research laboratories, and labor unions affiliated with the
    nuclear industry. Among other things, it provides a forum to resolve
    technical and business issues and offers information to its members and
    policymakers on nuclear issues.

    14Reactors that were categorized as having already identified cracking or
    were highly susceptible included Arkansas Nuclear reactor unit 1; D.C.
    Cook reactor unit 2; Davis-Besse; North Anna reactor units 1 and 2; Oconee
    reactor units 1, 2 and 3; Robinson reactor unit 2; Surry reactor units 1
    and 2; and Three Mile Island reactor unit 1.

    15NRC, "Circumferential Cracking of Reactor Pressure Vessel Head
    Penetration Nozzles" (Bulletin 2001-01, Aug. 8, 2001).

    conducted their inspections. NRC used a bulletin, as opposed to a generic
    letter, to request this information because cracking was considered a
    significant and urgent issue. All of the licensees of the highly
    susceptible reactors, except Davis-Besse and D.C. Cook reactor unit 2,
    provided NRC with plans for conducting inspections by December 31, 2001.16

    In September 2001, FirstEnergy proposed conducting the requested
    inspection in April 2002, following its planned March 31, 2002, shutdown
    to replace fuel. In making this proposal, FirstEnergy contended that the
    reactor coolant pressure boundary at Davis-Besse met and would continue to
    meet regulatory requirements until its inspection. NRC and FirstEnergy
    exchanged information throughout the fall of 2001 regarding when
    FirstEnergy would conduct the inspection at Davis-Besse. NRC drafted an
    enforcement order that would have shut down Davis-Besse by December 2001
    for the requested inspection in the event that FirstEnergy could not
    provide an adequate justification for safe operation beyond December 31,
    2001, but ultimately compromised on a mid-February 2002 shutdown date.
    NRC, in deciding when FirstEnergy had to shut down Davis-Besse for the
    inspection, used a risk-informed decision-making process, including
    probabilistic risk assessment (PRA), to conclude that the risk that
    Davis-Besse would have an accident in the interim was relatively low. PRA
    is an analytical tool for estimating the probability that a potential
    accident might occur by examining how physical structures, systems, and
    components, along with employees, work together to ensure plant safety.

    Following the mid-February 2002 shutdown and in the course of its
    inspection in March 2002, FirstEnergy removed about 900 pounds of boric
    acid crystals and powder from the reactor vessel head, and subsequently
    discovered three cracked nozzles. The number of nozzles that had cracked,
    as well as the extent of cracking, was consistent with analyses that NRC
    staff had conducted prior to the shutdown. However, in examining the
    extent of cracking, FirstEnergy also discovered that corrosion had caused
    a pineapple-sized cavity in the reactor vessel head. (See figs. 3 and 4.)

    16The licensee for D.C. Cook reactor unit 2 proposed to shut down in
    mid-January 2002 for its inspection. NRC agreed to the delay after
    crediting D.C. Cook for having been shut down for about a month during the
    fall of 2001, thus reducing the reactor's operating time.

    Figure 3: Diagram of the Cavity in Davis-Besse's Reactor Vessel Head

    4: The Cavity in Davis-BFi esse's Reactor Vessel Hegure ad after Discovery

    Source: FirstEnergy.

    After this discovery, NRC directed FirstEnergy to, among other things,
    determine the root cause of the corrosion and obtain NRC approval before
    restarting Davis-Besse. NRC also dispatched an augmented inspection team
    consisting of NRC resident, regional, and headquarters officials.17 The
    inspection team concluded that the cavity was caused by boric acid
    corrosion from leaks through the control rod drive mechanism nozzles in
    the reactor vessel head. Primary water stress corrosion cracking of the
    nozzles caused through-wall cracks, which led to the leakage and eventual
    corrosion of the vessel head. NRC's inspection team also concluded, among
    other things, that this corrosion had gone undetected for an extended
    period of time-at least 4 years-and significantly compromised the plant's

    17NRC forms such inspection teams to ensure that the agency investigates
    significant operational events in a timely, objective, systematic, and
    technically sound manner, and identifies and documents the causes of such
    events.

    safety margins. As of May 2004, NRC had not yet completed other analyses,
    including how long Davis-Besse could have continued to operate with the
    corrosion it had experienced before a vessel head loss-of-coolant accident
    would have occurred.18 However, on May 4, 2004, NRC released preliminary
    results of its analysis of the vessel head and cracked cladding. Based on
    its analysis of conditions that existed on February 16, 2002, NRC
    estimated that Davis-Besse could have operated for another 2 to 13 months
    without the vessel head failing. However, the agency cautioned that this
    estimate was based on several uncertainties associated with the complex
    network of cracks on the cladding and the lack of knowledge about
    corrosion and cracking rates. NRC plans to use this data in preparing its
    preliminary analysis of how, and the likelihood that, the events at
    Davis-Besse could have led to core damage. NRC plans to complete this
    preliminary analysis in the summer of 2004.

    NRC also established a special oversight panel to (1) coordinate NRC's
    efforts to assess FirstEnergy's performance problems that resulted in the
    corrosion damage, (2) monitor Davis-Besse's corrective actions, and (3)
    evaluate the plant's readiness to resume operations. The panel, which is
    referred to as the Davis-Besse Oversight Panel, comprises officials from
    NRC's Region III office in Lisle, Illinois; NRC headquarters; and the
    resident inspector office at Davis-Besse. In addition to overseeing
    FirstEnergy's performance during the shutdown and through restart of
    Davis-Besse, the panel holds public meetings in Oak Harbor, Ohio, where
    the plant is located, and nearby Port Clinton, Ohio, to inform the public
    about its oversight of Davis-Besse's restart efforts and its views on the
    adequacy of these efforts. The panel developed a checklist of issues that
    FirstEnergy had to resolve prior to restarting: (1) replacing the vessel
    head and ensuring the adequacy of other equipment important for safety,
    (2) correcting FirstEnergy programs that led to the corrosion, and (3)
    ensuring FirstEnergy's readiness to restart. To restart the plant,
    FirstEnergy, among other things, removed the damaged reactor vessel head,
    purchased and installed a new head, replaced management at the plant, and
    took steps to improve key programs that should have prevented or detected
    the corrosion. As of March 2004, when NRC gave its approval for
    Davis-Besse to resume

    18NRC has an Accident Sequence Precursor Analysis Program to analyze
    significant events that occur at nuclear power plants to determine how,
    and the likelihood that, the events could have led to core damage.

    operations, the shutdown and preparations for restart had cost FirstEnergy
    approximately $640 million.19

    In addition, NRC established a task force to evaluate its regulatory
    processes for assuring reactor pressure vessel head integrity and to
    identify and recommend areas for improvement that may be applicable to
    either NRC or the nuclear power industry. The task force's report, which
    was issued in September 2002, contains 51 recommendations aimed primarily
    at improving NRC's process for inspecting and overseeing licensees,
    communicating with industry, and identifying potential emerging technical
    issues that could impact plant safety. NRC developed an action plan to
    implement the report's recommendations.

    NRC's Actions to Oversee Davis-Besse Did Not Provide an Accurate
    Assessment of Safety at the Plant

    NRC's inspections and assessments of FirstEnergy's operations should have
    but did not provide the agency with an accurate understanding of safety
    conditions at Davis-Besse, and thus NRC failed to identify or prevent the
    vessel head corrosion. Some NRC inspectors were aware of the indications
    of corrosion and leakage that could have alerted NRC to corrosion problems
    at the plant, but they did not have the knowledge to recognize the
    significance of this information. These problems were compounded by NRC's
    assessments of FirstEnergy that led the agency to believe FirstEnergy was
    a good performer and could or would successfully resolve problems before
    they became significant safety issues. More broadly, NRC had a range of
    information that could have identified and prevented the incident at
    Davis-Besse but did not effectively integrate it into its oversight.

    19FirstEnergy spent about $293 million on operations, maintenance, and
    capital projects (including $47 million for the new reactor vessel head)
    and $348 million to purchase power to replace the power that Davis-Besse
    would have generated over the 2-year shutdown period. In contrast, during
    a more routine refueling outage, Davis-Besse would spend about $60
    million-about $37 million on operations, maintenance, and capital projects
    and $23 million on replacing the power that would have been generated over
    a 42-day shutdown period. These latter estimates are based on the
    Davis-Besse refueling outage in midcalendar year 2000.

    Several Factors Contributed to the Inadequacy of NRC's Inspections for
    Determining Plant Conditions

    Inspectors Did Not Know Safety Significance of Observed Problems

    Three separate, but related, NRC inspection program factors contributed to
    the development of the corrosion problems at Davis-Besse. First, resident
    inspectors did not know that the boric acid, rust, and unidentified
    leaking indicated that the reactor vessel head might be degrading. Second,
    these inspectors thought they understood the cause for the indications,
    based on licensee actions to address them. Therefore, resident inspectors,
    as well as regional and headquarters officials, did not fully communicate
    information on the indications or decide how to address them, and
    therefore took no action. Third, because the significance of the symptoms
    was not fully recognized, NRC did not direct sufficient inspector
    resources to aggressively investigate the indicators. NRC might have taken
    a different approach to the Davis-Besse situation if its program to
    identify emerging issues important to safety had pursued earlier concerns
    about boric acid corrosion and cracking and recognized how they could
    affect safety.

    NRC limits the amount of unidentified leakage from the reactor coolant
    system to no more than 1 gallon per minute. When this limit is exceeded,
    NRC requires that licensees identify and correct any sources of
    unidentified leakage. NRC also prohibits any leakage from the reactor
    coolant pressure boundary, of which the reactor vessel is a key component.
    Such leakage is prohibited because the pressure boundary is key to
    maintaining adequate coolant around the reactor fuel and thus protects
    public health and safety. Because of this, NRC's technical specification
    states that licensees are to monitor reactor coolant leakage and shut down
    within 36 hours if leakage is found in the pressure boundary.

    In the years leading up to FirstEnergy's March 2002 discovery that
    Davis-Besse's vessel head had corroded extensively, NRC had several
    indications of potential leakage problems. First, NRC knew that the rates
    of leakage in the reactor coolant system had increased. Between 1995 and
    mid-1998, the unidentified leakage rate was about 0.06 gallon per minute
    or less, according to FirstEnergy's monitoring. In mid-1998, the
    unidentified reactor coolant system leakage rate increased
    significantly-to as much as 0.8 gallon per minute. The elevated leakage
    rate was dominated by a known problem with a leaking relief valve on the
    reactor coolant system pressurizer tank, which masked the ongoing leak on
    the reactor pressure vessel head. However, the elevated leak rate should
    have raised concerns.

    To investigate this leakage, as well as to repair other equipment,
    FirstEnergy shut down the plant in mid-1999. It then identified a faulty
    relief valve that accounted for much of the leakage and repaired the
    valve.

    However, after restarting Davis-Besse, the unidentified leakage rate
    remained significantly higher than the historical average. Specifically,
    the unidentified leakage rate varied between 0.15 and 0.25 gallon per
    minute as opposed to the historical low of about 0.06 gallon or less.
    While NRC was aware that the rate was higher than before, NRC did not
    aggressively pursue the difference because the rate was well below NRC's
    limit of no more than 1 gallon per minute, and thus the leak was not
    viewed as being a significant safety concern. Following the repair in
    1999, NRC's inspection report concluded that FirstEnergy's efforts to
    reduce the leak rate during the outage were effective.

    Second, NRC was aware of increased levels of boric acid in the containment
    building-an indication that components containing reactor coolant were
    leaking. So much boric acid was being deposited that FirstEnergy officials
    had to repeatedly clean the containment air cooling system and radiation
    monitor filters. For example, before 1998, the containment air coolers
    seldom needed cleaning, but FirstEnergy had to clean them 28 times between
    late 1998 and May 2001. Between May 2001 and the mid-February 2002
    shutdown, the containment air coolers were not cleaned, but at shutdown,
    FirstEnergy removed 15 5-gallon buckets of boric acid from the
    coolers-which is almost as much as was found on the reactor pressure
    vessel head. Rather than seeing these repeated cleanings as an indication
    of a problem that needed to be addressed, FirstEnergy made cleaning the
    coolers a routine maintenance activity, which NRC did not consider
    significant enough to require additional inspections. Furthermore, the
    radiation monitors, used to sample air from the containment building to
    detect radiation, typically required new filters every month. However,
    from 1998 to 2002, these monitors became clogged and inoperable hundreds
    of times because of boric acid, despite FirstEnergy's efforts to fix the
    problem.

    Third, NRC was aware that FirstEnergy found rust in the containment
    building. The radiation monitor filters had accumulated dark colored iron
    oxide particles-a product of carbon steel corrosion-that were likely to
    have resulted from a very small steam leak. NRC inspection reports during
    the summer and fall of 1999 noted these indications and, while recognizing
    FirstEnergy's aggressive attempts to identify the reasons for the
    phenomenon, concluded that they were a "distraction to plant personnel."
    Several NRC inspection reports noted indications of leakage, boric acid,
    and rust before the agency adopted its new Reactor Oversight Process in
    2000, but because the leakage was within NRC's technical specifications
    and NRC officials thought that the licensee understood and would fix the

    problem, NRC did not aggressively pursue the indications. NRC's new
    oversight process, implemented in the spring of 2000, limited the issues
    that could be discussed in NRC inspection reports to those that the agency
    considers to have more than minor significance. Because the leakage rates
    were below NRC's limits, NRC's inspection reports following the
    implementation of NRC's new oversight process did not identify any
    discussion of these problems at the plant.

    Fourth, NRC was aware that FirstEnergy found rust on the Davis-Besse
    reactor vessel head, but it did not recognize its significance. For
    instance, during the 2000 refueling outage, a FirstEnergy official said he
    showed one of the two NRC resident inspectors a report that included
    photographs of rust-colored boric acid on the vessel head. (See fig. 5.)

    Figure 5: Rust and Boric Acid on Davis-Besse's Vessel Head as Shown to
    Resident Inspector during the 2000 Refueling Outage

    Source: FirstEnergy.

    According to this resident inspector, he did not recall seeing the report
    or photographs but had no reason to doubt the FirstEnergy official's
    statement. Regardless, he stated that had he seen the photographs, he
    would not have considered the condition to be significant at the time. He
    said that he did not know what the rust and boric acid might have
    indicated, and he assumed that FirstEnergy would take care of the vessel
    head before restarting. The second resident inspector said he reviewed all
    such reports at Davis-Besse but did not recall seeing the photographs or
    this particular report. He stated that it was quite possible that he had
    read the report, but because the licensee had a plan to clean the vessel
    head, he would have concluded that the licensee would correct the matter
    before plant restart. However, FirstEnergy did not accomplish this, even
    though work orders and subsequent licensee reports indicated that this was
    done. According to the NRC resident inspector and NRC regional officials,
    because of the large number of licensee activities that occur during a
    refueling outage, NRC inspectors do not have the time to investigate or
    follow up on every issue, particularly when the issue is not viewed as
    being important to safety. While the resident inspector informed regional
    officials about conditions at Davis-Besse, the regional office did not
    direct more inspection resources to the plant, or instruct the resident
    inspector to conduct more focused oversight. Some NRC regional officials
    were aware of indications of boric acid corrosion at the plant; others
    were not. According to the Office of the Inspector General's investigation
    and 2003 report on Davis-Besse,20 the NRC regional branch chief-who
    supervised the staff responsible for overseeing FirstEnergy's vessel head
    inspection activities during the 2000 refueling outage-said that he was
    unaware of the boric acid leakage issues at Davis-Besse, including its
    effects on the containment air coolers and the radiation monitor filters.
    Had his staff been requested to look at these specific issues, he might
    have directed inspection resources to that area. (App. I provides a time
    line showing significant events of interest.)

    NRC Did Not Fully Communicate NRC was not fully aware of the indications
    of a potential problem at Davis-

    Indications	Besse because NRC's process for transmitting information from
    resident inspectors to regional offices and headquarters did not ensure
    that information was fully communicated, evaluated, or used. NRC staff
    communicated information about plant operations through inspection
    reports, licensee assessments, and daily conference calls that included

    20NRC, Office of the Inspector General, NRC's Oversight of Davis-Besse
    during the April 2000 Refueling Outage (Washington, D.C.: Oct. 17, 2003).

    resident, regional, and headquarters officials. According to regional
    officials, information that is not considered important is not routinely
    communicated to NRC management and technical specialists. For example,
    while the resident inspectors at Davis-Besse knew all of the indications
    of leakage, and there was some level of knowledge about these indications
    at the regional office level, the knowledge was not sufficiently
    widespread within NRC to alert a technical specialist who might have
    recognized their safety significance. According to NRC Region III
    officials, the region uses an informal means-memorandums sent to other
    regions and headquarters-of communicating information identified at plants
    that it considers to be important to safety. However, because the
    indications at Davis-Besse were not considered important, officials did
    not transmit this information to headquarters. Further, because the
    process is informal, these officials said they did not know whether-and if
    so, how-other NRC regions or headquarters used this information.

    Similarly, NRC officials said that NRC headquarters had no systematic
    process for communicating information, such as on boric acid corrosion,
    cracking, and small amounts of unidentified leakage, that had not yet
    risen to a relatively high level of concern within the agency, in a timely
    manner to its regions or on-site inspectors. For example, the regional
    inspector that oversaw FirstEnergy's activities during the 2000 refueling
    outage, including the reactor vessel head inspection, stated that he was
    not aware of NRC's generic bulletins and letters pertaining to boric acid
    and corrosion, even though NRC issues only a few of these bulletins and
    generic letters each year.21 In addition, according to NRC regional
    officials and the resident inspector at Davis-Besse, there is little time
    to review technical reports about emerging safety issues that NRC compiles
    because they are too lengthy and detailed. Ineffective communication, both
    within the region and between NRC headquarters and the region, was a
    primary factor cited by NRC's Office of the Inspector General in its
    investigation of NRC's oversight of Davis-Besse boric acid leakage and
    corrosion. 22 For example, it found that ineffective communication
    resulted in senior regional management being largely unaware of repeated
    reports of boric acid leakage at Davis-Besse. It also found that
    headquarters, in communications with the regions, did not emphasize the
    issues discussed in its generic

    21Over the last 10 years, NRC has issued an average of about two generic
    bulletins and about four generic letters a year.

    22NRC, Office of the Inspector General, NRC's Oversight of Davis-Besse
    during the April 2000 Refueling Outage (Washington, D.C.; Oct. 17, 2003).

    letters or bulletins on boric acid corrosion or cracking. NRC programs for
    informing its inspectors about issues that can reduce safety at nuclear
    power plants were not effective. As a result, NRC inspectors did not
    recognize the significance of the indications at Davis-Besse, fully
    communicate information about the indications, or spend additional effort
    to follow up on the indications.

    Resource Constraints Affected NRC also did not focus on the indications
    that the vessel head was

    NRC Oversight	corroding because of several staff constraints. Region III
    was directing resources to other plants that had experienced problems
    throughout the region, and these plants thus were the subject of increased
    regulatory oversight. For example, during the refueling outages in 1998
    and 2000, while NRC oversaw FirstEnergy's inspection of the reactor vessel
    head, the region lacked senior project engineers to devote to Davis-Besse.
    A vacancy existed for a senior project engineer responsible for
    Davis-Besse from June 1997 until June 1998, except for a one month period,
    and from September 1999 until May 2000, which resulted in fewer inspection
    hours at the facility than would have been normal. Other regional staff
    were also occupied with other plants in the region that were having
    difficulties, and NRC had unfilled vacancies for resident and regional
    inspector positions that strained resources for overseeing Davis-Besse.

    Even if the inspector positions had been filled, it is not certain that
    the inspectors would have aggressively followed up on any of the
    indications. According to our discussions with resident and regional
    inspectors and our on-site review of plant activities, because nuclear
    power plants are so large, with many physical structures, systems, and
    components, an inspector could miss problems that were potentially
    significant for safety. Licensees typically prepare several hundred
    reports per month for identifying and resolving problems, and NRC
    inspectors have only a limited amount of time to follow up on these
    licensee reports. Consequently, NRC selects and oversees the most safety
    significant structures, systems, and components.

    NRC's Assessment Process Did Not Indicate Deteriorating Performance

    Under NRC's Reactor Oversight Process, NRC assesses licensees' performance
    using two distinct types of information: (1) NRC's inspection results and
    (2) performance indicators reported by the licensees. These indicators,
    which reflect various aspects of a plant's operations, include data on,
    for example, the failure or unavailability of certain important operating
    systems, the number of unplanned power changes, and the amount of reactor
    coolant system leakage. NRC evaluates both the inspection results and the
    performance indicators to arrive at licensee

    assessments, which it then color codes to reflect their safety
    significance. Green assessments indicate that performance is acceptable,
    and thus connote a very low risk significance and impact on safety. White,
    yellow, and red assessments each represent a greater degree of safety
    significance. After NRC adopted its Reactor Oversight Process in April
    2000, FirstEnergy never received anything but green designations for its
    operations at Davis-Besse and was viewed by NRC as a good performer until
    the 2002 discovery of the vessel head corrosion.23 Similarly, prior to
    adopting the Reactor Oversight Process, NRC consistently assessed
    FirstEnergy as generally being a good performer. NRC officials stated,
    however, that significant issues were identified and addressed as
    warranted throughout this period, such as when the agency took enforcement
    action in response to FirstEnergy's failure to properly repair important
    components in 1999-a failure caused by weaknesses in FirstEnergy's boric
    acid corrosion control program.

    Key Davis-Besse programs for ensuring the quality and safe operation of
    the plant's engineered structures, systems, and components include, for
    example,

    o 	a corrective action program to ensure that problems at the plant that
    are relevant to safety are identified and resolved in a timely manner,

    o 	an operating experience program to ensure that experiences or problems
    that occur are appropriately identified and analyzed to determine their
    significance and relevance to operations, and

    o 	a plant modification program to ensure that modifications important to
    safety are implemented in a timely manner.

    As at other commercial nuclear power plants, NRC conducted routine,
    baseline inspections of Davis-Besse to determine the effectiveness of
    these programs. Reports documenting these inspections noted incidences of
    boric acid leakage, corrosion, and deposits. However, between February
    1997 and March 2000, the regional office's assessment of the licensee's
    performance addressed leakage in the reactor coolant system only once and
    never noted the other indications. Furthermore, Davis-Besse was not

    23Before adopting the Reactor Oversight Process, NRC also assessed
    licensee performance based on inspection results and other information;
    however, NRC did not assign color codes to assessment results.

    the subject of intense scrutiny in regional plant assessment meetings
    because plants perceived as good performers-such as Davis-Besse- received
    substantially less attention. Between April 2000-when NRC's revised
    assessment process took effect-until the corrosion was discovered in March
    2002, none of NRC's assessments of Davis-Besse's performance noted leakage
    or other indications of corrosion at the plant. As a result, NRC may have
    missed opportunities to identify weaknesses in the Davis-Besse programs
    intended to detect or prevent the corrosion.

    After the corrosion was discovered, NRC analyzed the problems that led to
    the corrosion on the reactor vessel head and concluded that FirstEnergy's
    programs for overseeing safety at Davis-Besse were weak, as seen in the
    following examples:

    o 	Davis-Besse's corrective action program did not result in timely or
    effective actions to prevent indications of leakage from reoccurring in
    the reactor coolant system.

    o 	FirstEnergy officials did not always enter equipment problems into the
    corrective action program because individuals who had identified the
    problem were often responsible for resolving it.

    o 	For over a decade, FirstEnergy had delayed plant modifications to its
    service structure platform, primarily because of cost. These modifications
    would have improved its ability to inspect the reactor vessel head
    nozzles. As a result, FirstEnergy could conduct only limited visual
    inspections and cleaning of the reactor pressure vessel head through the
    small "mouse-holes" that perforated the service structure.

    NRC was also unaware of the extent to which various aspects of
    FirstEnergy's safety culture had degraded-that is, FirstEnergy's
    organization and performance related to ensuring safety at Davis-Besse.
    This degradation had allowed the incident to occur with no forewarning
    because NRC's inspections and performance indicators do not directly
    assess safety culture. Safety culture is a group of characteristics and
    attitudes within an organization that establish, as an overriding
    priority, that issues affecting nuclear plant safety receive the attention
    their significance warrants. Following FirstEnergy's March 2002 discovery,
    NRC found numerous indications that FirstEnergy emphasized production over
    plant safety. First, Davis-Besse routinely restarted the plant following
    an outage, even though reactor pressure vessel valves and control rod
    drive mechanisms leaked. Second, staff was unable to remove all of the
    boric

    acid deposits from the reactor pressure vessel head because FirstEnergy's
    schedule to restart the plant dictated the amount of work that could be
    performed. Third, FirstEnergy management was willing to accept degraded
    equipment, which indicated a lack of commitment to resolve issues that
    could potentially compromise safety. Fourth, Davis-Besse's program that
    was intended to ensure that employees feel free to raise safety concerns
    without fear of retaliation had several weaknesses. For example, in one
    instance, a worker assigned to repair the containment air conditioner was
    not provided a respirator in spite of his concerns that he would inhale
    boric acid residue. According to NRC's lessons-learned task force report,
    NRC was not aware of weaknesses in this program because its inspections
    did not adequately assess it.

    Given that FirstEnergy concluded that one of the causes for the
    Davis-Besse incident was human performance and management failures, the
    panel overseeing FirstEnergy's efforts to restart Davis-Besse requested
    that FirstEnergy assess its safety culture before allowing the plant to
    restart. To oversee FirstEnergy's efforts to improve its safety culture,
    NRC (1) reviewed whether FirstEnergy had adequately identified all of the
    root causes for management and human performance failures at Davis-Besse,
    (2) assessed whether FirstEnergy had identified and implemented
    appropriate corrective actions to resolve these failures, and (3) assessed
    whether FirstEnergy's corrective actions were effective. As late as
    February 2004, NRC had concerns about whether FirstEnergy's actions would
    be adequate in the long term. As a result, the Davis-Besse safety culture
    was one of the issues contributing to the delay in restarting the plant.
    In March 2004, NRC's panel concluded that FirstEnergy's efforts to improve
    its safety culture were sufficient to allow the plant to restart. In doing
    so, however, NRC officials stated that one of the conditions the panel
    imposed was for FirstEnergy to conduct an independent assessment of the
    safety culture at Davis-Besse annually over the course of the next 5
    years.

    NRC Did Not Effectively Incorporate Long-Standing Knowledge about
    Corrosion, Nozzle Cracking, and Leak Detection into Its Oversight

    NRC has been aware of boric acid corrosion and its potential to affect
    safety since at least 1979. It issued several notices to the nuclear power
    industry about boric acid corrosion and, specifically, the potential for
    it to degrade the reactor coolant pressure boundary. In 1987, two
    licensees found significant corrosion on their reactor pressure vessel
    heads, which heightened NRC's concern. A subsequent industry study
    concluded that concentrated solutions of boric acid could result in
    unacceptably high corrosion rates-up to 4 inches per year-when primary
    coolant leaks onto surfaces and concentrates at temperatures found on the
    surface of the

    reactor vessel.24 After considering this information and several more
    instances of boric acid corrosion at plants, NRC issued a generic letter
    in 1988 requesting licensees to implement boric acid corrosion control
    programs.

    In 1990, NRC visited Davis-Besse to assess the adequacy of the plant's
    boric acid corrosion control program. At that time, NRC concluded that the
    program was acceptable. However, in 1999, NRC became aware that
    FirstEnergy's boric acid corrosion control program was inadequate because
    boric acid had corroded several bolts on a valve, and NRC issued a
    violation. As a result of the violation, FirstEnergy agreed to review its
    boric acid corrosion procedures and enhance its program. NRC inspectors
    evaluated FirstEnergy's completed and planned actions to improve the boric
    acid corrosion control program and found them to be adequate. According to
    NRC officials, they never inspected the remaining actions- assuming that
    the planned actions had been implemented effectively. In 2000, NRC adopted
    its new Reactor Oversight Process and discontinued its inspection
    procedure for plants' corrosion control programs because these inspections
    had rarely been conducted due to higher priorities. Thus, NRC had no
    reliable or routine way to ensure that the nuclear power industry fully
    implemented boric acid corrosion control programs.

    NRC also did not routinely review operating experiences at reactors, both
    in the United States and abroad, to keep abreast of boric acid
    developments and determine the need to emphasize this problem. Indeed, NRC
    did not fully understand the circumstances in which boric acid would
    result in corrosion, rather than flash to steam. Similarly, NRC did not
    know the rate at which carbon steel would corrode under different
    conditions. This lack of knowledge may be linked to shortcomings in its
    program to review operating experiences at reactors, which could have been
    exacerbated by the 1999 elimination of the office specifically responsible
    for reviewing operating experiences.25 This office was responsible for,
    among other things, (1) coordinating operational data collection, (2)

    24Westinghouse Electric Company, Corrosion Effects of Boric Acid Leakage
    on Steel under Plant Operating Conditions-A Review of Available Data
    (Pittsburgh: October 1987).

    25NRC's Office for Analysis and Evaluation of Operating Data was
    established in response to a recommendation that we made to the agency in
    1978 that it have a systematic process for analyzing operating experience
    and feeding this information back to licensees and the industry. NRC
    eliminated this office, and its responsibilities were transferred to other
    NRC offices in an effort to gain efficiencies.

    systematically analyzing and evaluating operational experience, (3)
    providing feedback on operational experience to improve safety, (4)
    assessing the effectiveness of the agencywide program, and (5) acting as a
    focal point for interaction with outside organizations on issues
    pertaining to operational safety data analysis and evaluation. According
    to NRC officials who had overseen Davis-Besse at the time of the incident,
    they would not have suspected the reactor vessel head or cracked head
    penetration nozzles as the source of the filter clogging and unidentified
    leakage because they had not been informed that these could be potential
    problems. According to these officials, the vessel head was "not on the
    radar screen."

    With regard to nozzle cracking, NRC, for more than two decades, was aware
    of the potential for nozzles and other components made of alloy 600 to
    crack. While cracks were found at nuclear power plants, NRC considered
    their safety significance to be low because the cracks were not developing
    rapidly. In contrast, other countries considered the safety significance
    of such cracks to be much higher. For example, concern over alloy 600
    cracking led France, as a preventive measure, to institute requirements
    for an extensive nondestructive examination inspection program for vessel
    head penetration nozzles, including the removal of insulation, during
    every fuel outage. When any indications of cracking were observed, even
    more frequent inspections were required, which, because of economic
    considerations, resulted in the replacement of vessel heads when
    indications were found. The effort to replace the vessel heads is still
    under way. Japan replaced those vessel heads whose nozzles it considered
    most susceptible to cracking, even though no cracks had yet been found.
    Both France and Sweden also installed enhanced leakage monitoring systems
    to detect leaks early. However, according to NRC, such systems cannot
    detect the small amounts of leakage that may be typical from cracked
    nozzles.

    NRC recognized that an integrated, long-term program, including periodic
    inspections and monitoring of vessel heads to check for nozzle cracking,
    was necessary. In 1997, it issued a generic letter that summarized NRC's
    efforts to address cracking of control rod drive mechanism nozzles and
    requested information on licensees' plans to inspect nozzles at their
    reactors. More specifically, this letter asked licensees to provide NRC
    with descriptions of their inspections of these nozzles and any plans for
    enhanced inspections to detect cracks. At that time, NRC was planning to
    review this information to determine if enhanced licensee inspections were
    warranted. Based on its review of this information, NRC concluded that the
    current inspection program was sufficient. As a result, between 1998 and

    2001, NRC did not issue or solicit additional information on nozzle
    cracking or assess its requirements for inspecting reactor vessels to
    determine whether they were sufficient to detect cracks. At Davis-Besse,
    NRC also did not determine if FirstEnergy had plans or was implementing
    any plans for enhanced nozzle inspections, as noted in the 1997 generic
    letter. NRC took no further action until the cracks were found in 2001 at
    the Oconee plant, in South Carolina. NRC attributed its lack of focus on
    nozzle cracking, in part, to the agency's inability to effectively review,
    assess, and follow up on industry operating experience events.
    Furthermore, as with boric acid corrosion, NRC did not obtain or analyze
    any new data about cracking that would have supported making changes in
    either its regulations or inspections to better identify or prevent
    corrosion on the vessel head at Davis-Besse.

    NRC's technical specifications regarding allowable leakage rates also
    contributed to the corrosion at Davis-Besse because the amount of leakage
    that can cause extensive corrosion can be significantly less than the
    level that NRC's specifications allow. According to NRC officials, NRC's
    requirements, established in 1973, were based on the best available
    technology at that time. The task of measuring identified and unidentified
    leakage from the reactor coolant system is not precise. It requires
    licensees to estimate the amount of coolant that the reactor is supposed
    to contain and identify any difference in coolant levels. They then have
    to account for the estimated difference in the actual amount of coolant to
    arrive at a leakage rate; to do this, they identify all sources and
    amounts of leakage by, among other things, measuring the amount of water
    contained in various sump collection systems. If these sources do not
    account for the difference, licensees know they have an unidentified
    source of leakage. This estimate can vary significantly from day to day
    between negative and positive numbers.

    According to analyses that FirstEnergy conducted after it identified the
    corrosion in March 2002, the leakage rates from the nozzle cracks were
    significantly below NRC's reactor coolant system unidentified leakage rate
    of 1 gallon per minute. Specifically, the leakage from the nozzle around
    which the vessel head corrosion occurred was predicted to be 0.025 gallon
    per minute. If such small leakage can result in such extensive corrosion,
    identifying if and where such leakage occurs is important. NRC staff
    recognized as early as 1993 it would be prudent for the nuclear power
    industry to consider implementing an enhanced method for detecting small
    leaks during plant operation, but NRC did not require this action, and the
    industry has not taken steps to do so. Furthermore, NRC has not

    consistently enforced its requirement for reactor coolant pressure
    boundary leakage. As a result, the NRC Davis-Besse task force concluded
    that inconsistent enforcement may have reinforced a belief that alloy 600
    nozzle leakage was not actually or potentially a safety significant issue.

    NRC's Process for Deciding Whether to Allow a Delayed Davis-Besse Shutdown
    Lacked Credibility

    Although FirstEnergy operated Davis-Besse without incident until shutting
    it down in February 2002, certain aspects of NRC's deliberations allowing
    the delayed shutdown raise questions about the credibility of the agency's
    decision making, if not about the Davis-Besse decision itself. NRC does
    not have specific guidance for deciding on plant shutdowns. Instead,
    agency officials turned to guidance developed for a different
    purpose-reviewing requests to amend license operating conditions-and even
    then did not always adhere to this guidance. In addition, NRC did not
    document its decision-making process, as called for by its guidance, and
    its letter to FirstEnergy to lay out the basis for the decision-sent a
    year after the decision-did not fully explain the decision. NRC's lack of
    guidance, coupled with the lack of documentation, precludes us from
    independently judging whether NRC's decision was reasonable. Finally, some
    NRC officials stated that the shutdown decision was based, in part, on the
    agency's probabilistic risk assessment (PRA) calculations of the risk that
    Davis-Besse would pose if it delayed its shutdown and inspection. However,
    as noted by our consultants, the calculations were flawed, and NRC's
    decision makers did not always follow the agency's guidance for developing
    and using such calculations.

    NRC Did Not Have Specific Guidance for Deciding on Plant Shutdowns

    NRC believed that Davis-Besse could have posed a potential safety risk
    because it was, in all likelihood, failing to comply with NRC's technical
    specification that no leakage occur in the reactor coolant pressure
    boundary. Its belief was based on the following indicators of probable
    leakage:

    o 	All six of the other reactors manufactured by the same company as
    Davis-Besse's reactor had cracked nozzles and identified leakage.26

    o  Three of these six reactors had identified circumferential cracking.

    26Davis-Besse's manufacturer was the Babcock and Wilcox Company, which is
    an operating unit of McDermott International.

    o 	FirstEnergy had not performed a recent visual examination of all of its
    nozzles.

    Furthermore, a FirstEnergy manager agreed that cracks and leakage were
    likely.

    NRC has the authority to shut down a plant when it is clear that the plant
    is in violation of important safety requirements, and it is clear that the
    plant poses a risk to public health and safety.27 Thus, if a licensee is
    not complying with technical specifications, such as those for no
    allowable reactor vessel pressure boundary leakage, NRC can order a plant
    to shut down. However, NRC decided that it could not require Davis-Besse
    to shut down on the basis of other plants' cracked nozzles and identified
    leakage or the manager's acknowledgement of a probable leak. Instead, it
    believed it needed more direct, or absolute, proof of a leak to order a
    shutdown. This standard of proof has been questioned. According to the
    Union of Concerned Scientists,28 for example, if NRC needed irrefutable
    proof in every case of suspected problems, the agency would probably never
    issue a shutdown order. In effect, in this case NRC created a Catch-22: It
    needed irrefutable proof to order a shutdown but could not get this proof
    without shutting down the plant and requiring that the reactor be
    inspected.

    Despite NRC's responsibility for ensuring that the public is adequately
    protected from accidents at commercial nuclear power plants, NRC does not
    have specific guidance for shutting down a plant when the plant may pose a
    risk to public health and safety, even though it may be complying with NRC
    requirements. It also has no specific guidance or standards for quality of
    evidence needed to determine that a plant may pose an undue risk. Lacking
    direct or absolute proof of leakage at Davis-Besse, NRC instead drafted a
    shutdown order on the basis that a potentially hazardous condition may
    have existed at the plant. NRC had no guidance for developing such a
    shutdown order, and therefore, it used its guidance for reviewing license
    amendment requests. NRC officials recognized that this guidance was not
    specifically designed to determine whether NRC should shut down a power
    plant such as Davis-Besse. However, NRC officials

    27Ordinarily, NRC would not suspend a license for a failure to meet a
    requirement unless the failure was willful and adequate corrective action
    had not been taken.

    28The Union of Concerned Scientists is a nonprofit partnership of
    scientists and citizens that augments scientific analyses and policy
    development for identifying environmental solutions to issues such as
    energy production.

    stated that this guidance was the best available for deciding on a
    shutdown because, although the review was not to amend a license, the
    factors that NRC needed to consider in making the decision and that were
    contained in the guidance were applicable to the Davis-Besse situation.

    To use its guidance for reviewing license amendment requests, NRC first
    determined that the situation at Davis-Besse posed a special circumstance
    because new information revealed a substantially greater potential for a
    known hazard to occur, even if Davis-Besse was in compliance with the
    technical specification for leakage from the reactor coolant pressure
    boundary. The special circumstance stemmed from NRC's determination that
    requirements for conducting vessel head inspections were not sufficient to
    detect nozzle cracking and, thus, small leaks.29 According to NRC
    officials, this determination allowed NRC to use its guidance for
    reviewing license amendment requests when deciding whether to order a
    shutdown.

    The Extent of NRC's Reliance on License Amendment Guidance Is Not Clear

    Under NRC's license amendment guidance, NRC considers how the license
    change affects risk, but not how it has previously assessed licensee
    performance, such as whether the licensee was viewed as a good performer.
    With regard to the Davis-Besse decision, the guidance directed NRC to
    determine whether the plant would comply with five NRC safety principles
    if it operated beyond December 2001 without inspecting the reactor vessel
    head. As applied to Davis-Besse, these principles were whether the plant
    would (1) continue to meet requirements for vessel head inspections, (2)
    maintain sufficient defense-in-depth, (3) maintain sufficient safety
    margins, (4) have little increase in the likelihood of a core damage
    accident, and (5) monitor the vessel head and nozzles. The guidance,
    however, does not specify how to apply these safety principles, how NRC
    can demonstrate it has followed the principles and ensured they are met,
    or whether any one principle takes precedence over the others. The
    guidance also does not indicate what actions NRC or licensees should take
    if some or all of the principles are not met.

    29Specifically, reactor vessel head inspection requirements do not require
    that insulation be removed. Because of this, reactor vessel head
    inspections performed without removing the insulation above the vessel
    head could not result in 100 percent of the nozzles being visually
    inspected.

    In mid-September 2001, NRC staff concluded that Davis-Besse complied with
    the first safety principle but did not meet the remaining four. According
    to the staff, Davis-Besse did not meet three safety principles because the
    requirements for vessel head inspections were not adequate. Specifically,
    the requirements do not require the inspector to remove the insulation
    above the vessel head, and thus allow all of the nozzles to be visually
    inspected. NRC therefore could not ensure that FirstEnergy was maintaining
    defense-in-depth and adequate safety margins or sufficiently monitoring
    the vessel head and nozzles. The staff believed that Davis-Besse did not
    meet the fourth safety principle because the risk estimate of core damage
    approached an unacceptable level and the estimate itself was highly
    uncertain.

    Between early October and the end of November 2001, NRC requested and
    received additional information from FirstEnergy regarding its risk
    estimate of core damage-its PRA estimate-and met with the company to
    determine the basis for the estimate. NRC was also developing its own risk
    estimate, although its numbers kept changing. At some point during this
    time, NRC staff also concluded that the first safety principle was
    probably not being met, although the basis for this conclusion is not
    known.

    At the end of November 2001, NRC contacted FirstEnergy and informed it
    that a shutdown order had been forwarded to the NRC commissioners and
    asked if FirstEnergy could take any actions that would persuade NRC to not
    issue the shutdown order. The following day, FirstEnergy proposed measures
    to mitigate the potential for and consequences of an accident. These
    measures included, among other things, lowering the operating temperature
    from 605 degrees Fahrenheit to 598 degrees Fahrenheit to reduce the
    driving force for stress corrosion cracking on the nozzles, identifying a
    specific operator to initiate emergency cooling in response to an
    accident, and moving the scheduled refueling outage up from March 31,
    2002, to no later than February 16, 2002. NRC staff discussed these
    measures, and NRC management asked the staff if they were concerned about
    extending Davis-Besse's operations until mid-February 2002. While some of
    the staff were concerned about continued operations, none indicated to NRC
    management that cracking in control rod drive mechanism nozzles was likely
    extensive enough to cause a nozzle to eject from the vessel head, thus
    making it unsafe to operate. NRC formally accepted FirstEnergy's
    compromise proposal within several days, thus abandoning its shutdown
    order.

    NRC Did Not Fully Explain or Document the Basis for Its Decision

    We could not fully assess NRC's basis for accepting FirstEnergy's
    proposal. NRC did not document its deliberations, even though its guidance
    requires that it do so. This documentation is to include the data,
    methods, and assessment criteria used; the basis for the decisions made;
    and essential correspondence sufficient to document the persons, places,
    and matters dealt with by NRC. Specifically, the guidance requires that
    the documentation contain sufficient detail to make possible a "proper
    scrutiny" of NRC decisions by authorized outside agencies and provide
    evidence of how basic decisions were formed, including oral decisions.
    NRC's guidance also states that NRC should document all important staff
    meetings.

    In reviewing NRC's documentation on the Davis-Besse decision, we found no
    evidence of an in-depth or formal analysis of how Davis-Besse's proposed
    measures would affect the plant's ability to satisfy the five safety
    principles. Thus, it is unclear whether the safety principles contained in
    the guidance were met by the measures that FirstEnergy proposed. However,
    several NRC officials stated that FirstEnergy's proposed measures had no
    impact on plant operations or safety. For example, according to one NRC
    official, FirstEnergy's proposal to reduce the operating temperature would
    have had little impact on safety because the small drop in operating
    temperature over a 7-week period would have had little effect on the
    growth rate of any cracks in a nozzle. As such, this official considered
    the measures as "window dressing." A proposed measure that NRC staff did
    consider as having a significant impact on the risk was for FirstEnergy to
    dedicate an operator for manually turning on safety equipment in the event
    that a nozzle was ejected. Subsequent to approving the delayed shutdown,
    NRC learned that FirstEnergy had not, in fact, planned to dedicate an
    operator for this task-rather, FirstEnergy planned to have an operator do
    this task in addition to other regularly assigned duties.

    According to an NRC official, once NRC decided not to issue a shutdown
    order for December 2001, NRC staff needed to discuss how NRC's assessment
    of whether the five safety principles had been met had changed in the
    course of the staff's deliberations. However, there was no evidence in the
    agency's records to support that this discussion was held, and other key
    meetings, such as the one in which the agency made its decision to allow
    Davis-Besse to operate past December 31, 2001, were not documented.
    Without documentation, it is not clear what factors influenced NRC's
    decision. For example, according to the NRC Office of the Inspector
    General's December 2002 report that examined the Davis-Besse incident,
    NRC's decision was driven in large part by a desire to lessen the
    financial

    impact on FirstEnergy that would result from an early shutdown.30 While
    NRC disputed this finding, we found no evidence in the agency's records to
    support or refute its position.

    In December 2001, when NRC informed FirstEnergy that it accepted the
    company's proposed measures and the February 16, 2002, shutdown date, it
    also said that the company would receive NRC's assessment in the near
    future. However, NRC did not provide the assessment until a full year
    later-in December 2002. In addition, the December 2002 assessment, which
    includes a four-page evaluation, does not fully explain how the safety
    principles were used or met-other than by stating that if the likelihood
    of nozzle failure were judged to be small, then adequate protection would
    be ensured. Even though NRC's regulations regarding the reactor coolant
    pressure boundary dictate that the reactor have an extremely low
    probability of failing, NRC stated it did not believe that Davis-Besse
    needed to demonstrate strict conformance with this regulation. As evidence
    of the small likelihood of failure, NRC cited the small size of cracks
    found at other power plants, as well as its preliminary assessment of
    nozzle cracking, which projected crack growth rates. NRC concluded that 7
    weeks of additional operation would not result in an appreciable increase
    in the size of the cracks.31 While NRC included its calculated estimates
    of the risk that Davis-Besse would pose, it did not detail how it
    calculated its estimates.

    NRC's PRA Estimate Was Flawed and Its Use in Deciding to Delay the
    Shutdown Is Unclear

    In moving forward with its more risk-informed regulatory approach, NRC has
    established a policy to increase the use of PRA methods as a means to
    promote regulatory stability and efficiency. Using PRA methods, NRC and
    the nuclear power industry can estimate the likelihood that different
    accident scenarios at nuclear power plants will result in reactor core
    damage and a release of radioactive materials. For example, one of these
    accident scenarios begins with a "medium break" loss-of-coolant accident
    in which the reactor coolant system is breached and a midsize-about 2- to
    4-inch-hole is formed that allows coolant to escape from the reactor

    30NRC, Office of the Inspector General, NRC's Regulation of Davis-Besse
    Regarding Damage to the Reactor Vessel Head (Washington, D.C.; Dec. 30,
    2002).

    31NRC, Preliminary Staff Technical Assessment for Pressurized Water
    Reactor Vessel Head Penetration Nozzles Associated with NRC Bulletin
    2001-01, "Circumferential Cracking of Reactor Pressure Vessel Head
    Penetration Nozzles" (Washington, D.C.; Nov. 6, 2001).

    pressure boundary. The probability of such an accident scenario occurring
    and the consequences of that accident take into account key engineering
    safety system failure rates and human error probabilities that influence
    how well the engineered systems would be able to mitigate the consequences
    of an accident and ensure no radioactive release from the plant.

    For Davis-Besse, NRC needed two estimates: one for the frequency of a
    nozzle ejecting and causing a loss-of-coolant accident and one for the
    probability that a loss-of-coolant accident would result in core damage.
    NRC first established an estimate, based partially on information provided
    by FirstEnergy, for the frequency of a plant developing a cracked nozzle
    that would initiate a medium break loss-of-coolant accident. NRC estimated
    that the frequency of this occurring would be about 2x10-2, or 1 chance in
    50,32 per year. NRC then used an estimate, which FirstEnergy provided, for
    the probability of core damage given a medium break loss-ofcoolant
    accident. This probability estimate was 2.7x10-3, or about 1 chance in
    370.33 Multiplying these two numbers, NRC estimated that the potential for
    a nozzle to crack and cause a loss-of-coolant accident would increase the
    frequency of core damage at Davis-Besse by about 5.4x10-5 per year, or
    about 1 in 18,500 per year.34 Converting this frequency to a probability
    associated with continued operation for 7 weeks, NRC calculated that the
    increase in the probability of core damage was approximately 5x10-6, or 1
    chance in 200,000.35 While NRC officials currently disagree that this was
    the number it used, this is the number that it included in its December
    2002 assessment provided to FirstEnergy. Further, we found no evidence in
    the agency's records to support NRC's current assertion.

    According to our consultants, the way NRC calculated and used the PRA
    estimate was inadequate in several respects. (See app. II for the
    consultants' detailed report.) First, NRC's calculations did not take into

    32Here is how to calculate the frequency estimate: 2x10-2 equates to 0.02,
    or 2/100, which equals 1/50.

    33Here is how to calculate the probability estimate: 2.7x10-3 equates to
    0.0027, or 27/10,000, which equals 1/370.37.

    34Here is how to calculate the frequency estimate: 5.4x10-5 equates to
    0.000054, or 54/1,000,000, which equals 1/18,518.52.

    35Here is how to calculate the probability estimate: 5x10-6 equates to
    0.000005, or 5/1,000,000, which equals 1/200,000.

    account several factors, such as the possibility of corrosion and axial
    cracking that could lead to leakage. For example, the consultants
    concluded that NRC's estimate of risk was incorrectly too small, primarily
    because the calculation did not consider corrosion of the vessel head. In
    reviewing how NRC developed and used its PRA estimates for Davis-Besse,
    our consultants noted that the calculated risk was smaller than it should
    have been because the calculations did not consider corrosion of the
    reactor vessel from the boric acid coolant leaking through cracks in the
    nozzles. According to the consultants, apparently all NRC staff involved
    in the Davis-Besse decision were aware that coolant under high pressure
    was leaking from valves, flanges, and possibly from cracks but evidently
    thought that the coolant would immediately flash into steam and
    noncorrosive compounds of boric acid. Our consultants, however, stated
    that because boric acid could potentially cause corrosion, except at
    temperatures much higher than 600 degrees Fahrenheit, NRC should have
    anticipated that corrosion could occur. Our consultants further stated
    that as evaporation occurs, boric acid becomes more concentrated in the
    remaining liquid-making it far more corrosive-and as vapor pressure
    decreases, evaporation is further slowed. They said it should be expected
    that some of the boric acid in the escaping coolant could reach the metal
    surfaces as wet or moist, highly corrosive material underlying the surface
    layers of dry noncorrosive boric acid, which is evidently what happened at
    Davis-Besse.

    Our consultants concluded that NRC staff should have been aware of the
    experience at French nuclear power plants, where boric acid corrosion from
    leaking reactor coolant had been identified during the previous decade,
    the safety significance had been recognized, and safety procedures to
    mitigate the problem had been implemented. Furthermore, tests had been
    conducted by the nuclear power industry and in government laboratories on
    boric acid corrosion that were widely available to NRC. They stated that
    keeping abreast of safety issues at similar plants, whether domestic or
    foreign, and conveying relevant safety information to licensees are
    important functions of NRC's safety program. According to NRC, the agency
    was aware of the experience at French nuclear power plants. For example,
    NRC concluded, in a December 15, 1994, internal NRC memo, that primary
    coolant leakage from a through-wall crack could cause boric acid corrosion
    of the vessel head. However, because it concluded that some analyses
    indicated that it would take at least 6 to 9 years before any corrosion
    would challenge the structural integrity of the head, NRC concluded that
    cracking was not a short-term safety issue.

    Our consultants also stated that NRC's risk analysis was inadequate
    because the analysis concerned only the formation and propagation of
    circumferential cracks that could result in nozzle failure, loss of
    coolant, and even control rod ejection. Although there is less chance of
    axial cracks causing complete nozzle failure, these cracks open additional
    pathways for coolant leakage. In addition, their long crevices provide
    considerably greater opportunity for the coolant to concentrate near the
    surface of the vessel head. However, according to our consultants, NRC was
    convinced that the boric acid they saw resulted from leaking flanges above
    the reactor vessel head, as opposed to axial cracks in the nozzles.

    Second, NRC's analysis was inadequate because it did not include the
    uncertainty of its risk estimate and use the uncertainty analysis in the
    Davis-Besse decision-making process, although NRC staff should have
    recognized large uncertainties associated with its risk estimate. Our
    consultants also concluded that NRC failed to take into account the large
    uncertainties associated with estimates of the frequency of core damage
    resulting from the failure of nozzles. PRA estimates for nuclear power
    plants are subject to significant uncertainties associated with human
    errors and other common causes of system component failures, and it is
    important that proper uncertainty analyses be performed for any PRA study.
    NRC guidance and other NRC reports on advancing PRA technology for
    risk-informed decisions emphasize the need to understand and characterize
    uncertainties in PRA estimates. Our consultants stated that had the NRC
    staff estimated the margin of error or uncertainty associated with its PRA
    estimate for Davis-Besse, the uncertainty would likely have been so high
    as to render the estimate of questionable value.

    Third, NRC's analysis was inadequate because the risk estimates were
    higher than generally considered acceptable under NRC guidance. Despite
    PRA's important role in the decision, our consultants found that NRC did
    not follow its own guidance for ensuring that the estimated risk was
    within levels acceptable to the agency. NRC required the nuclear power
    industry to develop a baseline estimate for how frequently a core damage
    accident could occur at every nuclear power plant in the United States.
    This baseline estimate is used as a basis for deciding whether changes at
    a plant that affect the core damage frequency are acceptable. The baseline
    core damage frequency estimate for the Davis-Besse plant was between
    4x10-5

    and 6.6x10-5 per year (which is between 1 chance in 25,00036 per year and
    about 1 chance in 15,15037 per year). NRC guidance for reviewing and
    approving license amendment requests indicates that any plant-specific
    change resulting in an increase in the frequency of core damage of 1x10-5
    per year (which is 1 chance in 100,000 per year) or more would fall within
    the highest risk zone: In this case, NRC would generally not approve the
    change because the risk criterion would not be met. If a license change
    would result in a core damage frequency change of 1x10-5 per year to
    1x10-6 per year (which is 1 chance in 100,000 per year to 1 chance in 1
    million per year), the risk criterion would be considered marginally met
    and NRC would consider approving the change but would require additional
    analysis. Finally, if a license change would result in a core damage
    frequency change of 1x10-6 per year (which is 1 chance in 1 million per
    year) or less, the risk would fall within the lowest risk zone and NRC
    would consider the risk criterion to be met and would generally consider
    approving the change without requiring additional analysis. (See fig. 6.)

    36Here is how to calculate the frequency estimate: 4x10-5 equates to
    0.00004, or 4/100,000, which equals 1/25,000.

    37Here is how to calculate the frequency estimate: 6.6x10-5 equates to
    0.000066, or 66/1,000,000, which equals 1/15,151.51.

    Figure 6: NRC's Acceptance Guidelines for Core Damage Frequency

    aRisk criterion is met and license changes would generally be considered.

    bRisk criterion is considered marginally met and while license changes are
    generally considered, they require additional analysis.

    cRisk criterion is not met and license changes are generally not allowed.

    However, NRC's PRA estimate for Davis-Besse-an increase in the frequency
    of core damage of 5.4x10-5, or 1 chance in about 18,500 per year-was
    higher than the acceptable level. While an NRC official who helped develop
    the risk estimate said that additional NRC and industry guidance was used
    to evaluate whether its PRA estimate was acceptable, this guidance also
    suggests that NRC's estimate was too high. NRC's estimate of the increase
    in the frequency of core damage of 5.4x10-5 per year equates to an
    increase in the probability of core damage of 5x10-6 , or 1 chance in
    200,000, for the 7-week period December 31, 2001, to February 16, 2002.35
    NRC's guidance for evaluating requests to relax NRC technical
    specifications suggests that a probability increase higher than 5x10-7, or
    1 chance in 2 million38, is considered unacceptable for relaxing the
    specifications. Thus, NRC's estimate would not be considered acceptable

    38Here is how to calculate the probability estimate: 5x10-7 equates to
    0.0000005, or 5/10,000,000, which equals 1/2,000,000.

    under this guidance. NRC's estimate would also not be considered
    acceptable under Electric Power Research Institute or Nuclear Energy
    Institute guidance unless further action were taken to evaluate or manage
    risk. According to NRC officials, NRC viewed its PRA estimate as being
    within acceptable bounds because it was a temporary situation-7 weeks-and
    NRC had, at other times, allowed much higher levels of risk at other
    plants. However, at the time that NRC made its decision, it did not
    document the basis for accepting this risk estimate, even though NRC's
    guidance explicitly states that the decision on whether PRA results are
    acceptable must be based on a full understanding of the contributors to
    the PRA results and the reasoning must be well documented. In defense of
    its decision, NRC officials said that the process they used to arrive at
    the decision is used to make about 1,500 licensing decisions such as this
    each year.

    Lastly, NRC's analysis was inadequate because the agency does not have
    clear guidance for how PRA estimates are to be used in the decisionmaking
    process. Our consultants concluded that NRC's process for riskinformed
    decision making is ill-defined, lacks guidelines for how it is supposed to
    work, and is not uniformly transparent within NRC. According to NRC
    officials involved in the Davis-Besse decision, NRC's guidance is not
    clear on the use of PRA in the decision-making process. For example, while
    NRC has extensive guidance, this guidance does not outline to what extent
    or how the resultant PRA risk number and uncertainty should be weighed
    with respect to the ultimate decision. One factor complicating this issue
    is the lack of a predetermined methodology to weigh risks expressed in PRA
    numbers against traditional deterministic results and other factors.39
    Absent this guidance, the value assigned to the PRA analysis is largely at
    the discretion of the decision maker. The process, which NRC stated is
    robust, can result in a decision in which PRA played no role, a partial
    role, or one in which it was the sole deciding factor. According to our
    consultants, this situation is made worse by the lack of guidelines for
    how, or by whom, decisions in general are made at NRC.

    It is not clear how NRC staff used the PRA risk estimate in the
    Davis-Besse decision-making process. For example, according to one NRC
    official who

    39The deterministic approach considers a set of safety challenges and how
    those challenges should be mitigated through engineering safety margins
    and quality assurance standards. The probabilistic approach extends this
    by allowing for the consideration of a broader set of safety challenges,
    prioritizing safety challenges based on risk significance, and allowing
    for a broader set of mitigation mechanisms.

    was familiar with some of the data on nozzle cracking, these data were not
    sufficient for making a good probabilistic decision. He stated that he
    favored issuing an order requiring that Davis-Besse be shut down by the
    end of December 2001 because he believed the available data were not
    sufficient to assure a low enough probability for a nozzle to be ejected.
    Other officials indicated that they accepted FirstEnergy's proposed
    February 16, 2002, shutdown date based largely on NRC's PRA estimate for a
    nozzle to crack and be ejected. According to one of these officials,
    allowing the additional 7 weeks of operating time was not sufficiently
    risk significant under NRC's guidance. He stated that safety margins at
    the plant were preserved and the PRA number was within an acceptable
    range. Still another official said he discounted the PRA estimate and did
    not use it at all when recommending that NRC accept FirstEnergy's
    compromise proposal. This official also stated that it was likely that
    many of the staff did base their conclusions on the PRA estimate.
    According to our consultants, although the extent to which the PRA risk
    analysis influenced the decision making will probably never be known, it
    is apparent that it did play an important role in the decision to allow
    the shutdown delay.

    NRC Has Made Progress in Implementing Recommended Changes, but Is Not
    Addressing Important Systemic Issues

    NRC has made significant progress in implementing the actions recommended
    by the Davis-Besse lessons-learned task force. While NRC has implemented
    slightly less than half-21 of the 51-recommendations as of March 2004, it
    is scheduled to have more than 70 percent of them implemented by the end
    of 2004. For example, NRC has already taken actions to improve staff
    training and inspections that would appear to help address the concern
    that NRC inspectors viewed FirstEnergy as a good performer and thus did
    not subject Davis-Besse to the level of scrutiny or questioning that they
    should have. It is not certain when actions to implement the remaining
    recommendations will occur, in part because of resource constraints. NRC
    also faces challenges in fully implementing the recommendations, also in
    part because of resource constraints, both in the staff needed to develop
    specific corrective actions and in the additional staff responsibilities
    and duties to carry them out. Further, while NRC is making progress, the
    agency is not addressing three systemic issues highlighted by the
    Davis-Besse experience: (1) an inability to detect weakness or
    deterioration in FirstEnergy's safety culture, (2) deficiencies in NRC's
    process for deciding on a shutdown, and (3) lack of management controls to
    track, on a longer-term basis, the effectiveness of actions implemented in
    response to incidents such as Davis-Besse, so that they do not occur at
    another power plant.

    NRC Does Not Expect to Complete Its Actions until 2006, in Part Because of
    Resource Constraints

    NRC's lessons-learned task force for Davis-Besse developed 51
    recommendations to address the weaknesses that contributed to the
    Davis-Besse incident. Of these 51 recommendations, NRC rejected 2 because
    it concluded that agency processes or procedures already provided for the
    recommendations' intent to be effectively carried out.40 To address the
    remaining 49 recommendations, NRC developed a plan in March 2003 that
    included, for each recommendation, the actions to be taken, the
    responsible NRC office, and the schedule for completing the actions. When
    developing its schedule, NRC placed the highest priority on implementing
    recommendations that were most directly related to the underlying causes
    of the Davis-Besse incident as well as those recommendations responding to
    vessel head corrosion. NRC assigned a lower priority to the remaining
    recommendations, which were to be integrated into the planning activities
    of those NRC offices assigned responsibility for taking action on the
    recommendations. In assigning these differing priorities, NRC officials
    stated they recognized that the agency has many other pressing matters to
    address that are not related to the Davis-Besse incident, such as renewing
    operating licenses, and they did not want to divert resources away from
    these activities. (App. III contains a complete list of the task force's
    recommendations, NRC actions, and the status of the recommendations as of
    March 2004.)

    To better track the status of the agency's actions to implement the
    recommendations, we split two of the 49 recommendations that NRC accepted
    into 4; therefore, our analysis reflects NRC's response to 51
    recommendations. As shown in table 1, as of March 2004, NRC had made
    progress in implementing the recommendations, although some completion
    dates have slipped.

    40These two recommendations were for NRC to (1) review how industry
    considers economic factors in making decisions to repair equipment and
    consider these factors in developing guidance for nonvisual inspections of
    vessel head penetration nozzles, and (2) revise the criteria for reviewing
    industry topical reports that have not been formally submitted to NRC for
    review but that have generic safety implications.

    Table 1: Status of Davis-Besse Lessons-Learned Task Force Recommendations,
    as of March 2004

    Number of Status recommendations

    Completed as of March 2004

    Scheduled for completion April through December 2004

    Scheduled for completion in 2005

    Completion date yet to be determined

    Total

    Source: GAO analysis of NRC data.

    Note: This table does not include the two recommendations NRC rejected.

    As the table shows, as of March 2004, NRC had implemented 21
    recommendations and scheduled another 17 for completion by December 2004.
    However, some slippage has already occurred in this schedule- primarily
    because of resource constraints-and NRC has rescheduled completion of some
    recommendations. NRC's time frames for completing the recommendations
    depend on several factors-the recommendations' priority, the amount of
    work required to develop and implement actions, and the need to first
    complete actions on other related recommendations.

    Of the 21 implemented recommendations, 10 called upon NRC to revise or
    enhance its inspection guidance or training. For example, NRC revised the
    guidance it uses to assess the implementation of licensees' programs to
    identify and resolve problems before they affect operations. It took this
    action because the task force had concluded that FirstEnergy's weak
    corrective action program implementation was a major contributor to the
    Davis-Besse incident. NRC has also developed Web-based training modules to
    improve NRC inspectors' knowledge of boric acid corrosion and nozzle
    cracking. The other 11 completed recommendations concerned actions such as

    o 	collecting and analyzing foreign and domestic information on alloy 600
    nozzle cracking,

    o 	fully implementing and revising guidance to better assure that
    licensees carry out their commitments to make operational changes, and

    o 	establishing measurements for resident inspector staffing levels and
    requirements.

    By the end of 2004, NRC expects to complete another 17 recommendations, 12
    of which generally address broad oversight or programmatic issues, and 5
    of which provide for additional inspection guidance and training. On the
    broader issues, for example, NRC is scheduled to complete a review of the
    effectiveness of its response to past NRC lessons-learned task force
    reports by April 2004. By December 2004, NRC expects to have a framework
    established for moving forward with implementing recommended improvements
    to its agencywide operating experience program.

    In 2005, 4 of the 6 recommendations scheduled for completion concern
    leakage from the reactor coolant system. For example, NRC is to (1)
    develop guidance and criteria for assessing licensees' responses to
    increasing leakage levels and (2) determine whether licensees should
    install enhanced systems to detect leakage from the reactor coolant
    system. The fifth recommendation calls for NRC to inspect the adequacy of
    licensees' programs for controlling boric acid corrosion, and the final
    recommendation calls on NRC to assess the basis for canceling a series of
    inspection procedures in 2001.

    NRC did not assign completion dates to 7 recommendations because, among
    other things, their completion depends on completing other recommendations
    or because of limited resources. Even though it has not assigned
    completion dates for these recommendations, NRC has begun to work on 5 of
    the 7:

    o 	Two recommendations will be addressed when requirements for vessel head
    inspections are revised. To date, NRC has taken some related, but
    temporary, actions. For example, since February 2003, it has required
    licensees to more extensively examine their reactor vessel heads. NRC has
    also issued a series of temporary instructions for NRC inspectors to
    oversee the enhanced examinations. NRC expects to replace these temporary
    steps with revised requirements for vessel head inspections.

    o 	Two recommendations call upon NRC to revise requirements for detecting
    leaks in the reactor coolant pressure boundary. In response, NRC has, for
    example, begun to review its barrier integrity requirements and has
    contracted for research on enhanced detection capabilities.

    o 	One recommendation is directed at improving follow-up of licensee
    actions taken in response to NRC generic communications. NRC is currently
    developing a temporary inspection procedure to assess the effectiveness of
    licensee actions taken in response to generic

    communications. Additionally, as a long-term change in the operating
    experience program, the agency plans to improve the verification of how
    effective its generic communications are.

    The remaining two recommendations address NRC's need to (1) evaluate the
    adequacy of methods for analyzing the risks posed by passive components,
    such as reactor vessels, and integrate these methods and risks into NRC's
    decision-making process and (2) review a sample of plant assessments
    conducted between 1998 and 2000 to determine if any identified plant
    safety issues have not been adequately assessed. NRC has not yet taken
    action on these recommendations.

    Some recommendations will require substantial resources to develop and
    implement. As a result, some implementation dates have slipped and some
    plans in response to the recommendations have changed in scope. For
    example, owing to resource constraints, NRC has postponed indefinitely the
    evaluation of methods to analyze the risk associated with passive reactor
    components such as the vessel head. Also, in part due to resource
    constraints, NRC has reconceptualized its plan to review licensee actions
    in response to previous generic communications, such as bulletins and
    letters.

    Staff resources will be strained because implementing the recommendations
    adds additional responsibilities or duties-that is, more inspections,
    training, and reviews of licensee reports. For example, NRC's revised
    inspection guidance for more thorough examinations of reactor vessel heads
    and nozzles, as well as new requirements for NRC oversight of licensees'
    corrective action programs, will require at least an additional 200 hours
    of inspection per reactor per year. As of February 2004, NRC was also
    revising other inspection requirements that are likely to place additional
    demands on inspectors' time. Thus, to respond to these increased demands,
    NRC will either need to add inspectors or reduce oversight of other
    licensee activities.

    To its credit, in its 2004 budget plan, NRC increased the level of
    resources for some inspection activities. However, it is not certain that
    these increases will be maintained. The number of inspection hours has
    fallen by more than one-third between 1995 and 2001. In addition, NRC is
    aware that resident inspector vacancies are filled with staff having
    varying levels of experience-from the basic level that would be expected
    from a newly qualified inspector to the advanced level that is achieved
    after several years' experience. According to the latest available data,
    as of May 2003,

    about 12 percent of sites had only one resident inspector; the remaining
    88 percent had two inspectors of varying levels of experience. Because of
    this situation, NRC augments these inspection resources with regional
    inspectors and contractors to ensure that, at a minimum, its baseline
    inspection program can be implemented throughout the year. Because of
    surges in the demand for inspections, NRC in 2003 increased its use of
    contractors and temporarily pulled qualified inspectors from other jobs to
    help complete the baseline inspection program for every plant. According
    to NRC, it did not expect to require such measures in 2004.

    Similarly, NRC may require additional staff to identify and evaluate
    plants' operating experiences and communicate the results to licensees, as
    the task force recommended. NRC has currently budgeted an increase of
    three full-time staff in fiscal year 2006 to implement a centralized
    system, or clearinghouse, for managing the operating experience program.
    However, according to an NRC official, questions remain about the level of
    resources needed to fully implement the task force recommendations. NRC's
    operating experience office, before it was disbanded in 1999, had about 33
    staff whose primary responsibility was to collect, evaluate, and
    communicate activities associated with safety performance trends, as
    reflected in licensees' operating experiences, and participate in
    developing rulemakings. However, it is too early to know the effectiveness
    of this clearinghouse approach and the adequacy of resources in the other
    offices available for collecting and analyzing operating experience
    information. Neither the operating experience office before it was
    disbanded nor the other offices flagged boric acid corrosion, cracking, or
    leakage as problems warranting significantly greater oversight by NRC,
    licensees, or the nuclear power industry.

    NRC Has Not Proposed Any Specific Actions to Correct Systemic Weaknesses
    in Oversight and Decision-Making Processes

    NRC's Task Force Recommendations Did Not Address Licensee Safety Culture

    NRC's Davis-Besse task force did not make any recommendations to address
    two systemic problems: evaluating licensees' commitment to safety and
    improving the agency's process for deciding on a shutdown.

    NRC's task force identified numerous problems at Davis-Besse that
    indicated human performance and management failures and concluded that
    FirstEnergy did not foster an environment that was fully conducive to
    ensuring that plant safety issues received appropriate attention. Although

    the task force report did not use the term safety culture, as evidence of
    FirstEnergy's safety culture problems, the task force pointed to

    o 	an imbalance between production and safety, as evidenced by
    FirstEnergy's efforts to address symptoms (such as regular cleanup of
    boric acid deposits) rather than causes (finding the source of the leaks
    during refueling outages);

    o 	a lack of management involvement in or oversight of work at Davis-Besse
    that was important for maintaining safety;

    o 	a lack of a questioning attitude by senior FirstEnergy managers with
    regard to vessel head inspections and cleaning activities;

    o  ineffective and untimely corrective action;

    o  a long-standing acceptance of degraded equipment; and

    o  inadequate engineering rigor.

    The task force concluded that NRC's implementation of guidance for
    inspecting and assessing a safety-conscious work environment and employee
    concerns programs failed to identify significant safety problems. Although
    the task force did not make any specific recommendations that NRC develop
    a means to assess licensees' safety culture, it did recommend changes to
    focus more effort on assessing programs to promote a safetyconscious work
    environment.

    NRC has taken little direct action in response to this task force
    recommendation. However, to help enhance NRC's capability to assess
    licensee safety culture by indirect means, NRC modified the wording in,
    and revised its inspection procedure for, assessing licensees' ability to
    identify and resolve problems, such as malfunctioning plant equipment.
    These revisions included requiring inspectors to

    o  review all licensee reports on plant conditions,

    o 	analyze trends in plant conditions to determine the existence of
    potentially significant safety issues, and

    o 	expand the scope of their reviews to the prior 5 years in order to
    identify recurring issues.

    This problem identification and resolution inspection procedure is
    intended to assess the end results of management's safety commitment
    rather than the commitment itself. However, by measuring only the end
    results, early signs of a deteriorating safety culture and declining
    management performance may not be readily visible and may be hard to
    interpret until clear violations of NRC's regulations occur. Furthermore,
    because NRC directs its inspections at problems that it recognizes as
    being more important to safety, NRC may overlook other problems until they
    develop into significant and immediate safety problems. Conditions at a
    plant can quickly degrade to the extent that they can compromise public
    health and safety.

    The International Atomic Energy Agency and its member nations have
    developed guidance and procedures for assessing safety culture at nuclear
    power plants, and today several countries, such as Brazil, Canada,
    Finland, Sweden, and the United Kingdom, assess plant safety culture or
    licensees' own assessments of their safety culture.41 In assessing safety
    culture, an advisory group to the agency suggests that regulatory agencies
    examine whether, for example, (1) employee workloads are not excessive,
    (2) staff training is sufficient, (3) responsibility for safety has been
    clearly assigned within the organization, (4) the corporation has clearly
    communicated its safety policy, and (5) managers sufficiently emphasize
    safety during plant meetings. One reason for assessing safety culture,
    according to the Canadian Nuclear Safety Commission, is because management
    and human performance aspects are among the leading causes of unplanned
    events at licensed nuclear facilities, particularly in light of pressures
    such as deregulation of the electricity market. Finland specifically
    requires that nuclear power plants maintain an advanced safety culture and
    its inspections target the importance that has been embedded in factors
    affecting safety, including management. NRC had begun considering methods
    for assessing organizational factors, including safety culture, but in
    1998, NRC's commissioners decided that the agency should have a
    performance-based inspection program of overall plant performance and
    should infer licensee management performance and competency from the
    results of that program. They chose this approach instead of one of four
    other options:

    41The International Atomic Energy Agency is an international organization
    affiliated with the United Nations that provides advice and assistance to
    its members on nuclear safety matters.

    o 	conduct performance-based inspections in all areas of facility
    operation and design, but not infer or articulate conclusions regarding
    the performance of licensee management;

    o 	assess the performance of licensee management through targeted
    operations-based inspections using specific inspection procedures, trained
    staff, and contractors to assess licensee management-a task that would
    require the development of inspection procedures and significant
    training-and to document inspection results;

    o 	assess the performance of licensee management as part of the routine
    inspection program by specifically evaluating and documenting management
    performance attributes-a larger effort that would require the development
    of assessment tools to evaluate safety culture as well as additional
    resources; or

    o 	assess the competency of licensee management by evaluating management
    competency attributes-an even larger effort that would require that
    implementation options and their impacts be assessed.

    When adopting the proposal to infer licensee management performance from
    the results of its performance-based inspection program, NRC eliminated
    any resource expenditures specifically directed at developing a systematic
    method of inferring management performance and competency. NRC stated that
    it currently has a number of means to assess safety culture that provide
    indirect insights into licensee safety culture. These means include, for
    example, (1) insights from augmented inspection teams, (2) lessons-learned
    reviews, and (3) information obtained in the course of conducting
    inspections under the Reactor Oversight Process. However, insights from
    augmented inspection teams and lessons-learned reviews are reactionary and
    do not prevent problems such as those that occurred at Davis-Besse.
    Further, before the Davis-Besse incident, NRC assumed its oversight
    process would adequately identify problems with licensees' safety culture.
    However, NRC has no formalized process for collectively assessing
    information obtained in the course of its problem identification and
    resolution inspection to ensure that individual inspection results would
    identify poor management performance. NRC stated that its licensee
    assessments consider inputs such as inspection results and insights,
    correspondence to licensees related to inspection observations, input from
    resident inspectors, and the results of any special investigations.
    However, this information may not be sufficient to inform NRC of problems
    at a plant in advance of these problems becoming safety significant.

    In part because of Davis-Besse, NRC's Advisory Committee on Reactor
    Safeguards42 recommended that NRC again pursue the development of a
    methodology for assessing safety culture. It also asked NRC to consider
    expanding research to identify leading indicators of degradation in human
    performance and work to develop a consistent comprehensive methodology for
    quantifying human performance. During an October 2003 public meeting of
    the advisory committee's Human Performance Subcommittee, the
    subcommittee's members again reiterated the need for NRC to assess safety
    culture. Specifically, the members recognized that certain aspects of
    safety culture, such as beliefs, perceptions, and management philosophies,
    are ultimately the nuclear power industry's responsibility but stated that
    NRC should deal with patterns of behavior and human performance, as well
    as organizational structures and processes. At this meeting, NRC officials
    discussed potential safety culture indicators that NRC could use,
    including, among other things, how many times a problem recurs at a plant,
    timeliness in correcting problems, number of temporary modifications, and
    individual program and process error rates. Committee members recommended
    that NRC test various safety culture indicators to determine whether (1)
    such indicators should ultimately be incorporated into the Reactor
    Oversight Process and (2) a significance determination process could be
    developed for safety culture. As of March 2004, NRC had yet to respond to
    the advisory committee's recommendation.

    Despite the lack of action to address safety culture issues, NRC's concern
    over FirstEnergy's safety culture at Davis-Besse was one of the last
    issues resolved before the agency approved Davis-Besse's restart. NRC
    undertook a series of inspections to examine Davis-Besse's safety culture
    and determine whether FirstEnergy had (1) correctly identified the
    underlying causes associated with its declining safety culture, (2)
    implemented appropriate actions to correct safety culture problems, and
    (3) developed a process for monitoring to ensure that actions taken were
    effective for resolving safety culture problems. In December 2003, NRC
    noted significant improvements in the safety culture at Davis-Besse, but
    expressed concern with the sustainability of Davis-Besse's performance in
    this area. For example, a survey of FirstEnergy and contract employees
    conducted by FirstEnergy in November 2003 indicated that about 17

    42The Advisory Committee on Reactor Safeguards is an independent committee
    comprising nuclear experts that advises NRC on matters of licensing and
    safety-related issues, and provides technical advice to aid the NRC
    commissioners' decision-making process.

    percent of employees believed that management cared more about cost and
    schedule than resolving safety and quality issues-again, production over
    safety.

    NRC's Task Force NRC's task force also did not analyze NRC's process for
    deciding not to Recommendations Did Not order a shutdown of the
    Davis-Besse plant. It noted that NRC's written Address NRC's
    Decision-Making rationale for accepting FirstEnergy's justification for
    continued plant Process operation had not yet been prepared and
    recommended that NRC change

    guidance requiring NRC to adequately document such decisions. It also made
    a recommendation to strengthen guidance for verifying information provided
    by licensees. According to an NRC official on the task force, the task
    force did not assess the decision-making process in detail because the
    task force was charged with determining why the degradation at Davis-Besse
    was not prevented and because NRC had coordinated with NRC's Office of the
    Inspector General, which was reviewing NRC's decision making.

    NRC's Failure to Track the Resolution of Identified Problems May Allow the
    Problems to Recur

    The NRC task force conducted a preliminary review of prior lessonslearned
    task force reports to determine whether they suggested any recurring or
    similar problems. As a result of this preliminary review, the task force
    recommended that a more detailed review be conducted to determine if
    actions that NRC took as a result of those reviews were effective. These
    previous task force reports included: Indian Point 2 in Buchanan, New
    York, in February 2000; Millstone in Waterford, Connecticut, in October
    1993; and South Texas Project in Wadsworth, Texas, from 1988 to 1994.43
    NRC's more detailed review, as of May 2004, was still under way. We also
    reviewed these reports to determine whether they suggested any recurring
    problems and found that they highlighted broad areas of continuing
    programmatic weaknesses, as seen in the following examples:

    o 	Inspector training and information sharing. All three of the other task
    forces also identified inspector training issues and problems with
    information collection and sharing. The Indian Point task force called

    43NRC formed the Indian Point lessons-learned task force in response to a
    steam-generatortube rupture that forced a reactor shutdown. NRC formed the
    Millstone lessons-learned task force because the plant operated outside
    its design standards while refueling. NRC formed the South Texas task
    force in response to concerns about the effectiveness of NRC's inspection
    program and the adequacy of the licensee's employee concerns program.

    upon NRC to develop a process for promptly disseminating technical
    information to NRC inspectors so that they can review and apply the
    information in their inspection program.

    o 	Oversight of licensee corrective action programs. Two of the three task
    forces also identified inadequate oversight of licensee corrective action
    programs. The South Texas task force recommended improving assessments of
    licensees' corrective action programs to ensure that NRC identifies
    broader licensee problems.

    o 	Better identification of problems. Two of the three task force reports
    also noted the need for NRC to develop a better process for identifying
    problem plants, and one report noted the need for NRC inspectors to more
    aggressively question licensees' activities.

    Over the past two decades, we have also reported on underlying causes
    similar to those that contributed, in part, to the incident at
    Davis-Besse. (See Related GAO Products.) For example, with respect to the
    safety culture at nuclear power plants, in 1986, 1995, and 1997, we
    reported on issues relevant to NRC assessing plant management so that
    significant problems could be detected and corrected before they led to
    incidents such as the one that later occurred at Davis-Besse. Regardless
    of our 1997 recommendation that NRC require that the assessment of
    management's competency and performance be a mandatory component of NRC's
    inspection process, NRC subsequently withdrew funding to accomplish this.
    In terms of inspections, in 1995 we reported that NRC, itself, had
    concluded that the agency was not effectively integrating information on
    previously identified and long-standing issues to determine if the issues
    indicated systemic weaknesses in plant operations. This report further
    noted that NRC was not using such information to focus future inspection
    activities. In 1997 and 2001, we reported on weaknesses in NRC's
    inspections of licensees' corrective action programs. Finally, with
    respect to learning from plants' operating experiences, in 1984 we noted
    that NRC needed to improve its methods for consolidating information so
    that it could evaluate safety trends and ensure that generic issues are
    resolved at individual plants. These recurring issues indicate that NRC's
    actions, in response to individual plant incidents and recommendations to
    improve oversight, are not always institutionalized.

    NRC guidance requires that resolutions to action plans be described and
    documented, and while NRC is monitoring the status of actions taken in
    response to Davis-Besse task force recommendations and preparing

    quarterly and semiannual reports on the status of actions taken, the
    Davis-Besse action plan does not specify how long NRC will monitor them.
    It also does not describe how long NRC will prepare quarterly and
    semiannual status reports, even though, according to NRC officials, these
    semiannual status reports will continue until all items are completed and
    the agency is required to issue a final summary report. The plan also does
    not specify what criteria the agency will use to determine when the
    actions in response to specific task force recommendations are completed.
    Furthermore, NRC's action plan does not require NRC to assess the
    long-term effectiveness of recommended actions, even though, according to
    NRC officials, some activities already have an effectiveness review
    included. As in the past and in response to prior lessons-learned task
    force reports and recommendations, NRC has no management control in place
    for assessing the long-term effectiveness of efforts resulting from the
    recommendations. NRC officials acknowledged the need for a management
    control, such as an agencywide tracking system, to ensure that actions
    taken in response to task force recommendations effectively resolve the
    underlying issue over the long term, but the officials have no plans to
    establish such a system.

    Conclusions	It is unlikely, given the actions that NRC has taken to date,
    that extensive reactor vessel corrosion will occur any time soon at
    another domestic nuclear power plant. However, we do not yet have adequate
    assurances from NRC that many of the factors that contributed to the
    incident at Davis-Besse will be fully addressed. These factors include
    NRC's failure to keep abreast of safety significant issues by collecting
    information on operating experiences at plants, assessing their relative
    safety significance, and effectively communicating information within the
    agency to ensure that oversight is fully informed. The underlying causes
    of the Davis-Besse incident underscore the potential for another incident
    unrelated to boric acid corrosion or cracked control rod drive mechanism
    nozzles to occur. This potential is reinforced by the fact that both prior
    NRC lessons-learned task forces and we have found similar weaknesses in
    many of the same NRC programs that led to the Davis-Besse incident. NRC
    has not followed up on prior task force recommendations to assess whether
    the lessons learned were institutionalized. NRC's actions to implement the
    Davis-Besse lessons-learned task force recommendations, to be fully
    effective, will require an extensive effort on NRC's part to ensure that
    these are effectively incorporated into the agency's processes. However,
    NRC has not estimated the amount of resources necessary to carry out these
    recommendations, and we are concerned that resource limitations could
    constrain their effectiveness. For this reason, it is important for NRC to
    not

    only monitor the implementation of Davis-Besse task force recommendations,
    but also determine their effectiveness, in the long term, and the impact
    that resource constraints may have on them. These actions are even more
    important because the nation's fleet of nuclear power plants is aging.

    Because the Davis-Besse task force did not address NRC's unwillingness to
    directly assess licensee safety culture, we are concerned that NRC's
    oversight will continue to be reactive rather than proactive. NRC's
    oversight can result in NRC making a determination that a licensee's
    performance is good one day, yet the next day NRC discovers the
    performance to be unacceptably risky to public health and safety. Such a
    situation does not occur overnight: Long-standing action or inaction on
    the part of the licensee causes unacceptably risky and degraded
    conditions. NRC needs better information to preclude such conditions.
    Given the complexity of nuclear power plants, the number of physical
    structures, systems, and components, and the manner in which NRC
    inspectors must sample to assess whether licensees are complying with NRC
    requirements and license specifications, it is possible that NRC will not
    identify licensees that value production over safety. While we recognize
    the difficulty in assessing licensee safety culture, we believe it is
    sufficiently important to develop a means to do so.

    Given the limited information NRC had at the time and that an accident did
    not occur during the delay in Davis-Besse's shutdown, we do not
    necessarily question the decision the agency made. However, we are
    concerned about NRC's process for making that decision. It used guidance
    intended to make decisions for another purpose, did not rigorously apply
    the guidance, established an unrealistically high standard of evidence to
    issue a shutdown order, relied on incomplete and faulty PRA analyses and
    licensee evidence, and did not document key decisions and data. It is
    extremely unusual for NRC to order a nuclear power plant to shut down.
    Given this fact, it is more imperative that NRC have guidance to use when
    technical specifications or requirements may be met, yet questions arise
    over whether sufficient safety is being maintained. This guidance does not
    need to be a risk-based approach, but rather a more structured
    riskinformed approach that is sufficiently flexible to ensure that the
    guidance is applicable under different circumstances. This is important
    because NRC annually makes about 1,500 licensing decisions relating to
    operating commercial nuclear power plants. While we recognize the
    challenges NRC will face in developing such guidance, the large number and
    wide variety of

    decisions strongly highlight the need for NRC to ensure that its
    decisionmaking process and decisions are sound and defensible.

    Recommendations for Executive Action

    To ensure that NRC aggressively and comprehensively addresses the
    weaknesses that contributed to the Davis-Besse incident and could
    contribute to problems at nuclear power plants in the future, we are
    recommending that the NRC commissioners take the following five actions:

    o 	Determine the resource implications of the task force's recommendations
    and reallocate the agency's resources, as appropriate, to better ensure
    that NRC effectively implements the recommendations.

    o 	Develop a management control approach to track, on a long-term basis,
    implementation of the recommendations made by the Davis-Besse
    lessons-learned task force and future task forces. This approach, at a
    minimum, should assign accountability for implementing each recommendation
    and include information on the status of major actions, how each
    recommendation will be judged as completed, and how its effectiveness will
    be assessed. The approach should also provide for regular-quarterly or
    semiannual-reports to the NRC commissioners on the status of and obstacles
    to full implementation of the recommendations.

    o 	Develop a methodology to assess licensees' safety culture that includes
    indicators of and inspection information on patterns of licensee
    performance, as well as on licensees' organization and processes. NRC
    should collect and analyze this data either during the course of the
    agency's routine inspection program or during separate targeted
    assessments, or during both routine and targeted inspections and
    assessments, to provide an early warning of deteriorating or declining
    performance and future safety problems.

    o 	Develop specific guidance and a well-defined process for deciding on
    when to shut down a nuclear power plant. The guidance should clearly set
    out the process to be used, the safety-related factors to be considered,
    the weight that should be assigned to each factor, and the standards for
    judging the quality of the evidence considered.

    o 	Improve NRC's use of probabilistic risk assessment estimates in
    decision making by (1) ensuring that the risk estimates, uncertainties,

    and assumptions made in developing the estimates are fully defined,
    documented, and communicated to NRC decision makers; and (2) providing
    guidance to decision makers on how to consider the relative importance,
    validity, and reliability of quantitative risk estimates in conjunction
    with other qualitative safety-related factors.

    Agency Comments and Our Evaluation

    We provided a draft of this report to NRC for review and comment. We
    received written comments from the agency's Executive Director for
    Operations. In its written comments, NRC generally addressed only those
    findings and recommendations with which it disagreed. Although commenting
    that it agreed with many of the report's findings, NRC expressed an
    overall concern that the report does not appropriately characterize or
    provide a balanced perspective on NRC's actions surrounding the discovery
    of the Davis-Besse reactor vessel head condition or NRC's actions to
    incorporate the lessons learned from that experience into its processes.
    Specifically, NRC stated that the report does not acknowledge that NRC
    must rely heavily on its licensees to provide it with complete and
    accurate information, as required by its regulations. NRC also expressed
    concern about the report's characterization of its use of risk
    estimates-specifically the report's statement that NRC's estimate of risk
    exceeded the risk levels generally accepted by the agency. In addition,
    NRC disagreed with two of our recommendations: (1) to develop specific
    guidance and a well-defined process for deciding on when to shut down a
    plant and (2) to develop a methodology to assess licensees' safety
    culture.

    With respect to NRC's overall concern, we believe that the report
    accurately captures NRC's performance. Our draft report, in discussing
    NRC's regulatory and oversight role and responsibilities, stated that
    according to NRC, the completeness and accuracy of the information
    provided by licensees is an important aspect of the agency's oversight. To
    respond further to NRC's concern, we added a statement to the effect that
    licensees are required under NRC's regulations to provide the agency with
    complete and accurate information. While we do not want to diminish the
    importance of this responsibility on the part of the licensees, we believe
    that NRC also has a responsibility, in designing its oversight program, to
    implement management controls, including inspection and enforcement, to
    ensure that it has accurate information on and is sufficiently aware of
    plant conditions. In this respect, it was NRC's decision to rely on the
    premise that the information provided by FirstEnergy was complete and
    accurate. As we point out in the report, the degradation of the vessel
    head at Davis-Besse occurred over several years. NRC knew about several
    indications that

    problems were occurring at the plant, and the agency could have requested
    and obtained additional information about the vessel head condition.

    We also believe that the report's characterization of NRC's use of risk
    estimates is accurate. The NRC risk estimate that we and our consultants
    found for the period leading up to the December 2001 decision on
    Davis-Besse's shutdown, including the risk estimate used by the staff
    during key briefings of NRC management, indicated that the estimate for
    core damage frequency was 5.4x10-5, as used in the report. The 5x10-6
    referenced in NRC's December 2002 safety evaluation is for core damage
    probability, which equates to a core damage frequency of approximately
    5x10-5-a level that is in excess of the level generally accepted by the
    agency. The impression of our consultants is that some confusion about the
    differences in these terms may exist among NRC staff.

    Concerning NRC's disagreement with our recommendation to develop specific
    guidance for making plant shutdown decisions, NRC stated that its
    regulations, guidance, and processes are robust and do provide sufficient
    guidance in the vast majority of situations. The agency added that from
    time to time a unique situation may present itself wherein sufficient
    information may not exist or the information available may not be
    sufficiently clear to apply existing rules and regulations definitively.
    According to NRC, in these unique instances, the agency's most senior
    managers, after consultation with staff experts and given all of the
    information available at the time, decide whether to require a plant
    shutdown. While we agree that NRC has an array of guidance for making
    decisions, we continue to believe that NRC needs specific guidance and a
    well-defined process for deciding when to shut down a plant. As discussed
    in our report, the agency used its guidance for approving license change
    requests to make the decision on when to shut down Davis-Besse. Although
    NRC's array of guidance provides flexibility, we do not believe that it
    provides the structure, direction, and accountability needed for important
    decisions such as the one on Davis-Besse's shutdown.

    In disagreeing with our recommendation concerning the need for a
    methodology to assess licensees' safety culture, NRC said that the
    Commission, to date, has specifically decided not to conduct direct
    evaluations or inspections of safety culture as a routine part of
    assessing licensee performance due to the subjective nature of such
    evaluations. According to NRC, as regulators, agency officials are not
    charged with managing licensees' facilities, and direct involvement with
    organizational structure and processes crosses over to a management
    function. We

    understand NRC's position that it is not charged with managing licensees'
    facilities, and we are not suggesting that NRC should prescribe or
    regulate the licensees' organizational structure or processes. Our
    recommendation is aimed at NRC monitoring trends in licensees' safety
    culture as an early warning of declining performance and safety problems.
    Such early warnings can help preclude NRC from assessing a licensee as
    being a good performer one day, and the next day being faced with a
    situation that it considers a potentially significant safety risk. As
    discussed in the report, considerable guidance is available on safety
    culture assessment, and other countries have established safety culture
    programs.

    NRC's written response also contained technical comments, which we have
    incorporated into the report, as appropriate. (NRC's comments and our
    responses are presented in app. IV.)

    As arranged with your staff, unless you publicly announce its contents
    earlier, we plan no further distribution of this report until 30 days from
    its issue date. At that time, we plan to provide copies of this report to
    the appropriate congressional committees; the Chairman, NRC; the Director,
    Office of Management and Budget; and other interested parties. We will
    also make copies available to others upon request. In addition, this
    report will be available at no charge on the GAO Web site at
    http://www.gao.gov. If you or your staff have any questions, please call
    me at (202) 512-3841. Key contributors to this report are listed in
    appendix V.

    Jim Wells Director, Natural Resources

    and Environment

    List of Congressional Requesters

    The Honorable George V. Voinovich United States Senate

    The Honorable Dennis J. Kucinich House of Representatives

    The Honorable Steven C. LaTourette House of Representatives

    Appendix I

    Time Line Relating Significant Events of Interest

    Appendix II

    Analysis of the Nuclear Regulatory Commission's Probabilistic Risk
    Assessment for Davis-Besse

    Appendix II
    Analysis of the Nuclear Regulatory
    Commission's Probabilistic Risk Assessment
    for Davis-Besse

    Appendix II
    Analysis of the Nuclear Regulatory
    Commission's Probabilistic Risk Assessment
    for Davis-Besse

    Appendix II
    Analysis of the Nuclear Regulatory
    Commission's Probabilistic Risk Assessment
    for Davis-Besse

    Appendix II
    Analysis of the Nuclear Regulatory
    Commission's Probabilistic Risk Assessment
    for Davis-Besse

    Appendix II
    Analysis of the Nuclear Regulatory
    Commission's Probabilistic Risk Assessment
    for Davis-Besse

    Appendix II
    Analysis of the Nuclear Regulatory
    Commission's Probabilistic Risk Assessment
    for Davis-Besse

    Appendix II
    Analysis of the Nuclear Regulatory
    Commission's Probabilistic Risk Assessment
    for Davis-Besse

    Appendix II
    Analysis of the Nuclear Regulatory
    Commission's Probabilistic Risk Assessment
    for Davis-Besse

    Appendix II
    Analysis of the Nuclear Regulatory
    Commission's Probabilistic Risk Assessment
    for Davis-Besse

    Appendix II
    Analysis of the Nuclear Regulatory
    Commission's Probabilistic Risk Assessment
    for Davis-Besse

    Appendix II
    Analysis of the Nuclear Regulatory
    Commission's Probabilistic Risk Assessment
    for Davis-Besse

    Appendix II
    Analysis of the Nuclear Regulatory
    Commission's Probabilistic Risk Assessment
    for Davis-Besse

    Appendix II
    Analysis of the Nuclear Regulatory
    Commission's Probabilistic Risk Assessment
    for Davis-Besse

    Appendix II
    Analysis of the Nuclear Regulatory
    Commission's Probabilistic Risk Assessment
    for Davis-Besse

    Appendix II
    Analysis of the Nuclear Regulatory
    Commission's Probabilistic Risk Assessment
    for Davis-Besse

    Appendix II
    Analysis of the Nuclear Regulatory
    Commission's Probabilistic Risk Assessment
    for Davis-Besse

    Appendix II
    Analysis of the Nuclear Regulatory
    Commission's Probabilistic Risk Assessment
    for Davis-Besse

    Appendix II
    Analysis of the Nuclear Regulatory
    Commission's Probabilistic Risk Assessment
    for Davis-Besse

    Appendix II
    Analysis of the Nuclear Regulatory
    Commission's Probabilistic Risk Assessment
    for Davis-Besse

    Appendix II
    Analysis of the Nuclear Regulatory
    Commission's Probabilistic Risk Assessment
    for Davis-Besse

    Appendix II
    Analysis of the Nuclear Regulatory
    Commission's Probabilistic Risk Assessment
    for Davis-Besse

    Appendix II
    Analysis of the Nuclear Regulatory
    Commission's Probabilistic Risk Assessment
    for Davis-Besse

    Appendix II
    Analysis of the Nuclear Regulatory
    Commission's Probabilistic Risk Assessment
    for Davis-Besse

    Appendix III

    Davis-Besse Task Force Recommendations to NRC and Their Status, as of
    March 2004

    Recommendation NRC actions and status as of March 2004

                               Completed recommendations

    Either fully implement or revise guidance to manage licensee Revised
    instructions for these submittals and reviews to ensure commitments.
    Determine whether the periodic report on that these tasks are
    accomplished. Completed in May 2003. commitment changes submitted by
    licensees should continue.

    Determine if stress corrosion cracking models are appropriate for
    Evaluated existing stress corrosion cracking models for their
    predicting susceptibility of vessel head penetration nozzles to continuing
    use in determining susceptibility. Completed in July
    pressurized water stress corrosion cracking. Determine if additional 2003.
    analysis and testing is needed to reduce modeling uncertainties for
    their continued applicability in regulatory decision making.

    Revise the problem identification and resolution approach so that Revised
    inspection procedure for determining licensee ability to safety problems
    noted in daily licensee reports are reviewed and promptly identify and
    resolve conditions adverse to quality or assessed. Enhance guidance to
    prescribe the format of information safety. Completed in September 2003.
    that is screened when deciding which problems to review.

    Provide enhanced inspection guidance to pursue issues and Revised
    inspection procedure for determining licensee capability

    problems identified during reviews of plant operations. 	to promptly
    identify and resolve conditions adverse to quality or safety. Completed in
    September 2003.

    Revise inspection guidance to provide for longer-term follow-up of
    previously identified issues that have not progressed to an inspection
    finding.

    Revised inspection procedure for determining licensee capability to
    promptly identify and resolve conditions adverse to quality or safety.
    Completed in September 2003.

    Revise inspection guidance to assess (1) the safety implications of
    long-standing unresolved licensee equipment problems, (2) the impact of
    phased in corrective actions, and (3) the implications of deferred plant
    modifications.

    Revised inspection procedure for determining licensee capability to
    identify and resolve conditions adverse to quality or safety. Completed in
    September 2003.

    Revise inspection guidance to allow for establishing reactor Revised
    inspection guidance for establishing reactor oversight
    oversight panels even when a significant performance problem, as panels.
    Completed in October 2003.
    defined under NRC's Reactor Oversight Process, does not exist.

    Assess the scope and adequacy of requirements for licensees to Included in
    NRC's recommendation to develop a program for

    review operating experience.	collecting, analyzing, and disseminating
    information on experiences at operating reactors. Completed in November
    2003.

    Ensure inspector training includes (1) boric acid corrosion effects and
    control, and (2) pressurized water stress corrosion cracking of
    nickel-based alloy nozzles.

    Developed and implemented Web-based training and a means for ensuring
    training is completed. Completed in December 2003.

    Provide training and reinforce expectations to managers and staff to (1)
    maintain a questioning attitude during inspection activities, (2) develop
    inspection insights from Davis-Besse on symptoms of reactor coolant
    leakage, (3) communicate expectations to follow up recurring and
    unresolved problems, and (4) maintain an awareness of surroundings while
    conducting inspections. Establish mechanisms to perpetuate this training.

    Developed Web-based inspector training and a means for ensuring that
    training has been completed. NRC headquarters provided an overview of the
    training to NRC regional offices. (Training modules will be added and
    updated as needed.) Completed in December 2003.

    Reinforce expectations that regional management should make Discussed at
    regional counterparts meeting. Completed in every effort to visit each
    reactor at least once every 2 years. December 2003.

    Develop guidance to address impacts of regional oversight panels Evaluated
    past and present oversight panels. Developed

    on regional resource allocations and organizational alignment.	enhanced
    inspection approaches for oversight panels and issued revised procedures.
    Completed in December 2003.

                                      Appendix III
                       Davis-Besse Task Force Recommendations to
                         NRC and Their Status, as of March 2004

                             (Continued From Previous Page)

    Recommendation NRC actions and status as of March 2004

    Evaluate (1) the capacity to retain operating experience information
    Developed program objectives and attributes and obtained
    and perform long-term operating experience reviews; (2) thresholds,
    management endorsement of a plan to implement the
    criteria, and guidance for initiating generic communications; (3)
    recommendation. Developed specific recommendations to improve
    opportunities for more gains in effectiveness and efficiency by program.
    Evaluation completed in November 2003.
    realigning the organization (i.e., feasibility of a centralized operating
    (Implementation of recommendations resulting from this evaluation
    experience "clearinghouse"); (4) effectiveness of the generic Issues
    expected to be completed in December 2004.)
    program; and (5) effectiveness of internal dissemination of operating
    experience information to end users.

    Ensure that generic requirements or guidance are not Revised inspection
    guidance. Completed in February 2004.
    inappropriately affected when making unrelated changes to other
    programs, processes, guidance, etc.

    Develop inspection guidance to assess scheduler influences on Revised the
    appropriate inspection procedure. Completed in amount of work performed
    during refueling outages. February 2004.

    Establish guidance to ensure that NRC decisions allowing licensees Update
    guidance to address documentation. Develop training and to deviate from
    guidelines and recommendations issued in generic distribute to NRC offices
    and regions to emphasize compliance communications are adequately
    documented. with the updated guidance. Follow up to assess the
    effectiveness

    of the training. Completed follow-up in February 2004.

    Develop or revise inspection guidance to ensure that NRC reviews vessel
    head penetration nozzles and the reactor vessel head during licensee
    inspection activities.

    Develop or revise inspection guidance to ensure that nozzles and the
    vessel head are reviewed during licensee inspection. Issued interim
    guidance in August 2003 and a temporary inspection procedure in September
    2003. Additional guidance expected in March 2004.

      Develop inspection guidance to assess (1) repetitive or multiple Revise the
                 appropriate inspection procedure to reflect this need.

    technical specification actions in NRC inspection or licensee reports, and
    (2) radiation dose implications for conducting repetitive tasks.

      Completion expected in March 2004. Develop guidance to periodically inspect
    licensees' boric acid Issued temporary guidance in November 2003. Completion of
      corrosion control programs. further inspection guidance changes expected in
                                      March 2004.

    Reinforce expectations for managers responsible for overseeing Update
    project manager handbook that provides guidance on
    operations at nuclear power plants regarding site visits, coordination
    activities to be conducted during site visits and interactions with
    with resident inspectors, and assignment duration. Reinforce NRC regional
    staff. Also, revise guidance for considering plant
    expectations to question information about operating conditions and
    conditions during licensing action and amendment reviews.
    strengthen guidance for reviewing license amendments to Completion
    expected in March 2004.
    emphasize consideration of current system conditions, reliability,
    and performance data in safety evaluation reports. Strengthen
    guidance for verifying licensee-provided information.

    Assemble and analyze foreign and domestic information on Alloy Assemble
    and analyze alloy 600 cracking data. Completion
    600 nozzle cracking. If additional regulatory action is warranted,
    expected in March 2004.
    propose a course of action and implement a schedule to address
    the results.

          Recommendations due to be completed between April and December 2004

    Conduct an effectiveness review of actions taken in response to past
    Review past lessons-learned actions. Completion expected in April NRC
    lessons-learned reviews. 2004.

    Provide inspection and oversight refresher training to managers and
    Develop a training module. Completion expected in June 2004. staff.

                                      Appendix III
                       Davis-Besse Task Force Recommendations to
                         NRC and Their Status, as of March 2004

                             (Continued From Previous Page)

    Recommendation NRC actions and status as of March 2004

    Establish guidance for accepting owners group and industry Revise office
    instructions to provide recommended guidance.
    recommended resolutions for generic communications and generic Completion
    expected in June 2004.
    issues, including guidance for verifying that actions are taken.

    Review inspection guidance to determine the inspection level that is
    Revised an inspection procedure to reflect these changes. Some sufficient
    during refueling outages, including inspecting reactor inspection
    procedure changes were completed in November 2003, areas inaccessible
    during normal operations and passive and additional changes are expected
    in August 2004. components.

    Evaluate, and revise as necessary, guidance for proposing Evaluate and
    revise guidance. Completion expected in October candidate generic issues.
    2004

    Assemble and analyze foreign and domestic information on boric acid
    corrosion of carbon steel. If additional regulatory action is warranted,
    propose a course of action and implement a schedule to address the
    results.

    Review Argonne National Laboratory study on boric acid corrosion. Analyze
    data to revise inspection requirements. Completion expected in October
    2004.

    Conduct a follow-on verification of licensee actions to implement a Screen
                candidate generic communications to identify those most

    sample of significant generic communications with emphasis on those that
    are programmatic in nature.

    appropriate for follow-up using management-approved criteria. Develop and
    approve verification plan. Completion expected in November 2004.

    Strengthen inspection guidance for periodically reviewing licensee
    Incorporated into the recommendation pertaining to NRC's

    operating experience. 	capacity to retain operating experience
    information. Completion expected in December 2004.

    Enhance the effectiveness of processes for collecting, reviewing,
    Incorporated into the recommendation pertaining to NRC's assessing,
    storing, retrieving, and disseminating foreign operating capacity to
    retain operating experience information. Completion experience. expected
    in December 2004.

    Update operating experience guidance to reflect the changes Incorporated
    into the recommendation pertaining to NRC's implemented in response to
    recommendations for operating capacity to retain operating experience
    information. Completion experience. expected in December 2004.

    Review a sample of NRC evaluations of licensee actions made in Conduct the
    recommended review. Completion expected in
    response to owners groups' commitments to identify whether December 2004.
    intended actions were effectively implemented.

    Develop general inspection guidance to periodically verify that Develop
    inspection procedure to provide a mechanism for regions

    licensees implement owners groups' commitments.	to support project
    managers' ability to verify that licensees implement commitments.
    Completion expected in December 2004.

    Conduct follow-on verification of licensee actions pertaining to a No
    specific actions have been identified. Completion expected in sample of
    resolved generic issues. December 2004.

    Review the range of baseline inspections and plant assessment No specific
    actions have been identified. Completion expected in
    processes to determine sufficiency to identify and dispose of December
    2004.
    problems like those at Davis-Besse.

    Identify alternative mechanisms to independently assess licensee No
    specific actions have been identified. Completion expected in
    plant performance for self-assessing NRC oversight processes and December
    2004.
    determine the feasibility of such mechanisms.

    Establish measurements for resident inspector staffing levels and
    requirements, including standards for satisfying minimum staffing levels.

    Develop standardized staffing measures and implement details. Metrics were
    developed in December 2003. Completion expected in December 2004.

    Structure and focus inspections to assess licensee employee No specific actions
     have been identified. Completion expected in concerns and a "safety conscious
                           work environment." December 2004.

                                      Appendix III
                       Davis-Besse Task Force Recommendations to
                         NRC and Their Status, as of March 2004

                             (Continued From Previous Page)

    Recommendation NRC actions and status as of March 2004 Recommendations due to be
                            completed in calendar year 2005

    Develop inspection guidance and criteria for addressing licensee Develop
    recommendations for guidance with action levels to response to increasing
    leakage levels and/or adverse trends in trigger greater NRC interaction
    with licensees in response to unidentified reactor coolant system leakage.
    increased leakage. Completion expected in January 2005.

    Reassess the basis for the cancellation, in 2001, of certain Review
    revised procedures and reactivate as necessary.
    inspection procedures (i.e., boric acid control programs and Completion
    expected in March 2005.
    operational experience feedback) to assess if these procedures are
    still applicable.

    Assess requirements for licensee procedures to respond to plant Review and
    assess adequacy of requirements and develop alarms for leakage to
    determine whether requirements are sufficient recommendations to (1)
    improve procedures to identify leakage to identify reactor coolant
    pressure boundary leakage. from boundary, (2) establish consistent
    technical specifications for

    leakage, and (3) use enhanced leakage detection systems.

    Completion expected in March 2005.

    Determine whether licensees should install enhanced systems to Re-evaluate
    the basis for current leakage requirements and

    detect leakage from the reactor coolant system.	assess the capabilities of
    current leakage detection systems. Develop recommendations to (1) improve
    procedures for identifying leakage, (2) establish consistent technical
    specifications, and (3) use enhanced leakage detection systems. Completion
    expected in March 2005

    Inspect the adequacy of licensee's programs to control boric acid Develop
    guidance to assess adequacy of corrosion control

    corrosion, including effectiveness of implementation.	programs, including
    implementation and effectiveness, and evaluate the status of this effort
    after the first year of inspections. Guidance expected to be developed by
    March 2004. Follow-up scheduled for completion in March 2005.

    Continue ongoing efforts to review and improve the usefulness of Develop
    and implement improved performance indicators based barrier integrity
    performance indicators and evaluate the use of on current requirements and
    measurements. Explore the use of primary system leakage that licensees
    have identified but not yet additional performance indicators to track the
    number, duration, corrected as a potential indicator. and rate of system
    leakage. Determine the feasibility of

    establishing a risk-informed performance indicator for barrier

    integrity. Completion expected in December 2005.

            Recommendations whose completion dates have yet to be determined

    Encourage the American Society of Mechanical Engineers to revise Monitor
    and provide input to industry efforts to develop revised inspection
    requirements for nickel-based alloy nozzles. Encourage inspection
    requirements. Participate in American Society of changes to requirements
    for nonvisual, nondestructive inspections Mechanical Engineers' meetings
    and communicate with of vessel head penetration nozzles. Alternatively,
    revise NRC appropriate stakeholders. Decide whether to endorse the revised
    regulations to address the nature and scope of these inspections. American
    Society of Mechanical Engineers' code requirements.

    These actions parallel a larger NRC rulemaking effort. Completion

    date yet to be determined.

    Revise processes to require short- and long-term verification of Target
    date to be set upon completion of review of NRC's generic licensee actions
    to respond to significant NRC generic communications program. Completion
    date yet to be determined. communications before closing out issues.

    Determine whether licensee reactor vessel head inspection Will be included
    as part of revised American Society of Mechanical summary reports should
    be submitted to NRC and, if so, revise Engineers' requirements for
    inspection of reactor vessel heads and submission requirements and report
    disposition guidance, as vessel head penetration nozzles. Completion date
    yet to be appropriate. determined.

                                      Appendix III
                       Davis-Besse Task Force Recommendations to
                         NRC and Their Status, as of March 2004

                             (Continued From Previous Page)

                 Recommendation NRC actions and status as of March 2004

     Evaluate the adequacy of methods for analyzing the risk of passive No specific
                actions have been identified. Completion date yet to be

    component degradation and integrate these methods and risks into NRC's
    decision-making processes.

                                      determined.

    Review pressurized water reactor technical specifications to identify
    Assessed plants for nonstandard technical specifications. plants that have
    nonstandard reactor coolant pressure boundary Completed in July 2003.
    Change leakage detection specifications leakage requirements and change
    specifications to make them in coordination with other changes in leakage
    detection consistent among all plants. requirements. Completion date yet
    to be determined.

    Improve requirements for unidentified leakage in reactor coolant Issue
    regulations implementing the improved requirements when
    system to ensure they are sufficient to (1) discriminate between these
    requirements are determined. Completion date yet to be
    unidentified leaks from the coolant system and leaks from the determined.
    reactor coolant pressure boundary and (2) ensure that plants do not
    operate with pressure boundary leakage.

    NRC should review a sample of plant assessments conducted No specific
    actions have been identified. Completion expected in
    between 1998 and 2000 to determine if any identified plant safety March
    2004.
    issues have not been adequately assessed.

                       Recommendations rejected by NRC management

    Review industry approaches licensees use to consider economic
    Recommendation rejected by NRC management. No completion
    factors for inspection and repair and consider this information in date.
    formulating future positions on the performance of non-visual
    inspections of vessel head penetration nozzles.

    Revise the criteria for review of industry topical reports to allow for
    Recommendation rejected by NRC management. No completion
    NRC staff review of safety-significant reports that have generic date.
    implications but have not been formally submitted for NRC review in
    accordance with the existing criteria.

                           Source: GAO analysis of NRC data.

    Appendix IV

    Comments from the Nuclear Regulatory Commission

    Note: GAO comments supplementing those in the report text appear at the
    end of this appendix.

    See comment 1.

    See comment 2.

    Appendix IV
    Comments from the Nuclear Regulatory
    Commission

                                     See comment 3.

                                     See comment 4.

                                     See comment 5.

    Appendix IV
    Comments from the Nuclear Regulatory
    Commission

    Appendix IV
    Comments from the Nuclear Regulatory
    Commission

                                     See comment 1.

                                     See comment 2.

    Appendix IV
    Comments from the Nuclear Regulatory
    Commission

                                     See comment 3.

    Appendix IV
    Comments from the Nuclear Regulatory
    Commission

                                     See comment 6.

                                     See comment 7.

                                     See comment 8.

                                     See comment 9.

    Appendix IV
    Comments from the Nuclear Regulatory
    Commission

                                    See comment 10.

                                    See comment 11.

                                    See comment 12.

    Appendix IV
    Comments from the Nuclear Regulatory
    Commission

                                     See comment 4.

                                    See comment 13.

    Appendix IV
    Comments from the Nuclear Regulatory
    Commission

                                    See comment 14.

                                    See comment 15.

    Appendix IV
    Comments from the Nuclear Regulatory
    Commission

    Appendix IV
    Comments from the Nuclear Regulatory
    Commission

                                    See comment 16.

                                    See comment 17.

                                    See comment 18.

    Appendix IV
    Comments from the Nuclear Regulatory
    Commission

                                    See comment 19.

                                    See comment 20.

    Appendix IV
    Comments from the Nuclear Regulatory
    Commission

                                    See comment 21.

                                    See comment 22.

                                    See comment 23.

    Appendix IV
    Comments from the Nuclear Regulatory
    Commission

                                    See comment 24.

                                    See comment 25.

    Appendix IV
    Comments from the Nuclear Regulatory
    Commission

                                    See comment 26.

                                     See comment 5.

                                     See comment 5.

    Appendix IV
    Comments from the Nuclear Regulatory
    Commission

                                     See comment 5.

    Appendix IV
    Comments from the Nuclear Regulatory
    Commission

                                    See comment 27.

                                    See comment 28.

    Appendix IV
    Comments from the Nuclear Regulatory
    Commission

    Appendix IV
    Comments from the Nuclear Regulatory
    Commission

    Appendix IV
    Comments from the Nuclear Regulatory
    Commission

                                      Appendix IV
                          Comments from the Nuclear Regulatory
                                       Commission

    The following are GAO's comments on the Nuclear Regulatory Commission's
    letter dated May 5, 2004.

    GAO Comments 1.	We agree with NRC that 10 C.F.R. S: 50.9 requires that
    information provided to NRC by a licensee be complete and accurate in all
    material respects, and we have added this information to the report. NRC
    also states that in carrying out its oversight responsibilities, NRC must
    "rely heavily" on licensees providing accurate information. However, we
    believe that NRC's oversight program should not place undue reliance on
    applicants providing complete and accurate information. NRC also
    recognizes that it cannot rely solely on information from licensees, as
    evidenced by its inspection program and process for determining the
    significance of licensee violations. Under this process, NRC considers
    whether there are any willful aspects associated with the violation-
    including the deliberate intent to violate a license requirement or
    regulation or falsify information. We believe that management controls,
    including inspection and enforcement, should be implemented by NRC so as
    to verify whether licensee-submitted information considered to be
    important for ensuring safety is complete and accurate as required by the
    regulation. In this regard, as stated in NRC's enforcement policy
    guidance, NRC is authorized to conduct inspections and investigations
    (Atomic Energy Act S: 161); revoke licenses for, among other things, a
    licensee's making material false statements or failing to build or operate
    a facility in accordance with the terms of the license (Atomic Energy Act
    S: 186); and impose civil penalties for a licensee's knowing failure to
    provide certain safety information to NRC (Energy Reorganization Act S:
    206).

    With regard to the draft report conveying the expectation that NRC should
    have known about the thick layer of boron on the reactor vessel head, we
    note in the draft report that since at least 1998, NRC was aware that (1)
    FirstEnergy's boric acid corrosion control program was inadequate, (2)
    radiation monitors within the containment area were continuously being
    clogged by boric acid deposits, (3) the containment air cooling system had
    to be cleaned repeatedly because of boric acid buildup, (4) corrosion was
    occurring within containment as evidenced by rust particles being found,
    and (5) the unidentified leakage rate had increased above the level that
    historically had been found at the plant. NRC was also aware of the
    repeated but ineffective attempts by FirstEnergy to correct many of these
    recurring problems-evidence that the licensee's programs to identify and
    correct problems were not

    Appendix IV
    Comments from the Nuclear Regulatory
    Commission

    effective. Given these indications at Davis-Besse, NRC could have taken
    more aggressive follow-up action to determine the underlying causes. For
    example, NRC could have taken action during the fuel outage in 1998, the
    shutdown to repair valves in mid-1999, or the fuel outage in 2000 to
    ensure that staff with sufficient knowledge appropriately investigated the
    types of conditions that could cause these indications, or followed up to
    ensure that FirstEnergy had fully investigated and successfully resolved
    the cause of the indications.

    2.	With respect to the responsibility of the licensee to provide complete
    and accurate information, see comment 1. As to the Davis-Besse
    lessons-learned task force finding, we agree that some information
    provided by FirstEnergy in response to Bulletin 2001-01 may have been
    inconsistent with some information subsequently identified by NRC's
    lessons-learned task force, and that had some of this information been
    known in the fall of 2001, the vessel head leakage and degradation may
    have been identified sooner than March 2002. This information included (1)
    the boric acid accumulations found on the vessel head by FirstEnergy in
    1998 and 2000, (2) FirstEnergy's limited ability to visually inspect the
    vessel head, (3) FirstEnergy's boric acid corrosion control procedures
    relative to the vessel head, (4) FirstEnergy's program to address the
    corrosive effects of small amounts of reactor coolant leakage, (5)
    previous nozzle inspection results, (6) the bases for FirstEnergy's
    conclusion that another source of leakage-control rod drive mechanism
    flanges-was the source of boric acid deposits on the vessel head that
    obscured multiple nozzles, and (7) photographs of vessel head penetration
    nozzles. However, various NRC officials knew some of this information,
    other information should have been known by NRC, and the remaining
    information could have been obtained had NRC requested it from
    FirstEnergy. For example, according to the senior resident inspector, he
    reviewed every Davis-Besse condition report on a daily basis to determine
    whether the licensee properly categorized the safety significance of the
    conditions. Vessel head conditions found by FirstEnergy in 1998 and 2000
    were noted in such condition reports or in
    potential-condition-adverse-to-quality reports. According to a FirstEnergy
    official, photographs of the pressure vessel head nozzles were
    specifically provided to NRC's resident inspector, who, although he did
    not specifically recall seeing the photographs, stated that he had no
    reason to doubt the FirstEnergy official's statement. NRC had been aware,
    in 1999, of limitations in FirstEnergy's boric acid corrosion control
    program and, while it cited FirstEnergy for its failure to adequately
    implement the program, NRC officials did not

    Appendix IV
    Comments from the Nuclear Regulatory
    Commission

    follow up to determine if the program had improved. Lastly, while NRC
    questioned the information provided by FirstEnergy in its submissions to
    NRC in response to Bulletin 2001-01 (regarding vessel head penetration
    nozzle inspections), NRC staff did not independently review and assess
    information pertaining to the results of past reactor pressure vessel head
    inspections and vessel head penetration nozzle inspections. Similarly, NRC
    did not independently assess the information concerning the extent and
    nature of the boric acid accumulations found on the vessel head by the
    licensee during past inspections.

    On page 2 of the report, we note that the Department of Justice has an
    ongoing investigation concerning the completeness and accuracy of
    information that FirstEnergy provided to NRC on the conditions at
    Davis-Besse. The investigation may or may not find that FirstEnergy
    provided inaccurate or incomplete information. While NRC notes that it
    might have detected something months earlier if information had been known
    in the fall of 2001, we would also note that the degradation of the
    reactor vessel head likely took years to occur.

    3.	We believe that the statement is correct. NRC produced an estimate of
    5x10-5 per year for the change in core damage frequency, as we state in
    the report. NRC specifically documented this calculation in its December
    2002 assessment:

    "The NRC staff estimated that, giving credit only to the [FirstEnergy]
    inspection performed in 1996, the probability of a [control rod drive
    mechanism] nozzle ejection during the period of operation from December
    31, 2001, to February 16, 2002, was in the range of 2E-3 and was an
    increase in the overall [loss of coolant accident] probability for the
    plant. The increase in core damage probability and large early release
    probability were estimated as approximately 5E-6 and 5E-08,
    respectively."1

    The probability of a large early release-5E-6-equates to a frequency of
    5x10-5 per year.2 As we note in the report, according to NRC's

    1The numbers 2E-3, 5E-6, and 5E-8 can also be written as 2x10-3, 5x10-6,
    and 5x10-8.

    2The probability of an event occurring is the product of the frequency of
    an event and a given time period. In this case, the time period-7
    weeks-was approximated as one-tenth of the year. Thus, 5.4x10-5 per year
    multiplied by 0.10 equates to a probability of 5.4x10-6. According to NRC,
    it revised 5.4x10-6 to 5.0x10-6 to account for uncertainties.

    Appendix IV
    Comments from the Nuclear Regulatory
    Commission

    regulatory guide 1.174, this frequency would be in the highest risk zone
    and NRC would generally not approve the requested change.

    On several occasions, we met with the NRC staff that developed the risk
    estimate in an attempt to understand how it was calculated. We obtained
    from NRC staff the risk estimate information provided to senior management
    in late November 2001, as well as several explanations of how the staff
    developed its calculations. We were provided with no evidence that NRC
    estimated the frequency of core damage as being 5x10-6 per year until
    February 2004, after our consultants and we had challenged NRC's estimate
    as being in the highest risk zone under NRC's regulatory guide 1.174.
    Furthermore, several NRC staff involved in deciding whether to issue the
    order to shut down Davis-Besse, or to allow it to continue operating until
    February 16, 2002, stated that the risk estimate they used was relatively
    high.

    4.	We agree that existing regulations provide a spectrum of conditions
    under which a plant shutdown could occur and that could be interpreted as
    covering the vast majority of situations. However, we continue to believe
    that NRC lacks sufficient guidance for making plant shutdown decisions. We
    disagree on two grounds: First, the decisionmaking guidance used by NRC to
    shut down Davis-Besse was guidance for approving license change requests.
    This guidance provides general direction on how to make risk-informed
    decisions when licensees request license changes. It does not address
    important aspects of decision-making involved in deciding whether to shut
    down a plant. It also does not provide direction on how NRC should weigh
    deterministic factors in relation to probabilistic factors in making
    shutdown decisions. Secondly, while NRC views the flexibility afforded by
    its existing array of guidance as a strength, we are concerned that, even
    on the basis of the same information or circumstances, staff can arrive at
    very different decisions. Without more specific guidance, NRC will
    continue to lack accountability and the degree of credibility needed to
    convince the industry and the public that its shutdown decisions are
    sufficiently sound and reasoned for protecting public health and safety.

    5.	We are aware that the commissioners have specifically decided not to
    conduct direct evaluations or inspections of safety culture. We agree that
    as regulators, NRC is not charged with managing licensees' facilities, but
    disagree that any direct NRC involvement with safety culture crosses over
    to a management function. Management is an

    Appendix IV
    Comments from the Nuclear Regulatory
    Commission

    embodiment of corporate beliefs and perceptions that affect management
    strategies, goals, and philosophies. These, in turn, impact licensee
    programs and processes and employee behaviors that have safety outcomes.
    We believe that NRC should not assess corporate beliefs and perceptions or
    management strategies, goals, or philosophies. Rather, we believe that NRC
    has a responsibility to assess licensee programs and processes, as well as
    employee behaviors. We cite several areas of safety culture in the report
    as being examples of various aspects of safety culture that NRC can assess
    which do not constitute "management functions." The International Atomic
    Energy Agency has extensive guidance on assessing additional aspects of
    licensee performance and indicators of safety culture.3 Such assessments
    can provide early indications of declining safety culture prior to when
    negative safety outcomes occur, such as at Davis-Besse.

    We also agree that NRC has indirect means by which it attempts to assess
    safety culture. For example, NRC's problem identification and resolution
    inspection procedure's stated objective is to provide an early warning of
    potential performance issues and insight into whether licensees have
    established safety conscious work environments. However, we do not believe
    that the implementation of the inspection procedure has been demonstrated
    to be effective in meeting its stated objectives. The inspection procedure
    directs inspectors to screen and analyze trends in all reported power
    plant issues. In doing so, the procedure directs that inspectors annually
    review 3 to 6 issues out of potentially thousands of issues that can arise
    and that are related to various structures, systems, and components
    necessary for the safe operation of the plant. This requires that
    inspectors judgmentally sample 3 to 6 issues on which they will focus
    their inspection resources. While we do not necessarily question inspector
    judgment when sampling for these 3 to 6 issues, NRC inspectors stated that
    due to the large number of issues that they can sample from, they try to
    focus on those issues that they believe have the most relevance for
    safety. Thus, if an issue is not yet perceived as being important to
    safety, it is less likely to be selected for follow up. Further, even if
    an issue were selected for follow up and this indicated that the licensee
    did not properly identify and resolve underlying problems that contributed
    to the issue, according to NRC officials, it is highly unlikely

    3The International Atomic Energy Agency, International Nuclear Safety
    Advisory Group, Safety Culture (Vienna, Austria: February 1991).

    Appendix IV
    Comments from the Nuclear Regulatory
    Commission

    that this one issue would rise to a high enough level of significance for
    it to be noted under NRC's Reactor Oversight Process. Additionally, the
    procedure is dependant on the inspector being aware of, and having the
    capability to, identify issues or trends in the area of safety culture.
    According to NRC officials, inspectors are not trained in what to look for
    when assessing licensee safety culture because they are, by and large,
    nuclear engineers. While they may have an intuition that something is
    wrong, they may not know how to assess it in terms of safety culture.

    Additional specific examples NRC cites for indirectly assessing a selected
    number of safety culture aspects have the following limitations:

    o 	NRC's inspection procedure for assessing licensees' employee concerns
    program is not frequently used. According to NRC Region III officials,
    approval to conduct such an inspection must be given by the regional
    administrator and the justification for the inspection to be performed has
    to be based on a very high level of evidence that a problem exists.
    Because of this, these officials said that the inspection procedure has
    only been implemented twice in Region III.

    o 	NRC's allegation program provides a way for individuals working at
    NRC-regulated plants and the public to provide safety and regulatory
    concerns directly to NRC. It is a reactive program by nature because it is
    dependent upon licensees' employees feeling free and able to come forward
    to NRC with information about potential licensee misconduct. While NRC
    follows up on those plants that have a much higher number of allegations
    than other plants to determine what actions licensees are taking to
    address any trends in the nature of the allegations, the number of
    allegations may not always provide an indication of a poor safety culture,
    and in fact, may be the reverse. For example, the number of allegations at
    Davis-Besse prior to the discovery of the cavity in the reactor head in
    March 2002 was relatively small. Between 1997 and 2001, NRC received 10
    allegations from individuals at the plant. In contrast, NRC received an
    average of 31 allegations per plant over the same 5-year period from
    individuals at other plants.

    o 	NRC's lessons-learned reviews, such as the one conducted for
    Davis-Besse, are generally conducted when an incident having potentially
    serious safety consequences has already occurred.

    Appendix IV
    Comments from the Nuclear Regulatory
    Commission

    o 	With respect to NRC's enforcement of employee protection regulations,
    NRC, under its current enforcement policy, would normally only take
    enforcement action when violations are of very significant or significant
    regulatory concern. This regulatory concern pertains to NRC's primary
    responsibility for ensuring safety and safeguards and protecting the
    environment. Examples of such violations would include the failure of a
    system designed to prevent a serious safety incident not working when it
    is needed, a licensed operator being inebriated while at the control of a
    nuclear reactor, and the failure to obtain prior NRC approval for a
    license change that has implications for safety. If violations of employee
    protection regulations do not pose very significant or significant safety,
    safeguards, or environmental concerns, NRC may consider such violations
    minor. In such cases, NRC would not normally document such violations in
    inspection reports or records, and would not take enforcement action.

    o 	NRC's Reactor Oversight Process, instituted in April 2000, focuses on
    seven specific "cornerstones" that support the safety of plant operations
    to ensure reactor safety, radiation safety, and security. These
    cornerstones are: (1) the occurrence of operations and events that could
    lead to a possible accident if safety systems did not work, (2) the
    ability of safety systems to function as intended, (3) the integrity of
    the three safety barriers, (4) the effectiveness of emergency
    preparedness, (5) the effectiveness of occupational radiation safety, (6)
    the ability to protect the public from radioactive releases, and (7) the
    ability to physically protect the plant. NRC's process also includes three
    elements that cut across these seven cornerstones: (1) human performance,
    (2) a licensee's safetyconscious work environment, and (3) problem
    identification and resolution. NRC assumes that problems in any of these
    three crosscutting areas will be evidenced in one or more of the seven
    cornerstones in advance of any serious compromise in the safety of a
    plant. However, as evidenced by the Davis-Besse incident, this assumption
    has not proved to be true.

    NRC also cites lessons-learned task force recommendations to improve NRC's
    ability to detect problems in licensee's safety culture, as a means to
    achieve our recommendation to directly assess licensee safety culture.
    These lessons-learned task force recommendations include (1) developing
    inspection guidance to assess the effect that a licensee's fuel outage
    shutdown schedule has on the scope of work conducted

    Appendix IV
    Comments from the Nuclear Regulatory
    Commission

    during a shutdown; (2) revising inspection guidance to provide for
    assessing the safety implications of long-standing, unresolved problems;
    corrective actions being phased in over the course of several years or
    refueling outages; and deferred plant modifications; (3) revising the
    problem identification and resolution inspection approach and guidance;
    and (4) reviewing the range of NRC's inspections and assessment processes
    and other NRC programs to determine whether they are sufficient to
    identify and dispose of the types of problems experienced at Davis-Besse.
    While we commend these recommendations, we do not believe that revising
    such guidance will necessarily alert NRC inspectors to early declines in
    licensee safety culture before they result in negative safety outcomes.
    Further, because of the nature of NRC's process for determining the
    relative safety significance of violations under NRC's new Reactor
    Oversight Process, we do not believe that any indications of such declines
    will result in a cited violation.

    6.	We have revised the report to reflect that boron in the form of boric
    acid crystals is dissolved in the cooling water. (See p. 13.)

    7.	On page 41 of the report, we recognize that NRC also relied on
    information provided by FirstEnergy regarding the condition of the vessel
    head. For example, in developing its risk estimate, NRC credited
    FirstEnergy with a vessel head inspection conducted in 1996. However, NRC
    decided that the information provided by FirstEnergy documenting vessel
    head inspections in 1998 and 2000 was of such poor quality that it did not
    credit FirstEnergy with having conducted them. As a result, NRC's risk
    estimate was higher than had these inspections been given credit.

    8.	The statement made by the NRC regional branch chief was taken directly
    from NRC's Office of the Inspector General report on NRC's oversight of
    Davis-Besse during the April 2000 refueling outage.4

    9.	We agree that up until the Davis-Besse event, NRC had not concluded
    that boric acid corrosion was a high priority issue. We clarified the text
    of the report to reflect this comment. (See p. 25.)

    4NRC, Office of the Inspector General, NRC's Oversight of Davis-Besse
    during the April 2000 Refueling Outage (Washington, D.C.: Oct. 17, 2003).

    Appendix IV
    Comments from the Nuclear Regulatory
    Commission

    10. We agree that plant operators in France decided to replace their
    vessel heads in lieu of performing the extensive inspections instituted by
    the French regulatory authority. The report has been revised to add these
    details. (See p. 31.)

    11. We agree that caked-on boron, in combination with leakage, could
    accelerate corrosion rates under certain conditions. However, even without
    caked-on boron, corrosion rates could be quite high. Westinghouse's 1987
    report on the corrosive effects of boric acid leakage concluded that the
    general corrosion rate of carbon steel can be unacceptably high under
    conditions that can prevail when primary coolant leaks onto surfaces and
    concentrates at the temperatures that are found on reactor surfaces. In
    one series of tests that it performed, boric acid solutions corroded
    carbon steel at a rate of about 0.4 inches per month, or about 4.8 inches
    a year. This was irrespective of any caked-on boron. In 1987, as a result
    of that report and extensive boric acid corrosion found at two other
    nuclear reactors that year-Salem unit 2 and San Onofre unit 2-NRC
    concluded that a review of existing inspection programs may be warranted
    to ensure that adequate monitoring procedures are in place to detect boric
    acid leakage and corrosion before it can result in significant degradation
    of the reactor coolant pressure boundary. However, NRC did not take any
    additional action.

    12. We agree that NRC has requirements and processes that provide a number
    of circumstances in which a plant shutdown would or could be required. We
    also recognize that there were no legal objections to the draft
    enforcement order to shut down the plant, and that the basis for not
    issuing the order was NRC's belief that the plant did not pose an
    unacceptable risk to public health and safety. The statement in our report
    that NRC is referring to is discussing one of these circumstances-the
    licensee's failure to meet NRC's technical specification-and whether NRC
    believed that it had enough proof that the technical specification was not
    being met. The statement is not discussing the basis for NRC issuing an
    enforcement order. We revised the report to clarify this point. (See p.
    34.)

    13. The basis for our statement that NRC staff concluded that the first
    safety principle was probably not met was its November 29, 2001, briefing
    to NRC's Executive Director's Office and its November 30, 2001, briefing
    to the NRC commissioners' technical assistants. These briefings, the basis
    for which are included in documented briefing

    Appendix IV
    Comments from the Nuclear Regulatory
    Commission

    slides, took place shortly before NRC formally notified FirstEnergy on
    December 4, 2001, that it would accept its compromise shutdown date.

    14. We are referring to the same document that NRC is referring to-NRC's
    December 3, 2002, response to FirstEnergy (NRC's ADAMS accession number
    ML023300539). The response consists of a 2-page transmittal letter and an
    7.3-page enclosure. The 7.3-page enclosure is 3 pages of background and
    4.3 pages of the agency's assessment. The assessment includes statements
    that the safety principles were met but does not provide an explanation of
    how NRC considered or weighed deterministic and probabilistic information
    in concluding that each of the safety factors were met. For example, NRC
    concluded that the likelihood of a loss-of-coolant accident was acceptably
    small because of the (1) staff's preliminary technical assessment for
    control rod drive mechanism cracking, (2) evidence of cracking found at
    other plants similar to Davis-Besse, (3) analytical work performed by
    NRC's research staff in support of the effort, and (4) information
    provided by FirstEnergy regarding past inspections at Davis-Besse.
    However, the assessment does not explain how these four pieces of
    information successfully demonstrated if and how each of the safety
    principles was met. The assessment also states that NRC examined the five
    safety principles, the fifth of which is the ability to monitor the
    effects of a risk-informed decision. The assessment is silent on whether
    this principle is met. However, in NRC's November 29, 2001, briefing to
    NRC's Executive Director's Office and in its November 30, 2001, briefing
    to the NRC commissioners' technical assistants, NRC concluded that this
    safety principle was not met. As noted above, NRC formally notified
    FirstEnergy on December 4, 2001, that it would accept FirstEnergy's
    February 16, 2002, shutdown date.

    15. See comment 3. We do not agree that the report statements
    mischaracterize the facts. Rather, we are concerned that NRC is misusing
    basic quantitative mathematics. In addition, with regard to NRC's concept
    of an annual average change in the frequency of core damage, NRC stated
    that the agency averaged the frequency of core damage that would exist for
    the 7-week period of time (representing the period of time between
    December 31, 2001, and February 16, 2002) over the entire 1-year period,
    using the assumption that the frequency of core damage would be zero for
    the remainder of the year-February 17, 2002, to December 31, 2002.
    According to our consultants, this calculation artificially reduced NRC's
    risk estimate to a level that is acceptable under NRC's guidance. By this
    logic, our consultants stated,

    Appendix IV
    Comments from the Nuclear Regulatory
    Commission

    risks can always be reduced by spreading them over time; by assuming
    another 10 years of plant operation (or even longer) NRC could find that
    its calculated "risks" are completely negligible. They further stated that
    NRC's approach is akin to arguing that an individual, who drives 100 miles
    per hour 10 percent of the time, with his car otherwise garaged, should
    not be cited because his time-average speed is only 10 miles per hour.

    Further, our consultants concluded that the "annual-average" core damage
    frequency approach was also clearly unnecessary, since one need only
    convert a core damage frequency to a core damage probability to handle
    part-year cases like the Davis-Besse case. Lastly, we find no basis for
    the calculation in any NRC guidance. According to our consultants, this
    new interpretation of NRC's guidance is at best unusual and certainly is
    inconsistent with NRC's guidelines regarding the use of an incremental
    core damage frequency. This interpretation also reinforces our
    consultants' impression that perhaps there was, in November 2001 and
    possibly is still today, some confusion among the NRC staff regarding
    basic quantitative metrics that should be considered in evaluating
    regulatory and safety issues. As noted in comment 3, we found no evidence
    of this calculation prior to February 2004.

    16. While we agree that vessel head corrosion as extensive as later found
    at Davis-Besse was not anticipated, NRC had known that leakage of the
    primary coolant from a through-wall crack could cause boric acid corrosion
    of the vessel head, as evidenced by the Westinghouse work cited above.
    Regardless of information provided to NRC by individual licensees, such as
    FirstEnergy, NRC's model should account for known risks, including the
    potential for corrosion.

    17. We agree that NRC was aware of control rod drive mechanism nozzle
    cracking at French nuclear power plants. NRC provided us additional
    information consisting of a December 15, 1994, internal memo, in which NRC
    concluded that primary coolant leakage from a through-wall crack could
    cause boric acid corrosion of the vessel head. However, because some
    analyses indicated that it would take at least 6 to 9 years before any
    corrosion would challenge the structural integrity of the head, NRC
    concluded that cracking was not a short-term safety issue. We revised the
    report to include this additional information. (See p. 40.)

    18. See comment 15.

    Appendix IV
    Comments from the Nuclear Regulatory
    Commission

    19. We agree that while not directly relevant to the Davis-Besse
    situation, NRC uses regulatory guide 1.177 to make decisions on whether
    certain equipment can be inoperable while a nuclear reactor is operating,
    which can pose very high instantaneous risks for very short periods of
    time. However, we include the reference to this particular guidance in the
    report because it was cited by an NRC official involved in the Davis-Besse
    decision-making process as another piece of guidance used in judging
    whether the risk that Davis-Besse posed was acceptable.

    20. While regulatory guide 1.174 comprises 25 pages of guidance on how to
    use risk in making decisions on whether to allow license changes, it does
    not lay out how NRC staff are to use quantitative estimates of risk or
    probabilistic factors, or how robust these estimates must be in order to
    be considered along with more deterministic factors. The regulatory guide,
    which was first issued in mid-1998, had been in effect for only about 1.5
    years when NRC staff was tasked with making their decision on Davis-Besse.
    According to the Deputy Executive Director of Nuclear Reactor Programs at
    the time the decision was being made, the agency was trying to bring the
    staff through the risk-informed decision-making process because
    Davis-Besse was a learning tool. He further stated that it was really the
    first time the agency had used the risk-informed decision-making process
    on operational decisions as opposed to programmatic decisions for
    licensing. At the time the decision was made, and currently, NRC has no
    guidance or criteria for use in assessing the quality of risk estimates or
    clear guidance or criteria for how risk estimates are to be weighed
    against other risk factors.

    21. The December 3, 2002, safety assessment or evaluation did state that
    the estimated increase in core damage frequency was consistent with NRC's
    regulatory guidelines. However, as noted in comment 3, we disagree with
    this conclusion. In addition, while we agree that NRC has staff with risk
    assessment disciplines, we found no reference to these staff in NRC's
    safety evaluation. We also found no reference to NRC's statement that
    these staff gave more weight to deterministic factors in arriving at the
    agency's decision. While we endorse NRC's consideration of deterministic
    as well as probabilistic factors and the use of a risk-informed
    decision-making process, we continue to maintain that NRC needs clear
    guidance and criteria for the quality of risk estimates, standards of
    evidence, and how to apply deterministic as well as probabilistic factors
    in plant shutdown decisions. As the agency continues to incorporate a
    risk-informed process into much of its regulatory guidance and programs,
    such criteria will be increasingly

    Appendix IV
    Comments from the Nuclear Regulatory
    Commission

    important when making shutdown as well as other types of decisions
    regarding nuclear power plants.

    22. The information that NRC provided us indicates that completion dates
    for 2 of the 22 high priority recommendations have slipped.5 One, the
    completion date for encouraging the American Society of Mechanical
    Engineers to revise vessel head penetration nozzle inspection requirements
    or, alternatively, for revising NRC's regulations for vessel head
    inspections has slipped from June 2004 to June 2006. Two, the completion
    date for assessing NRC's requirements that licensees have procedures for
    responding to plant leakage alarms to determine if the requirements are
    sufficient for identifying reactor coolant pressure boundary leakage has
    slipped from March 2004 to March 2005.

    23. We agree with this comment and have revised the report to reflect this
    clarification. (See p. 49.)

    24. Our estimate of at least an additional 200 hours of inspection per
    reactor per year is based on:

    o 	NRC's new requirement that its resident inspectors review all licensee
    corrective action items on a daily basis (approximately 30 minutes per
    day). Given that reactors are intended to operate continuously throughout
    the year, this results in about 3.5 hours per week for reviewing
    corrective action items, or about 182 hours per year. In addition,
    resident inspections are now required to determine, on a semi-annual
    basis, whether such corrective action items reflect any trends in licensee
    performance (16 to 24 hours per year). The total increase for these new
    requirements is about 198 to 206 hours per reactor per year.

    o 	A new NRC requirement that its resident inspectors validate that
    licensees comply with additional inspection commitments made in response
    to NRC's 2002 generic bulletin regarding reactor pressure vessel head and
    vessel head penetration nozzles. This requirement results in an additional
    15 to 50 hours per reactor per fuel outage.

    5Of NRC's 21 high priority recommendations, we categorized 1
    recommendation as 2 so that we could better track actions taken to
    implement it. Thus, we have 22 recommendations categorized as high
    priority.

    Appendix IV
    Comments from the Nuclear Regulatory
    Commission

    25. Our draft report included a discussion that NRC management's failure
    to recognize the scope or breadth of actions and resources necessary to
    fully implement task force recommendations could adversely affect how
    effective the actions may be. We made this statement based on NRC's
    initial response to the Office of the Inspector General's October 2003
    report on Davis-Besse.6 That report concluded that ineffective
    communication within NRC's Region III and between Region III and NRC
    headquarters contributed to the Davis-Besse incident. NRC, in its January
    2004 response to the report, stated that among other things, it had
    developed training on boric acid corrosion and revised its inspection
    program to require semi-annual trend reviews. In February 2004, the Office
    of the Inspector General criticized NRC for limiting the agency's efforts
    in responding to its findings. Specifically, it stated that NRC did not
    address underlying and generic communication failures identified in the
    Office's report. In response to the criticism, on April 19, 2004 (while
    our draft report was with NRC for review and comment), NRC provided the
    Office of the Inspector General with additional information to demonstrate
    that its actions to improve communication within the agency were broader
    than indicated in the agency's January 2004 response. Based on NRC's April
    19, 2004, response and the Office's agreement that NRC's actions
    appropriately address its concerns about communication within the agency,
    we deleted this discussion in the report.

    26. We recognize that the lessons-learned task force did not make a
    recommendation for improving the agency's decision-making process because
    the task force coordinated with the Office of the Inspector General
    regarding the scope of their respective review activities and because the
    task force was primarily charged with determining why the vessel head
    degradation was not prevented. (See p. 55.)

    27. We agree that NRC's December 3, 2002, documentation of its decision
    was prepared in response to a finding by the Davis-Besse lessonslearned
    task force. We revised our report to incorporate this fact. (See

    p. 55.)

    28. We agree that NRC's lessons-learned task force conducted a preliminary
    review of reports from previous lessons-learned task forces

    6NRC, Office of the Inspector General, NRC's Oversight of Davis-Besse
    during the 2000 Refueling Outage (Washington, D.C.: Oct. 17, 2003).

    Appendix IV
    Comments from the Nuclear Regulatory
    Commission

    and, as a result of that review, made a recommendation that the agency
    perform a more detailed effectiveness review of the actions taken in
    response to those reviews. We revised the report to reflect that NRC's
    detailed review is currently underway. (See p. 55.)

    Appendix V

                         GAO Contacts and Staff Acknowledgments

    GAO Contacts	Jim Wells, (202) 512-3841 Ray Smith, (202) 512-6551

    Staff 	In addition, Heather L. Barker, David L. Brack, William F. Fenzel,
    Michael L. Krafve, William J. Lanouette, Marcia Brouns McWreath, Judy K.
    Pagano,

    Acknowledgments	Keith A. Rhodes, and Carol Hernstadt Shulman made key
    contributions to this report.

    Related GAO Products

    Management Weaknesses Affect Nuclear Regulatory Commission Efforts to
    Address Safety Issues Common to Nuclear Power Plants.
    GAO-RCED84-149.Washington, D.C.: September 19, 1984.

    Probabilistic Risk Assessment: An Emerging Aid to Nuclear Power Plant
    Safety Regulation. GAO-RCED-85-11. Washington, D.C.: June 19, 1985.

    The Nuclear Regulatory Commission Should Report on Progress in
    Implementing Lessons Learned from the Three Mile Island Accident.

    GAO-RCED-85-72. Washington, D.C.: July 19, 1985.

    Nuclear Regulation: Oversight of Quality Assurance at Nuclear Power Plants
    Needs Improvement. GAO-RCED-86-41.Washington, D.C.: January 23, 1986.

    Nuclear Regulation: Efforts to Ensure Nuclear Power Plant Safety Can Be
    Strengthened. GAO-RCED-87-141. Washington, D.C.: August 13, 1987.

    Nuclear Regulation: NRC's Restart Actions Appear Reasonable-but Criteria
    Needed. GAO-RCED-89-95.Washington, D.C.: May 4, 1989.

    Nuclear Regulation: NRC's Efforts to Ensure Effective Plant Maintenance
    Are Incomplete. GAO-RCED-91-36. Washington, D.C.: December 17, 1990.

    Nuclear Regulation: NRC's Relationship with the Institute of Nuclear Power
    Operations. GAO-RCED-91-122. Washington, D.C.: May 16, 1991.

    Nuclear Regulation: Weaknesses in NRC's Inspection Program at a South
    Texas Nuclear Power Plant. GAO-RCED-96-10. Washington, D.C.: October 3,
    1995.

    Nuclear Regulation: Preventing Problem Plants Requires More Effective NRC
    Action. GAO-RCED-97-145. Washington, D.C.: May 30, 1997.

    Nuclear Regulatory Commission: Preventing Problem Plants Requires More
    Effective Action by NRC. GAO-T-RCED-98-252. Washington, D.C.: July 30,
    1998.

    Nuclear Regulatory Commission: Strategy Needed to Develop a Risk-Informed
    Safety Approach. GAO-T-RCED-99-71. Washington, D.C.: February 4, 1999.

    Related GAO Products

    Nuclear Regulation: Strategy Needed to Regulate Safety Using Information
    on Risk. GAO-RCED-99-95. Washington, D.C.: March 19, 1999.

    Nuclear Regulation: Regulatory and Cultural Changes Challenge NRC.
    GAO/T-RCED-00-115. Washington, D.C.: March 9, 2000.

    Major Management Challenges and Performance Risks at the Nuclear
    Regulatory Commission. GAO-01-259. Washington, D.C.: January 2001.

    Nuclear Regulation: Progress Made in Emergency Preparedness at Indian
    Point 2, but Additional Improvements Needed. GAO-01-605. Washington, D.C.:
    July 30, 2001.

    Nuclear Regulation: Challenges Confronting NRC in a Changing Regulatory
    Environment. GAO-01-707T. Washington, D.C.: May 8, 2001.

    Nuclear Regulatory Commission: Status of Achieving Key Outcomes and
    Addressing Major Management Challenges. GAO-01-760. Washington, D.C.: June
    29, 2001.

    Managing for Results: Efforts to Strengthen the Link between Resources and
    Results at the Nuclear Regulatory Commission. GAO-03-258. Washington,
    D.C.: December 10, 2002.

    Nuclear Regulatory Commission: Oversight of Security at Commercial Nuclear
    Power Plants Needs to Be Strengthened. GAO-03-752. Washington, D.C.:
    September 4, 2003.

    GAO's Mission	The General Accounting Office, the audit, evaluation and
    investigative arm of Congress, exists to support Congress in meeting its
    constitutional responsibilities and to help improve the performance and
    accountability of the federal government for the American people. GAO
    examines the use of public funds; evaluates federal programs and policies;
    and provides analyses, recommendations, and other assistance to help
    Congress make informed oversight, policy, and funding decisions. GAO's
    commitment to good government is reflected in its core values of
    accountability, integrity, and reliability.

    Obtaining Copies of GAO Reports and Testimony

    The fastest and easiest way to obtain copies of GAO documents at no cost
    is through the Internet. GAO's Web site (www.gao.gov) contains abstracts
    and fulltext files of current reports and testimony and an expanding
    archive of older products. The Web site features a search engine to help
    you locate documents using key words and phrases. You can print these
    documents in their entirety, including charts and other graphics.

    Each day, GAO issues a list of newly released reports, testimony, and
    correspondence. GAO posts this list, known as "Today's Reports," on its
    Web site daily. The list contains links to the full-text document files.
    To have GAO e-mail this list to you every afternoon, go to www.gao.gov and
    select "Subscribe to e-mail alerts" under the "Order GAO Products"
    heading.

    Order by Mail or Phone	The first copy of each printed report is free.
    Additional copies are $2 each. A check or money order should be made out
    to the Superintendent of Documents. GAO also accepts VISA and Mastercard.
    Orders for 100 or more copies mailed to a single address are discounted 25
    percent. Orders should be sent to:

    U.S. General Accounting Office 441 G Street NW, Room LM Washington, D.C.
    20548

    To order by Phone: 	Voice: (202) 512-6000 TDD: (202) 512-2537 Fax: (202)
    512-6061

    To Report Fraud, Contact:

    Web site: www.gao.gov/fraudnet/fraudnet.htmWaste, and Abuse in E-mail:
    fraudnet@gao.gov Federal Programs Automated answering system: (800)
    424-5454 or (202) 512-7470

    Public Affairs	Jeff Nelligan, Managing Director, NelliganJ@gao.gov (202)
    512-4800 U.S. General Accounting Office, 441 G Street NW, Room 7149
    Washington, D.C. 20548

                                   Presorted Standard
                                  Postage & Fees Paid
                                          GAO
                                    Permit No. GI00

    United States
    General Accounting Office
    Washington, D.C. 20548-0001

    Official Business
    Penalty for Private Use $300

    Address Service Requested
    *** End of document. ***