Nuclear Regulation: NRC Needs to More Aggressively and
Comprehensively Resolve Issues Related to the Davis-Besse Nuclear
Power Plant's Shutdown (17-MAY-04, GAO-04-415).
In March 2002, the most serious safety issue confronting the
nation's commercial nuclear power industry since Three Mile
Island in 1979 was identified at the Davis- Besse plant in Ohio.
After the Nuclear Regulatory Commission (NRC) allowed Davis-Besse
to delay shutting down to inspect its reactor vessel for cracked
tubing, the plant found that leakage from these tubes had caused
extensive corrosion on the vessel head--a vital barrier
preventing a radioactive release. GAO determined (1) why NRC did
not identify and prevent the corrosion, (2) whether the process
NRC used in deciding to delay the shutdown was credible, and (3)
whether NRC is taking sufficient action in the wake of the
incident to prevent similar problems from developing at other
plants.
-------------------------Indexing Terms-------------------------
REPORTNUM: GAO-04-415
ACCNO: A10014
TITLE: Nuclear Regulation: NRC Needs to More Aggressively and
Comprehensively Resolve Issues Related to the Davis-Besse Nuclear
Power Plant's Shutdown
DATE: 05/17/2004
SUBJECT: Inspection
Nuclear powerplant safety
Nuclear powerplants
Nuclear reactors
Safety regulation
Regulatory agencies
******************************************************************
** This file contains an ASCII representation of the text of a **
** GAO Product. **
** **
** No attempt has been made to display graphic images, although **
** figure captions are reproduced. Tables are included, but **
** may not resemble those in the printed version. **
** **
** Please see the PDF (Portable Document Format) file, when **
** available, for a complete electronic file of the printed **
** document's contents. **
** **
******************************************************************
GAO-04-415
United States General Accounting Office
GAO Report to Congressional Requesters
May 2004
NUCLEAR REGULATION
NRC Needs to More Aggressively and Comprehensively Resolve Issues Related to the
Davis-Besse Nuclear Power Plant's Shutdown
a
GAO-04-415
Highlights of GAO-04-415, a report to congressional requesters
In March 2002, the most serious safety issue confronting the nation's
commercial nuclear power industry since Three Mile Island in 1979 was
identified at the Davis-Besse plant in Ohio. After the Nuclear Regulatory
Commission (NRC) allowed Davis-Besse to delay shutting down to inspect its
reactor vessel for cracked tubing, the plant found that leakage from these
tubes had caused extensive corrosion on the vessel head-a vital barrier
preventing a radioactive release. GAO determined (1) why NRC did not
identify and prevent the corrosion, (2) whether the process NRC used in
deciding to delay the shutdown was credible, and (3) whether NRC is taking
sufficient action in the wake of the incident to prevent similar problems
from developing at other plants.
Because the nation's nuclear power plants are aging, GAO is recommending
that NRC take more aggressive actions to mitigate the risk of serious
safety problems occurring at Davis-Besse and other nuclear power plants.
NRC disagreed with two of the report's five recommendations- that it
develop (1) additional means to better identify safety problems early and
(2) guidance for making decisions whether to shut down a plant. GAO
continues to believe these recommendations are appropriate and should be
implemented.
www.gao.gov/cgi-bin/getrpt?GAO-04-415.
To view the full product, including the scope and methodology, click on
the link above. For more information, contact Jim Wells at (202) 512-3841
or [email protected].
May 2004
NUCLEAR REGULATION
NRC Needs to More Aggressively and Comprehensively Resolve Issues Related to the
Davis-Besse Nuclear Power Plant's Shutdown
NRC should have but did not identify or prevent the corrosion at
Davis-Besse because its oversight did not generate accurate information on
plant conditions. NRC inspectors were aware of indications of leaking
tubes and corrosion; however, the inspectors did not recognize the
indications' importance and did not fully communicate information about
them. NRC also considered FirstEnergy-Davis-Besse's owner-a good
performer, which resulted in fewer NRC inspections and questions about
plant conditions. NRC was aware of the potential for cracked tubes and
corrosion at plants like Davis-Besse but did not view them as an immediate
concern. Thus, NRC did not modify its inspections to identify these
conditions.
NRC's process for deciding to allow Davis-Besse to delay its shutdown
lacks credibility. Because NRC had no guidance specifically for making a
decision on whether a plant should shut down, it used guidance for
deciding whether a plant should be allowed to modify its operating
license. NRC did not always follow this guidance and generally did not
document how it applied the guidance. The risk estimate NRC used to help
decide whether the plant should shut down was also flawed and
underestimated the amount of risk that Davis-Besse posed. Further, even
though underestimated, the estimate still exceeded risk levels generally
accepted by the agency.
NRC has taken several significant actions to help prevent reactor vessel
corrosion from recurring at nuclear power plants. For example, NRC has
required more extensive vessel examinations and augmented inspector
training. However, NRC has not yet completed all of its planned actions
and, more importantly, has no plans to address three systemic weaknesses
underscored by the incident. Specifically, NRC has proposed no actions to
help it better (1) identify early indications of deteriorating safety
conditions at plants, (2) decide whether to shut down a plant, or (3)
monitor actions taken in response to incidents at plants. Both NRC and GAO
had previously identified problems in NRC programs that contributed to the
Davis-Besse incident, yet these problems continue to persist.
The Davis-Besse Nuclear Power Plant in Oak Harbor, Ohio
Contents
Letter
Scope and Methodology
Results in Brief
Background
NRC's Actions to Oversee Davis-Besse Did Not Provide an Accurate
Assessment of Safety at the Plant NRC's Process for Deciding Whether to
Allow a Delayed Davis-Besse Shutdown Lacked Credibility NRC Has Made
Progress in Implementing Recommended Changes,
but Is Not Addressing Important Systemic Issues Conclusions
Recommendations for Executive Action Agency Comments and Our Evaluation
1 3 5 8
20
33
45 57 59 60
Appendixes
Appendix I:
Appendix II:
Appendix III:
Appendix IV:
Appendix V:
Time Line Relating Significant Events of Interest
Analysis of the Nuclear Regulatory Commission's Probabilistic Risk
Assessment for Davis-Besse
Davis-Besse Task Force Recommendations to NRC and Their Status, as of
March 2004
Comments from the Nuclear Regulatory Commission
GAO Comments
GAO Contacts and Staff Acknowledgments
GAO Contacts
Staff Acknowledgments
64
65
89
94 114
129 129 129
Related GAO Products
Table Table 1: Status of Davis-Besse Lessons-Learned Task Force
Recommendations, as of March 2004 47
Figures Figure 1: Major Components of a Pressurized Water Reactor 12
Figure 2: Major Components of the Davis-Besse Reactor Vessel
Head and Pressure Boundary 13
Figure 3: Diagram of the Cavity in Davis-Besse's Reactor Vessel
Head 17
Contents
Figure 4: The Cavity in Davis-Besse's Reactor Vessel Head after Discovery
18
Figure 5: Rust and Boric Acid on Davis-Besse's Vessel Head as Shown to
Resident Inspector during the 2000 Refueling Outage 23
Figure 6: NRC's Acceptance Guidelines for Core Damage Frequency 43
Abbreviations
NRC Nuclear Regulatory Commission PRA Probabilistic risk assessment
This is a work of the U.S. government and is not subject to copyright
protection in the United States. It may be reproduced and distributed in
its entirety without further permission from GAO. However, because this
work may contain copyrighted images or other material, permission from the
copyright holder may be necessary if you wish to reproduce this material
separately.
A
United States General Accounting Office Washington, D.C. 20548
May 17, 2004
Congressional Requesters
In 2002, the most serious safety issue confronting the nation's commercial
nuclear power industry since the accident at Three Mile Island in 1979 was
identified at the Davis-Besse nuclear power plant in northwestern Ohio. On
March 7, 2002, during shutdown for inspection and refueling, the owner of
the Davis-Besse plant-FirstEnergy Nuclear Operating Company- discovered a
pineapple-sized cavity in the plant's carbon steel reactor vessel head.
The reactor vessel head is an 18-foot-diameter, 6-inch-thick, 80-ton cap
that is bolted to the reactor vessel. The vessel head is an integral part
of the reactor coolant pressure boundary that serves as a vital barrier
for protecting the environment from any release of radiation from the
reactor core. In pressurized water reactors such as the one at
Davis-Besse, the reactor vessel contains the nuclear fuel, as well as
water with diluted boric acid that cools the fuel and helps control the
nuclear reaction. At the Davis-Besse plant, vertical tubes had cracked
that penetrate the reactor vessel head and that contain this water as well
as drive mechanisms used to lower and raise the fuel, thus allowing leaked
boric acid to corrode the reactor vessel head. The corrosion had extended
through the vessel head to a thin stainless steel lining and had likely
occurred over a period of several years. The lining, which is less than
one-third of an inch thick and was not designed as a pressure barrier, was
found to have a slight bulge with evidence of cracking. Had this lining
given way, the water within the reactor vessel would have escaped,
triggering a loss-of-coolant accident, which-if back-up safety systems had
failed to operate-likely would have resulted in the melting of the
radioactive core and a subsequent release of radioactive materials into
the environment. In March 2004, after 2 years of increased NRC oversight
and considerable repairs by FirstEnergy, NRC approved the restart of
Davis-Besse's operations.
Under the Atomic Energy Act of 1954, as amended, and the Energy
Reorganization Act of 1974, as amended, the Nuclear Regulatory Commission
(NRC) and the operators of nuclear power plants share the responsibility
for ensuring that nuclear reactors are operated safely. NRC is responsible
for issuing regulations, licensing and inspecting plants, and requiring
action, as necessary, to protect public health and safety; plant operators
have the primary responsibility for safely operating the plants in
accordance with their licenses. NRC has the authority to order plant
operators to take actions, up to and including shutting down a plant, if
licensing conditions are not being met and the plant poses an undue risk
to
public health and safety. In carrying out its responsibilities, NRC relies
on, among other things, on-site NRC resident inspectors to assess plant
conditions and quality assurance programs, such as those for maintenance
and operations, that operators establish to ensure safety at the plant.
Before the discovery of the cavity in the Davis-Besse reactor vessel head,
NRC had requested that operators of Davis-Besse and other similar
pressurized water reactors (1) thoroughly inspect the vertical tubing on
their reactor vessel heads by December 31, 2001, for possible cracking, or
(2) justify why their tubing and reactor vessel heads were sufficiently
safe without being inspected. This request was a reaction to cracked
vertical tubing found on a pressurized water reactor vessel head at
another plant. Such thorough inspections require that the reactor be shut
down. FirstEnergy, believing that its reactor vessel head was safe, asked
NRC if its shutdown could be delayed until the end of March 2002 to
coincide with an already scheduled shutdown for refueling-during which
time it would conduct the requested inspection. FirstEnergy provided
evidence supporting its assertion that the reactor could continue
operating safely. After considerable discussion, and after NRC developed a
risk assessment estimate for deciding that Davis-Besse would not pose an
unacceptable level of risk, NRC and FirstEnergy compromised, and
FirstEnergy agreed to shut down the reactor in mid-February 2002 for
inspection. Soon after Davis-Besse was shut down, the cracked tubes and
the significant reactor vessel head corrosion were discovered.
You asked us to determine (1) why NRC did not identify and prevent the
vessel head corrosion at Davis-Besse, (2) whether the process NRC used
when deciding to allow FirstEnergy to delay its shutdown was credible, and
(3) whether NRC is taking sufficient action in the wake of the Davis-Besse
incident to prevent similar problems from developing in the future at
Davis-Besse and other nuclear power plants. As agreed with your offices,
our review focused on NRC's role in the events leading up to Davis-Besse's
shutdown, NRC's response to the problems discovered, and NRC's management
controls over programs and processes that may have contributed to the
Davis-Besse incident. We did not evaluate the role of FirstEnergy because,
at the time of our review, NRC's Office of Investigations and the
Department of Justice were conducting separate inquiries into the
potential liability of FirstEnergy concerning its knowledge of conditions
at Davis-Besse, including the condition of the reactor vessel head. We
also did not review NRC's March 2004 decision to allow the plant to
restart.
Scope and Methodology
To determine why NRC did not identify and prevent the vessel head
corrosion at the Davis-Besse nuclear power plant, we reviewed NRC's
lessons-learned task force report;1 FirstEnergy's root cause analysis
reports;2 NRC's Office of the Inspector General reports on Davis-Besse;3
NRC's augmented inspection team report;4 and NRC's inspection reports and
licensee assessments from 1998 through 2001. We also reviewed NRC generic
communications issued on boric acid corrosion and on nozzle cracking. In
addition, we interviewed NRC regional officials who were involved in
overseeing Davis-Besse at the time corrosion was occurring, and when the
reactor vessel head cavity was found, to learn what information they had,
their knowledge of plant activities, and how they communicated information
to headquarters. We also held discussions with the resident inspector who
was at Davis-Besse at the time that corrosion was occurring to determine
what information he had and how this information was communicated to the
regional office. Further, we met with FirstEnergy and NRC officials at
Davis-Besse and walked through the facility, including the containment
building, to understand the nature and extent of NRC's oversight of
licensees. Additionally, we met with NRC headquarters officials to discuss
the oversight process as it related to Davis-Besse, and the extent of
their knowledge of conditions at Davis-Besse. We also met with county
officials from Ottawa County, Ohio, to discuss their views on NRC and
Davis-Besse plant safety. Further, we met with representatives from a
variety of public interest groups to obtain their thoughts on NRC's
oversight and the agency's proposed changes in the wake of Davis-Besse.
1NRC, Degradation of Davis-Besse Nuclear Power Station Reactor Pressure
Vessel Head Lessons-Learned Report (Washington, D.C.; Sept. 30, 2002).
2FirstEnergy, Davis-Besse Nuclear Power Station, Root Cause Analysis
Report: Significant Degradation of the Reactor Pressure Vessel Head, CR
2002-089 (Oak Harbor, Ohio; Aug. 27, 2002) and Root Cause Analysis Report:
Failure to Identify Significant Degradation of the Reactor Pressure Vessel
Head, CR-02-0685, 02-0846, 02-0891, 02-1053, 02-1128, 021583, 02-1850,
02-2584, and 02-2585 (Oak Harbor, Ohio; Aug. 13, 2002).
3NRC, Office of the Inspector General, NRC's Regulation of Davis-Besse
Regarding Damage to the Reactor Vessel Head (Washington, D.C.; Dec. 30,
2002) and NRC's Oversight of Davis-Besse Boric Acid Leakage and Corrosion
during the April 2000 Refueling Outage
(Washington, D.C.: Oct. 17, 2003).
4NRC, Davis-Besse Nuclear Power Station NRC Augmented Inspection Team-
Degradation of the Reactor Pressure Vessel Head (Washington, D.C.; May 3,
2002).
To determine whether the process NRC used was credible when deciding to
allow Davis-Besse to delay its shutdown, we evaluated NRC guidelines for
reviewing licensee requests for temporary and permanent license changes,
or amendments to their licenses. We also reviewed NRC guidance for making
and documenting agency decisions, such as those on whether to accept
licensee responses to generic communications, as well as NRC's policies
and procedures for taking enforcement action. We supplemented these
reviews with an analysis of internal NRC correspondence related to the
decision-making process, including e-mail correspondence, notes, and
briefing slides. We also reviewed NRC's request for additional information
to FirstEnergy following the issuance of NRC's generic bulletin for
conducting reactor vessel head and nozzle inspections, as well as
responses provided by FirstEnergy. In addition, we reviewed the draft
shutdown order that NRC prepared before accepting FirstEnergy's proposal
to conduct its inspection in mid-February 2002. We reviewed these
documents to determine whether the basis for NRC's decision was clearly
laid out, persuasive, and defensible to a party outside of NRC.
As part of our analysis for determining whether NRC's process was
credible, we also obtained and reviewed NRC's probabilistic risk
assessment (PRA) calculations that it developed to guide its decision
making. To conduct this analysis, we relied on the advice of consultants
who, collectively, have an extensive background in nuclear engineering,
PRA, and metallurgy. These consultants included Dr. John C. Lee, Professor
and Chair, Nuclear Engineering and Radiological Sciences at the University
of Michigan's College of Engineering; Dr. Thomas H. Pigford, Professor
Emeritus, at the University of California-Berkeley's College of
Engineering; and Dr. Gary S. Was, Associate Dean for Research in the
College of Engineering, and Professor, Nuclear Engineering and
Radiological Sciences at the University of Michigan's College of
Engineering. These consultants reviewed internal NRC correspondence
relating to NRC's PRA estimate, NRC's calculations, and the basis for
these calculations. These consultants also discussed the basis for NRC's
estimates with NRC officials and outside contractors who provided
information to NRC as it developed its estimates. These consultants were
selected on the basis of recommendations made by other nuclear engineering
experts, their resumes, their collective experience, lack of a conflict of
interest, and previous experience with assessing incidents at nuclear
power plants such as Three Mile Island.
To determine whether NRC is taking sufficient action in the wake of the
Davis-Besse incident to prevent similar problems from developing in the
future, we reviewed NRC's lessons-learned task force recommendations,
NRC's analysis of the underlying causes for failing to identify the
corrosion of the reactor vessel head, and NRC's action plan developed in
response to the task force recommendations. We also reviewed other NRC
lessonslearned task force reports and their recommendations, our prior
reports to identify issues related to those at Davis-Besse, and NRC's
Office of the Inspector General reports. We met with NRC officials
responsible for implementing task force recommendations to obtain a clear
understanding of the actions they were taking and the status of their
efforts, and discussed NRC's recommendations with NRC regional officials,
on-site inspectors, and representatives from public interest groups. We
conducted our review from November 2002 through May 2004 in accordance
with generally accepted government auditing standards.
Results in Brief NRC should have but did not identify or prevent the
vessel head corrosion at Davis-Besse because both its inspections at the
plant and its assessments of the operator's performance yielded inaccurate
and incomplete information on plant safety conditions. With respect to
inspections, NRC resident inspectors had information revealing potential
problems, such as boric acid deposits on the vessel head and air monitors
clogged with boric acid deposits, but this information did not raise
alarms about the plant's safety. NRC inspectors did not know that these
indications could signal a potentially significant problem and therefore
did not fully communicate their observations to other NRC staff, some of
whom might have recognized the significance of the problem. However, even
if these staff had been informed, according to NRC officials, the agency
would have taken action only if these indications were considered
significant safety concerns. Furthermore, NRC's assessments of
Davis-Besse, which include inspection results as well as other data, did
not provide complete and accurate information on FirstEnergy's
performance. For example, NRC consistently assessed Davis-Besse's operator
as a "good performer" during those years when the corrosion was likely
occurring, and the operator was not correctly identifying the source of
boric acid deposits. NRC had been aware for several years that corrosion
and cracking were issues that could possibly affect safety, but did not
view them as immediate safety concerns and therefore had not fully
incorporated them into its oversight process.
NRC's process for deciding whether Davis-Besse could delay its shutdown to
inspect for nozzle cracking lacks credibility because the guidance NRC
used was not intended for making such a decision and the basis for the
decision was not fully documented. In the absence of written guidance
specifically intended to direct the decision-making process for a
shutdown,
NRC used guidance designed for considering operator requests for license
amendments. This guidance describes safety factors that NRC should
consider in deciding whether to approve a license amendment, as well as a
process for considering the relative risk the amendment could pose.
However, the guidance does not specify how NRC should use the safety
factors, and we could not determine if NRC appropriately followed this
guidance because it did not clearly document the basis for its decision.
For example, NRC initially decided that several safety factors were not
met and considered issuing a shutdown order. Regardless, the agency
allowed FirstEnergy to delay its shutdown, even though it is not clear
whether- and if so, how-the safety factors were subsequently met. Further,
NRC did not provide a rationale for its decision for more than a year. NRC
also did not follow other aspects of its guidance. In the absence of
specific guidance, and with little documentation of the decision-making
process, we could not judge whether the agency's decision was reasonable.
Our consultants identified substantial problems with how NRC developed and
used its risk estimate when making the decision. For example, NRC did not
perform an analysis of the uncertainty associated with the risk estimate;
if it had, our consultants believe the uncertainty would have been so
large as to render NRC's risk estimate of questionable value. Further, the
risk estimate indicated that the likelihood of an accident occurring at
Davis-Besse was greater than the level of risk generally accepted as being
reasonable by NRC.
Responding to the Davis-Besse incident, NRC has taken several significant
actions to help prevent boric acid from corroding reactor vessel heads at
nuclear power plants. NRC issued requirements that licensees more
extensively examine their reactor vessel heads, revised NRC inspection
guidance used to identify and resolve licensee problems before they affect
operations, augmented training to keep its inspectors better informed
about boric acid and cracking issues, and revised guidance to better
ensure that licensees implement commitments to change their operations.
However, NRC has not yet implemented more than half of its planned
actions, and resource constraints could affect the agency's ability to
fully and effectively implement the actions. More importantly, NRC is not
addressing three systemic problems underscored by the Davis-Besse
incident. First, its process for assessing safety at nuclear power plants
is not adequate for detecting early indications of deteriorating safety.
In this respect, the process does not effectively identify changes in the
operator's performance or approach to safety before a more serious safety
problem can develop. Second, NRC's decision-making guidance does not
specifically address shutdown decisions or explain how different safety
considerations, such as quantitative estimates of risk, should be weighed.
Third, NRC does not have adequate management controls for systematically
tracking actions that it has taken in response to incidents at plants to
determine if the actions were sufficient to resolve underlying problems
and thereby prevent future incidents. Analyses of earlier incidents at
other plants identified several issues, such as inadequate communication,
that contributed to the Davis-Besse incident. Such management controls may
have helped to resolve these issues before the Davis-Besse incident
occurred. While NRC is monitoring how it implements actions taken as a
result of the Davis-Besse incident, the agency has not yet committed to a
process for assessing the effectiveness of actions taken.
Given NRC's actions in response to Davis-Besse, severe vessel head
corrosion is unlikely to occur at a plant any time soon. However, in part
because of unresolved systemic problems, another incident unrelated to
vessel head corrosion could occur in the future. As a result, we are
recommending that NRC take more aggressive and specific actions in several
areas, such as revising how it assesses plant performance, establishing a
more specific methodology for deciding to shut down a plant, and
establishing management controls for monitoring and assessing the
effectiveness of changes made in response to task force findings.
In commenting on a draft of this report, NRC generally addressed only
those findings and recommendations with which it disagreed. While
commenting that it agreed with many of our findings, the agency said that
the report overall does not appropriately characterize or provide a
balanced perspective on NRC's actions surrounding the discovery of the
reactor vessel head condition at Davis-Besse or its efforts to incorporate
the lessons learned from that experience into its processes. More
specifically, NRC stated that the report does not acknowledge that NRC
must rely heavily on its licensees to provide complete and accurate
information. NRC also expressed concern about the report's
characterization of its use of risk estimates. We believe that the report
fairly and accurately describes NRC's actions regarding the Davis-Besse
incident. Nonetheless, we expanded our discussion of NRC's roles and
responsibilities to point out that licensees are required to provide NRC
with complete and accurate information.
NRC disagreed with our recommendations to develop (1) specific guidance
and a well-defined process for deciding when to shut down a plant and (2)
a methodology to assess early indications of deteriorating safety at
nuclear
power plants. NRC stated that it has sufficient guidance to make plant
shutdown decisions. NRC also stated that, as regulators, the agency is not
charged with managing licensees' facilities and that direct involvement
with those aspects of licensees' operations that could provide it with
information on early indications of deteriorating safety crosses over to a
management function. We continue to believe that NRC should develop
specific guidance and a well-defined process to decide when to shut down a
plant. In absence of such guidance for making the Davis-Besse shutdown
decision, NRC used its guidance for considering operators' requests for
amendments to their licenses. This guidance describes safety factors that
NRC should consider in deciding whether to approve license changes, as
well as a process for considering the relative risk the amendment would
pose. This guidance does not specify how NRC should use the safety
factors. We also continue to believe that NRC should develop a methodology
to assess aspects of licensees' operations as a means to have an early
warning of developing safety problems. In implementing this
recommendation, we envision that NRC would be analyzing data for changes
in operators' performance or approach to safety, not prescribing how the
plants are managed.
Background
NRC's Role and NRC, as an independent federal agency, regulates the
commercial uses of
Responsibilities nuclear material to ensure adequate protection of public
health and safety and the environment. NRC is headed by a five-member
commission appointed by the President and confirmed by the Senate; one
commissioner is appointed as chairman.5 NRC has about 2,900 employees who
work in its headquarters office in Rockville, Maryland, and its four
regional offices. NRC is financed primarily by fees that it imposes on
commercial users of the nuclear material that it regulates. For fiscal
year 2004, NRC's appropriated budget of $626 million includes about $546
million financed by these fees.
NRC regulates the nation's commercial nuclear power plants by establishing
requirements for plant owners and operators to follow in the design,
construction, and operation of the nuclear reactors. NRC also
5Two commissioner positions are currently vacant.
licenses the reactors and individuals who operate them. Currently, 104
commercial nuclear reactors at 65 locations are licensed to operate.6 Many
of these reactors have been in service since the early to mid-1970s. NRC
initially licensed the reactors to operate for 40 years, but as these
licenses approach their expiration dates, NRC has been granting 20-year
extensions.
To ensure the reactors are operated within their licensing requirements
and technical specifications, NRC oversees them by both inspecting
activities at the plants and assessing plant performance.7 NRC's
inspections consist of both routine, or baseline, inspections and
supplemental inspections to assess particular licensee programs or issues
that arise at a power plant. Inspections may also occur in response to a
specific operational problem or event that has occurred at a plant. NRC
maintains inspectors at every operating nuclear power plant in the United
States and supplements the inspections conducted by these resident
inspectors with inspections conducted by staff from its regional offices
and from headquarters. Generally, inspectors verify that the plant's
operator qualifications and operations, engineering, maintenance, fuel
handling, emergency preparedness, and environmental and radiation
protection programs are adequate and comply with NRC safety requirements.
NRC also oversees licensees by requesting information on their activities.
NRC requires that information provided by licensees be complete and
accurate and, according to NRC officials, this is an important aspect of
the agency's oversight.8 While we have added information to this report on
the requirement that licensees provide NRC with complete and accurate
information, we believe that NRC's oversight program should not place
undue reliance on this requirement.
Nuclear power plants have many physical structures, systems, and
components, and licensees have numerous activities under way, 24-hours a
6These licensed reactors include Browns Ferry Unit 1-one of three reactors
owned by the Tennessee Valley Authority in Alabama-which was shut down in
1985. The Tennessee Valley Authority plans to restart the reactor in 2007,
which will require NRC approval.
7NRC's oversight program has changed significantly since the beginning of
1998. The third and most recent change occurred in mid-2000, when the
agency adopted its Reactor Oversight Process. Under this process, NRC
continues to rely on inspection results to assess licensee performance.
However, it supplements this information with other indicators of
self-reported licensee performance, such as how frequently unscheduled
shutdowns occur.
810 C.F.R. S: 50.9 requires that information provided by licensees be
complete and accurate in all material respects.
day, to ensure the plants operate safely. Programs to ensure quality
assurance and safe operations include monitoring, maintenance, and
inspection. To carry out these programs, licensees typically prepare
several thousand reports per year describing conditions at the plant that
need to be addressed to ensure continued safe operations. Because of the
large number of activities and physical structures, systems, and
components, NRC focuses its inspections on those activities and pieces of
equipment or systems that are considered to be most significant for
protecting public health and safety. NRC terms this a "risk-informed"
approach for regulating nuclear power plants. Under this risk-informed
approach, some systems and activities that NRC considers to have
relatively less safety significance receive little NRC oversight. NRC has
adopted a risk-informed approach because it believes it can focus its
regulatory resources on those areas of the plant that the agency considers
to be most important to safety. In addition, it was able to adopt this
approach because, according to NRC, safety performance at nuclear power
plants has improved as a result of more than 25 years of operating
experience.
To decide whether inspection findings are minor or major, NRC uses a
process it began in 2000 to determine the extent to which violations
compromise plant safety. Under this process, NRC characterizes the
significance of its inspection findings by using a significance
determination process to evaluate how an inspection finding impacts the
margin of safety at a power plant. NRC has a range of enforcement actions
it can take, depending on how much the safety of the plant had been
compromised. For findings that have low safety significance, NRC can
choose to take no formal enforcement action. In these instances,
nonetheless, licensees remain responsible for addressing the identified
problems. For more serious findings, NRC may take more formal action, such
as issuing enforcement orders. Orders can be used to modify, suspend, or
even revoke an operating license. NRC has issued one enforcement order to
shut down an operating power plant in its 28-year history-in 1987, after
NRC discovered control room personnel sleeping while on duty at the Peach
Bottom nuclear power plant in Pennsylvania. In addition to enforcement
orders, NRC can issue civil penalties of up to $120,000 per violation per
day. Although NRC does not normally use civil penalties for violations
associated with its Reactor Oversight Process, NRC will consider using
them for issues that are willful, have the potential for impacting the
agency's regulatory process, or have actual public health and safety
consequences. In fiscal year 2003, NRC proposed imposing civil penalties
totaling $120,000 against two power plant licensees for the failure to
provide complete and accurate information to the agency.
NRC uses generic communications-such as bulletins, generic letters, and
information notices-to provide information to and request information from
the nuclear industry at large or specific groups of licensees. Bulletins
and generic letters both usually request information from licensees
regarding their compliance with specific regulations. They do not require
licensees to take any specific actions, but do require licensees to
provide responses to the information requests. In general, NRC uses
bulletins, as opposed to generic letters, to address significant issues of
greater urgency. NRC uses information notices to transmit significant
recently identified information about safety, safeguards, or environmental
issues. Licensees are expected to review the information to determine
whether it is applicable to their operations and consider action to avoid
similar problems.
Operation of Pressurized Water Nuclear Power Plants and Events Leading to
the March 2002 Discovery of Serious Corrosion
The Davis-Besse Nuclear Power Station, owned and operated by FirstEnergy
Nuclear Operating Company, is an 882-megawatt electric pressurized water
reactor located on Lake Erie in Oak Harbor, Ohio, about 20 miles east of
Toledo. The power plant is under NRC's Region III oversight, which is
located in Lisle, Illinois. Like other pressurized water reactors,
Davis-Besse is designed with multiple barriers between the radioactive
heat-producing core and the outside environment-a design concept called
"defense-in-depth." Three main design components provide defense-in-depth.
First, the reactor core is designed to retain radioactive material within
the uranium oxide fuel, which is also covered with a layer of metal
tubing. Second, a 6-inch-thick carbon steel vessel, lined with
threesixteenth-inch-thick stainless steel, surrounds the reactor core.
Third, a steel containment structure, surrounded by a thick reinforced
concrete building, encloses the reactor vessel and other systems and
components important for maintaining safety. The containment structure and
concrete building are intended to help not only prevent a release of
radioactivity to the environment, but also shield the reactor from
external hazards like tornados and missiles. The reactor vessel, in
addition to housing the reactor core, contains highly pressurized water to
cool the radioactive heat-producing core and transfer heat to a steam
generator. Consequently, the vessel is referred to as the reactor pressure
vessel. From the vessel, hot pressurized water is piped to the steam
generator, where a separate supply of water is turned to steam to drive
turbines that generate electricity. (See fig. 1.)
structure were perforated with 18 5-by 7-inch rectangular openings, termed
"mouse-holes," that were used for vessel head inspections. In pressurized
water reactors such as Davis-Besse, the reactor vessel, the vessel head,
the nozzles, and other equipment used to ensure a continuous supply of
pressurized water in the reactor vessel are collectively referred to as
the reactor coolant pressure boundary. (See fig. 2.)
Figure 2: Major Components of the Davis-Besse Reactor Vessel Head and
Pressure Boundary
Source: FirstEnergy.
To better control the nuclear reaction at nuclear power plants, boron in
the form of boric acid crystals is dissolved in the cooling water
contained within the reactor vessel and pressure boundary. Boric acid,
under certain
conditions, can cause corrosion of carbon steel. For about 3 decades, NRC
and the nuclear power industry have known that boric acid had the
potential to corrode reactor components. In general, if leakage occurs
from the reactor coolant system, the escaping coolant will flash to steam
and leave behind a concentration of impurities, including noncorrosive dry
boric acid crystals. However, under certain conditions, the coolant will
not flash to steam, and the boric acid will remain in a liquid state where
it can cause extensive and rapid degradation of any carbon steel
components it contacts. Such extensive degradation, in both domestic and
foreign pressurized water reactor plants, has been well documented and led
NRC to issue a generic letter in 1988 requesting information from
pressurized water reactor licensees to ensure they had implemented
programs to control boric acid corrosion. NRC was primarily concerned that
boric acid corrosion could compromise the reactor coolant pressure
boundary. This concern also led NRC to develop a procedure for inspecting
licensees' boric acid corrosion control programs and led the Electric
Power Research Institute to issue guidance on boric acid corrosion
control.10
NRC and the nuclear power industry have also known that nozzles made of
alloy 600,11 used in several areas within nuclear power plants, were prone
to cracking. Cracking had become an increasingly topical issue as the
nuclear power plant fleet has aged. In 1986, operators at domestic and
foreign pressurized water reactors began reporting leaks in various types
of alloy 600 nozzles. In 1989, after leakage was detected at a domestic
plant, NRC identified the cause of the leakage as cracking due to primary
water stress corrosion.12 However, NRC concluded that the cracking was not
an immediate safety concern for a few reasons. For example, the cracks had
a low growth rate, were in a material with an extremely high flaw
tolerance and, accordingly, were unlikely to spread. Also, the cracks were
axial-that is, they ran the length of the nozzle rather than its
circumference. NRC and
10The Electric Power Research Institute is a nonprofit energy research
consortium whose members include utilities. It provides science and
technology-based solutions to members through its scientific research,
technology development, and product implementation program.
11Alloy 600 is an alloy of nickel, chromium, iron, and minor amounts of
other elements. The alloy is highly resistant to general corrosion but can
be susceptible to cracking at high temperatures.
12Primary water stress corrosion cracking refers to cracking under stress
and in primary coolant water. The primary water coolant system is that
portion of a nuclear power plant's coolant system that cools the reactor
core in the reactor pressure vessel and deposits heat to the steam
generator.
the nuclear power industry were more concerned that circumferential cracks
could result in broken or snapped nozzles. NRC did, however, issue a
generic information notice in 1990 to inform the industry of alloy 600
cracking. Through the early 1990s, NRC, the Nuclear Energy Institute,13
and others continued to monitor alloy 600 cracking. In 1997, continued
concern over cracking led NRC to issue a generic letter to pressurized
water reactor licensees requesting information on their plans to monitor
and manage cracking in vessel head penetration nozzles as well as to
examine these nozzles.
In the spring of 2001, licensee inspections led to the discovery of large
circumferential cracking in several vessel head penetration nozzles at the
Oconee Nuclear Station, in South Carolina. As a result of the discovery,
the nuclear power industry and NRC categorized the 69 operating
pressurized water reactors in the United States into different groups on
the basis of (1) whether cracking had already been found and (2) how
similar they were to Oconee in terms of the amount of time and the
temperature at which the reactors had operated. The industry had developed
information indicating that greater operating time and temperature were
related to cracking. In total, five reactors at three locations were
categorized as having already identified cracking, while seven reactors at
five locations were categorized as being highly susceptible, given their
similarity to Oconee.14
In August 2001, NRC issued a bulletin requesting that licensees of these
reactors provide, within 30 days, information on their plans for
conducting nozzle inspections before December 31, 2001.15 In lieu of this
information, NRC stated that licensees could provide the agency with a
reasoned basis for their conclusions that their reactor vessel pressure
boundaries would continue to meet regulatory requirements for ensuring the
structural integrity of the reactor coolant pressure boundary until the
licensees
13The Nuclear Energy Institute comprises companies that operate commercial
power plants and supports the commercial nuclear industry; and
universities, research laboratories, and labor unions affiliated with the
nuclear industry. Among other things, it provides a forum to resolve
technical and business issues and offers information to its members and
policymakers on nuclear issues.
14Reactors that were categorized as having already identified cracking or
were highly susceptible included Arkansas Nuclear reactor unit 1; D.C.
Cook reactor unit 2; Davis-Besse; North Anna reactor units 1 and 2; Oconee
reactor units 1, 2 and 3; Robinson reactor unit 2; Surry reactor units 1
and 2; and Three Mile Island reactor unit 1.
15NRC, "Circumferential Cracking of Reactor Pressure Vessel Head
Penetration Nozzles" (Bulletin 2001-01, Aug. 8, 2001).
conducted their inspections. NRC used a bulletin, as opposed to a generic
letter, to request this information because cracking was considered a
significant and urgent issue. All of the licensees of the highly
susceptible reactors, except Davis-Besse and D.C. Cook reactor unit 2,
provided NRC with plans for conducting inspections by December 31, 2001.16
In September 2001, FirstEnergy proposed conducting the requested
inspection in April 2002, following its planned March 31, 2002, shutdown
to replace fuel. In making this proposal, FirstEnergy contended that the
reactor coolant pressure boundary at Davis-Besse met and would continue to
meet regulatory requirements until its inspection. NRC and FirstEnergy
exchanged information throughout the fall of 2001 regarding when
FirstEnergy would conduct the inspection at Davis-Besse. NRC drafted an
enforcement order that would have shut down Davis-Besse by December 2001
for the requested inspection in the event that FirstEnergy could not
provide an adequate justification for safe operation beyond December 31,
2001, but ultimately compromised on a mid-February 2002 shutdown date.
NRC, in deciding when FirstEnergy had to shut down Davis-Besse for the
inspection, used a risk-informed decision-making process, including
probabilistic risk assessment (PRA), to conclude that the risk that
Davis-Besse would have an accident in the interim was relatively low. PRA
is an analytical tool for estimating the probability that a potential
accident might occur by examining how physical structures, systems, and
components, along with employees, work together to ensure plant safety.
Following the mid-February 2002 shutdown and in the course of its
inspection in March 2002, FirstEnergy removed about 900 pounds of boric
acid crystals and powder from the reactor vessel head, and subsequently
discovered three cracked nozzles. The number of nozzles that had cracked,
as well as the extent of cracking, was consistent with analyses that NRC
staff had conducted prior to the shutdown. However, in examining the
extent of cracking, FirstEnergy also discovered that corrosion had caused
a pineapple-sized cavity in the reactor vessel head. (See figs. 3 and 4.)
16The licensee for D.C. Cook reactor unit 2 proposed to shut down in
mid-January 2002 for its inspection. NRC agreed to the delay after
crediting D.C. Cook for having been shut down for about a month during the
fall of 2001, thus reducing the reactor's operating time.
Figure 3: Diagram of the Cavity in Davis-Besse's Reactor Vessel Head
4: The Cavity in Davis-BFi esse's Reactor Vessel Hegure ad after Discovery
Source: FirstEnergy.
After this discovery, NRC directed FirstEnergy to, among other things,
determine the root cause of the corrosion and obtain NRC approval before
restarting Davis-Besse. NRC also dispatched an augmented inspection team
consisting of NRC resident, regional, and headquarters officials.17 The
inspection team concluded that the cavity was caused by boric acid
corrosion from leaks through the control rod drive mechanism nozzles in
the reactor vessel head. Primary water stress corrosion cracking of the
nozzles caused through-wall cracks, which led to the leakage and eventual
corrosion of the vessel head. NRC's inspection team also concluded, among
other things, that this corrosion had gone undetected for an extended
period of time-at least 4 years-and significantly compromised the plant's
17NRC forms such inspection teams to ensure that the agency investigates
significant operational events in a timely, objective, systematic, and
technically sound manner, and identifies and documents the causes of such
events.
safety margins. As of May 2004, NRC had not yet completed other analyses,
including how long Davis-Besse could have continued to operate with the
corrosion it had experienced before a vessel head loss-of-coolant accident
would have occurred.18 However, on May 4, 2004, NRC released preliminary
results of its analysis of the vessel head and cracked cladding. Based on
its analysis of conditions that existed on February 16, 2002, NRC
estimated that Davis-Besse could have operated for another 2 to 13 months
without the vessel head failing. However, the agency cautioned that this
estimate was based on several uncertainties associated with the complex
network of cracks on the cladding and the lack of knowledge about
corrosion and cracking rates. NRC plans to use this data in preparing its
preliminary analysis of how, and the likelihood that, the events at
Davis-Besse could have led to core damage. NRC plans to complete this
preliminary analysis in the summer of 2004.
NRC also established a special oversight panel to (1) coordinate NRC's
efforts to assess FirstEnergy's performance problems that resulted in the
corrosion damage, (2) monitor Davis-Besse's corrective actions, and (3)
evaluate the plant's readiness to resume operations. The panel, which is
referred to as the Davis-Besse Oversight Panel, comprises officials from
NRC's Region III office in Lisle, Illinois; NRC headquarters; and the
resident inspector office at Davis-Besse. In addition to overseeing
FirstEnergy's performance during the shutdown and through restart of
Davis-Besse, the panel holds public meetings in Oak Harbor, Ohio, where
the plant is located, and nearby Port Clinton, Ohio, to inform the public
about its oversight of Davis-Besse's restart efforts and its views on the
adequacy of these efforts. The panel developed a checklist of issues that
FirstEnergy had to resolve prior to restarting: (1) replacing the vessel
head and ensuring the adequacy of other equipment important for safety,
(2) correcting FirstEnergy programs that led to the corrosion, and (3)
ensuring FirstEnergy's readiness to restart. To restart the plant,
FirstEnergy, among other things, removed the damaged reactor vessel head,
purchased and installed a new head, replaced management at the plant, and
took steps to improve key programs that should have prevented or detected
the corrosion. As of March 2004, when NRC gave its approval for
Davis-Besse to resume
18NRC has an Accident Sequence Precursor Analysis Program to analyze
significant events that occur at nuclear power plants to determine how,
and the likelihood that, the events could have led to core damage.
operations, the shutdown and preparations for restart had cost FirstEnergy
approximately $640 million.19
In addition, NRC established a task force to evaluate its regulatory
processes for assuring reactor pressure vessel head integrity and to
identify and recommend areas for improvement that may be applicable to
either NRC or the nuclear power industry. The task force's report, which
was issued in September 2002, contains 51 recommendations aimed primarily
at improving NRC's process for inspecting and overseeing licensees,
communicating with industry, and identifying potential emerging technical
issues that could impact plant safety. NRC developed an action plan to
implement the report's recommendations.
NRC's Actions to Oversee Davis-Besse Did Not Provide an Accurate
Assessment of Safety at the Plant
NRC's inspections and assessments of FirstEnergy's operations should have
but did not provide the agency with an accurate understanding of safety
conditions at Davis-Besse, and thus NRC failed to identify or prevent the
vessel head corrosion. Some NRC inspectors were aware of the indications
of corrosion and leakage that could have alerted NRC to corrosion problems
at the plant, but they did not have the knowledge to recognize the
significance of this information. These problems were compounded by NRC's
assessments of FirstEnergy that led the agency to believe FirstEnergy was
a good performer and could or would successfully resolve problems before
they became significant safety issues. More broadly, NRC had a range of
information that could have identified and prevented the incident at
Davis-Besse but did not effectively integrate it into its oversight.
19FirstEnergy spent about $293 million on operations, maintenance, and
capital projects (including $47 million for the new reactor vessel head)
and $348 million to purchase power to replace the power that Davis-Besse
would have generated over the 2-year shutdown period. In contrast, during
a more routine refueling outage, Davis-Besse would spend about $60
million-about $37 million on operations, maintenance, and capital projects
and $23 million on replacing the power that would have been generated over
a 42-day shutdown period. These latter estimates are based on the
Davis-Besse refueling outage in midcalendar year 2000.
Several Factors Contributed to the Inadequacy of NRC's Inspections for
Determining Plant Conditions
Inspectors Did Not Know Safety Significance of Observed Problems
Three separate, but related, NRC inspection program factors contributed to
the development of the corrosion problems at Davis-Besse. First, resident
inspectors did not know that the boric acid, rust, and unidentified
leaking indicated that the reactor vessel head might be degrading. Second,
these inspectors thought they understood the cause for the indications,
based on licensee actions to address them. Therefore, resident inspectors,
as well as regional and headquarters officials, did not fully communicate
information on the indications or decide how to address them, and
therefore took no action. Third, because the significance of the symptoms
was not fully recognized, NRC did not direct sufficient inspector
resources to aggressively investigate the indicators. NRC might have taken
a different approach to the Davis-Besse situation if its program to
identify emerging issues important to safety had pursued earlier concerns
about boric acid corrosion and cracking and recognized how they could
affect safety.
NRC limits the amount of unidentified leakage from the reactor coolant
system to no more than 1 gallon per minute. When this limit is exceeded,
NRC requires that licensees identify and correct any sources of
unidentified leakage. NRC also prohibits any leakage from the reactor
coolant pressure boundary, of which the reactor vessel is a key component.
Such leakage is prohibited because the pressure boundary is key to
maintaining adequate coolant around the reactor fuel and thus protects
public health and safety. Because of this, NRC's technical specification
states that licensees are to monitor reactor coolant leakage and shut down
within 36 hours if leakage is found in the pressure boundary.
In the years leading up to FirstEnergy's March 2002 discovery that
Davis-Besse's vessel head had corroded extensively, NRC had several
indications of potential leakage problems. First, NRC knew that the rates
of leakage in the reactor coolant system had increased. Between 1995 and
mid-1998, the unidentified leakage rate was about 0.06 gallon per minute
or less, according to FirstEnergy's monitoring. In mid-1998, the
unidentified reactor coolant system leakage rate increased
significantly-to as much as 0.8 gallon per minute. The elevated leakage
rate was dominated by a known problem with a leaking relief valve on the
reactor coolant system pressurizer tank, which masked the ongoing leak on
the reactor pressure vessel head. However, the elevated leak rate should
have raised concerns.
To investigate this leakage, as well as to repair other equipment,
FirstEnergy shut down the plant in mid-1999. It then identified a faulty
relief valve that accounted for much of the leakage and repaired the
valve.
However, after restarting Davis-Besse, the unidentified leakage rate
remained significantly higher than the historical average. Specifically,
the unidentified leakage rate varied between 0.15 and 0.25 gallon per
minute as opposed to the historical low of about 0.06 gallon or less.
While NRC was aware that the rate was higher than before, NRC did not
aggressively pursue the difference because the rate was well below NRC's
limit of no more than 1 gallon per minute, and thus the leak was not
viewed as being a significant safety concern. Following the repair in
1999, NRC's inspection report concluded that FirstEnergy's efforts to
reduce the leak rate during the outage were effective.
Second, NRC was aware of increased levels of boric acid in the containment
building-an indication that components containing reactor coolant were
leaking. So much boric acid was being deposited that FirstEnergy officials
had to repeatedly clean the containment air cooling system and radiation
monitor filters. For example, before 1998, the containment air coolers
seldom needed cleaning, but FirstEnergy had to clean them 28 times between
late 1998 and May 2001. Between May 2001 and the mid-February 2002
shutdown, the containment air coolers were not cleaned, but at shutdown,
FirstEnergy removed 15 5-gallon buckets of boric acid from the
coolers-which is almost as much as was found on the reactor pressure
vessel head. Rather than seeing these repeated cleanings as an indication
of a problem that needed to be addressed, FirstEnergy made cleaning the
coolers a routine maintenance activity, which NRC did not consider
significant enough to require additional inspections. Furthermore, the
radiation monitors, used to sample air from the containment building to
detect radiation, typically required new filters every month. However,
from 1998 to 2002, these monitors became clogged and inoperable hundreds
of times because of boric acid, despite FirstEnergy's efforts to fix the
problem.
Third, NRC was aware that FirstEnergy found rust in the containment
building. The radiation monitor filters had accumulated dark colored iron
oxide particles-a product of carbon steel corrosion-that were likely to
have resulted from a very small steam leak. NRC inspection reports during
the summer and fall of 1999 noted these indications and, while recognizing
FirstEnergy's aggressive attempts to identify the reasons for the
phenomenon, concluded that they were a "distraction to plant personnel."
Several NRC inspection reports noted indications of leakage, boric acid,
and rust before the agency adopted its new Reactor Oversight Process in
2000, but because the leakage was within NRC's technical specifications
and NRC officials thought that the licensee understood and would fix the
problem, NRC did not aggressively pursue the indications. NRC's new
oversight process, implemented in the spring of 2000, limited the issues
that could be discussed in NRC inspection reports to those that the agency
considers to have more than minor significance. Because the leakage rates
were below NRC's limits, NRC's inspection reports following the
implementation of NRC's new oversight process did not identify any
discussion of these problems at the plant.
Fourth, NRC was aware that FirstEnergy found rust on the Davis-Besse
reactor vessel head, but it did not recognize its significance. For
instance, during the 2000 refueling outage, a FirstEnergy official said he
showed one of the two NRC resident inspectors a report that included
photographs of rust-colored boric acid on the vessel head. (See fig. 5.)
Figure 5: Rust and Boric Acid on Davis-Besse's Vessel Head as Shown to
Resident Inspector during the 2000 Refueling Outage
Source: FirstEnergy.
According to this resident inspector, he did not recall seeing the report
or photographs but had no reason to doubt the FirstEnergy official's
statement. Regardless, he stated that had he seen the photographs, he
would not have considered the condition to be significant at the time. He
said that he did not know what the rust and boric acid might have
indicated, and he assumed that FirstEnergy would take care of the vessel
head before restarting. The second resident inspector said he reviewed all
such reports at Davis-Besse but did not recall seeing the photographs or
this particular report. He stated that it was quite possible that he had
read the report, but because the licensee had a plan to clean the vessel
head, he would have concluded that the licensee would correct the matter
before plant restart. However, FirstEnergy did not accomplish this, even
though work orders and subsequent licensee reports indicated that this was
done. According to the NRC resident inspector and NRC regional officials,
because of the large number of licensee activities that occur during a
refueling outage, NRC inspectors do not have the time to investigate or
follow up on every issue, particularly when the issue is not viewed as
being important to safety. While the resident inspector informed regional
officials about conditions at Davis-Besse, the regional office did not
direct more inspection resources to the plant, or instruct the resident
inspector to conduct more focused oversight. Some NRC regional officials
were aware of indications of boric acid corrosion at the plant; others
were not. According to the Office of the Inspector General's investigation
and 2003 report on Davis-Besse,20 the NRC regional branch chief-who
supervised the staff responsible for overseeing FirstEnergy's vessel head
inspection activities during the 2000 refueling outage-said that he was
unaware of the boric acid leakage issues at Davis-Besse, including its
effects on the containment air coolers and the radiation monitor filters.
Had his staff been requested to look at these specific issues, he might
have directed inspection resources to that area. (App. I provides a time
line showing significant events of interest.)
NRC Did Not Fully Communicate NRC was not fully aware of the indications
of a potential problem at Davis-
Indications Besse because NRC's process for transmitting information from
resident inspectors to regional offices and headquarters did not ensure
that information was fully communicated, evaluated, or used. NRC staff
communicated information about plant operations through inspection
reports, licensee assessments, and daily conference calls that included
20NRC, Office of the Inspector General, NRC's Oversight of Davis-Besse
during the April 2000 Refueling Outage (Washington, D.C.: Oct. 17, 2003).
resident, regional, and headquarters officials. According to regional
officials, information that is not considered important is not routinely
communicated to NRC management and technical specialists. For example,
while the resident inspectors at Davis-Besse knew all of the indications
of leakage, and there was some level of knowledge about these indications
at the regional office level, the knowledge was not sufficiently
widespread within NRC to alert a technical specialist who might have
recognized their safety significance. According to NRC Region III
officials, the region uses an informal means-memorandums sent to other
regions and headquarters-of communicating information identified at plants
that it considers to be important to safety. However, because the
indications at Davis-Besse were not considered important, officials did
not transmit this information to headquarters. Further, because the
process is informal, these officials said they did not know whether-and if
so, how-other NRC regions or headquarters used this information.
Similarly, NRC officials said that NRC headquarters had no systematic
process for communicating information, such as on boric acid corrosion,
cracking, and small amounts of unidentified leakage, that had not yet
risen to a relatively high level of concern within the agency, in a timely
manner to its regions or on-site inspectors. For example, the regional
inspector that oversaw FirstEnergy's activities during the 2000 refueling
outage, including the reactor vessel head inspection, stated that he was
not aware of NRC's generic bulletins and letters pertaining to boric acid
and corrosion, even though NRC issues only a few of these bulletins and
generic letters each year.21 In addition, according to NRC regional
officials and the resident inspector at Davis-Besse, there is little time
to review technical reports about emerging safety issues that NRC compiles
because they are too lengthy and detailed. Ineffective communication, both
within the region and between NRC headquarters and the region, was a
primary factor cited by NRC's Office of the Inspector General in its
investigation of NRC's oversight of Davis-Besse boric acid leakage and
corrosion. 22 For example, it found that ineffective communication
resulted in senior regional management being largely unaware of repeated
reports of boric acid leakage at Davis-Besse. It also found that
headquarters, in communications with the regions, did not emphasize the
issues discussed in its generic
21Over the last 10 years, NRC has issued an average of about two generic
bulletins and about four generic letters a year.
22NRC, Office of the Inspector General, NRC's Oversight of Davis-Besse
during the April 2000 Refueling Outage (Washington, D.C.; Oct. 17, 2003).
letters or bulletins on boric acid corrosion or cracking. NRC programs for
informing its inspectors about issues that can reduce safety at nuclear
power plants were not effective. As a result, NRC inspectors did not
recognize the significance of the indications at Davis-Besse, fully
communicate information about the indications, or spend additional effort
to follow up on the indications.
Resource Constraints Affected NRC also did not focus on the indications
that the vessel head was
NRC Oversight corroding because of several staff constraints. Region III
was directing resources to other plants that had experienced problems
throughout the region, and these plants thus were the subject of increased
regulatory oversight. For example, during the refueling outages in 1998
and 2000, while NRC oversaw FirstEnergy's inspection of the reactor vessel
head, the region lacked senior project engineers to devote to Davis-Besse.
A vacancy existed for a senior project engineer responsible for
Davis-Besse from June 1997 until June 1998, except for a one month period,
and from September 1999 until May 2000, which resulted in fewer inspection
hours at the facility than would have been normal. Other regional staff
were also occupied with other plants in the region that were having
difficulties, and NRC had unfilled vacancies for resident and regional
inspector positions that strained resources for overseeing Davis-Besse.
Even if the inspector positions had been filled, it is not certain that
the inspectors would have aggressively followed up on any of the
indications. According to our discussions with resident and regional
inspectors and our on-site review of plant activities, because nuclear
power plants are so large, with many physical structures, systems, and
components, an inspector could miss problems that were potentially
significant for safety. Licensees typically prepare several hundred
reports per month for identifying and resolving problems, and NRC
inspectors have only a limited amount of time to follow up on these
licensee reports. Consequently, NRC selects and oversees the most safety
significant structures, systems, and components.
NRC's Assessment Process Did Not Indicate Deteriorating Performance
Under NRC's Reactor Oversight Process, NRC assesses licensees' performance
using two distinct types of information: (1) NRC's inspection results and
(2) performance indicators reported by the licensees. These indicators,
which reflect various aspects of a plant's operations, include data on,
for example, the failure or unavailability of certain important operating
systems, the number of unplanned power changes, and the amount of reactor
coolant system leakage. NRC evaluates both the inspection results and the
performance indicators to arrive at licensee
assessments, which it then color codes to reflect their safety
significance. Green assessments indicate that performance is acceptable,
and thus connote a very low risk significance and impact on safety. White,
yellow, and red assessments each represent a greater degree of safety
significance. After NRC adopted its Reactor Oversight Process in April
2000, FirstEnergy never received anything but green designations for its
operations at Davis-Besse and was viewed by NRC as a good performer until
the 2002 discovery of the vessel head corrosion.23 Similarly, prior to
adopting the Reactor Oversight Process, NRC consistently assessed
FirstEnergy as generally being a good performer. NRC officials stated,
however, that significant issues were identified and addressed as
warranted throughout this period, such as when the agency took enforcement
action in response to FirstEnergy's failure to properly repair important
components in 1999-a failure caused by weaknesses in FirstEnergy's boric
acid corrosion control program.
Key Davis-Besse programs for ensuring the quality and safe operation of
the plant's engineered structures, systems, and components include, for
example,
o a corrective action program to ensure that problems at the plant that
are relevant to safety are identified and resolved in a timely manner,
o an operating experience program to ensure that experiences or problems
that occur are appropriately identified and analyzed to determine their
significance and relevance to operations, and
o a plant modification program to ensure that modifications important to
safety are implemented in a timely manner.
As at other commercial nuclear power plants, NRC conducted routine,
baseline inspections of Davis-Besse to determine the effectiveness of
these programs. Reports documenting these inspections noted incidences of
boric acid leakage, corrosion, and deposits. However, between February
1997 and March 2000, the regional office's assessment of the licensee's
performance addressed leakage in the reactor coolant system only once and
never noted the other indications. Furthermore, Davis-Besse was not
23Before adopting the Reactor Oversight Process, NRC also assessed
licensee performance based on inspection results and other information;
however, NRC did not assign color codes to assessment results.
the subject of intense scrutiny in regional plant assessment meetings
because plants perceived as good performers-such as Davis-Besse- received
substantially less attention. Between April 2000-when NRC's revised
assessment process took effect-until the corrosion was discovered in March
2002, none of NRC's assessments of Davis-Besse's performance noted leakage
or other indications of corrosion at the plant. As a result, NRC may have
missed opportunities to identify weaknesses in the Davis-Besse programs
intended to detect or prevent the corrosion.
After the corrosion was discovered, NRC analyzed the problems that led to
the corrosion on the reactor vessel head and concluded that FirstEnergy's
programs for overseeing safety at Davis-Besse were weak, as seen in the
following examples:
o Davis-Besse's corrective action program did not result in timely or
effective actions to prevent indications of leakage from reoccurring in
the reactor coolant system.
o FirstEnergy officials did not always enter equipment problems into the
corrective action program because individuals who had identified the
problem were often responsible for resolving it.
o For over a decade, FirstEnergy had delayed plant modifications to its
service structure platform, primarily because of cost. These modifications
would have improved its ability to inspect the reactor vessel head
nozzles. As a result, FirstEnergy could conduct only limited visual
inspections and cleaning of the reactor pressure vessel head through the
small "mouse-holes" that perforated the service structure.
NRC was also unaware of the extent to which various aspects of
FirstEnergy's safety culture had degraded-that is, FirstEnergy's
organization and performance related to ensuring safety at Davis-Besse.
This degradation had allowed the incident to occur with no forewarning
because NRC's inspections and performance indicators do not directly
assess safety culture. Safety culture is a group of characteristics and
attitudes within an organization that establish, as an overriding
priority, that issues affecting nuclear plant safety receive the attention
their significance warrants. Following FirstEnergy's March 2002 discovery,
NRC found numerous indications that FirstEnergy emphasized production over
plant safety. First, Davis-Besse routinely restarted the plant following
an outage, even though reactor pressure vessel valves and control rod
drive mechanisms leaked. Second, staff was unable to remove all of the
boric
acid deposits from the reactor pressure vessel head because FirstEnergy's
schedule to restart the plant dictated the amount of work that could be
performed. Third, FirstEnergy management was willing to accept degraded
equipment, which indicated a lack of commitment to resolve issues that
could potentially compromise safety. Fourth, Davis-Besse's program that
was intended to ensure that employees feel free to raise safety concerns
without fear of retaliation had several weaknesses. For example, in one
instance, a worker assigned to repair the containment air conditioner was
not provided a respirator in spite of his concerns that he would inhale
boric acid residue. According to NRC's lessons-learned task force report,
NRC was not aware of weaknesses in this program because its inspections
did not adequately assess it.
Given that FirstEnergy concluded that one of the causes for the
Davis-Besse incident was human performance and management failures, the
panel overseeing FirstEnergy's efforts to restart Davis-Besse requested
that FirstEnergy assess its safety culture before allowing the plant to
restart. To oversee FirstEnergy's efforts to improve its safety culture,
NRC (1) reviewed whether FirstEnergy had adequately identified all of the
root causes for management and human performance failures at Davis-Besse,
(2) assessed whether FirstEnergy had identified and implemented
appropriate corrective actions to resolve these failures, and (3) assessed
whether FirstEnergy's corrective actions were effective. As late as
February 2004, NRC had concerns about whether FirstEnergy's actions would
be adequate in the long term. As a result, the Davis-Besse safety culture
was one of the issues contributing to the delay in restarting the plant.
In March 2004, NRC's panel concluded that FirstEnergy's efforts to improve
its safety culture were sufficient to allow the plant to restart. In doing
so, however, NRC officials stated that one of the conditions the panel
imposed was for FirstEnergy to conduct an independent assessment of the
safety culture at Davis-Besse annually over the course of the next 5
years.
NRC Did Not Effectively Incorporate Long-Standing Knowledge about
Corrosion, Nozzle Cracking, and Leak Detection into Its Oversight
NRC has been aware of boric acid corrosion and its potential to affect
safety since at least 1979. It issued several notices to the nuclear power
industry about boric acid corrosion and, specifically, the potential for
it to degrade the reactor coolant pressure boundary. In 1987, two
licensees found significant corrosion on their reactor pressure vessel
heads, which heightened NRC's concern. A subsequent industry study
concluded that concentrated solutions of boric acid could result in
unacceptably high corrosion rates-up to 4 inches per year-when primary
coolant leaks onto surfaces and concentrates at temperatures found on the
surface of the
reactor vessel.24 After considering this information and several more
instances of boric acid corrosion at plants, NRC issued a generic letter
in 1988 requesting licensees to implement boric acid corrosion control
programs.
In 1990, NRC visited Davis-Besse to assess the adequacy of the plant's
boric acid corrosion control program. At that time, NRC concluded that the
program was acceptable. However, in 1999, NRC became aware that
FirstEnergy's boric acid corrosion control program was inadequate because
boric acid had corroded several bolts on a valve, and NRC issued a
violation. As a result of the violation, FirstEnergy agreed to review its
boric acid corrosion procedures and enhance its program. NRC inspectors
evaluated FirstEnergy's completed and planned actions to improve the boric
acid corrosion control program and found them to be adequate. According to
NRC officials, they never inspected the remaining actions- assuming that
the planned actions had been implemented effectively. In 2000, NRC adopted
its new Reactor Oversight Process and discontinued its inspection
procedure for plants' corrosion control programs because these inspections
had rarely been conducted due to higher priorities. Thus, NRC had no
reliable or routine way to ensure that the nuclear power industry fully
implemented boric acid corrosion control programs.
NRC also did not routinely review operating experiences at reactors, both
in the United States and abroad, to keep abreast of boric acid
developments and determine the need to emphasize this problem. Indeed, NRC
did not fully understand the circumstances in which boric acid would
result in corrosion, rather than flash to steam. Similarly, NRC did not
know the rate at which carbon steel would corrode under different
conditions. This lack of knowledge may be linked to shortcomings in its
program to review operating experiences at reactors, which could have been
exacerbated by the 1999 elimination of the office specifically responsible
for reviewing operating experiences.25 This office was responsible for,
among other things, (1) coordinating operational data collection, (2)
24Westinghouse Electric Company, Corrosion Effects of Boric Acid Leakage
on Steel under Plant Operating Conditions-A Review of Available Data
(Pittsburgh: October 1987).
25NRC's Office for Analysis and Evaluation of Operating Data was
established in response to a recommendation that we made to the agency in
1978 that it have a systematic process for analyzing operating experience
and feeding this information back to licensees and the industry. NRC
eliminated this office, and its responsibilities were transferred to other
NRC offices in an effort to gain efficiencies.
systematically analyzing and evaluating operational experience, (3)
providing feedback on operational experience to improve safety, (4)
assessing the effectiveness of the agencywide program, and (5) acting as a
focal point for interaction with outside organizations on issues
pertaining to operational safety data analysis and evaluation. According
to NRC officials who had overseen Davis-Besse at the time of the incident,
they would not have suspected the reactor vessel head or cracked head
penetration nozzles as the source of the filter clogging and unidentified
leakage because they had not been informed that these could be potential
problems. According to these officials, the vessel head was "not on the
radar screen."
With regard to nozzle cracking, NRC, for more than two decades, was aware
of the potential for nozzles and other components made of alloy 600 to
crack. While cracks were found at nuclear power plants, NRC considered
their safety significance to be low because the cracks were not developing
rapidly. In contrast, other countries considered the safety significance
of such cracks to be much higher. For example, concern over alloy 600
cracking led France, as a preventive measure, to institute requirements
for an extensive nondestructive examination inspection program for vessel
head penetration nozzles, including the removal of insulation, during
every fuel outage. When any indications of cracking were observed, even
more frequent inspections were required, which, because of economic
considerations, resulted in the replacement of vessel heads when
indications were found. The effort to replace the vessel heads is still
under way. Japan replaced those vessel heads whose nozzles it considered
most susceptible to cracking, even though no cracks had yet been found.
Both France and Sweden also installed enhanced leakage monitoring systems
to detect leaks early. However, according to NRC, such systems cannot
detect the small amounts of leakage that may be typical from cracked
nozzles.
NRC recognized that an integrated, long-term program, including periodic
inspections and monitoring of vessel heads to check for nozzle cracking,
was necessary. In 1997, it issued a generic letter that summarized NRC's
efforts to address cracking of control rod drive mechanism nozzles and
requested information on licensees' plans to inspect nozzles at their
reactors. More specifically, this letter asked licensees to provide NRC
with descriptions of their inspections of these nozzles and any plans for
enhanced inspections to detect cracks. At that time, NRC was planning to
review this information to determine if enhanced licensee inspections were
warranted. Based on its review of this information, NRC concluded that the
current inspection program was sufficient. As a result, between 1998 and
2001, NRC did not issue or solicit additional information on nozzle
cracking or assess its requirements for inspecting reactor vessels to
determine whether they were sufficient to detect cracks. At Davis-Besse,
NRC also did not determine if FirstEnergy had plans or was implementing
any plans for enhanced nozzle inspections, as noted in the 1997 generic
letter. NRC took no further action until the cracks were found in 2001 at
the Oconee plant, in South Carolina. NRC attributed its lack of focus on
nozzle cracking, in part, to the agency's inability to effectively review,
assess, and follow up on industry operating experience events.
Furthermore, as with boric acid corrosion, NRC did not obtain or analyze
any new data about cracking that would have supported making changes in
either its regulations or inspections to better identify or prevent
corrosion on the vessel head at Davis-Besse.
NRC's technical specifications regarding allowable leakage rates also
contributed to the corrosion at Davis-Besse because the amount of leakage
that can cause extensive corrosion can be significantly less than the
level that NRC's specifications allow. According to NRC officials, NRC's
requirements, established in 1973, were based on the best available
technology at that time. The task of measuring identified and unidentified
leakage from the reactor coolant system is not precise. It requires
licensees to estimate the amount of coolant that the reactor is supposed
to contain and identify any difference in coolant levels. They then have
to account for the estimated difference in the actual amount of coolant to
arrive at a leakage rate; to do this, they identify all sources and
amounts of leakage by, among other things, measuring the amount of water
contained in various sump collection systems. If these sources do not
account for the difference, licensees know they have an unidentified
source of leakage. This estimate can vary significantly from day to day
between negative and positive numbers.
According to analyses that FirstEnergy conducted after it identified the
corrosion in March 2002, the leakage rates from the nozzle cracks were
significantly below NRC's reactor coolant system unidentified leakage rate
of 1 gallon per minute. Specifically, the leakage from the nozzle around
which the vessel head corrosion occurred was predicted to be 0.025 gallon
per minute. If such small leakage can result in such extensive corrosion,
identifying if and where such leakage occurs is important. NRC staff
recognized as early as 1993 it would be prudent for the nuclear power
industry to consider implementing an enhanced method for detecting small
leaks during plant operation, but NRC did not require this action, and the
industry has not taken steps to do so. Furthermore, NRC has not
consistently enforced its requirement for reactor coolant pressure
boundary leakage. As a result, the NRC Davis-Besse task force concluded
that inconsistent enforcement may have reinforced a belief that alloy 600
nozzle leakage was not actually or potentially a safety significant issue.
NRC's Process for Deciding Whether to Allow a Delayed Davis-Besse Shutdown
Lacked Credibility
Although FirstEnergy operated Davis-Besse without incident until shutting
it down in February 2002, certain aspects of NRC's deliberations allowing
the delayed shutdown raise questions about the credibility of the agency's
decision making, if not about the Davis-Besse decision itself. NRC does
not have specific guidance for deciding on plant shutdowns. Instead,
agency officials turned to guidance developed for a different
purpose-reviewing requests to amend license operating conditions-and even
then did not always adhere to this guidance. In addition, NRC did not
document its decision-making process, as called for by its guidance, and
its letter to FirstEnergy to lay out the basis for the decision-sent a
year after the decision-did not fully explain the decision. NRC's lack of
guidance, coupled with the lack of documentation, precludes us from
independently judging whether NRC's decision was reasonable. Finally, some
NRC officials stated that the shutdown decision was based, in part, on the
agency's probabilistic risk assessment (PRA) calculations of the risk that
Davis-Besse would pose if it delayed its shutdown and inspection. However,
as noted by our consultants, the calculations were flawed, and NRC's
decision makers did not always follow the agency's guidance for developing
and using such calculations.
NRC Did Not Have Specific Guidance for Deciding on Plant Shutdowns
NRC believed that Davis-Besse could have posed a potential safety risk
because it was, in all likelihood, failing to comply with NRC's technical
specification that no leakage occur in the reactor coolant pressure
boundary. Its belief was based on the following indicators of probable
leakage:
o All six of the other reactors manufactured by the same company as
Davis-Besse's reactor had cracked nozzles and identified leakage.26
o Three of these six reactors had identified circumferential cracking.
26Davis-Besse's manufacturer was the Babcock and Wilcox Company, which is
an operating unit of McDermott International.
o FirstEnergy had not performed a recent visual examination of all of its
nozzles.
Furthermore, a FirstEnergy manager agreed that cracks and leakage were
likely.
NRC has the authority to shut down a plant when it is clear that the plant
is in violation of important safety requirements, and it is clear that the
plant poses a risk to public health and safety.27 Thus, if a licensee is
not complying with technical specifications, such as those for no
allowable reactor vessel pressure boundary leakage, NRC can order a plant
to shut down. However, NRC decided that it could not require Davis-Besse
to shut down on the basis of other plants' cracked nozzles and identified
leakage or the manager's acknowledgement of a probable leak. Instead, it
believed it needed more direct, or absolute, proof of a leak to order a
shutdown. This standard of proof has been questioned. According to the
Union of Concerned Scientists,28 for example, if NRC needed irrefutable
proof in every case of suspected problems, the agency would probably never
issue a shutdown order. In effect, in this case NRC created a Catch-22: It
needed irrefutable proof to order a shutdown but could not get this proof
without shutting down the plant and requiring that the reactor be
inspected.
Despite NRC's responsibility for ensuring that the public is adequately
protected from accidents at commercial nuclear power plants, NRC does not
have specific guidance for shutting down a plant when the plant may pose a
risk to public health and safety, even though it may be complying with NRC
requirements. It also has no specific guidance or standards for quality of
evidence needed to determine that a plant may pose an undue risk. Lacking
direct or absolute proof of leakage at Davis-Besse, NRC instead drafted a
shutdown order on the basis that a potentially hazardous condition may
have existed at the plant. NRC had no guidance for developing such a
shutdown order, and therefore, it used its guidance for reviewing license
amendment requests. NRC officials recognized that this guidance was not
specifically designed to determine whether NRC should shut down a power
plant such as Davis-Besse. However, NRC officials
27Ordinarily, NRC would not suspend a license for a failure to meet a
requirement unless the failure was willful and adequate corrective action
had not been taken.
28The Union of Concerned Scientists is a nonprofit partnership of
scientists and citizens that augments scientific analyses and policy
development for identifying environmental solutions to issues such as
energy production.
stated that this guidance was the best available for deciding on a
shutdown because, although the review was not to amend a license, the
factors that NRC needed to consider in making the decision and that were
contained in the guidance were applicable to the Davis-Besse situation.
To use its guidance for reviewing license amendment requests, NRC first
determined that the situation at Davis-Besse posed a special circumstance
because new information revealed a substantially greater potential for a
known hazard to occur, even if Davis-Besse was in compliance with the
technical specification for leakage from the reactor coolant pressure
boundary. The special circumstance stemmed from NRC's determination that
requirements for conducting vessel head inspections were not sufficient to
detect nozzle cracking and, thus, small leaks.29 According to NRC
officials, this determination allowed NRC to use its guidance for
reviewing license amendment requests when deciding whether to order a
shutdown.
The Extent of NRC's Reliance on License Amendment Guidance Is Not Clear
Under NRC's license amendment guidance, NRC considers how the license
change affects risk, but not how it has previously assessed licensee
performance, such as whether the licensee was viewed as a good performer.
With regard to the Davis-Besse decision, the guidance directed NRC to
determine whether the plant would comply with five NRC safety principles
if it operated beyond December 2001 without inspecting the reactor vessel
head. As applied to Davis-Besse, these principles were whether the plant
would (1) continue to meet requirements for vessel head inspections, (2)
maintain sufficient defense-in-depth, (3) maintain sufficient safety
margins, (4) have little increase in the likelihood of a core damage
accident, and (5) monitor the vessel head and nozzles. The guidance,
however, does not specify how to apply these safety principles, how NRC
can demonstrate it has followed the principles and ensured they are met,
or whether any one principle takes precedence over the others. The
guidance also does not indicate what actions NRC or licensees should take
if some or all of the principles are not met.
29Specifically, reactor vessel head inspection requirements do not require
that insulation be removed. Because of this, reactor vessel head
inspections performed without removing the insulation above the vessel
head could not result in 100 percent of the nozzles being visually
inspected.
In mid-September 2001, NRC staff concluded that Davis-Besse complied with
the first safety principle but did not meet the remaining four. According
to the staff, Davis-Besse did not meet three safety principles because the
requirements for vessel head inspections were not adequate. Specifically,
the requirements do not require the inspector to remove the insulation
above the vessel head, and thus allow all of the nozzles to be visually
inspected. NRC therefore could not ensure that FirstEnergy was maintaining
defense-in-depth and adequate safety margins or sufficiently monitoring
the vessel head and nozzles. The staff believed that Davis-Besse did not
meet the fourth safety principle because the risk estimate of core damage
approached an unacceptable level and the estimate itself was highly
uncertain.
Between early October and the end of November 2001, NRC requested and
received additional information from FirstEnergy regarding its risk
estimate of core damage-its PRA estimate-and met with the company to
determine the basis for the estimate. NRC was also developing its own risk
estimate, although its numbers kept changing. At some point during this
time, NRC staff also concluded that the first safety principle was
probably not being met, although the basis for this conclusion is not
known.
At the end of November 2001, NRC contacted FirstEnergy and informed it
that a shutdown order had been forwarded to the NRC commissioners and
asked if FirstEnergy could take any actions that would persuade NRC to not
issue the shutdown order. The following day, FirstEnergy proposed measures
to mitigate the potential for and consequences of an accident. These
measures included, among other things, lowering the operating temperature
from 605 degrees Fahrenheit to 598 degrees Fahrenheit to reduce the
driving force for stress corrosion cracking on the nozzles, identifying a
specific operator to initiate emergency cooling in response to an
accident, and moving the scheduled refueling outage up from March 31,
2002, to no later than February 16, 2002. NRC staff discussed these
measures, and NRC management asked the staff if they were concerned about
extending Davis-Besse's operations until mid-February 2002. While some of
the staff were concerned about continued operations, none indicated to NRC
management that cracking in control rod drive mechanism nozzles was likely
extensive enough to cause a nozzle to eject from the vessel head, thus
making it unsafe to operate. NRC formally accepted FirstEnergy's
compromise proposal within several days, thus abandoning its shutdown
order.
NRC Did Not Fully Explain or Document the Basis for Its Decision
We could not fully assess NRC's basis for accepting FirstEnergy's
proposal. NRC did not document its deliberations, even though its guidance
requires that it do so. This documentation is to include the data,
methods, and assessment criteria used; the basis for the decisions made;
and essential correspondence sufficient to document the persons, places,
and matters dealt with by NRC. Specifically, the guidance requires that
the documentation contain sufficient detail to make possible a "proper
scrutiny" of NRC decisions by authorized outside agencies and provide
evidence of how basic decisions were formed, including oral decisions.
NRC's guidance also states that NRC should document all important staff
meetings.
In reviewing NRC's documentation on the Davis-Besse decision, we found no
evidence of an in-depth or formal analysis of how Davis-Besse's proposed
measures would affect the plant's ability to satisfy the five safety
principles. Thus, it is unclear whether the safety principles contained in
the guidance were met by the measures that FirstEnergy proposed. However,
several NRC officials stated that FirstEnergy's proposed measures had no
impact on plant operations or safety. For example, according to one NRC
official, FirstEnergy's proposal to reduce the operating temperature would
have had little impact on safety because the small drop in operating
temperature over a 7-week period would have had little effect on the
growth rate of any cracks in a nozzle. As such, this official considered
the measures as "window dressing." A proposed measure that NRC staff did
consider as having a significant impact on the risk was for FirstEnergy to
dedicate an operator for manually turning on safety equipment in the event
that a nozzle was ejected. Subsequent to approving the delayed shutdown,
NRC learned that FirstEnergy had not, in fact, planned to dedicate an
operator for this task-rather, FirstEnergy planned to have an operator do
this task in addition to other regularly assigned duties.
According to an NRC official, once NRC decided not to issue a shutdown
order for December 2001, NRC staff needed to discuss how NRC's assessment
of whether the five safety principles had been met had changed in the
course of the staff's deliberations. However, there was no evidence in the
agency's records to support that this discussion was held, and other key
meetings, such as the one in which the agency made its decision to allow
Davis-Besse to operate past December 31, 2001, were not documented.
Without documentation, it is not clear what factors influenced NRC's
decision. For example, according to the NRC Office of the Inspector
General's December 2002 report that examined the Davis-Besse incident,
NRC's decision was driven in large part by a desire to lessen the
financial
impact on FirstEnergy that would result from an early shutdown.30 While
NRC disputed this finding, we found no evidence in the agency's records to
support or refute its position.
In December 2001, when NRC informed FirstEnergy that it accepted the
company's proposed measures and the February 16, 2002, shutdown date, it
also said that the company would receive NRC's assessment in the near
future. However, NRC did not provide the assessment until a full year
later-in December 2002. In addition, the December 2002 assessment, which
includes a four-page evaluation, does not fully explain how the safety
principles were used or met-other than by stating that if the likelihood
of nozzle failure were judged to be small, then adequate protection would
be ensured. Even though NRC's regulations regarding the reactor coolant
pressure boundary dictate that the reactor have an extremely low
probability of failing, NRC stated it did not believe that Davis-Besse
needed to demonstrate strict conformance with this regulation. As evidence
of the small likelihood of failure, NRC cited the small size of cracks
found at other power plants, as well as its preliminary assessment of
nozzle cracking, which projected crack growth rates. NRC concluded that 7
weeks of additional operation would not result in an appreciable increase
in the size of the cracks.31 While NRC included its calculated estimates
of the risk that Davis-Besse would pose, it did not detail how it
calculated its estimates.
NRC's PRA Estimate Was Flawed and Its Use in Deciding to Delay the
Shutdown Is Unclear
In moving forward with its more risk-informed regulatory approach, NRC has
established a policy to increase the use of PRA methods as a means to
promote regulatory stability and efficiency. Using PRA methods, NRC and
the nuclear power industry can estimate the likelihood that different
accident scenarios at nuclear power plants will result in reactor core
damage and a release of radioactive materials. For example, one of these
accident scenarios begins with a "medium break" loss-of-coolant accident
in which the reactor coolant system is breached and a midsize-about 2- to
4-inch-hole is formed that allows coolant to escape from the reactor
30NRC, Office of the Inspector General, NRC's Regulation of Davis-Besse
Regarding Damage to the Reactor Vessel Head (Washington, D.C.; Dec. 30,
2002).
31NRC, Preliminary Staff Technical Assessment for Pressurized Water
Reactor Vessel Head Penetration Nozzles Associated with NRC Bulletin
2001-01, "Circumferential Cracking of Reactor Pressure Vessel Head
Penetration Nozzles" (Washington, D.C.; Nov. 6, 2001).
pressure boundary. The probability of such an accident scenario occurring
and the consequences of that accident take into account key engineering
safety system failure rates and human error probabilities that influence
how well the engineered systems would be able to mitigate the consequences
of an accident and ensure no radioactive release from the plant.
For Davis-Besse, NRC needed two estimates: one for the frequency of a
nozzle ejecting and causing a loss-of-coolant accident and one for the
probability that a loss-of-coolant accident would result in core damage.
NRC first established an estimate, based partially on information provided
by FirstEnergy, for the frequency of a plant developing a cracked nozzle
that would initiate a medium break loss-of-coolant accident. NRC estimated
that the frequency of this occurring would be about 2x10-2, or 1 chance in
50,32 per year. NRC then used an estimate, which FirstEnergy provided, for
the probability of core damage given a medium break loss-ofcoolant
accident. This probability estimate was 2.7x10-3, or about 1 chance in
370.33 Multiplying these two numbers, NRC estimated that the potential for
a nozzle to crack and cause a loss-of-coolant accident would increase the
frequency of core damage at Davis-Besse by about 5.4x10-5 per year, or
about 1 in 18,500 per year.34 Converting this frequency to a probability
associated with continued operation for 7 weeks, NRC calculated that the
increase in the probability of core damage was approximately 5x10-6, or 1
chance in 200,000.35 While NRC officials currently disagree that this was
the number it used, this is the number that it included in its December
2002 assessment provided to FirstEnergy. Further, we found no evidence in
the agency's records to support NRC's current assertion.
According to our consultants, the way NRC calculated and used the PRA
estimate was inadequate in several respects. (See app. II for the
consultants' detailed report.) First, NRC's calculations did not take into
32Here is how to calculate the frequency estimate: 2x10-2 equates to 0.02,
or 2/100, which equals 1/50.
33Here is how to calculate the probability estimate: 2.7x10-3 equates to
0.0027, or 27/10,000, which equals 1/370.37.
34Here is how to calculate the frequency estimate: 5.4x10-5 equates to
0.000054, or 54/1,000,000, which equals 1/18,518.52.
35Here is how to calculate the probability estimate: 5x10-6 equates to
0.000005, or 5/1,000,000, which equals 1/200,000.
account several factors, such as the possibility of corrosion and axial
cracking that could lead to leakage. For example, the consultants
concluded that NRC's estimate of risk was incorrectly too small, primarily
because the calculation did not consider corrosion of the vessel head. In
reviewing how NRC developed and used its PRA estimates for Davis-Besse,
our consultants noted that the calculated risk was smaller than it should
have been because the calculations did not consider corrosion of the
reactor vessel from the boric acid coolant leaking through cracks in the
nozzles. According to the consultants, apparently all NRC staff involved
in the Davis-Besse decision were aware that coolant under high pressure
was leaking from valves, flanges, and possibly from cracks but evidently
thought that the coolant would immediately flash into steam and
noncorrosive compounds of boric acid. Our consultants, however, stated
that because boric acid could potentially cause corrosion, except at
temperatures much higher than 600 degrees Fahrenheit, NRC should have
anticipated that corrosion could occur. Our consultants further stated
that as evaporation occurs, boric acid becomes more concentrated in the
remaining liquid-making it far more corrosive-and as vapor pressure
decreases, evaporation is further slowed. They said it should be expected
that some of the boric acid in the escaping coolant could reach the metal
surfaces as wet or moist, highly corrosive material underlying the surface
layers of dry noncorrosive boric acid, which is evidently what happened at
Davis-Besse.
Our consultants concluded that NRC staff should have been aware of the
experience at French nuclear power plants, where boric acid corrosion from
leaking reactor coolant had been identified during the previous decade,
the safety significance had been recognized, and safety procedures to
mitigate the problem had been implemented. Furthermore, tests had been
conducted by the nuclear power industry and in government laboratories on
boric acid corrosion that were widely available to NRC. They stated that
keeping abreast of safety issues at similar plants, whether domestic or
foreign, and conveying relevant safety information to licensees are
important functions of NRC's safety program. According to NRC, the agency
was aware of the experience at French nuclear power plants. For example,
NRC concluded, in a December 15, 1994, internal NRC memo, that primary
coolant leakage from a through-wall crack could cause boric acid corrosion
of the vessel head. However, because it concluded that some analyses
indicated that it would take at least 6 to 9 years before any corrosion
would challenge the structural integrity of the head, NRC concluded that
cracking was not a short-term safety issue.
Our consultants also stated that NRC's risk analysis was inadequate
because the analysis concerned only the formation and propagation of
circumferential cracks that could result in nozzle failure, loss of
coolant, and even control rod ejection. Although there is less chance of
axial cracks causing complete nozzle failure, these cracks open additional
pathways for coolant leakage. In addition, their long crevices provide
considerably greater opportunity for the coolant to concentrate near the
surface of the vessel head. However, according to our consultants, NRC was
convinced that the boric acid they saw resulted from leaking flanges above
the reactor vessel head, as opposed to axial cracks in the nozzles.
Second, NRC's analysis was inadequate because it did not include the
uncertainty of its risk estimate and use the uncertainty analysis in the
Davis-Besse decision-making process, although NRC staff should have
recognized large uncertainties associated with its risk estimate. Our
consultants also concluded that NRC failed to take into account the large
uncertainties associated with estimates of the frequency of core damage
resulting from the failure of nozzles. PRA estimates for nuclear power
plants are subject to significant uncertainties associated with human
errors and other common causes of system component failures, and it is
important that proper uncertainty analyses be performed for any PRA study.
NRC guidance and other NRC reports on advancing PRA technology for
risk-informed decisions emphasize the need to understand and characterize
uncertainties in PRA estimates. Our consultants stated that had the NRC
staff estimated the margin of error or uncertainty associated with its PRA
estimate for Davis-Besse, the uncertainty would likely have been so high
as to render the estimate of questionable value.
Third, NRC's analysis was inadequate because the risk estimates were
higher than generally considered acceptable under NRC guidance. Despite
PRA's important role in the decision, our consultants found that NRC did
not follow its own guidance for ensuring that the estimated risk was
within levels acceptable to the agency. NRC required the nuclear power
industry to develop a baseline estimate for how frequently a core damage
accident could occur at every nuclear power plant in the United States.
This baseline estimate is used as a basis for deciding whether changes at
a plant that affect the core damage frequency are acceptable. The baseline
core damage frequency estimate for the Davis-Besse plant was between
4x10-5
and 6.6x10-5 per year (which is between 1 chance in 25,00036 per year and
about 1 chance in 15,15037 per year). NRC guidance for reviewing and
approving license amendment requests indicates that any plant-specific
change resulting in an increase in the frequency of core damage of 1x10-5
per year (which is 1 chance in 100,000 per year) or more would fall within
the highest risk zone: In this case, NRC would generally not approve the
change because the risk criterion would not be met. If a license change
would result in a core damage frequency change of 1x10-5 per year to
1x10-6 per year (which is 1 chance in 100,000 per year to 1 chance in 1
million per year), the risk criterion would be considered marginally met
and NRC would consider approving the change but would require additional
analysis. Finally, if a license change would result in a core damage
frequency change of 1x10-6 per year (which is 1 chance in 1 million per
year) or less, the risk would fall within the lowest risk zone and NRC
would consider the risk criterion to be met and would generally consider
approving the change without requiring additional analysis. (See fig. 6.)
36Here is how to calculate the frequency estimate: 4x10-5 equates to
0.00004, or 4/100,000, which equals 1/25,000.
37Here is how to calculate the frequency estimate: 6.6x10-5 equates to
0.000066, or 66/1,000,000, which equals 1/15,151.51.
Figure 6: NRC's Acceptance Guidelines for Core Damage Frequency
aRisk criterion is met and license changes would generally be considered.
bRisk criterion is considered marginally met and while license changes are
generally considered, they require additional analysis.
cRisk criterion is not met and license changes are generally not allowed.
However, NRC's PRA estimate for Davis-Besse-an increase in the frequency
of core damage of 5.4x10-5, or 1 chance in about 18,500 per year-was
higher than the acceptable level. While an NRC official who helped develop
the risk estimate said that additional NRC and industry guidance was used
to evaluate whether its PRA estimate was acceptable, this guidance also
suggests that NRC's estimate was too high. NRC's estimate of the increase
in the frequency of core damage of 5.4x10-5 per year equates to an
increase in the probability of core damage of 5x10-6 , or 1 chance in
200,000, for the 7-week period December 31, 2001, to February 16, 2002.35
NRC's guidance for evaluating requests to relax NRC technical
specifications suggests that a probability increase higher than 5x10-7, or
1 chance in 2 million38, is considered unacceptable for relaxing the
specifications. Thus, NRC's estimate would not be considered acceptable
38Here is how to calculate the probability estimate: 5x10-7 equates to
0.0000005, or 5/10,000,000, which equals 1/2,000,000.
under this guidance. NRC's estimate would also not be considered
acceptable under Electric Power Research Institute or Nuclear Energy
Institute guidance unless further action were taken to evaluate or manage
risk. According to NRC officials, NRC viewed its PRA estimate as being
within acceptable bounds because it was a temporary situation-7 weeks-and
NRC had, at other times, allowed much higher levels of risk at other
plants. However, at the time that NRC made its decision, it did not
document the basis for accepting this risk estimate, even though NRC's
guidance explicitly states that the decision on whether PRA results are
acceptable must be based on a full understanding of the contributors to
the PRA results and the reasoning must be well documented. In defense of
its decision, NRC officials said that the process they used to arrive at
the decision is used to make about 1,500 licensing decisions such as this
each year.
Lastly, NRC's analysis was inadequate because the agency does not have
clear guidance for how PRA estimates are to be used in the decisionmaking
process. Our consultants concluded that NRC's process for riskinformed
decision making is ill-defined, lacks guidelines for how it is supposed to
work, and is not uniformly transparent within NRC. According to NRC
officials involved in the Davis-Besse decision, NRC's guidance is not
clear on the use of PRA in the decision-making process. For example, while
NRC has extensive guidance, this guidance does not outline to what extent
or how the resultant PRA risk number and uncertainty should be weighed
with respect to the ultimate decision. One factor complicating this issue
is the lack of a predetermined methodology to weigh risks expressed in PRA
numbers against traditional deterministic results and other factors.39
Absent this guidance, the value assigned to the PRA analysis is largely at
the discretion of the decision maker. The process, which NRC stated is
robust, can result in a decision in which PRA played no role, a partial
role, or one in which it was the sole deciding factor. According to our
consultants, this situation is made worse by the lack of guidelines for
how, or by whom, decisions in general are made at NRC.
It is not clear how NRC staff used the PRA risk estimate in the
Davis-Besse decision-making process. For example, according to one NRC
official who
39The deterministic approach considers a set of safety challenges and how
those challenges should be mitigated through engineering safety margins
and quality assurance standards. The probabilistic approach extends this
by allowing for the consideration of a broader set of safety challenges,
prioritizing safety challenges based on risk significance, and allowing
for a broader set of mitigation mechanisms.
was familiar with some of the data on nozzle cracking, these data were not
sufficient for making a good probabilistic decision. He stated that he
favored issuing an order requiring that Davis-Besse be shut down by the
end of December 2001 because he believed the available data were not
sufficient to assure a low enough probability for a nozzle to be ejected.
Other officials indicated that they accepted FirstEnergy's proposed
February 16, 2002, shutdown date based largely on NRC's PRA estimate for a
nozzle to crack and be ejected. According to one of these officials,
allowing the additional 7 weeks of operating time was not sufficiently
risk significant under NRC's guidance. He stated that safety margins at
the plant were preserved and the PRA number was within an acceptable
range. Still another official said he discounted the PRA estimate and did
not use it at all when recommending that NRC accept FirstEnergy's
compromise proposal. This official also stated that it was likely that
many of the staff did base their conclusions on the PRA estimate.
According to our consultants, although the extent to which the PRA risk
analysis influenced the decision making will probably never be known, it
is apparent that it did play an important role in the decision to allow
the shutdown delay.
NRC Has Made Progress in Implementing Recommended Changes, but Is Not
Addressing Important Systemic Issues
NRC has made significant progress in implementing the actions recommended
by the Davis-Besse lessons-learned task force. While NRC has implemented
slightly less than half-21 of the 51-recommendations as of March 2004, it
is scheduled to have more than 70 percent of them implemented by the end
of 2004. For example, NRC has already taken actions to improve staff
training and inspections that would appear to help address the concern
that NRC inspectors viewed FirstEnergy as a good performer and thus did
not subject Davis-Besse to the level of scrutiny or questioning that they
should have. It is not certain when actions to implement the remaining
recommendations will occur, in part because of resource constraints. NRC
also faces challenges in fully implementing the recommendations, also in
part because of resource constraints, both in the staff needed to develop
specific corrective actions and in the additional staff responsibilities
and duties to carry them out. Further, while NRC is making progress, the
agency is not addressing three systemic issues highlighted by the
Davis-Besse experience: (1) an inability to detect weakness or
deterioration in FirstEnergy's safety culture, (2) deficiencies in NRC's
process for deciding on a shutdown, and (3) lack of management controls to
track, on a longer-term basis, the effectiveness of actions implemented in
response to incidents such as Davis-Besse, so that they do not occur at
another power plant.
NRC Does Not Expect to Complete Its Actions until 2006, in Part Because of
Resource Constraints
NRC's lessons-learned task force for Davis-Besse developed 51
recommendations to address the weaknesses that contributed to the
Davis-Besse incident. Of these 51 recommendations, NRC rejected 2 because
it concluded that agency processes or procedures already provided for the
recommendations' intent to be effectively carried out.40 To address the
remaining 49 recommendations, NRC developed a plan in March 2003 that
included, for each recommendation, the actions to be taken, the
responsible NRC office, and the schedule for completing the actions. When
developing its schedule, NRC placed the highest priority on implementing
recommendations that were most directly related to the underlying causes
of the Davis-Besse incident as well as those recommendations responding to
vessel head corrosion. NRC assigned a lower priority to the remaining
recommendations, which were to be integrated into the planning activities
of those NRC offices assigned responsibility for taking action on the
recommendations. In assigning these differing priorities, NRC officials
stated they recognized that the agency has many other pressing matters to
address that are not related to the Davis-Besse incident, such as renewing
operating licenses, and they did not want to divert resources away from
these activities. (App. III contains a complete list of the task force's
recommendations, NRC actions, and the status of the recommendations as of
March 2004.)
To better track the status of the agency's actions to implement the
recommendations, we split two of the 49 recommendations that NRC accepted
into 4; therefore, our analysis reflects NRC's response to 51
recommendations. As shown in table 1, as of March 2004, NRC had made
progress in implementing the recommendations, although some completion
dates have slipped.
40These two recommendations were for NRC to (1) review how industry
considers economic factors in making decisions to repair equipment and
consider these factors in developing guidance for nonvisual inspections of
vessel head penetration nozzles, and (2) revise the criteria for reviewing
industry topical reports that have not been formally submitted to NRC for
review but that have generic safety implications.
Table 1: Status of Davis-Besse Lessons-Learned Task Force Recommendations,
as of March 2004
Number of Status recommendations
Completed as of March 2004
Scheduled for completion April through December 2004
Scheduled for completion in 2005
Completion date yet to be determined
Total
Source: GAO analysis of NRC data.
Note: This table does not include the two recommendations NRC rejected.
As the table shows, as of March 2004, NRC had implemented 21
recommendations and scheduled another 17 for completion by December 2004.
However, some slippage has already occurred in this schedule- primarily
because of resource constraints-and NRC has rescheduled completion of some
recommendations. NRC's time frames for completing the recommendations
depend on several factors-the recommendations' priority, the amount of
work required to develop and implement actions, and the need to first
complete actions on other related recommendations.
Of the 21 implemented recommendations, 10 called upon NRC to revise or
enhance its inspection guidance or training. For example, NRC revised the
guidance it uses to assess the implementation of licensees' programs to
identify and resolve problems before they affect operations. It took this
action because the task force had concluded that FirstEnergy's weak
corrective action program implementation was a major contributor to the
Davis-Besse incident. NRC has also developed Web-based training modules to
improve NRC inspectors' knowledge of boric acid corrosion and nozzle
cracking. The other 11 completed recommendations concerned actions such as
o collecting and analyzing foreign and domestic information on alloy 600
nozzle cracking,
o fully implementing and revising guidance to better assure that
licensees carry out their commitments to make operational changes, and
o establishing measurements for resident inspector staffing levels and
requirements.
By the end of 2004, NRC expects to complete another 17 recommendations, 12
of which generally address broad oversight or programmatic issues, and 5
of which provide for additional inspection guidance and training. On the
broader issues, for example, NRC is scheduled to complete a review of the
effectiveness of its response to past NRC lessons-learned task force
reports by April 2004. By December 2004, NRC expects to have a framework
established for moving forward with implementing recommended improvements
to its agencywide operating experience program.
In 2005, 4 of the 6 recommendations scheduled for completion concern
leakage from the reactor coolant system. For example, NRC is to (1)
develop guidance and criteria for assessing licensees' responses to
increasing leakage levels and (2) determine whether licensees should
install enhanced systems to detect leakage from the reactor coolant
system. The fifth recommendation calls for NRC to inspect the adequacy of
licensees' programs for controlling boric acid corrosion, and the final
recommendation calls on NRC to assess the basis for canceling a series of
inspection procedures in 2001.
NRC did not assign completion dates to 7 recommendations because, among
other things, their completion depends on completing other recommendations
or because of limited resources. Even though it has not assigned
completion dates for these recommendations, NRC has begun to work on 5 of
the 7:
o Two recommendations will be addressed when requirements for vessel head
inspections are revised. To date, NRC has taken some related, but
temporary, actions. For example, since February 2003, it has required
licensees to more extensively examine their reactor vessel heads. NRC has
also issued a series of temporary instructions for NRC inspectors to
oversee the enhanced examinations. NRC expects to replace these temporary
steps with revised requirements for vessel head inspections.
o Two recommendations call upon NRC to revise requirements for detecting
leaks in the reactor coolant pressure boundary. In response, NRC has, for
example, begun to review its barrier integrity requirements and has
contracted for research on enhanced detection capabilities.
o One recommendation is directed at improving follow-up of licensee
actions taken in response to NRC generic communications. NRC is currently
developing a temporary inspection procedure to assess the effectiveness of
licensee actions taken in response to generic
communications. Additionally, as a long-term change in the operating
experience program, the agency plans to improve the verification of how
effective its generic communications are.
The remaining two recommendations address NRC's need to (1) evaluate the
adequacy of methods for analyzing the risks posed by passive components,
such as reactor vessels, and integrate these methods and risks into NRC's
decision-making process and (2) review a sample of plant assessments
conducted between 1998 and 2000 to determine if any identified plant
safety issues have not been adequately assessed. NRC has not yet taken
action on these recommendations.
Some recommendations will require substantial resources to develop and
implement. As a result, some implementation dates have slipped and some
plans in response to the recommendations have changed in scope. For
example, owing to resource constraints, NRC has postponed indefinitely the
evaluation of methods to analyze the risk associated with passive reactor
components such as the vessel head. Also, in part due to resource
constraints, NRC has reconceptualized its plan to review licensee actions
in response to previous generic communications, such as bulletins and
letters.
Staff resources will be strained because implementing the recommendations
adds additional responsibilities or duties-that is, more inspections,
training, and reviews of licensee reports. For example, NRC's revised
inspection guidance for more thorough examinations of reactor vessel heads
and nozzles, as well as new requirements for NRC oversight of licensees'
corrective action programs, will require at least an additional 200 hours
of inspection per reactor per year. As of February 2004, NRC was also
revising other inspection requirements that are likely to place additional
demands on inspectors' time. Thus, to respond to these increased demands,
NRC will either need to add inspectors or reduce oversight of other
licensee activities.
To its credit, in its 2004 budget plan, NRC increased the level of
resources for some inspection activities. However, it is not certain that
these increases will be maintained. The number of inspection hours has
fallen by more than one-third between 1995 and 2001. In addition, NRC is
aware that resident inspector vacancies are filled with staff having
varying levels of experience-from the basic level that would be expected
from a newly qualified inspector to the advanced level that is achieved
after several years' experience. According to the latest available data,
as of May 2003,
about 12 percent of sites had only one resident inspector; the remaining
88 percent had two inspectors of varying levels of experience. Because of
this situation, NRC augments these inspection resources with regional
inspectors and contractors to ensure that, at a minimum, its baseline
inspection program can be implemented throughout the year. Because of
surges in the demand for inspections, NRC in 2003 increased its use of
contractors and temporarily pulled qualified inspectors from other jobs to
help complete the baseline inspection program for every plant. According
to NRC, it did not expect to require such measures in 2004.
Similarly, NRC may require additional staff to identify and evaluate
plants' operating experiences and communicate the results to licensees, as
the task force recommended. NRC has currently budgeted an increase of
three full-time staff in fiscal year 2006 to implement a centralized
system, or clearinghouse, for managing the operating experience program.
However, according to an NRC official, questions remain about the level of
resources needed to fully implement the task force recommendations. NRC's
operating experience office, before it was disbanded in 1999, had about 33
staff whose primary responsibility was to collect, evaluate, and
communicate activities associated with safety performance trends, as
reflected in licensees' operating experiences, and participate in
developing rulemakings. However, it is too early to know the effectiveness
of this clearinghouse approach and the adequacy of resources in the other
offices available for collecting and analyzing operating experience
information. Neither the operating experience office before it was
disbanded nor the other offices flagged boric acid corrosion, cracking, or
leakage as problems warranting significantly greater oversight by NRC,
licensees, or the nuclear power industry.
NRC Has Not Proposed Any Specific Actions to Correct Systemic Weaknesses
in Oversight and Decision-Making Processes
NRC's Task Force Recommendations Did Not Address Licensee Safety Culture
NRC's Davis-Besse task force did not make any recommendations to address
two systemic problems: evaluating licensees' commitment to safety and
improving the agency's process for deciding on a shutdown.
NRC's task force identified numerous problems at Davis-Besse that
indicated human performance and management failures and concluded that
FirstEnergy did not foster an environment that was fully conducive to
ensuring that plant safety issues received appropriate attention. Although
the task force report did not use the term safety culture, as evidence of
FirstEnergy's safety culture problems, the task force pointed to
o an imbalance between production and safety, as evidenced by
FirstEnergy's efforts to address symptoms (such as regular cleanup of
boric acid deposits) rather than causes (finding the source of the leaks
during refueling outages);
o a lack of management involvement in or oversight of work at Davis-Besse
that was important for maintaining safety;
o a lack of a questioning attitude by senior FirstEnergy managers with
regard to vessel head inspections and cleaning activities;
o ineffective and untimely corrective action;
o a long-standing acceptance of degraded equipment; and
o inadequate engineering rigor.
The task force concluded that NRC's implementation of guidance for
inspecting and assessing a safety-conscious work environment and employee
concerns programs failed to identify significant safety problems. Although
the task force did not make any specific recommendations that NRC develop
a means to assess licensees' safety culture, it did recommend changes to
focus more effort on assessing programs to promote a safetyconscious work
environment.
NRC has taken little direct action in response to this task force
recommendation. However, to help enhance NRC's capability to assess
licensee safety culture by indirect means, NRC modified the wording in,
and revised its inspection procedure for, assessing licensees' ability to
identify and resolve problems, such as malfunctioning plant equipment.
These revisions included requiring inspectors to
o review all licensee reports on plant conditions,
o analyze trends in plant conditions to determine the existence of
potentially significant safety issues, and
o expand the scope of their reviews to the prior 5 years in order to
identify recurring issues.
This problem identification and resolution inspection procedure is
intended to assess the end results of management's safety commitment
rather than the commitment itself. However, by measuring only the end
results, early signs of a deteriorating safety culture and declining
management performance may not be readily visible and may be hard to
interpret until clear violations of NRC's regulations occur. Furthermore,
because NRC directs its inspections at problems that it recognizes as
being more important to safety, NRC may overlook other problems until they
develop into significant and immediate safety problems. Conditions at a
plant can quickly degrade to the extent that they can compromise public
health and safety.
The International Atomic Energy Agency and its member nations have
developed guidance and procedures for assessing safety culture at nuclear
power plants, and today several countries, such as Brazil, Canada,
Finland, Sweden, and the United Kingdom, assess plant safety culture or
licensees' own assessments of their safety culture.41 In assessing safety
culture, an advisory group to the agency suggests that regulatory agencies
examine whether, for example, (1) employee workloads are not excessive,
(2) staff training is sufficient, (3) responsibility for safety has been
clearly assigned within the organization, (4) the corporation has clearly
communicated its safety policy, and (5) managers sufficiently emphasize
safety during plant meetings. One reason for assessing safety culture,
according to the Canadian Nuclear Safety Commission, is because management
and human performance aspects are among the leading causes of unplanned
events at licensed nuclear facilities, particularly in light of pressures
such as deregulation of the electricity market. Finland specifically
requires that nuclear power plants maintain an advanced safety culture and
its inspections target the importance that has been embedded in factors
affecting safety, including management. NRC had begun considering methods
for assessing organizational factors, including safety culture, but in
1998, NRC's commissioners decided that the agency should have a
performance-based inspection program of overall plant performance and
should infer licensee management performance and competency from the
results of that program. They chose this approach instead of one of four
other options:
41The International Atomic Energy Agency is an international organization
affiliated with the United Nations that provides advice and assistance to
its members on nuclear safety matters.
o conduct performance-based inspections in all areas of facility
operation and design, but not infer or articulate conclusions regarding
the performance of licensee management;
o assess the performance of licensee management through targeted
operations-based inspections using specific inspection procedures, trained
staff, and contractors to assess licensee management-a task that would
require the development of inspection procedures and significant
training-and to document inspection results;
o assess the performance of licensee management as part of the routine
inspection program by specifically evaluating and documenting management
performance attributes-a larger effort that would require the development
of assessment tools to evaluate safety culture as well as additional
resources; or
o assess the competency of licensee management by evaluating management
competency attributes-an even larger effort that would require that
implementation options and their impacts be assessed.
When adopting the proposal to infer licensee management performance from
the results of its performance-based inspection program, NRC eliminated
any resource expenditures specifically directed at developing a systematic
method of inferring management performance and competency. NRC stated that
it currently has a number of means to assess safety culture that provide
indirect insights into licensee safety culture. These means include, for
example, (1) insights from augmented inspection teams, (2) lessons-learned
reviews, and (3) information obtained in the course of conducting
inspections under the Reactor Oversight Process. However, insights from
augmented inspection teams and lessons-learned reviews are reactionary and
do not prevent problems such as those that occurred at Davis-Besse.
Further, before the Davis-Besse incident, NRC assumed its oversight
process would adequately identify problems with licensees' safety culture.
However, NRC has no formalized process for collectively assessing
information obtained in the course of its problem identification and
resolution inspection to ensure that individual inspection results would
identify poor management performance. NRC stated that its licensee
assessments consider inputs such as inspection results and insights,
correspondence to licensees related to inspection observations, input from
resident inspectors, and the results of any special investigations.
However, this information may not be sufficient to inform NRC of problems
at a plant in advance of these problems becoming safety significant.
In part because of Davis-Besse, NRC's Advisory Committee on Reactor
Safeguards42 recommended that NRC again pursue the development of a
methodology for assessing safety culture. It also asked NRC to consider
expanding research to identify leading indicators of degradation in human
performance and work to develop a consistent comprehensive methodology for
quantifying human performance. During an October 2003 public meeting of
the advisory committee's Human Performance Subcommittee, the
subcommittee's members again reiterated the need for NRC to assess safety
culture. Specifically, the members recognized that certain aspects of
safety culture, such as beliefs, perceptions, and management philosophies,
are ultimately the nuclear power industry's responsibility but stated that
NRC should deal with patterns of behavior and human performance, as well
as organizational structures and processes. At this meeting, NRC officials
discussed potential safety culture indicators that NRC could use,
including, among other things, how many times a problem recurs at a plant,
timeliness in correcting problems, number of temporary modifications, and
individual program and process error rates. Committee members recommended
that NRC test various safety culture indicators to determine whether (1)
such indicators should ultimately be incorporated into the Reactor
Oversight Process and (2) a significance determination process could be
developed for safety culture. As of March 2004, NRC had yet to respond to
the advisory committee's recommendation.
Despite the lack of action to address safety culture issues, NRC's concern
over FirstEnergy's safety culture at Davis-Besse was one of the last
issues resolved before the agency approved Davis-Besse's restart. NRC
undertook a series of inspections to examine Davis-Besse's safety culture
and determine whether FirstEnergy had (1) correctly identified the
underlying causes associated with its declining safety culture, (2)
implemented appropriate actions to correct safety culture problems, and
(3) developed a process for monitoring to ensure that actions taken were
effective for resolving safety culture problems. In December 2003, NRC
noted significant improvements in the safety culture at Davis-Besse, but
expressed concern with the sustainability of Davis-Besse's performance in
this area. For example, a survey of FirstEnergy and contract employees
conducted by FirstEnergy in November 2003 indicated that about 17
42The Advisory Committee on Reactor Safeguards is an independent committee
comprising nuclear experts that advises NRC on matters of licensing and
safety-related issues, and provides technical advice to aid the NRC
commissioners' decision-making process.
percent of employees believed that management cared more about cost and
schedule than resolving safety and quality issues-again, production over
safety.
NRC's Task Force NRC's task force also did not analyze NRC's process for
deciding not to Recommendations Did Not order a shutdown of the
Davis-Besse plant. It noted that NRC's written Address NRC's
Decision-Making rationale for accepting FirstEnergy's justification for
continued plant Process operation had not yet been prepared and
recommended that NRC change
guidance requiring NRC to adequately document such decisions. It also made
a recommendation to strengthen guidance for verifying information provided
by licensees. According to an NRC official on the task force, the task
force did not assess the decision-making process in detail because the
task force was charged with determining why the degradation at Davis-Besse
was not prevented and because NRC had coordinated with NRC's Office of the
Inspector General, which was reviewing NRC's decision making.
NRC's Failure to Track the Resolution of Identified Problems May Allow the
Problems to Recur
The NRC task force conducted a preliminary review of prior lessonslearned
task force reports to determine whether they suggested any recurring or
similar problems. As a result of this preliminary review, the task force
recommended that a more detailed review be conducted to determine if
actions that NRC took as a result of those reviews were effective. These
previous task force reports included: Indian Point 2 in Buchanan, New
York, in February 2000; Millstone in Waterford, Connecticut, in October
1993; and South Texas Project in Wadsworth, Texas, from 1988 to 1994.43
NRC's more detailed review, as of May 2004, was still under way. We also
reviewed these reports to determine whether they suggested any recurring
problems and found that they highlighted broad areas of continuing
programmatic weaknesses, as seen in the following examples:
o Inspector training and information sharing. All three of the other task
forces also identified inspector training issues and problems with
information collection and sharing. The Indian Point task force called
43NRC formed the Indian Point lessons-learned task force in response to a
steam-generatortube rupture that forced a reactor shutdown. NRC formed the
Millstone lessons-learned task force because the plant operated outside
its design standards while refueling. NRC formed the South Texas task
force in response to concerns about the effectiveness of NRC's inspection
program and the adequacy of the licensee's employee concerns program.
upon NRC to develop a process for promptly disseminating technical
information to NRC inspectors so that they can review and apply the
information in their inspection program.
o Oversight of licensee corrective action programs. Two of the three task
forces also identified inadequate oversight of licensee corrective action
programs. The South Texas task force recommended improving assessments of
licensees' corrective action programs to ensure that NRC identifies
broader licensee problems.
o Better identification of problems. Two of the three task force reports
also noted the need for NRC to develop a better process for identifying
problem plants, and one report noted the need for NRC inspectors to more
aggressively question licensees' activities.
Over the past two decades, we have also reported on underlying causes
similar to those that contributed, in part, to the incident at
Davis-Besse. (See Related GAO Products.) For example, with respect to the
safety culture at nuclear power plants, in 1986, 1995, and 1997, we
reported on issues relevant to NRC assessing plant management so that
significant problems could be detected and corrected before they led to
incidents such as the one that later occurred at Davis-Besse. Regardless
of our 1997 recommendation that NRC require that the assessment of
management's competency and performance be a mandatory component of NRC's
inspection process, NRC subsequently withdrew funding to accomplish this.
In terms of inspections, in 1995 we reported that NRC, itself, had
concluded that the agency was not effectively integrating information on
previously identified and long-standing issues to determine if the issues
indicated systemic weaknesses in plant operations. This report further
noted that NRC was not using such information to focus future inspection
activities. In 1997 and 2001, we reported on weaknesses in NRC's
inspections of licensees' corrective action programs. Finally, with
respect to learning from plants' operating experiences, in 1984 we noted
that NRC needed to improve its methods for consolidating information so
that it could evaluate safety trends and ensure that generic issues are
resolved at individual plants. These recurring issues indicate that NRC's
actions, in response to individual plant incidents and recommendations to
improve oversight, are not always institutionalized.
NRC guidance requires that resolutions to action plans be described and
documented, and while NRC is monitoring the status of actions taken in
response to Davis-Besse task force recommendations and preparing
quarterly and semiannual reports on the status of actions taken, the
Davis-Besse action plan does not specify how long NRC will monitor them.
It also does not describe how long NRC will prepare quarterly and
semiannual status reports, even though, according to NRC officials, these
semiannual status reports will continue until all items are completed and
the agency is required to issue a final summary report. The plan also does
not specify what criteria the agency will use to determine when the
actions in response to specific task force recommendations are completed.
Furthermore, NRC's action plan does not require NRC to assess the
long-term effectiveness of recommended actions, even though, according to
NRC officials, some activities already have an effectiveness review
included. As in the past and in response to prior lessons-learned task
force reports and recommendations, NRC has no management control in place
for assessing the long-term effectiveness of efforts resulting from the
recommendations. NRC officials acknowledged the need for a management
control, such as an agencywide tracking system, to ensure that actions
taken in response to task force recommendations effectively resolve the
underlying issue over the long term, but the officials have no plans to
establish such a system.
Conclusions It is unlikely, given the actions that NRC has taken to date,
that extensive reactor vessel corrosion will occur any time soon at
another domestic nuclear power plant. However, we do not yet have adequate
assurances from NRC that many of the factors that contributed to the
incident at Davis-Besse will be fully addressed. These factors include
NRC's failure to keep abreast of safety significant issues by collecting
information on operating experiences at plants, assessing their relative
safety significance, and effectively communicating information within the
agency to ensure that oversight is fully informed. The underlying causes
of the Davis-Besse incident underscore the potential for another incident
unrelated to boric acid corrosion or cracked control rod drive mechanism
nozzles to occur. This potential is reinforced by the fact that both prior
NRC lessons-learned task forces and we have found similar weaknesses in
many of the same NRC programs that led to the Davis-Besse incident. NRC
has not followed up on prior task force recommendations to assess whether
the lessons learned were institutionalized. NRC's actions to implement the
Davis-Besse lessons-learned task force recommendations, to be fully
effective, will require an extensive effort on NRC's part to ensure that
these are effectively incorporated into the agency's processes. However,
NRC has not estimated the amount of resources necessary to carry out these
recommendations, and we are concerned that resource limitations could
constrain their effectiveness. For this reason, it is important for NRC to
not
only monitor the implementation of Davis-Besse task force recommendations,
but also determine their effectiveness, in the long term, and the impact
that resource constraints may have on them. These actions are even more
important because the nation's fleet of nuclear power plants is aging.
Because the Davis-Besse task force did not address NRC's unwillingness to
directly assess licensee safety culture, we are concerned that NRC's
oversight will continue to be reactive rather than proactive. NRC's
oversight can result in NRC making a determination that a licensee's
performance is good one day, yet the next day NRC discovers the
performance to be unacceptably risky to public health and safety. Such a
situation does not occur overnight: Long-standing action or inaction on
the part of the licensee causes unacceptably risky and degraded
conditions. NRC needs better information to preclude such conditions.
Given the complexity of nuclear power plants, the number of physical
structures, systems, and components, and the manner in which NRC
inspectors must sample to assess whether licensees are complying with NRC
requirements and license specifications, it is possible that NRC will not
identify licensees that value production over safety. While we recognize
the difficulty in assessing licensee safety culture, we believe it is
sufficiently important to develop a means to do so.
Given the limited information NRC had at the time and that an accident did
not occur during the delay in Davis-Besse's shutdown, we do not
necessarily question the decision the agency made. However, we are
concerned about NRC's process for making that decision. It used guidance
intended to make decisions for another purpose, did not rigorously apply
the guidance, established an unrealistically high standard of evidence to
issue a shutdown order, relied on incomplete and faulty PRA analyses and
licensee evidence, and did not document key decisions and data. It is
extremely unusual for NRC to order a nuclear power plant to shut down.
Given this fact, it is more imperative that NRC have guidance to use when
technical specifications or requirements may be met, yet questions arise
over whether sufficient safety is being maintained. This guidance does not
need to be a risk-based approach, but rather a more structured
riskinformed approach that is sufficiently flexible to ensure that the
guidance is applicable under different circumstances. This is important
because NRC annually makes about 1,500 licensing decisions relating to
operating commercial nuclear power plants. While we recognize the
challenges NRC will face in developing such guidance, the large number and
wide variety of
decisions strongly highlight the need for NRC to ensure that its
decisionmaking process and decisions are sound and defensible.
Recommendations for Executive Action
To ensure that NRC aggressively and comprehensively addresses the
weaknesses that contributed to the Davis-Besse incident and could
contribute to problems at nuclear power plants in the future, we are
recommending that the NRC commissioners take the following five actions:
o Determine the resource implications of the task force's recommendations
and reallocate the agency's resources, as appropriate, to better ensure
that NRC effectively implements the recommendations.
o Develop a management control approach to track, on a long-term basis,
implementation of the recommendations made by the Davis-Besse
lessons-learned task force and future task forces. This approach, at a
minimum, should assign accountability for implementing each recommendation
and include information on the status of major actions, how each
recommendation will be judged as completed, and how its effectiveness will
be assessed. The approach should also provide for regular-quarterly or
semiannual-reports to the NRC commissioners on the status of and obstacles
to full implementation of the recommendations.
o Develop a methodology to assess licensees' safety culture that includes
indicators of and inspection information on patterns of licensee
performance, as well as on licensees' organization and processes. NRC
should collect and analyze this data either during the course of the
agency's routine inspection program or during separate targeted
assessments, or during both routine and targeted inspections and
assessments, to provide an early warning of deteriorating or declining
performance and future safety problems.
o Develop specific guidance and a well-defined process for deciding on
when to shut down a nuclear power plant. The guidance should clearly set
out the process to be used, the safety-related factors to be considered,
the weight that should be assigned to each factor, and the standards for
judging the quality of the evidence considered.
o Improve NRC's use of probabilistic risk assessment estimates in
decision making by (1) ensuring that the risk estimates, uncertainties,
and assumptions made in developing the estimates are fully defined,
documented, and communicated to NRC decision makers; and (2) providing
guidance to decision makers on how to consider the relative importance,
validity, and reliability of quantitative risk estimates in conjunction
with other qualitative safety-related factors.
Agency Comments and Our Evaluation
We provided a draft of this report to NRC for review and comment. We
received written comments from the agency's Executive Director for
Operations. In its written comments, NRC generally addressed only those
findings and recommendations with which it disagreed. Although commenting
that it agreed with many of the report's findings, NRC expressed an
overall concern that the report does not appropriately characterize or
provide a balanced perspective on NRC's actions surrounding the discovery
of the Davis-Besse reactor vessel head condition or NRC's actions to
incorporate the lessons learned from that experience into its processes.
Specifically, NRC stated that the report does not acknowledge that NRC
must rely heavily on its licensees to provide it with complete and
accurate information, as required by its regulations. NRC also expressed
concern about the report's characterization of its use of risk
estimates-specifically the report's statement that NRC's estimate of risk
exceeded the risk levels generally accepted by the agency. In addition,
NRC disagreed with two of our recommendations: (1) to develop specific
guidance and a well-defined process for deciding on when to shut down a
plant and (2) to develop a methodology to assess licensees' safety
culture.
With respect to NRC's overall concern, we believe that the report
accurately captures NRC's performance. Our draft report, in discussing
NRC's regulatory and oversight role and responsibilities, stated that
according to NRC, the completeness and accuracy of the information
provided by licensees is an important aspect of the agency's oversight. To
respond further to NRC's concern, we added a statement to the effect that
licensees are required under NRC's regulations to provide the agency with
complete and accurate information. While we do not want to diminish the
importance of this responsibility on the part of the licensees, we believe
that NRC also has a responsibility, in designing its oversight program, to
implement management controls, including inspection and enforcement, to
ensure that it has accurate information on and is sufficiently aware of
plant conditions. In this respect, it was NRC's decision to rely on the
premise that the information provided by FirstEnergy was complete and
accurate. As we point out in the report, the degradation of the vessel
head at Davis-Besse occurred over several years. NRC knew about several
indications that
problems were occurring at the plant, and the agency could have requested
and obtained additional information about the vessel head condition.
We also believe that the report's characterization of NRC's use of risk
estimates is accurate. The NRC risk estimate that we and our consultants
found for the period leading up to the December 2001 decision on
Davis-Besse's shutdown, including the risk estimate used by the staff
during key briefings of NRC management, indicated that the estimate for
core damage frequency was 5.4x10-5, as used in the report. The 5x10-6
referenced in NRC's December 2002 safety evaluation is for core damage
probability, which equates to a core damage frequency of approximately
5x10-5-a level that is in excess of the level generally accepted by the
agency. The impression of our consultants is that some confusion about the
differences in these terms may exist among NRC staff.
Concerning NRC's disagreement with our recommendation to develop specific
guidance for making plant shutdown decisions, NRC stated that its
regulations, guidance, and processes are robust and do provide sufficient
guidance in the vast majority of situations. The agency added that from
time to time a unique situation may present itself wherein sufficient
information may not exist or the information available may not be
sufficiently clear to apply existing rules and regulations definitively.
According to NRC, in these unique instances, the agency's most senior
managers, after consultation with staff experts and given all of the
information available at the time, decide whether to require a plant
shutdown. While we agree that NRC has an array of guidance for making
decisions, we continue to believe that NRC needs specific guidance and a
well-defined process for deciding when to shut down a plant. As discussed
in our report, the agency used its guidance for approving license change
requests to make the decision on when to shut down Davis-Besse. Although
NRC's array of guidance provides flexibility, we do not believe that it
provides the structure, direction, and accountability needed for important
decisions such as the one on Davis-Besse's shutdown.
In disagreeing with our recommendation concerning the need for a
methodology to assess licensees' safety culture, NRC said that the
Commission, to date, has specifically decided not to conduct direct
evaluations or inspections of safety culture as a routine part of
assessing licensee performance due to the subjective nature of such
evaluations. According to NRC, as regulators, agency officials are not
charged with managing licensees' facilities, and direct involvement with
organizational structure and processes crosses over to a management
function. We
understand NRC's position that it is not charged with managing licensees'
facilities, and we are not suggesting that NRC should prescribe or
regulate the licensees' organizational structure or processes. Our
recommendation is aimed at NRC monitoring trends in licensees' safety
culture as an early warning of declining performance and safety problems.
Such early warnings can help preclude NRC from assessing a licensee as
being a good performer one day, and the next day being faced with a
situation that it considers a potentially significant safety risk. As
discussed in the report, considerable guidance is available on safety
culture assessment, and other countries have established safety culture
programs.
NRC's written response also contained technical comments, which we have
incorporated into the report, as appropriate. (NRC's comments and our
responses are presented in app. IV.)
As arranged with your staff, unless you publicly announce its contents
earlier, we plan no further distribution of this report until 30 days from
its issue date. At that time, we plan to provide copies of this report to
the appropriate congressional committees; the Chairman, NRC; the Director,
Office of Management and Budget; and other interested parties. We will
also make copies available to others upon request. In addition, this
report will be available at no charge on the GAO Web site at
http://www.gao.gov. If you or your staff have any questions, please call
me at (202) 512-3841. Key contributors to this report are listed in
appendix V.
Jim Wells Director, Natural Resources
and Environment
List of Congressional Requesters
The Honorable George V. Voinovich United States Senate
The Honorable Dennis J. Kucinich House of Representatives
The Honorable Steven C. LaTourette House of Representatives
Appendix I
Time Line Relating Significant Events of Interest
Appendix II
Analysis of the Nuclear Regulatory Commission's Probabilistic Risk
Assessment for Davis-Besse
Appendix II
Analysis of the Nuclear Regulatory
Commission's Probabilistic Risk Assessment
for Davis-Besse
Appendix II
Analysis of the Nuclear Regulatory
Commission's Probabilistic Risk Assessment
for Davis-Besse
Appendix II
Analysis of the Nuclear Regulatory
Commission's Probabilistic Risk Assessment
for Davis-Besse
Appendix II
Analysis of the Nuclear Regulatory
Commission's Probabilistic Risk Assessment
for Davis-Besse
Appendix II
Analysis of the Nuclear Regulatory
Commission's Probabilistic Risk Assessment
for Davis-Besse
Appendix II
Analysis of the Nuclear Regulatory
Commission's Probabilistic Risk Assessment
for Davis-Besse
Appendix II
Analysis of the Nuclear Regulatory
Commission's Probabilistic Risk Assessment
for Davis-Besse
Appendix II
Analysis of the Nuclear Regulatory
Commission's Probabilistic Risk Assessment
for Davis-Besse
Appendix II
Analysis of the Nuclear Regulatory
Commission's Probabilistic Risk Assessment
for Davis-Besse
Appendix II
Analysis of the Nuclear Regulatory
Commission's Probabilistic Risk Assessment
for Davis-Besse
Appendix II
Analysis of the Nuclear Regulatory
Commission's Probabilistic Risk Assessment
for Davis-Besse
Appendix II
Analysis of the Nuclear Regulatory
Commission's Probabilistic Risk Assessment
for Davis-Besse
Appendix II
Analysis of the Nuclear Regulatory
Commission's Probabilistic Risk Assessment
for Davis-Besse
Appendix II
Analysis of the Nuclear Regulatory
Commission's Probabilistic Risk Assessment
for Davis-Besse
Appendix II
Analysis of the Nuclear Regulatory
Commission's Probabilistic Risk Assessment
for Davis-Besse
Appendix II
Analysis of the Nuclear Regulatory
Commission's Probabilistic Risk Assessment
for Davis-Besse
Appendix II
Analysis of the Nuclear Regulatory
Commission's Probabilistic Risk Assessment
for Davis-Besse
Appendix II
Analysis of the Nuclear Regulatory
Commission's Probabilistic Risk Assessment
for Davis-Besse
Appendix II
Analysis of the Nuclear Regulatory
Commission's Probabilistic Risk Assessment
for Davis-Besse
Appendix II
Analysis of the Nuclear Regulatory
Commission's Probabilistic Risk Assessment
for Davis-Besse
Appendix II
Analysis of the Nuclear Regulatory
Commission's Probabilistic Risk Assessment
for Davis-Besse
Appendix II
Analysis of the Nuclear Regulatory
Commission's Probabilistic Risk Assessment
for Davis-Besse
Appendix II
Analysis of the Nuclear Regulatory
Commission's Probabilistic Risk Assessment
for Davis-Besse
Appendix III
Davis-Besse Task Force Recommendations to NRC and Their Status, as of
March 2004
Recommendation NRC actions and status as of March 2004
Completed recommendations
Either fully implement or revise guidance to manage licensee Revised
instructions for these submittals and reviews to ensure commitments.
Determine whether the periodic report on that these tasks are
accomplished. Completed in May 2003. commitment changes submitted by
licensees should continue.
Determine if stress corrosion cracking models are appropriate for
Evaluated existing stress corrosion cracking models for their
predicting susceptibility of vessel head penetration nozzles to continuing
use in determining susceptibility. Completed in July
pressurized water stress corrosion cracking. Determine if additional 2003.
analysis and testing is needed to reduce modeling uncertainties for
their continued applicability in regulatory decision making.
Revise the problem identification and resolution approach so that Revised
inspection procedure for determining licensee ability to safety problems
noted in daily licensee reports are reviewed and promptly identify and
resolve conditions adverse to quality or assessed. Enhance guidance to
prescribe the format of information safety. Completed in September 2003.
that is screened when deciding which problems to review.
Provide enhanced inspection guidance to pursue issues and Revised
inspection procedure for determining licensee capability
problems identified during reviews of plant operations. to promptly
identify and resolve conditions adverse to quality or safety. Completed in
September 2003.
Revise inspection guidance to provide for longer-term follow-up of
previously identified issues that have not progressed to an inspection
finding.
Revised inspection procedure for determining licensee capability to
promptly identify and resolve conditions adverse to quality or safety.
Completed in September 2003.
Revise inspection guidance to assess (1) the safety implications of
long-standing unresolved licensee equipment problems, (2) the impact of
phased in corrective actions, and (3) the implications of deferred plant
modifications.
Revised inspection procedure for determining licensee capability to
identify and resolve conditions adverse to quality or safety. Completed in
September 2003.
Revise inspection guidance to allow for establishing reactor Revised
inspection guidance for establishing reactor oversight
oversight panels even when a significant performance problem, as panels.
Completed in October 2003.
defined under NRC's Reactor Oversight Process, does not exist.
Assess the scope and adequacy of requirements for licensees to Included in
NRC's recommendation to develop a program for
review operating experience. collecting, analyzing, and disseminating
information on experiences at operating reactors. Completed in November
2003.
Ensure inspector training includes (1) boric acid corrosion effects and
control, and (2) pressurized water stress corrosion cracking of
nickel-based alloy nozzles.
Developed and implemented Web-based training and a means for ensuring
training is completed. Completed in December 2003.
Provide training and reinforce expectations to managers and staff to (1)
maintain a questioning attitude during inspection activities, (2) develop
inspection insights from Davis-Besse on symptoms of reactor coolant
leakage, (3) communicate expectations to follow up recurring and
unresolved problems, and (4) maintain an awareness of surroundings while
conducting inspections. Establish mechanisms to perpetuate this training.
Developed Web-based inspector training and a means for ensuring that
training has been completed. NRC headquarters provided an overview of the
training to NRC regional offices. (Training modules will be added and
updated as needed.) Completed in December 2003.
Reinforce expectations that regional management should make Discussed at
regional counterparts meeting. Completed in every effort to visit each
reactor at least once every 2 years. December 2003.
Develop guidance to address impacts of regional oversight panels Evaluated
past and present oversight panels. Developed
on regional resource allocations and organizational alignment. enhanced
inspection approaches for oversight panels and issued revised procedures.
Completed in December 2003.
Appendix III
Davis-Besse Task Force Recommendations to
NRC and Their Status, as of March 2004
(Continued From Previous Page)
Recommendation NRC actions and status as of March 2004
Evaluate (1) the capacity to retain operating experience information
Developed program objectives and attributes and obtained
and perform long-term operating experience reviews; (2) thresholds,
management endorsement of a plan to implement the
criteria, and guidance for initiating generic communications; (3)
recommendation. Developed specific recommendations to improve
opportunities for more gains in effectiveness and efficiency by program.
Evaluation completed in November 2003.
realigning the organization (i.e., feasibility of a centralized operating
(Implementation of recommendations resulting from this evaluation
experience "clearinghouse"); (4) effectiveness of the generic Issues
expected to be completed in December 2004.)
program; and (5) effectiveness of internal dissemination of operating
experience information to end users.
Ensure that generic requirements or guidance are not Revised inspection
guidance. Completed in February 2004.
inappropriately affected when making unrelated changes to other
programs, processes, guidance, etc.
Develop inspection guidance to assess scheduler influences on Revised the
appropriate inspection procedure. Completed in amount of work performed
during refueling outages. February 2004.
Establish guidance to ensure that NRC decisions allowing licensees Update
guidance to address documentation. Develop training and to deviate from
guidelines and recommendations issued in generic distribute to NRC offices
and regions to emphasize compliance communications are adequately
documented. with the updated guidance. Follow up to assess the
effectiveness
of the training. Completed follow-up in February 2004.
Develop or revise inspection guidance to ensure that NRC reviews vessel
head penetration nozzles and the reactor vessel head during licensee
inspection activities.
Develop or revise inspection guidance to ensure that nozzles and the
vessel head are reviewed during licensee inspection. Issued interim
guidance in August 2003 and a temporary inspection procedure in September
2003. Additional guidance expected in March 2004.
Develop inspection guidance to assess (1) repetitive or multiple Revise the
appropriate inspection procedure to reflect this need.
technical specification actions in NRC inspection or licensee reports, and
(2) radiation dose implications for conducting repetitive tasks.
Completion expected in March 2004. Develop guidance to periodically inspect
licensees' boric acid Issued temporary guidance in November 2003. Completion of
corrosion control programs. further inspection guidance changes expected in
March 2004.
Reinforce expectations for managers responsible for overseeing Update
project manager handbook that provides guidance on
operations at nuclear power plants regarding site visits, coordination
activities to be conducted during site visits and interactions with
with resident inspectors, and assignment duration. Reinforce NRC regional
staff. Also, revise guidance for considering plant
expectations to question information about operating conditions and
conditions during licensing action and amendment reviews.
strengthen guidance for reviewing license amendments to Completion
expected in March 2004.
emphasize consideration of current system conditions, reliability,
and performance data in safety evaluation reports. Strengthen
guidance for verifying licensee-provided information.
Assemble and analyze foreign and domestic information on Alloy Assemble
and analyze alloy 600 cracking data. Completion
600 nozzle cracking. If additional regulatory action is warranted,
expected in March 2004.
propose a course of action and implement a schedule to address
the results.
Recommendations due to be completed between April and December 2004
Conduct an effectiveness review of actions taken in response to past
Review past lessons-learned actions. Completion expected in April NRC
lessons-learned reviews. 2004.
Provide inspection and oversight refresher training to managers and
Develop a training module. Completion expected in June 2004. staff.
Appendix III
Davis-Besse Task Force Recommendations to
NRC and Their Status, as of March 2004
(Continued From Previous Page)
Recommendation NRC actions and status as of March 2004
Establish guidance for accepting owners group and industry Revise office
instructions to provide recommended guidance.
recommended resolutions for generic communications and generic Completion
expected in June 2004.
issues, including guidance for verifying that actions are taken.
Review inspection guidance to determine the inspection level that is
Revised an inspection procedure to reflect these changes. Some sufficient
during refueling outages, including inspecting reactor inspection
procedure changes were completed in November 2003, areas inaccessible
during normal operations and passive and additional changes are expected
in August 2004. components.
Evaluate, and revise as necessary, guidance for proposing Evaluate and
revise guidance. Completion expected in October candidate generic issues.
2004
Assemble and analyze foreign and domestic information on boric acid
corrosion of carbon steel. If additional regulatory action is warranted,
propose a course of action and implement a schedule to address the
results.
Review Argonne National Laboratory study on boric acid corrosion. Analyze
data to revise inspection requirements. Completion expected in October
2004.
Conduct a follow-on verification of licensee actions to implement a Screen
candidate generic communications to identify those most
sample of significant generic communications with emphasis on those that
are programmatic in nature.
appropriate for follow-up using management-approved criteria. Develop and
approve verification plan. Completion expected in November 2004.
Strengthen inspection guidance for periodically reviewing licensee
Incorporated into the recommendation pertaining to NRC's
operating experience. capacity to retain operating experience
information. Completion expected in December 2004.
Enhance the effectiveness of processes for collecting, reviewing,
Incorporated into the recommendation pertaining to NRC's assessing,
storing, retrieving, and disseminating foreign operating capacity to
retain operating experience information. Completion experience. expected
in December 2004.
Update operating experience guidance to reflect the changes Incorporated
into the recommendation pertaining to NRC's implemented in response to
recommendations for operating capacity to retain operating experience
information. Completion experience. expected in December 2004.
Review a sample of NRC evaluations of licensee actions made in Conduct the
recommended review. Completion expected in
response to owners groups' commitments to identify whether December 2004.
intended actions were effectively implemented.
Develop general inspection guidance to periodically verify that Develop
inspection procedure to provide a mechanism for regions
licensees implement owners groups' commitments. to support project
managers' ability to verify that licensees implement commitments.
Completion expected in December 2004.
Conduct follow-on verification of licensee actions pertaining to a No
specific actions have been identified. Completion expected in sample of
resolved generic issues. December 2004.
Review the range of baseline inspections and plant assessment No specific
actions have been identified. Completion expected in
processes to determine sufficiency to identify and dispose of December
2004.
problems like those at Davis-Besse.
Identify alternative mechanisms to independently assess licensee No
specific actions have been identified. Completion expected in
plant performance for self-assessing NRC oversight processes and December
2004.
determine the feasibility of such mechanisms.
Establish measurements for resident inspector staffing levels and
requirements, including standards for satisfying minimum staffing levels.
Develop standardized staffing measures and implement details. Metrics were
developed in December 2003. Completion expected in December 2004.
Structure and focus inspections to assess licensee employee No specific actions
have been identified. Completion expected in concerns and a "safety conscious
work environment." December 2004.
Appendix III
Davis-Besse Task Force Recommendations to
NRC and Their Status, as of March 2004
(Continued From Previous Page)
Recommendation NRC actions and status as of March 2004 Recommendations due to be
completed in calendar year 2005
Develop inspection guidance and criteria for addressing licensee Develop
recommendations for guidance with action levels to response to increasing
leakage levels and/or adverse trends in trigger greater NRC interaction
with licensees in response to unidentified reactor coolant system leakage.
increased leakage. Completion expected in January 2005.
Reassess the basis for the cancellation, in 2001, of certain Review
revised procedures and reactivate as necessary.
inspection procedures (i.e., boric acid control programs and Completion
expected in March 2005.
operational experience feedback) to assess if these procedures are
still applicable.
Assess requirements for licensee procedures to respond to plant Review and
assess adequacy of requirements and develop alarms for leakage to
determine whether requirements are sufficient recommendations to (1)
improve procedures to identify leakage to identify reactor coolant
pressure boundary leakage. from boundary, (2) establish consistent
technical specifications for
leakage, and (3) use enhanced leakage detection systems.
Completion expected in March 2005.
Determine whether licensees should install enhanced systems to Re-evaluate
the basis for current leakage requirements and
detect leakage from the reactor coolant system. assess the capabilities of
current leakage detection systems. Develop recommendations to (1) improve
procedures for identifying leakage, (2) establish consistent technical
specifications, and (3) use enhanced leakage detection systems. Completion
expected in March 2005
Inspect the adequacy of licensee's programs to control boric acid Develop
guidance to assess adequacy of corrosion control
corrosion, including effectiveness of implementation. programs, including
implementation and effectiveness, and evaluate the status of this effort
after the first year of inspections. Guidance expected to be developed by
March 2004. Follow-up scheduled for completion in March 2005.
Continue ongoing efforts to review and improve the usefulness of Develop
and implement improved performance indicators based barrier integrity
performance indicators and evaluate the use of on current requirements and
measurements. Explore the use of primary system leakage that licensees
have identified but not yet additional performance indicators to track the
number, duration, corrected as a potential indicator. and rate of system
leakage. Determine the feasibility of
establishing a risk-informed performance indicator for barrier
integrity. Completion expected in December 2005.
Recommendations whose completion dates have yet to be determined
Encourage the American Society of Mechanical Engineers to revise Monitor
and provide input to industry efforts to develop revised inspection
requirements for nickel-based alloy nozzles. Encourage inspection
requirements. Participate in American Society of changes to requirements
for nonvisual, nondestructive inspections Mechanical Engineers' meetings
and communicate with of vessel head penetration nozzles. Alternatively,
revise NRC appropriate stakeholders. Decide whether to endorse the revised
regulations to address the nature and scope of these inspections. American
Society of Mechanical Engineers' code requirements.
These actions parallel a larger NRC rulemaking effort. Completion
date yet to be determined.
Revise processes to require short- and long-term verification of Target
date to be set upon completion of review of NRC's generic licensee actions
to respond to significant NRC generic communications program. Completion
date yet to be determined. communications before closing out issues.
Determine whether licensee reactor vessel head inspection Will be included
as part of revised American Society of Mechanical summary reports should
be submitted to NRC and, if so, revise Engineers' requirements for
inspection of reactor vessel heads and submission requirements and report
disposition guidance, as vessel head penetration nozzles. Completion date
yet to be appropriate. determined.
Appendix III
Davis-Besse Task Force Recommendations to
NRC and Their Status, as of March 2004
(Continued From Previous Page)
Recommendation NRC actions and status as of March 2004
Evaluate the adequacy of methods for analyzing the risk of passive No specific
actions have been identified. Completion date yet to be
component degradation and integrate these methods and risks into NRC's
decision-making processes.
determined.
Review pressurized water reactor technical specifications to identify
Assessed plants for nonstandard technical specifications. plants that have
nonstandard reactor coolant pressure boundary Completed in July 2003.
Change leakage detection specifications leakage requirements and change
specifications to make them in coordination with other changes in leakage
detection consistent among all plants. requirements. Completion date yet
to be determined.
Improve requirements for unidentified leakage in reactor coolant Issue
regulations implementing the improved requirements when
system to ensure they are sufficient to (1) discriminate between these
requirements are determined. Completion date yet to be
unidentified leaks from the coolant system and leaks from the determined.
reactor coolant pressure boundary and (2) ensure that plants do not
operate with pressure boundary leakage.
NRC should review a sample of plant assessments conducted No specific
actions have been identified. Completion expected in
between 1998 and 2000 to determine if any identified plant safety March
2004.
issues have not been adequately assessed.
Recommendations rejected by NRC management
Review industry approaches licensees use to consider economic
Recommendation rejected by NRC management. No completion
factors for inspection and repair and consider this information in date.
formulating future positions on the performance of non-visual
inspections of vessel head penetration nozzles.
Revise the criteria for review of industry topical reports to allow for
Recommendation rejected by NRC management. No completion
NRC staff review of safety-significant reports that have generic date.
implications but have not been formally submitted for NRC review in
accordance with the existing criteria.
Source: GAO analysis of NRC data.
Appendix IV
Comments from the Nuclear Regulatory Commission
Note: GAO comments supplementing those in the report text appear at the
end of this appendix.
See comment 1.
See comment 2.
Appendix IV
Comments from the Nuclear Regulatory
Commission
See comment 3.
See comment 4.
See comment 5.
Appendix IV
Comments from the Nuclear Regulatory
Commission
Appendix IV
Comments from the Nuclear Regulatory
Commission
See comment 1.
See comment 2.
Appendix IV
Comments from the Nuclear Regulatory
Commission
See comment 3.
Appendix IV
Comments from the Nuclear Regulatory
Commission
See comment 6.
See comment 7.
See comment 8.
See comment 9.
Appendix IV
Comments from the Nuclear Regulatory
Commission
See comment 10.
See comment 11.
See comment 12.
Appendix IV
Comments from the Nuclear Regulatory
Commission
See comment 4.
See comment 13.
Appendix IV
Comments from the Nuclear Regulatory
Commission
See comment 14.
See comment 15.
Appendix IV
Comments from the Nuclear Regulatory
Commission
Appendix IV
Comments from the Nuclear Regulatory
Commission
See comment 16.
See comment 17.
See comment 18.
Appendix IV
Comments from the Nuclear Regulatory
Commission
See comment 19.
See comment 20.
Appendix IV
Comments from the Nuclear Regulatory
Commission
See comment 21.
See comment 22.
See comment 23.
Appendix IV
Comments from the Nuclear Regulatory
Commission
See comment 24.
See comment 25.
Appendix IV
Comments from the Nuclear Regulatory
Commission
See comment 26.
See comment 5.
See comment 5.
Appendix IV
Comments from the Nuclear Regulatory
Commission
See comment 5.
Appendix IV
Comments from the Nuclear Regulatory
Commission
See comment 27.
See comment 28.
Appendix IV
Comments from the Nuclear Regulatory
Commission
Appendix IV
Comments from the Nuclear Regulatory
Commission
Appendix IV
Comments from the Nuclear Regulatory
Commission
Appendix IV
Comments from the Nuclear Regulatory
Commission
The following are GAO's comments on the Nuclear Regulatory Commission's
letter dated May 5, 2004.
GAO Comments 1. We agree with NRC that 10 C.F.R. S: 50.9 requires that
information provided to NRC by a licensee be complete and accurate in all
material respects, and we have added this information to the report. NRC
also states that in carrying out its oversight responsibilities, NRC must
"rely heavily" on licensees providing accurate information. However, we
believe that NRC's oversight program should not place undue reliance on
applicants providing complete and accurate information. NRC also
recognizes that it cannot rely solely on information from licensees, as
evidenced by its inspection program and process for determining the
significance of licensee violations. Under this process, NRC considers
whether there are any willful aspects associated with the violation-
including the deliberate intent to violate a license requirement or
regulation or falsify information. We believe that management controls,
including inspection and enforcement, should be implemented by NRC so as
to verify whether licensee-submitted information considered to be
important for ensuring safety is complete and accurate as required by the
regulation. In this regard, as stated in NRC's enforcement policy
guidance, NRC is authorized to conduct inspections and investigations
(Atomic Energy Act S: 161); revoke licenses for, among other things, a
licensee's making material false statements or failing to build or operate
a facility in accordance with the terms of the license (Atomic Energy Act
S: 186); and impose civil penalties for a licensee's knowing failure to
provide certain safety information to NRC (Energy Reorganization Act S:
206).
With regard to the draft report conveying the expectation that NRC should
have known about the thick layer of boron on the reactor vessel head, we
note in the draft report that since at least 1998, NRC was aware that (1)
FirstEnergy's boric acid corrosion control program was inadequate, (2)
radiation monitors within the containment area were continuously being
clogged by boric acid deposits, (3) the containment air cooling system had
to be cleaned repeatedly because of boric acid buildup, (4) corrosion was
occurring within containment as evidenced by rust particles being found,
and (5) the unidentified leakage rate had increased above the level that
historically had been found at the plant. NRC was also aware of the
repeated but ineffective attempts by FirstEnergy to correct many of these
recurring problems-evidence that the licensee's programs to identify and
correct problems were not
Appendix IV
Comments from the Nuclear Regulatory
Commission
effective. Given these indications at Davis-Besse, NRC could have taken
more aggressive follow-up action to determine the underlying causes. For
example, NRC could have taken action during the fuel outage in 1998, the
shutdown to repair valves in mid-1999, or the fuel outage in 2000 to
ensure that staff with sufficient knowledge appropriately investigated the
types of conditions that could cause these indications, or followed up to
ensure that FirstEnergy had fully investigated and successfully resolved
the cause of the indications.
2. With respect to the responsibility of the licensee to provide complete
and accurate information, see comment 1. As to the Davis-Besse
lessons-learned task force finding, we agree that some information
provided by FirstEnergy in response to Bulletin 2001-01 may have been
inconsistent with some information subsequently identified by NRC's
lessons-learned task force, and that had some of this information been
known in the fall of 2001, the vessel head leakage and degradation may
have been identified sooner than March 2002. This information included (1)
the boric acid accumulations found on the vessel head by FirstEnergy in
1998 and 2000, (2) FirstEnergy's limited ability to visually inspect the
vessel head, (3) FirstEnergy's boric acid corrosion control procedures
relative to the vessel head, (4) FirstEnergy's program to address the
corrosive effects of small amounts of reactor coolant leakage, (5)
previous nozzle inspection results, (6) the bases for FirstEnergy's
conclusion that another source of leakage-control rod drive mechanism
flanges-was the source of boric acid deposits on the vessel head that
obscured multiple nozzles, and (7) photographs of vessel head penetration
nozzles. However, various NRC officials knew some of this information,
other information should have been known by NRC, and the remaining
information could have been obtained had NRC requested it from
FirstEnergy. For example, according to the senior resident inspector, he
reviewed every Davis-Besse condition report on a daily basis to determine
whether the licensee properly categorized the safety significance of the
conditions. Vessel head conditions found by FirstEnergy in 1998 and 2000
were noted in such condition reports or in
potential-condition-adverse-to-quality reports. According to a FirstEnergy
official, photographs of the pressure vessel head nozzles were
specifically provided to NRC's resident inspector, who, although he did
not specifically recall seeing the photographs, stated that he had no
reason to doubt the FirstEnergy official's statement. NRC had been aware,
in 1999, of limitations in FirstEnergy's boric acid corrosion control
program and, while it cited FirstEnergy for its failure to adequately
implement the program, NRC officials did not
Appendix IV
Comments from the Nuclear Regulatory
Commission
follow up to determine if the program had improved. Lastly, while NRC
questioned the information provided by FirstEnergy in its submissions to
NRC in response to Bulletin 2001-01 (regarding vessel head penetration
nozzle inspections), NRC staff did not independently review and assess
information pertaining to the results of past reactor pressure vessel head
inspections and vessel head penetration nozzle inspections. Similarly, NRC
did not independently assess the information concerning the extent and
nature of the boric acid accumulations found on the vessel head by the
licensee during past inspections.
On page 2 of the report, we note that the Department of Justice has an
ongoing investigation concerning the completeness and accuracy of
information that FirstEnergy provided to NRC on the conditions at
Davis-Besse. The investigation may or may not find that FirstEnergy
provided inaccurate or incomplete information. While NRC notes that it
might have detected something months earlier if information had been known
in the fall of 2001, we would also note that the degradation of the
reactor vessel head likely took years to occur.
3. We believe that the statement is correct. NRC produced an estimate of
5x10-5 per year for the change in core damage frequency, as we state in
the report. NRC specifically documented this calculation in its December
2002 assessment:
"The NRC staff estimated that, giving credit only to the [FirstEnergy]
inspection performed in 1996, the probability of a [control rod drive
mechanism] nozzle ejection during the period of operation from December
31, 2001, to February 16, 2002, was in the range of 2E-3 and was an
increase in the overall [loss of coolant accident] probability for the
plant. The increase in core damage probability and large early release
probability were estimated as approximately 5E-6 and 5E-08,
respectively."1
The probability of a large early release-5E-6-equates to a frequency of
5x10-5 per year.2 As we note in the report, according to NRC's
1The numbers 2E-3, 5E-6, and 5E-8 can also be written as 2x10-3, 5x10-6,
and 5x10-8.
2The probability of an event occurring is the product of the frequency of
an event and a given time period. In this case, the time period-7
weeks-was approximated as one-tenth of the year. Thus, 5.4x10-5 per year
multiplied by 0.10 equates to a probability of 5.4x10-6. According to NRC,
it revised 5.4x10-6 to 5.0x10-6 to account for uncertainties.
Appendix IV
Comments from the Nuclear Regulatory
Commission
regulatory guide 1.174, this frequency would be in the highest risk zone
and NRC would generally not approve the requested change.
On several occasions, we met with the NRC staff that developed the risk
estimate in an attempt to understand how it was calculated. We obtained
from NRC staff the risk estimate information provided to senior management
in late November 2001, as well as several explanations of how the staff
developed its calculations. We were provided with no evidence that NRC
estimated the frequency of core damage as being 5x10-6 per year until
February 2004, after our consultants and we had challenged NRC's estimate
as being in the highest risk zone under NRC's regulatory guide 1.174.
Furthermore, several NRC staff involved in deciding whether to issue the
order to shut down Davis-Besse, or to allow it to continue operating until
February 16, 2002, stated that the risk estimate they used was relatively
high.
4. We agree that existing regulations provide a spectrum of conditions
under which a plant shutdown could occur and that could be interpreted as
covering the vast majority of situations. However, we continue to believe
that NRC lacks sufficient guidance for making plant shutdown decisions. We
disagree on two grounds: First, the decisionmaking guidance used by NRC to
shut down Davis-Besse was guidance for approving license change requests.
This guidance provides general direction on how to make risk-informed
decisions when licensees request license changes. It does not address
important aspects of decision-making involved in deciding whether to shut
down a plant. It also does not provide direction on how NRC should weigh
deterministic factors in relation to probabilistic factors in making
shutdown decisions. Secondly, while NRC views the flexibility afforded by
its existing array of guidance as a strength, we are concerned that, even
on the basis of the same information or circumstances, staff can arrive at
very different decisions. Without more specific guidance, NRC will
continue to lack accountability and the degree of credibility needed to
convince the industry and the public that its shutdown decisions are
sufficiently sound and reasoned for protecting public health and safety.
5. We are aware that the commissioners have specifically decided not to
conduct direct evaluations or inspections of safety culture. We agree that
as regulators, NRC is not charged with managing licensees' facilities, but
disagree that any direct NRC involvement with safety culture crosses over
to a management function. Management is an
Appendix IV
Comments from the Nuclear Regulatory
Commission
embodiment of corporate beliefs and perceptions that affect management
strategies, goals, and philosophies. These, in turn, impact licensee
programs and processes and employee behaviors that have safety outcomes.
We believe that NRC should not assess corporate beliefs and perceptions or
management strategies, goals, or philosophies. Rather, we believe that NRC
has a responsibility to assess licensee programs and processes, as well as
employee behaviors. We cite several areas of safety culture in the report
as being examples of various aspects of safety culture that NRC can assess
which do not constitute "management functions." The International Atomic
Energy Agency has extensive guidance on assessing additional aspects of
licensee performance and indicators of safety culture.3 Such assessments
can provide early indications of declining safety culture prior to when
negative safety outcomes occur, such as at Davis-Besse.
We also agree that NRC has indirect means by which it attempts to assess
safety culture. For example, NRC's problem identification and resolution
inspection procedure's stated objective is to provide an early warning of
potential performance issues and insight into whether licensees have
established safety conscious work environments. However, we do not believe
that the implementation of the inspection procedure has been demonstrated
to be effective in meeting its stated objectives. The inspection procedure
directs inspectors to screen and analyze trends in all reported power
plant issues. In doing so, the procedure directs that inspectors annually
review 3 to 6 issues out of potentially thousands of issues that can arise
and that are related to various structures, systems, and components
necessary for the safe operation of the plant. This requires that
inspectors judgmentally sample 3 to 6 issues on which they will focus
their inspection resources. While we do not necessarily question inspector
judgment when sampling for these 3 to 6 issues, NRC inspectors stated that
due to the large number of issues that they can sample from, they try to
focus on those issues that they believe have the most relevance for
safety. Thus, if an issue is not yet perceived as being important to
safety, it is less likely to be selected for follow up. Further, even if
an issue were selected for follow up and this indicated that the licensee
did not properly identify and resolve underlying problems that contributed
to the issue, according to NRC officials, it is highly unlikely
3The International Atomic Energy Agency, International Nuclear Safety
Advisory Group, Safety Culture (Vienna, Austria: February 1991).
Appendix IV
Comments from the Nuclear Regulatory
Commission
that this one issue would rise to a high enough level of significance for
it to be noted under NRC's Reactor Oversight Process. Additionally, the
procedure is dependant on the inspector being aware of, and having the
capability to, identify issues or trends in the area of safety culture.
According to NRC officials, inspectors are not trained in what to look for
when assessing licensee safety culture because they are, by and large,
nuclear engineers. While they may have an intuition that something is
wrong, they may not know how to assess it in terms of safety culture.
Additional specific examples NRC cites for indirectly assessing a selected
number of safety culture aspects have the following limitations:
o NRC's inspection procedure for assessing licensees' employee concerns
program is not frequently used. According to NRC Region III officials,
approval to conduct such an inspection must be given by the regional
administrator and the justification for the inspection to be performed has
to be based on a very high level of evidence that a problem exists.
Because of this, these officials said that the inspection procedure has
only been implemented twice in Region III.
o NRC's allegation program provides a way for individuals working at
NRC-regulated plants and the public to provide safety and regulatory
concerns directly to NRC. It is a reactive program by nature because it is
dependent upon licensees' employees feeling free and able to come forward
to NRC with information about potential licensee misconduct. While NRC
follows up on those plants that have a much higher number of allegations
than other plants to determine what actions licensees are taking to
address any trends in the nature of the allegations, the number of
allegations may not always provide an indication of a poor safety culture,
and in fact, may be the reverse. For example, the number of allegations at
Davis-Besse prior to the discovery of the cavity in the reactor head in
March 2002 was relatively small. Between 1997 and 2001, NRC received 10
allegations from individuals at the plant. In contrast, NRC received an
average of 31 allegations per plant over the same 5-year period from
individuals at other plants.
o NRC's lessons-learned reviews, such as the one conducted for
Davis-Besse, are generally conducted when an incident having potentially
serious safety consequences has already occurred.
Appendix IV
Comments from the Nuclear Regulatory
Commission
o With respect to NRC's enforcement of employee protection regulations,
NRC, under its current enforcement policy, would normally only take
enforcement action when violations are of very significant or significant
regulatory concern. This regulatory concern pertains to NRC's primary
responsibility for ensuring safety and safeguards and protecting the
environment. Examples of such violations would include the failure of a
system designed to prevent a serious safety incident not working when it
is needed, a licensed operator being inebriated while at the control of a
nuclear reactor, and the failure to obtain prior NRC approval for a
license change that has implications for safety. If violations of employee
protection regulations do not pose very significant or significant safety,
safeguards, or environmental concerns, NRC may consider such violations
minor. In such cases, NRC would not normally document such violations in
inspection reports or records, and would not take enforcement action.
o NRC's Reactor Oversight Process, instituted in April 2000, focuses on
seven specific "cornerstones" that support the safety of plant operations
to ensure reactor safety, radiation safety, and security. These
cornerstones are: (1) the occurrence of operations and events that could
lead to a possible accident if safety systems did not work, (2) the
ability of safety systems to function as intended, (3) the integrity of
the three safety barriers, (4) the effectiveness of emergency
preparedness, (5) the effectiveness of occupational radiation safety, (6)
the ability to protect the public from radioactive releases, and (7) the
ability to physically protect the plant. NRC's process also includes three
elements that cut across these seven cornerstones: (1) human performance,
(2) a licensee's safetyconscious work environment, and (3) problem
identification and resolution. NRC assumes that problems in any of these
three crosscutting areas will be evidenced in one or more of the seven
cornerstones in advance of any serious compromise in the safety of a
plant. However, as evidenced by the Davis-Besse incident, this assumption
has not proved to be true.
NRC also cites lessons-learned task force recommendations to improve NRC's
ability to detect problems in licensee's safety culture, as a means to
achieve our recommendation to directly assess licensee safety culture.
These lessons-learned task force recommendations include (1) developing
inspection guidance to assess the effect that a licensee's fuel outage
shutdown schedule has on the scope of work conducted
Appendix IV
Comments from the Nuclear Regulatory
Commission
during a shutdown; (2) revising inspection guidance to provide for
assessing the safety implications of long-standing, unresolved problems;
corrective actions being phased in over the course of several years or
refueling outages; and deferred plant modifications; (3) revising the
problem identification and resolution inspection approach and guidance;
and (4) reviewing the range of NRC's inspections and assessment processes
and other NRC programs to determine whether they are sufficient to
identify and dispose of the types of problems experienced at Davis-Besse.
While we commend these recommendations, we do not believe that revising
such guidance will necessarily alert NRC inspectors to early declines in
licensee safety culture before they result in negative safety outcomes.
Further, because of the nature of NRC's process for determining the
relative safety significance of violations under NRC's new Reactor
Oversight Process, we do not believe that any indications of such declines
will result in a cited violation.
6. We have revised the report to reflect that boron in the form of boric
acid crystals is dissolved in the cooling water. (See p. 13.)
7. On page 41 of the report, we recognize that NRC also relied on
information provided by FirstEnergy regarding the condition of the vessel
head. For example, in developing its risk estimate, NRC credited
FirstEnergy with a vessel head inspection conducted in 1996. However, NRC
decided that the information provided by FirstEnergy documenting vessel
head inspections in 1998 and 2000 was of such poor quality that it did not
credit FirstEnergy with having conducted them. As a result, NRC's risk
estimate was higher than had these inspections been given credit.
8. The statement made by the NRC regional branch chief was taken directly
from NRC's Office of the Inspector General report on NRC's oversight of
Davis-Besse during the April 2000 refueling outage.4
9. We agree that up until the Davis-Besse event, NRC had not concluded
that boric acid corrosion was a high priority issue. We clarified the text
of the report to reflect this comment. (See p. 25.)
4NRC, Office of the Inspector General, NRC's Oversight of Davis-Besse
during the April 2000 Refueling Outage (Washington, D.C.: Oct. 17, 2003).
Appendix IV
Comments from the Nuclear Regulatory
Commission
10. We agree that plant operators in France decided to replace their
vessel heads in lieu of performing the extensive inspections instituted by
the French regulatory authority. The report has been revised to add these
details. (See p. 31.)
11. We agree that caked-on boron, in combination with leakage, could
accelerate corrosion rates under certain conditions. However, even without
caked-on boron, corrosion rates could be quite high. Westinghouse's 1987
report on the corrosive effects of boric acid leakage concluded that the
general corrosion rate of carbon steel can be unacceptably high under
conditions that can prevail when primary coolant leaks onto surfaces and
concentrates at the temperatures that are found on reactor surfaces. In
one series of tests that it performed, boric acid solutions corroded
carbon steel at a rate of about 0.4 inches per month, or about 4.8 inches
a year. This was irrespective of any caked-on boron. In 1987, as a result
of that report and extensive boric acid corrosion found at two other
nuclear reactors that year-Salem unit 2 and San Onofre unit 2-NRC
concluded that a review of existing inspection programs may be warranted
to ensure that adequate monitoring procedures are in place to detect boric
acid leakage and corrosion before it can result in significant degradation
of the reactor coolant pressure boundary. However, NRC did not take any
additional action.
12. We agree that NRC has requirements and processes that provide a number
of circumstances in which a plant shutdown would or could be required. We
also recognize that there were no legal objections to the draft
enforcement order to shut down the plant, and that the basis for not
issuing the order was NRC's belief that the plant did not pose an
unacceptable risk to public health and safety. The statement in our report
that NRC is referring to is discussing one of these circumstances-the
licensee's failure to meet NRC's technical specification-and whether NRC
believed that it had enough proof that the technical specification was not
being met. The statement is not discussing the basis for NRC issuing an
enforcement order. We revised the report to clarify this point. (See p.
34.)
13. The basis for our statement that NRC staff concluded that the first
safety principle was probably not met was its November 29, 2001, briefing
to NRC's Executive Director's Office and its November 30, 2001, briefing
to the NRC commissioners' technical assistants. These briefings, the basis
for which are included in documented briefing
Appendix IV
Comments from the Nuclear Regulatory
Commission
slides, took place shortly before NRC formally notified FirstEnergy on
December 4, 2001, that it would accept its compromise shutdown date.
14. We are referring to the same document that NRC is referring to-NRC's
December 3, 2002, response to FirstEnergy (NRC's ADAMS accession number
ML023300539). The response consists of a 2-page transmittal letter and an
7.3-page enclosure. The 7.3-page enclosure is 3 pages of background and
4.3 pages of the agency's assessment. The assessment includes statements
that the safety principles were met but does not provide an explanation of
how NRC considered or weighed deterministic and probabilistic information
in concluding that each of the safety factors were met. For example, NRC
concluded that the likelihood of a loss-of-coolant accident was acceptably
small because of the (1) staff's preliminary technical assessment for
control rod drive mechanism cracking, (2) evidence of cracking found at
other plants similar to Davis-Besse, (3) analytical work performed by
NRC's research staff in support of the effort, and (4) information
provided by FirstEnergy regarding past inspections at Davis-Besse.
However, the assessment does not explain how these four pieces of
information successfully demonstrated if and how each of the safety
principles was met. The assessment also states that NRC examined the five
safety principles, the fifth of which is the ability to monitor the
effects of a risk-informed decision. The assessment is silent on whether
this principle is met. However, in NRC's November 29, 2001, briefing to
NRC's Executive Director's Office and in its November 30, 2001, briefing
to the NRC commissioners' technical assistants, NRC concluded that this
safety principle was not met. As noted above, NRC formally notified
FirstEnergy on December 4, 2001, that it would accept FirstEnergy's
February 16, 2002, shutdown date.
15. See comment 3. We do not agree that the report statements
mischaracterize the facts. Rather, we are concerned that NRC is misusing
basic quantitative mathematics. In addition, with regard to NRC's concept
of an annual average change in the frequency of core damage, NRC stated
that the agency averaged the frequency of core damage that would exist for
the 7-week period of time (representing the period of time between
December 31, 2001, and February 16, 2002) over the entire 1-year period,
using the assumption that the frequency of core damage would be zero for
the remainder of the year-February 17, 2002, to December 31, 2002.
According to our consultants, this calculation artificially reduced NRC's
risk estimate to a level that is acceptable under NRC's guidance. By this
logic, our consultants stated,
Appendix IV
Comments from the Nuclear Regulatory
Commission
risks can always be reduced by spreading them over time; by assuming
another 10 years of plant operation (or even longer) NRC could find that
its calculated "risks" are completely negligible. They further stated that
NRC's approach is akin to arguing that an individual, who drives 100 miles
per hour 10 percent of the time, with his car otherwise garaged, should
not be cited because his time-average speed is only 10 miles per hour.
Further, our consultants concluded that the "annual-average" core damage
frequency approach was also clearly unnecessary, since one need only
convert a core damage frequency to a core damage probability to handle
part-year cases like the Davis-Besse case. Lastly, we find no basis for
the calculation in any NRC guidance. According to our consultants, this
new interpretation of NRC's guidance is at best unusual and certainly is
inconsistent with NRC's guidelines regarding the use of an incremental
core damage frequency. This interpretation also reinforces our
consultants' impression that perhaps there was, in November 2001 and
possibly is still today, some confusion among the NRC staff regarding
basic quantitative metrics that should be considered in evaluating
regulatory and safety issues. As noted in comment 3, we found no evidence
of this calculation prior to February 2004.
16. While we agree that vessel head corrosion as extensive as later found
at Davis-Besse was not anticipated, NRC had known that leakage of the
primary coolant from a through-wall crack could cause boric acid corrosion
of the vessel head, as evidenced by the Westinghouse work cited above.
Regardless of information provided to NRC by individual licensees, such as
FirstEnergy, NRC's model should account for known risks, including the
potential for corrosion.
17. We agree that NRC was aware of control rod drive mechanism nozzle
cracking at French nuclear power plants. NRC provided us additional
information consisting of a December 15, 1994, internal memo, in which NRC
concluded that primary coolant leakage from a through-wall crack could
cause boric acid corrosion of the vessel head. However, because some
analyses indicated that it would take at least 6 to 9 years before any
corrosion would challenge the structural integrity of the head, NRC
concluded that cracking was not a short-term safety issue. We revised the
report to include this additional information. (See p. 40.)
18. See comment 15.
Appendix IV
Comments from the Nuclear Regulatory
Commission
19. We agree that while not directly relevant to the Davis-Besse
situation, NRC uses regulatory guide 1.177 to make decisions on whether
certain equipment can be inoperable while a nuclear reactor is operating,
which can pose very high instantaneous risks for very short periods of
time. However, we include the reference to this particular guidance in the
report because it was cited by an NRC official involved in the Davis-Besse
decision-making process as another piece of guidance used in judging
whether the risk that Davis-Besse posed was acceptable.
20. While regulatory guide 1.174 comprises 25 pages of guidance on how to
use risk in making decisions on whether to allow license changes, it does
not lay out how NRC staff are to use quantitative estimates of risk or
probabilistic factors, or how robust these estimates must be in order to
be considered along with more deterministic factors. The regulatory guide,
which was first issued in mid-1998, had been in effect for only about 1.5
years when NRC staff was tasked with making their decision on Davis-Besse.
According to the Deputy Executive Director of Nuclear Reactor Programs at
the time the decision was being made, the agency was trying to bring the
staff through the risk-informed decision-making process because
Davis-Besse was a learning tool. He further stated that it was really the
first time the agency had used the risk-informed decision-making process
on operational decisions as opposed to programmatic decisions for
licensing. At the time the decision was made, and currently, NRC has no
guidance or criteria for use in assessing the quality of risk estimates or
clear guidance or criteria for how risk estimates are to be weighed
against other risk factors.
21. The December 3, 2002, safety assessment or evaluation did state that
the estimated increase in core damage frequency was consistent with NRC's
regulatory guidelines. However, as noted in comment 3, we disagree with
this conclusion. In addition, while we agree that NRC has staff with risk
assessment disciplines, we found no reference to these staff in NRC's
safety evaluation. We also found no reference to NRC's statement that
these staff gave more weight to deterministic factors in arriving at the
agency's decision. While we endorse NRC's consideration of deterministic
as well as probabilistic factors and the use of a risk-informed
decision-making process, we continue to maintain that NRC needs clear
guidance and criteria for the quality of risk estimates, standards of
evidence, and how to apply deterministic as well as probabilistic factors
in plant shutdown decisions. As the agency continues to incorporate a
risk-informed process into much of its regulatory guidance and programs,
such criteria will be increasingly
Appendix IV
Comments from the Nuclear Regulatory
Commission
important when making shutdown as well as other types of decisions
regarding nuclear power plants.
22. The information that NRC provided us indicates that completion dates
for 2 of the 22 high priority recommendations have slipped.5 One, the
completion date for encouraging the American Society of Mechanical
Engineers to revise vessel head penetration nozzle inspection requirements
or, alternatively, for revising NRC's regulations for vessel head
inspections has slipped from June 2004 to June 2006. Two, the completion
date for assessing NRC's requirements that licensees have procedures for
responding to plant leakage alarms to determine if the requirements are
sufficient for identifying reactor coolant pressure boundary leakage has
slipped from March 2004 to March 2005.
23. We agree with this comment and have revised the report to reflect this
clarification. (See p. 49.)
24. Our estimate of at least an additional 200 hours of inspection per
reactor per year is based on:
o NRC's new requirement that its resident inspectors review all licensee
corrective action items on a daily basis (approximately 30 minutes per
day). Given that reactors are intended to operate continuously throughout
the year, this results in about 3.5 hours per week for reviewing
corrective action items, or about 182 hours per year. In addition,
resident inspections are now required to determine, on a semi-annual
basis, whether such corrective action items reflect any trends in licensee
performance (16 to 24 hours per year). The total increase for these new
requirements is about 198 to 206 hours per reactor per year.
o A new NRC requirement that its resident inspectors validate that
licensees comply with additional inspection commitments made in response
to NRC's 2002 generic bulletin regarding reactor pressure vessel head and
vessel head penetration nozzles. This requirement results in an additional
15 to 50 hours per reactor per fuel outage.
5Of NRC's 21 high priority recommendations, we categorized 1
recommendation as 2 so that we could better track actions taken to
implement it. Thus, we have 22 recommendations categorized as high
priority.
Appendix IV
Comments from the Nuclear Regulatory
Commission
25. Our draft report included a discussion that NRC management's failure
to recognize the scope or breadth of actions and resources necessary to
fully implement task force recommendations could adversely affect how
effective the actions may be. We made this statement based on NRC's
initial response to the Office of the Inspector General's October 2003
report on Davis-Besse.6 That report concluded that ineffective
communication within NRC's Region III and between Region III and NRC
headquarters contributed to the Davis-Besse incident. NRC, in its January
2004 response to the report, stated that among other things, it had
developed training on boric acid corrosion and revised its inspection
program to require semi-annual trend reviews. In February 2004, the Office
of the Inspector General criticized NRC for limiting the agency's efforts
in responding to its findings. Specifically, it stated that NRC did not
address underlying and generic communication failures identified in the
Office's report. In response to the criticism, on April 19, 2004 (while
our draft report was with NRC for review and comment), NRC provided the
Office of the Inspector General with additional information to demonstrate
that its actions to improve communication within the agency were broader
than indicated in the agency's January 2004 response. Based on NRC's April
19, 2004, response and the Office's agreement that NRC's actions
appropriately address its concerns about communication within the agency,
we deleted this discussion in the report.
26. We recognize that the lessons-learned task force did not make a
recommendation for improving the agency's decision-making process because
the task force coordinated with the Office of the Inspector General
regarding the scope of their respective review activities and because the
task force was primarily charged with determining why the vessel head
degradation was not prevented. (See p. 55.)
27. We agree that NRC's December 3, 2002, documentation of its decision
was prepared in response to a finding by the Davis-Besse lessonslearned
task force. We revised our report to incorporate this fact. (See
p. 55.)
28. We agree that NRC's lessons-learned task force conducted a preliminary
review of reports from previous lessons-learned task forces
6NRC, Office of the Inspector General, NRC's Oversight of Davis-Besse
during the 2000 Refueling Outage (Washington, D.C.: Oct. 17, 2003).
Appendix IV
Comments from the Nuclear Regulatory
Commission
and, as a result of that review, made a recommendation that the agency
perform a more detailed effectiveness review of the actions taken in
response to those reviews. We revised the report to reflect that NRC's
detailed review is currently underway. (See p. 55.)
Appendix V
GAO Contacts and Staff Acknowledgments
GAO Contacts Jim Wells, (202) 512-3841 Ray Smith, (202) 512-6551
Staff In addition, Heather L. Barker, David L. Brack, William F. Fenzel,
Michael L. Krafve, William J. Lanouette, Marcia Brouns McWreath, Judy K.
Pagano,
Acknowledgments Keith A. Rhodes, and Carol Hernstadt Shulman made key
contributions to this report.
Related GAO Products
Management Weaknesses Affect Nuclear Regulatory Commission Efforts to
Address Safety Issues Common to Nuclear Power Plants.
GAO-RCED84-149.Washington, D.C.: September 19, 1984.
Probabilistic Risk Assessment: An Emerging Aid to Nuclear Power Plant
Safety Regulation. GAO-RCED-85-11. Washington, D.C.: June 19, 1985.
The Nuclear Regulatory Commission Should Report on Progress in
Implementing Lessons Learned from the Three Mile Island Accident.
GAO-RCED-85-72. Washington, D.C.: July 19, 1985.
Nuclear Regulation: Oversight of Quality Assurance at Nuclear Power Plants
Needs Improvement. GAO-RCED-86-41.Washington, D.C.: January 23, 1986.
Nuclear Regulation: Efforts to Ensure Nuclear Power Plant Safety Can Be
Strengthened. GAO-RCED-87-141. Washington, D.C.: August 13, 1987.
Nuclear Regulation: NRC's Restart Actions Appear Reasonable-but Criteria
Needed. GAO-RCED-89-95.Washington, D.C.: May 4, 1989.
Nuclear Regulation: NRC's Efforts to Ensure Effective Plant Maintenance
Are Incomplete. GAO-RCED-91-36. Washington, D.C.: December 17, 1990.
Nuclear Regulation: NRC's Relationship with the Institute of Nuclear Power
Operations. GAO-RCED-91-122. Washington, D.C.: May 16, 1991.
Nuclear Regulation: Weaknesses in NRC's Inspection Program at a South
Texas Nuclear Power Plant. GAO-RCED-96-10. Washington, D.C.: October 3,
1995.
Nuclear Regulation: Preventing Problem Plants Requires More Effective NRC
Action. GAO-RCED-97-145. Washington, D.C.: May 30, 1997.
Nuclear Regulatory Commission: Preventing Problem Plants Requires More
Effective Action by NRC. GAO-T-RCED-98-252. Washington, D.C.: July 30,
1998.
Nuclear Regulatory Commission: Strategy Needed to Develop a Risk-Informed
Safety Approach. GAO-T-RCED-99-71. Washington, D.C.: February 4, 1999.
Related GAO Products
Nuclear Regulation: Strategy Needed to Regulate Safety Using Information
on Risk. GAO-RCED-99-95. Washington, D.C.: March 19, 1999.
Nuclear Regulation: Regulatory and Cultural Changes Challenge NRC.
GAO/T-RCED-00-115. Washington, D.C.: March 9, 2000.
Major Management Challenges and Performance Risks at the Nuclear
Regulatory Commission. GAO-01-259. Washington, D.C.: January 2001.
Nuclear Regulation: Progress Made in Emergency Preparedness at Indian
Point 2, but Additional Improvements Needed. GAO-01-605. Washington, D.C.:
July 30, 2001.
Nuclear Regulation: Challenges Confronting NRC in a Changing Regulatory
Environment. GAO-01-707T. Washington, D.C.: May 8, 2001.
Nuclear Regulatory Commission: Status of Achieving Key Outcomes and
Addressing Major Management Challenges. GAO-01-760. Washington, D.C.: June
29, 2001.
Managing for Results: Efforts to Strengthen the Link between Resources and
Results at the Nuclear Regulatory Commission. GAO-03-258. Washington,
D.C.: December 10, 2002.
Nuclear Regulatory Commission: Oversight of Security at Commercial Nuclear
Power Plants Needs to Be Strengthened. GAO-03-752. Washington, D.C.:
September 4, 2003.
GAO's Mission The General Accounting Office, the audit, evaluation and
investigative arm of Congress, exists to support Congress in meeting its
constitutional responsibilities and to help improve the performance and
accountability of the federal government for the American people. GAO
examines the use of public funds; evaluates federal programs and policies;
and provides analyses, recommendations, and other assistance to help
Congress make informed oversight, policy, and funding decisions. GAO's
commitment to good government is reflected in its core values of
accountability, integrity, and reliability.
Obtaining Copies of GAO Reports and Testimony
The fastest and easiest way to obtain copies of GAO documents at no cost
is through the Internet. GAO's Web site (www.gao.gov) contains abstracts
and fulltext files of current reports and testimony and an expanding
archive of older products. The Web site features a search engine to help
you locate documents using key words and phrases. You can print these
documents in their entirety, including charts and other graphics.
Each day, GAO issues a list of newly released reports, testimony, and
correspondence. GAO posts this list, known as "Today's Reports," on its
Web site daily. The list contains links to the full-text document files.
To have GAO e-mail this list to you every afternoon, go to www.gao.gov and
select "Subscribe to e-mail alerts" under the "Order GAO Products"
heading.
Order by Mail or Phone The first copy of each printed report is free.
Additional copies are $2 each. A check or money order should be made out
to the Superintendent of Documents. GAO also accepts VISA and Mastercard.
Orders for 100 or more copies mailed to a single address are discounted 25
percent. Orders should be sent to:
U.S. General Accounting Office 441 G Street NW, Room LM Washington, D.C.
20548
To order by Phone: Voice: (202) 512-6000 TDD: (202) 512-2537 Fax: (202)
512-6061
To Report Fraud, Contact:
Web site: www.gao.gov/fraudnet/fraudnet.htmWaste, and Abuse in E-mail:
[email protected] Federal Programs Automated answering system: (800)
424-5454 or (202) 512-7470
Public Affairs Jeff Nelligan, Managing Director, [email protected] (202)
512-4800 U.S. General Accounting Office, 441 G Street NW, Room 7149
Washington, D.C. 20548
Presorted Standard
Postage & Fees Paid
GAO
Permit No. GI00
United States
General Accounting Office
Washington, D.C. 20548-0001
Official Business
Penalty for Private Use $300
Address Service Requested
*** End of document. ***