Nuclear Regulation: Preventing Problem Plants Requires More Effective NRC
Action (Letter Report, 05/30/97, GAO/RCED-97-145).
Pursuant to a congressional request, GAO reviewed the Nuclear Regulatory
Commission's (NRC) oversight of the nuclear power industry, focusing on:
how NRC: (1) defines nuclear safety; (2) measures and monitors the
safety condition of nuclear plants; and (3) uses its knowledge of safety
conditions to ensure the safety of nuclear plants.
GAO noted that: (1) to achieve NRC's safety mission, it is critical that
NRC maintain a high degree of confidence in its regulatory program's
ability to ensure that the nuclear industry performs to high safety
standards; (2) while GAO is not making judgments on the safety of
plants, the many safety problems identified in some plants raises
questions about whether NRC's regulatory program is working as it
should; (3) determining the safety of plants is difficult because NRC
does not precisely define safety; (4) instead, NRC presumes that plants
are safe if they operate within their approved designs and in accordance
with NRC's regulations; (5) according to recent findings in some plants,
NRC is no longer confident that all plants are still operating as
designed and is requiring all 110 nuclear plant licensees to certify
that they are maintaining their plants in accordance with their approved
plant designs; (6) NRC is also concerned that as nuclear plant owners
pursue cost-cutting strategies to meet future competition, safety
priorities may be jeopardized; (7) NRC is responsible for laying out
clear requirements for operating nuclear plants and for overseeing its
licensees to ensure that they are performing as they should; (8) NRC has
on-site inspectors that prepare reports on the plants' activities about
every 6 weeks, and comprehensive assessments are assembled every 12 to
24 months for all nuclear plants; (9) NRC also collects and publishes
safety performance indicators; (10) these data, which are supplied by
the licensees, show that the overall safety performance of the nuclear
industry, is good and improving but that some plants are chronically
poor performers; (11) currently, NRC has placed 14 nuclear plants on its
"Watch List," which includes those plants whose declining safety
performance triggers additional oversight attention by NRC; (12) 37
percent of the nation's nuclear plants have been on the list at some
point over the past 11 years, and many of these plants have stayed on
the list for many years; (13) for some plants, NRC has not taken
aggressive enforcement action to force the licensees to fix their
long-standing safety problems on a timely basis; (14) as a result, the
plants' conditions have worsened, making safety margins smaller; (15)
NRC's ongoing reforms, which include expanding its inspection program
and revamping its process for identifying plants with long-standing saf*
--------------------------- Indexing Terms -----------------------------
REPORTNUM: RCED-97-145
TITLE: Nuclear Regulation: Preventing Problem Plants Requires More
Effective NRC Action
DATE: 05/30/97
SUBJECT: Nuclear powerplant safety
Energy industry
Safety standards
Safety regulation
Inspection
Electric utilities
Quality assurance
Accountability
Reporting requirements
Fines (penalties)
IDENTIFIER: Salem Generating Station (NJ)
Millstone Nuclear Power Station (CT)
Cooper Nuclear Station (NE)
NRC Watch List
NRC Systematic Assessment of Licensee Performance Program
**************************************************************************
* This file contains an ASCII representation of the text of a GAO *
* report. Delineations within the text indicating chapter titles, *
* headings, and bullets are preserved. Major divisions and subdivisions *
* of the text, such as Chapters, Sections, and Appendixes, are *
* identified by double and single lines. The numbers on the right end *
* of these lines indicate the position of each of the subsections in the *
* document outline. These numbers do NOT correspond with the page *
* numbers of the printed product. *
* *
* No attempt has been made to display graphic images, although figure *
* captions are reproduced. Tables are included, but may not resemble *
* those in the printed version. *
* *
* A printed copy of this report may be obtained from the GAO Document *
* Distribution Facility by calling (202) 512-6000, by faxing your *
* request to (301) 258-4066, or by writing to P.O. Box 6015, *
* Gaithersburg, MD 20884-6015. We are unable to accept electronic orders *
* for printed documents at this time. *
**************************************************************************
Cover
================================================================ COVER
Report to Congressional Requesters
May 1997
NUCLEAR REGULATION - PREVENTING
PROBLEM PLANTS REQUIRES MORE
EFFECTIVE NRC ACTION
GAO/RCED-97-145
NRC's Oversight of Nuclear Power Plants
(170270)
Abbreviations
=============================================================== ABBREV
AIT - Augmented Inspection Team
GAO - General Accounting Office
OIG - Office of Inspector General
NRC - Nuclear Regulatory Commission
NU - Northeast Utilities
PSE&G - Public Service Electric and Gas Company
RAP - Restart Action Plan
SMM - Senior Management Meeting
SALP - Systematic Assessment of Licensee Performance
Letter
=============================================================== LETTER
B-276754
May 30, 1997
The Honorable Joseph I. Lieberman
United States Senate
The Honorable Joseph R. Biden, Jr.
United States Senate
As requested, we reviewed the Nuclear Regulatory Commission's (NRC)
oversight of the nuclear power industry. NRC, an independent agency
created by the Congress in 1974, is responsible for, among other
things, ensuring that the operation of the nation's 110 commercial
nuclear power plants occurs in a manner that adequately protects the
health and safety of the public. Identifying plants with safety
problems and making sure that the owners of the plants (licensees)
correct their safety deficiencies promptly is critical to NRC's
safety mission.
As agreed with your offices, we focused our review on how NRC
defines nuclear safety,
measures and monitors the safety condition of nuclear plants, and
uses its knowledge of safety conditions to ensure the safety of
nuclear plants.
As part of our work, we looked at three plants that had long-standing
histories of uncorrected safety concerns. Specifically, as agreed
with your offices, we focused on the Salem Generating Station (Salem)
in Salem, New Jersey; the Millstone Nuclear Power Station (Millstone)
near New London, Connecticut; and the Cooper Nuclear Station (Cooper)
near Brownville, Nebraska. We chose these three facilities because
of your concerns that some nuclear plants have reached serious states
of decline despite NRC's oversight efforts. The Millstone and Salem
plants were shut down by their licensees because they violated NRC
regulations. The licensees of these plants must address many
long-standing safety problems before NRC will allow them to restart
operations. Cooper is currently operating but was shut down by its
licensee in 1994 because of safety concerns. As with Millstone and
Salem, Cooper could not restart without NRC's approval. (App. I
describes NRC's regulatory program; apps. II, III, and IV describe
these facilities in more detail.)
RESULTS IN BRIEF
------------------------------------------------------------ Letter :1
To achieve NRC's safety mission, it is critical that the Commission
maintain a high degree of confidence in its regulatory program's
ability to ensure that the nuclear industry performs to high safety
standards. While we are not making judgments on the safety of
plants, the many safety problems identified in some plants raises
questions about whether NRC's regulatory program is working as it
should. Determining the safety of plants is difficult because NRC
does not precisely define safety. Instead, NRC presumes that plants
are safe if they operate within their approved designs and in
accordance with NRC's regulations. Because of the many redundant
safety systems built into the plants' designs, NRC believes that
plants are safe to operate even when some of their safety systems are
not working properly. However, according to recent findings in some
plants, including Millstone, NRC is no longer confident that all
plants are still operating as designed and is requiring all 110
nuclear plant licensees to certify that they are maintaining their
plants in accordance with their approved plant designs. NRC is also
concerned that as nuclear plant owners pursue cost-cutting strategies
to meet future competition, safety priorities may be jeopardized.
NRC is responsible for laying out clear requirements for operating
nuclear plants and for overseeing its licensees to ensure that they
are performing as they should. NRC has on-site inspectors that
prepare reports on the plants' activities about every 6 weeks, and
comprehensive assessments are assembled every 12 to 24 months for all
nuclear plants. NRC also collects and publishes safety performance
indicators, such as the number of safety system failures at all
plants. These data, which are supplied by the licensees, show that
the overall safety performance of the nuclear industry, as a whole,
is good and improving but that some plants are chronically poor
performers. Currently, NRC has placed 14 nuclear plants on its
"Watch List," which includes those plants whose declining safety
performance triggers additional oversight attention by NRC. This is
the highest number of plants on NRC's Watch List since 1988.
Thirty-seven percent of the nation's nuclear plants have been on
NRC's Watch List at some point over the past 11 years, and many of
these plants have stayed on the Watch List for many years. For
example, Units 1 and 3 at the Browns Ferry site in Alabama have been
on the Watch List for 10 years, and Dresden's two plants in Illinois
have been on the Watch List for 7 years.
For some plants, NRC has not taken aggressive enforcement action to
force the licensees to fix their long-standing safety problems on a
timely basis. As a result, the plants' conditions have worsened,
making safety margins smaller. For example, Salem, Millstone, and
Cooper were closed for safety deficiencies. In each of these cases,
NRC's inspection records show a pattern of licensees that are not
adequately identifying and correcting their plants' safety
deficiencies over long periods of time. NRC allowed safety problems
to persist because it was confident that redundant design features
kept plants inherently safe and because it relied heavily on the
licensees' promises to make changes. NRC forced the licensees to
correct their problems only after the licensees voluntarily shut down
plants. In addition, NRC lacks a process for ensuring that the
licensee uses competent managers, which is widely recognized by NRC
and industry officials as important to ensuring plants' safe
performance. Finally, NRC was slow in placing plants on its Watch
List, which it uses to trigger more regulatory attention at an early
stage so that a plant's performance conditions can be improved.
Salem was not placed on the Watch List until after the licensee shut
it down for safety reasons. Millstone was eventually placed on the
Watch List years after first being recognized as having many safety
problems. Cooper was never on the Watch List, even though it was
shut down by the licensee in 1994 because of many safety
deficiencies.
NRC's ongoing reforms, which include expanding its inspection program
and revamping its process for identifying plants with long-standing
safety problems, show a strong commitment by the current Chairman and
Commission to strengthen the Commission's oversight capability.
However, changing NRC's culture of tolerating problems will not be
easy. Achieving fundamental reform starts with holding the licensees
accountable for fixing their plants' problems more promptly and
addressing management issues more directly.
BACKGROUND
------------------------------------------------------------ Letter :2
Under the authority of the Atomic Energy Act, the NRC licenses the
construction and operation of nuclear power plants; develops,
implements, and enforces the rules and regulations that govern
nuclear activities; inspects facilities to ensure compliance with
legal requirements; and conducts research to support its programs.
NRC also maintains at least two inspectors at every operating nuclear
reactor site and supplements their inspection activities with staff
from any of its four regions and from NRC headquarters.
NRC's fiscal year 1997 budget is estimated at $477 million. Its
staff of about 3,000 is responsible to five Commissioners appointed
by the President and approved by the Senate. About 55 percent of
NRC's professional staff is dedicated to nuclear reactor activities.
The 110 licensed nuclear plants operate in 32 states and provide
about 22 percent of the nation's electricity. Six states
(Connecticut, New Jersey, Maine, Vermont, South Carolina, and
Illinois) rely on nuclear power for over half of their electricity.
The utility companies that own and operate nuclear plants include
both public and private enterprises.
Utility experts agree that aggressively attending to safety
deficiencies is good business strategy because safety problems are a
significant economic burden on both licensees and ratepayers. Plants
that perform poorly must shut down for repairs more often than those
that perform well. According to NRC, a shutdown costs a licensee
between $249,000 and $310,000 per day in operating costs and in
purchases of alternate power. Also, NRC reports that the nuclear
industry has matured to the point that plants have been in operation
long enough for reactors' aging to be a major issue that can affect
cost and safety. Aging affects all of a plant's structures, systems,
and components. These conditions can cause safety concerns that, if
not appropriately addressed, would require a licensee to shut down
the plant.
NRC officials are also worried that safety levels may be compromised
as licensees cut costs to stay competitive. A private research
report concluded that because competition will result in lower
electricity prices in the future, as many as 37 of the nation's
nuclear sites are vulnerable to shutdown because their production
costs are higher than the projected prices in the market.\1
Together, these sites represent over 40 percent of the nuclear
generating capacity of the United States.
--------------------
\1 Nuclear Power Plant Shutdowns and Implications for Future Natural
Gas Demand, Washington International Energy Group (Feb. 1997).
NUCLEAR PLANT SAFETY
------------------------------------------------------------ Letter :3
NRC's statutory obligation when it grants an operating license is to
require sufficient information from the licensee to enable NRC to
"provide adequate protection to the health and safety of the public."
NRC approves the plant's design, monitors the plant's performance,
reports on conditions, and inspects the plant to ensure compliance
with its regulations as part of its statutory responsibility. NRC
has three primary enforcement sanctions--notices of violation; civil
penalties; and orders to modify, suspend, or revoke licenses:
A notice of violation informs the licensee of one or more
violations of legal or regulatory requirements.
Depending on the severity of the violation, a notice can be
accompanied by a civil penalty (fine) of up to $110,000 per
violation per day. The amount of the fine, if any, depends on
the safety significance of the violation and on the licensee's
responsiveness to the violation, including any corrective action
that the licensee has already taken. In fiscal year 1996, NRC
levied fines totaling $3,700,000 on 28 plants; Salem led all
plants with fines of $600,000.
NRC uses orders to demand more information from the licensees
concerning potential hazardous conditions, in more severe cases
to require a licensee to shut down or, to prevent a licensee
from restarting its plant's reactors if the NRC feels it would
be prudent to force the licensee to fix an accumulation of
safety problems while the reactors are idle.
Only once in its history has NRC issued an order to shut down an
operating plant (Peach Bottom, Pennsylvania, in 1987). On other
occasions, NRC issued a shut down order after the licensee suspended
operations. Typically, licensees shut down a plant when they violate
certain regulations or their plant specifications. They may also
shut down a plant if they believe such an action is appropriate for
safety reasons, usually as a result of substantial involvement by
NRC. Once a plant is shut down, NRC can keep it shut down until the
licensee addresses its problems to NRC's satisfaction. NRC can also
place plants on its Watch List when the plants' performance
indicators and other data show a pattern of deteriorating safety
performance. This action prompts additional oversight by NRC and
more intensive inspection activity.
NRC's regulations and other guidance do not provide either the
licensees or the public with the specific definitions and conditions
that define the safety of a plant. According to NRC, nuclear plants
are presumed to be safe if they operate as designed. NRC reasons
that the many safety features and systems built into a plant's design
provide an adequate level of safety, even when some of them are not
functioning. System redundancies--the duplication of a plant's
safety systems and components--provide in-depth protection to help
prevent an accident from releasing radiation to the public. The
concept of defense-in-depth forms the foundation of NRC's confidence
that nuclear plants are safe, even those that may be shut down for
safety problems.
The conditions found at Millstone, however, have challenged NRC's
confidence that it can rely on licensees to ensure that the plants
are operating within their approved design basis. In 1996, NRC
discovered that Millstone had been operating outside of its plant
design for many years, a condition that contributed to the licensee's
decision to shut down the plant. NRC's on-site inspectors were
unaware of the extent to which Millstone was operating outside of its
design basis because, according to NRC's Chairman, the agency stopped
doing design basis inspections too early (NRC is now re-emphasizing
design basis issues in its inspection program). The Chairman also
said that NRC should have put more resources into discovering the
problems at Millstone at an earlier stage. Concerned that
Millstone's conditions exist in other plants, NRC is now no longer
confident that all nuclear plants have accurate information on the
extent to which they are operating as designed. As a result, NRC is
requiring all licensees to certify that they are in compliance with
their approved design basis.\2 At the time of our review, the
licensees were in the process of reporting back to NRC on this
requirement.
--------------------
\2 A plant is designed to operate according to a "design basis,"
which includes the specific functions to be performed by the plant's
structure, systems, and components.
NRC'S SAFETY PERFORMANCE DATA
SHOW THAT SEVERAL PLANTS ARE
POOR PERFORMERS
------------------------------------------------------------ Letter :4
NRC collects an enormous amount of information on nuclear plants,
both from its own inspectors and from the nuclear plant licensees.
Taken together, these sources provide NRC with an extensive knowledge
base with which to measure and monitor a plant's safety conditions
and safety performance. These data characterize an industry that has
improving safety trends overall but that also has several chronically
poor performers.
INSPECTIONS AND PERFORMANCE
INDICATORS PROVIDE EXTENSIVE
INFORMATION ON NUCLEAR PLANT
SAFETY CONDITIONS AND
PERFORMANCE
---------------------------------------------------------- Letter :4.1
NRC's on-site inspectors prepare reports about every 6 weeks on a
plant's performance, using a comprehensive guide covering the aspects
of nuclear plant operations. These reports are then rolled up into a
Systematic Assessment of Licensee Performance (SALP) approximately
every 12 to 24 months. SALPs, which form NRC's basic performance
rating for each nuclear plant, cover broad areas, including
operations, maintenance, and engineering. NRC also conducts special
inspections if they are warranted by a plant's conditions. The
plants with histories of poor performance are often the subject of
additional inspection activity (app. I describes SALPs and other
inspection activities in more detail). NRC also prepares a summary
of plant performance at least every 6 months. NRC uses the summary
as a guide for determining the plants' need for additional inspection
attention. In addition to these NRC activities, licensees report
daily to NRC on the plants' conditions and events. Unusual events,
such as equipment failures and accidents, are included in these daily
reports.
Performance indicators are an important tool to gauge plants' safety
trends. Following a series of events, including the Three Mile
Island nuclear accident and a loss of feedwater at the Davis-Besse,
Ohio, plant, NRC developed eight indicators for monitoring the safety
performance of licensees (see app. I for a description of these
indicators). The indicators were needed, according to NRC, to
improve its ability to predict declining performance. Collected
quarterly from the plants' reports, the indicators cover many safety
performance aspects of operating reactors, such as the number of
safety system failures and the extent of workers' exposure to
radiation.
SEVERAL PLANTS CONTINUALLY
PERFORM POORLY
---------------------------------------------------------- Letter :4.2
While NRC's indicators show generally improving safety conditions
throughout the nuclear power industry, the indicators on a
plant-specific basis also show that several nuclear power plants
continue to plague NRC with chronically poor performance. Currently,
14 plants are on NRC's Watch List, which contains those plants
identified by NRC as needing close attention because of their
declining performance.\3 This is the highest number of problem plants
listed since 1988 (see fig. 1).
Figure 1: The History of NRC's
Watch List
(See figure in printed
edition.)
Source: GAO's analysis of NRC's data.
Over the past 11 years, 41 plants, or 37 percent of the nation's
nuclear power plants, have been placed on the Watch List by NRC, as
shown in figure 2.
Figure 2: The Nuclear Plants
on NRC's Watch List
(See figure in printed
edition.)
Source: GAO's analysis of NRC's data.
Twenty-four plants have been on the Watch List for 2 or more years.
However, about half of the plants that NRC placed on the Watch List
were known by NRC to be poor performers long before they were placed
on the list. NRC's senior managers formally discuss plants that are
experiencing declining safety performance. Although about half of
these plants are eventually placed on the Watch List, NRC has not
precisely defined the criteria for when a plant is formally discussed
and/or placed on the Watch List. Salem and Millstone were under
discussion by NRC for 3 to 4 years before they were placed on the
Watch List in 1996 and 1997, respectively. NRC discussed Cooper as a
problem plant but never placed it on the Watch List. In their letter
commenting on a draft of this report, NRC said that 43 other plants
have been discussed but not placed on the Watch List (see app. V for
NRC's letter).
--------------------
\3 NRC develops the Watch List semi-annually at its Senior Management
Meeting, which is discussed in more detail later in this report.
NRC IS NOT EFFECTIVELY
OVERSEEING THE PLANTS THAT HAVE
PROBLEMS
------------------------------------------------------------ Letter :5
Our review of three facilities with a history of poor performance
shows that NRC has not gotten licensees to fix safety problems at
these plants in a timely manner. Identifying and correcting safety
deficiencies are among the licensees' most important safety
responsibilities and a major focus of NRC's inspection program. Yet
NRC allows licensees repeated opportunities to correct their safety
problems, often waiting for a significant problem or series of events
to occur at a plant before taking tough enforcement action. We found
that NRC fined licensees, in some cases long after problems became
apparent, and was very slow to place problem plants on its Watch
List. NRC also lacks an effective process for ensuring that
licensees have competent management in place, which is considered by
NRC and nuclear experts as an important influence on a plant's safety
performance. Finally, the Senior Management Meeting process, a tool
created by NRC to provide an early warning of problem plants, is not
working effectively.
NRC IS NOT GETTING LICENSEES
TO FIX DEFICIENCIES IN A
TIMELY MANNER
---------------------------------------------------------- Letter :5.1
NRC's regulations require nuclear plants to have an effective program
to "assure that conditions adverse to quality . . . are promptly
identified and corrected." NRC places importance on evaluating
plants' corrective action programs to ensure that they will lead to
timely correction of the identified problems. However, in all three
facilities we examined (Millstone, Salem, and Cooper), the licensees
did not fix their substantial and recurring safety problems in a
timely manner. For example, NRC concluded in its 1995 performance
review of Salem that
". . . overall performance has declined and . . . the
challenges to plant systems and operators caused by repetitive
equipment problems and personnel errors . . . had the
potential to, or actually did, adversely affect plant or
personnel safety."
Of the 43 deficiencies that NRC required to be addressed before the
Salem reactors can be restarted, all but 5 were conditions that were
present when the reactor was operating. Two of these deficiencies
had been continuing problems for 6 to 7 years--a control air system
and circulating water for a motor--and one had been on NRC's followup
system since 1989 and was addressed in three separate NRC inspection
reports. The licensee has identified approximately 31,000 work items
that it feels should be completed before restarting the units.
Similarly, at Millstone, a special NRC inspection team reported in
1996 that it found several instances in which the licensee failed to
identify safety problems and lacked an adequate system to track
corrective actions. The team also reported that the licensee
inappropriately closed corrective actions before they were completed.
A former Senior Resident Inspector at Millstone told us that the
plant's managers were notoriously late in correcting problems. Also,
the unpublished 1995 SALP on Millstone was very critical of
Millstone's inattention to a growing backlog of unresolved safety
concerns.\4
Like Salem's, Millstone's problems were also long-standing and well
known to NRC. Moreover, NRC acknowledges that Millstone's
performance declined for years before the plant was first discussed
as a potential Watch List candidate in 1991. In a 1990 meeting in
which NRC officials determined which plants should be placed on the
Watch List, they noted that "[Millstone] . . . has acknowledged
that weaknesses existed prior to 1991 in their programs for timely
resolution and reporting of deficiencies." A former Millstone Senior
Resident Inspector also told us that he saw performance slip over
several years as maintenance backlogs grew, violations increased, and
management's responsiveness to NRC waned. He also said that NRC
should have pursued more aggressive enforcement action. A 1996
independent auditor's report summed up the Millstone situation as
follows:
"[Millstone's] attempts to regain [confidence that it can
operate safely] will be complicated by the fact that the NRC has
also publicly admitted that, by failing to take more aggressive
action against [Millstone] over the years, the agency itself has
lost the confidence of the public it serves."\5
Similarly, problems in identifying and correcting the deficiencies at
Cooper were long-standing and were well known to NRC. Cooper was
shut down for 9 consecutive months in 1994 and 1995 because of safety
system failures that were, according to NRC, of long standing. Some
of Cooper's problems dated back to the plant's first start-up in
1974--problems that Cooper's management should have addressed years
earlier, according to the NRC inspectors we interviewed. An NRC
audit reported that the plant's managers were "living with problems,
not fixing them" and that "ineffective self-assessment" and a "weak
corrective action program" characterized operations.
Several reasons may account for why NRC tolerated safety problems in
these plants. As previously discussed, NRC believes that the
multiple safety systems gives NRC and its licensees confidence that
plants are safe even when they have many safety problems. Therefore,
unless an accident or serious event poses an obvious safety or health
risk to workers or the public, NRC appears reluctant to take swift
enforcement action. In addition, since NRC does not precisely define
safety, perceptions of safety levels and risk are subjective and are
not always consistent from inspector to inspector. Several current
and former NRC inspectors told us that they cannot easily distinguish
a safe plant from an unsafe one and that the guidance on when to shut
down a plant does not cover all situations. Finally, as discussed
below, NRC inspectors are heavily influenced by licensees' promises
to fix identified problems. As a result, NRC inspectors allow
licensees' managers considerable time and effort to fix a problem
before enforcement action is considered.
NRC's Chairman has expressed concern about the consequences of NRC's
past patience with licensees. The Chairman has stated that nuclear
plant safety is based on full compliance with all of NRC's
regulations.
--------------------
\4 In accordance with NRC's policy, Millstone's latest performance
assessment was not published because Millstone is shut down.
\5 Focused Audit of the Connecticut Light and Power Company: Nuclear
Operations, prepared for the State of Connecticut's Department of
Public Utility Control (Dec. 31, 1996).
RELYING ON PLANT MANAGERS TO
FIX PROBLEMS IS NOT ALWAYS
EFFECTIVE
---------------------------------------------------------- Letter :5.2
NRC gives licensees considerable latitude to fix their problems.
This strategy works well when the licensees' managers place priority
on maintaining a strong safety culture. However, we found that this
condition was not present in the problem plants we examined and that
the conditions worsened when NRC did not hold the licensees
accountable for fixing their problems.
For example, Salem's managers developed several action plans over
time to correct deficiencies and, at one point, established an
independent team to evaluate why prior action plans had failed to
correct ongoing problems. Salem also made changes to its senior
management team several times and met with NRC officials many times
with promises to make improvements. After several years of recurring
problems, management changes, and disappointing action plans,
failures in several of the plant's safety systems forced the managers
to shut down the plant. NRC then stepped in and conditioned
restarting the plants on correcting previously identified problems.
Similar conditions existed at Cooper. Relying on the licensee's
promises to fix the problems, NRC allowed Cooper to restart its
reactors after the plant was shut down in 1994. After a period of
improvement over several months, the plant's performance quickly
declined. A subsequent NRC audit report discovered that many of the
safety problems that Cooper's management had promised to correct had
not been corrected. NRC inspectors told us that NRC's restart
decision relied not only on Cooper's plans and promises, but also on
Cooper's monitoring its own progress.
At Millstone, NRC relied on the licensee's plans to correct deficient
conditions without success. The NRC's OIG found that
"[Millstone's] change in program initiatives and management
reorganizations lulled the NRC staff into allowing an excessive
amount of time for [the licensee's] proposed corrective actions
to take effect. [Millstone's] sporadic improvements in some
areas neutralized the NRC staff's willingness to take prompt
action."\6
The OIG also noted that Millstone managers would often identify a
problem and develop a "grandiose" plan to address the issue.
Although some improvement would occur, permanent change was never
achieved. According to the OIG, NRC would then take a "year or two"
to determine the effectiveness of the plan or a change in management.
A Connecticut State audit described how NRC was influenced by
management's promises and was reluctant to place Millstone on its
Watch List:
"The NRC did not advance any of the Millstone units to its Watch
List, as various combinations of improvement initiatives and
management changes led the NRC to believe that sustained
improvements at the site would be forthcoming."\7
A 1993 incident at Millstone illustrates how NRC's tolerance of the
efforts of the licensee's management to fix problems can affect
safety. A May 1993 leak in a high-pressure steam line was discovered
by workers at the plant. To avoid shutting down the reactor to fix
this valve, workers made about 30 unsuccessful attempts over 74 days
to fix the leak. Eventually, the workers' attempts worsened the
condition, causing the reactor to be shut down. NRC later fined
Millstone $237,500 for its actions, referencing three violations of
the law and noting the "egregious" nature of this event, which NRC
said had placed the workers at an unacceptable level of risk. NRC
inspectors and regional management were aware of the attempts to fix
the leak but took no immediate action, deferring instead to the
management's efforts to make repairs. An NRC inspector assigned to
Millstone during this incident told us that NRC should have taken
more aggressive enforcement action at the time. He also told us that
NRC's Senior Resident Inspector had recommended a shut down but was
overruled by regional management, who believed there was not a
regulatory basis for shutting down the plant. NRC's former Executive
Director of Operations, told us that he would have ordered the
reactor shut down immediately if he had known that the plant's
managers were struggling to fix a problem that had potentially very
serious safety consequences.
--------------------
\6 Management Implications Report-NRC Staff Handling of
Millstone/Maine Yankee Issues, Office of Inspector General, NRC
(98/MIR-1, June 13, 1996).
\7 Focused Audit of the Connecticut Light and Power Company: Nuclear
Operations, prepared for the State of Connecticut Department of
Public Utility Control (Dec. 31, 1996).
NRC ENFORCEMENT ACTIONS ARE
TOO LATE TO BE EFFECTIVE
---------------------------------------------------------- Letter :5.3
NRC's enforcement program is designed to ensure compliance with NRC's
regulations, obtain prompt correction of violations, deter future
violations, and encourage licensees to operate their plants safely.
Salem, Millstone, and Cooper were all fined amounts well above the
industry average (see fig. 3). However, Salem's fines were levied
by NRC well after the plants were in periods of significant decline.
Furthermore, NRC still has not completed its enforcement action
against Millstone for violations that were first discovered in 1995,
partially due to, according to NRC, the need for close coordination
with the U.S. Attorney for consideration of criminal prosecution.
Figure 3: Fines That NRC
Levied Against Three Nuclear
Plants
(See figure in printed
edition.)
Source: GAO's analysis of NRC's data.
Another NRC enforcement action is to prevent shutdown plants from
restarting until all of their safety deficiencies are addressed.
This is an effective strategy for correcting long-standing problems.
Unfortunately, this NRC action sometimes occurs long after plants'
performances are in significant decline. Usually, a specific
incident or a series of problems causes plants to shut down. The
economic impact of keeping a plant idle--$249,000 to $310,000
daily--is significantly more than the fines levied on a licensee.
THE IMPORTANCE OF QUALITY
MANAGEMENT TO A PLANT'S
SAFETY PERFORMANCE
---------------------------------------------------------- Letter :5.4
The nuclear industry and NRC officials widely agree that the
competency of a nuclear plant's management is a critical factor in
safety performance. Despite the importance of management, NRC does
not have an effective process for ensuring that licensees maintain
competent management in their nuclear plants. Although NRC's
regulations do not require the evaluation of plant management before
a license to operate a nuclear plant can be issued, NRC must
determine if the prospective licensee is "technically and financially
qualified to engage in the activities authorized by the operating
license . . . ." These are important components of management that
could also be part of a licensee's overall ability to manage a
facility competently on an ongoing basis.
NRC's audits frequently cite management weaknesses as the major cause
of the declining performance of nuclear plants. For example, NRC's
audits made many references to management's performance in the
Commission's reviews of why conditions deteriorated at Cooper,
including a "poor management safety culture," "weak management
oversight of engineering programs," a "fragmented approach" to
problem resolution, and failure to provide an "adequate level of
oversight."\8 Cooper's own self-assessment team also reported many
management-related problems in its 1994 report, including
"management's ineffectiveness in establishing a corporate culture
that encourages the highest standards of safe nuclear plant
operation" and the "failure of management to establish the vision
supported by adequate direction and performance standards to improve
station performance." The self-assessment also noted the ". . .
failure to direct critical self assessment activities that recognize
program and process deficiencies and identify necessary
improvements."\9
At Salem, NRC's audit reports also cited the licensee's management as
a cause of safety problems. Inspection reports indicated that
Salem's problems could have been addressed. We believe a shutdown
could have been avoided if more competent management were in place.
Also, audit reports frequently cited management weaknesses as a root
cause of Salem's performance problems.
The management's decisions in the late 1980s were the cause of
Millstone's current conditions, according to a 1996 comprehensive
review by an independent auditor.\10 Concerned about the need to trim
costs in the face of future competition, the managers chose to manage
close to the regulatory margin. This decision translated into
deferring maintenance and allowing corrective action backlogs to
grow, eventually creating a situation that led to a shutdown and
several hundred million dollars worth of repairs.
Senior NRC managers are aware of the importance of competent
management to safety performance. For example, the NRC Chairman
recently stated that the ". . . recent events at Maine Yankee . .
. resulted in a failure to identify and promptly correct problems
arising in areas that management viewed, not always correctly, as
having low safety significance."\11
From the minutes of NRC's January 1997 public meeting on operating
reactors to discuss the nuclear industry's safety performance (the
Senior Management Meeting), NRC stated that safety performance
problems were found at the LaSalle and Zion nuclear plants in
Illinois and that the principal reasons for the problems were weak
management processes and a lack of management involvement.
Despite the clear importance of management to safety performance, NRC
does not assess management factors in its plant inspection program.
Individual inspection reports specifically avoid any references to
management's competency. NRC's references to management weaknesses
are usually made retrospectively, often after the licensee admits to
management deficiencies, or by NRC audit teams or special
investigations--long after the window of opportunity to provide an
early warning of potential management weaknesses has passed.
NRC's inspection guidance once contained a management assessment
component, but this requirement was eliminated when NRC streamlined
its inspection process in the early 1990s. Both industry and NRC
officials have advised us that management competency is considered
the licensee's responsibility and that NRC lacks the skills and
experience to properly assess management. NRC officials also told us
that they agree that management competency is a key to plant
performance and that they discuss managerial competency in meetings
involving senior NRC management. Furthermore, they cite instances in
which senior NRC officials interact with the licensee's management to
discuss matters that lead to management improvements and, in some
cases, to changes in management.
We recognize the sensitivity of this issue and the technical
challenges posed by assessing management factors. To assess
management, professionals with the proper training and experience
would be needed, along with objective criteria for making judgments.
We also believe that gauging management factors is critical to the
goal of the early identification of the problems in nuclear plants.
A 1996 Arthur Andersen report to NRC agrees. Arthur Andersen noted
the importance of management, stating that "To assess plant
performance proactively, the NRC needs to remain fully aware of plant
management activities."\12 Andersen recommended that NRC hire experts
or train staff to evaluate management performance and changes, which
they viewed as necessary steps to allow NRC to be more proactive.
They also noted that by evaluating management factors (and other
factors as well), NRC would be better positioned to identify problems
earlier, which would in turn reduce safety risks to the public and
lead to an earlier and less costly resolution of problems. NRC is
currently evaluating Arthur Andersen's recommendations.
--------------------
\8 Supplemental Plant Performance Review, NRC (95-04, Oct. 3, 1995).
\9 Diagnostic Self Assessment, Nebraska Public Power District, Cooper
Nuclear Station (Sept. 1, 1994).
\10 Focused Audit of the Connecticut Light and Power Company:
Nuclear Operations, prepared for the State of Connecticut Department
of Public Utility Control (Dec. 31, 1996).
\11 Remarks by NRC Chairman Shirley Jackson, November 7, 1996.
\12 Recommendations to Improve the Senior Management Meeting Process,
Arthur Andersen (Dec. 30, 1996).
THE SENIOR MANAGEMENT
MEETING NEEDS REVAMPING TO
AID EARLY INTERVENTION
---------------------------------------------------------- Letter :5.5
A major tool for intervening in plants before they become major
problems--the Senior Management Meeting (SMM)--is not working
effectively. The SMM process was created in 1986 for the purpose of
providing NRC with an early warning on plants exhibiting declining
performance. SMM meetings, which are held twice every year, include
NRC's senior managers from headquarters and regional directors. Data
on plant performance are drawn from NRC's performance indicator
program and from inspection and audit reports so that senior managers
can take steps to prevent the problems at these plants from
worsening. An important outcome of the SMM is the Watch List. A
plant's inclusion on the Watch List can lead to more oversight by NRC
in the form of additional inspections, letters to licensees
expressing NRC's concern about declining performance, or other
actions. Being on the Watch List also brings significant public
attention to the plant. NRC also prepares a list of plants that are
discussed during its SMM meetings but not placed on the Watch List.
NRC informs the senior management of affected licensees that their
plants were discussed.
The Watch List has not produced a consistent inventory of plants with
performance problems. As noted earlier, Millstone and Salem
exhibited clear performance declines long before NRC placed them on
the Watch List in 1996 and 1997, respectively. Salem was placed on
the Watch List after they were forced to shut down for safety
problems. Millstone was shut down several times before they were
placed on the Watch List. The Watch List actions were far too late
to achieve the objective of "early identification of declining
performance." Other plants that were shut down, such as Cooper and
Haddam Neck, were never on the Watch List. Still other plants, such
as Washington Nuclear Power II, had performance indicators that were
consistently worse than some plants on the Watch List. In fact,
Arthur Andersen identified 10 plants that were not placed on the
Watch List but whose performance indicators are similar to those on
the Watch List.
Recognizing the weaknesses in its SMM process, NRC is making
improvements. For example, NRC asked Arthur Andersen to examine how
the Commission can improve the timeliness and thoroughness of its
plant-safety assessments through the SMM decision-making process.
Andersen reported findings that parallel our observations, noting
that many procedural problems prevent the process from working as
intended. These problems include a lack of rigor and discipline in
the process; unclear criteria for placing plants on the Watch List;
and the confusion among some NRC managers about their role in the
process. Also noted was the highly subjective nature of the process.
NRC is currently examining Arthur Andersen's recommendations.
NRC is making other changes to its oversight program to aid early
intervention. For example, future inspections will determine if
plants are still operating within their design basis. Also, NRC is
attempting to improve its knowledge base on the plants' conditions by
better integrating its many sources of information on performance
information into a more consistent data format. NRC also reports
that it is piloting a program that identifies, tracks, and verifies
licensee commitments. Moreover, NRC is conducting an internal
strategic reassessment, in which all current programs and activities
are being re-examined. These are useful efforts that illustrate a
commitment by the current Chairman and Commission to improve how NRC
operates.
CONCLUSIONS
------------------------------------------------------------ Letter :6
There are a number of instances in which NRC has neither taken
aggressive enforcement action nor held nuclear plant licensees
accountable for correcting their problems on a timely basis. NRC's
practice of giving licensees extensive time to fix their problems
allows nuclear plants to continue to operate and the problems to grow
worse. Fines levied against licensees for violations of regulations
often occur long after problems are first identified. In the plants
we examined, NRC forced the licensees to correct their problems only
after they had voluntarily shut down their plants. In addition, by
not evaluating the competency of the licensees' plant managers as
part of the on-going plant inspection process, NRC is missing an
opportunity to act on the plants' safety performance problems at an
early stage, when problems are easier and cheaper to address.
Finally, NRC's process to focus attention on those plants with
declining safety performance--the Senior Management Meeting--needs
substantial revisions to achieve its goal of an early warning tool.
By intervening early and taking aggressive enforcement action when
warranted, NRC can prevent declines in nuclear plants' long-term
performance and better assure itself that the plants are meeting high
safety standards. With concern growing that some licensees are
pursuing aggressive cost-cutting strategies at the risk of reducing
safety margins, now is the time to take steps to make sure that NRC's
regulatory program is working as effectively as it can. The changes
that the Commission has under way provide a basic framework for
making its regulatory strategy work, but additional measures are
needed if NRC's culture of tolerating problems is to change.
Ensuring that licensees fix their safety deficiencies promptly and
have high-quality management in place is the key for NRC to fulfill
its mission of adequately protecting the public's health and safety
from the dangers inherent in nuclear power plants.
RECOMMENDATIONS
------------------------------------------------------------ Letter :7
To enhance licensees' accountability, we recommend that the
Commissioners of NRC direct NRC staff to develop strategies to more
aggressively act on safety deficiencies when they are discovered. To
achieve this goal, NRC should take the following steps:
Require inspection reports to fully document for all plants the
status of the licensees' actions to address identified problems
under NRC's corrective action requirements, including timetables
for the completion of corrective actions and how NRC will
respond to nonconformance with planned actions.
Make licensees' responsiveness to identified problems a major
feature of the information provided to the participants of the
Senior Management Meetings, including how NRC will respond if
problems go uncorrected. For example, NRC should describe the
range of sanctions that it will impose on the licensees on the
basis of the potential seriousness of their failure to resolve
problems within a predetermined time. These sanctions should
range from assessing fines to involuntary shutdown of the plant.
Require that the assessment of management's competency and
performance be a mandatory component of NRC's inspection
process.
AGENCY COMMENTS
------------------------------------------------------------ Letter :8
In commenting on a draft of this report (see app. V for NRC's
letter), NRC acknowledged that safety margins fell in the plants we
examined. NRC also stated that their defense-in-depth regulatory
approach provides an adequate safety margin even in plants with
safety deficiencies. Our concern is that NRC cannot ensure that all
plants have adequate documentation to support that they are still
operating in accordance with their plant designs. Operating within
approved plant design is critical to the defense-in-depth philosophy.
This deficiency in NRC's knowledge base, especially in light of
substantial design deficiencies discovered at Millstone and in other
plants, erodes NRC's confidence that its licensees are operating
their plants in accordance with their plant design and, thereby,
within adequate safety margins.
Further, NRC stated that the safety deficiencies at plants we
examined were not serious enough to warrant shutting down the plants
while they were operating. Once the plants shut themselves down,
however, NRC then required them to address their backlog of safety
deficiencies before allowing them to restart. For example, Millstone
must address a long list of technical and programmatic issues
including weaknesses in correcting identified safety problems and
responding to employees' safety concerns. Salem must also correct
many long-standing safety problems prior to restarting their plants,
including ineffective corrective actions, weak management oversight,
and numerous equipment failures. Most of the problems keeping these
plants shut down are longstanding deficiencies known by NRC. Forcing
licensees to fix their problems before they accumulated would have
helped prevent these plants from reaching conditions where safety
margins were reduced.
NRC agreed with the "basic thrust" of our recommendations, and
described a number of actions underway that they believe address some
of the issues raised in this report. For example, NRC cited
improvements in their inspection program and a pilot program to track
and verify licensee commitments. We agree that the actions NRC have
underway are worthwhile steps, but they do not address the
fundamental issues raised in our report. NRC needs to be stronger in
holding licensees accountable for fixing their safety problems. This
can be accomplished by fully documenting licensee progress in
addressing their problems, and then outlining sanctions NRC will
impose for noncompliance. We agree with NRC that evaluating
management competency and performance is difficult. However,
evaluating this influence on plant safety performance, which NRC
admits is important, would allow NRC to be a more proactive and
effective regulator.
In response to NRC's detailed comments, we have made changes to our
report where appropriate. NRC's letter and our response to their
specific comments are provided in appendix V.
---------------------------------------------------------- Letter :8.1
As arranged with your offices, unless you publicly announce its
contents earlier, we plan no further distribution of this report
until 30 days after the date of this letter. At that time, we will
send copies to the Commissioners, Nuclear Regulatory Commission, and
the Director, Office of Management and Budget. We will make copies
available to other interested parties on request.
Our review was performed from March 1996 through April 1997 in
accordance with generally accepted government auditing standards.
See appendix VI for a description of our scope and methodology.
If you or your staff have any questions about this report, please
call me on (202) 512-3841. Major contributors to this report are
listed in appendix VII.
Victor S. Rezendes
Director, Energy, Resources,
and Science Issues
NRC'S REGULATORY FRAMEWORK
=========================================================== Appendix I
The Atomic Energy Act of 1954, as amended, authorizes the Nuclear
Regulatory Commission (NRC) to license, regulate, and inspect the
design, construction, and operation of commercial nuclear power
plants. NRC's regulations are intended to ensure the safe operation
of the 110 nuclear reactors operating in the United States. For
example, NRC requires nuclear reactors to have multiple safety
systems to control and contain the radioactive materials used in each
reactor's operation. NRC also requires the owner of the reactor (the
licensee) to test and maintain safety equipment to help ensure that
the equipment, such as a reactor's emergency safety systems, will
operate when needed. The requirements are intended to protect
workers and the public from the harmful effects of radiation.
Reactors have specific operating requirements (technical
specifications), depending on their design. These requirements are
intended to provide a high margin of safety under all operating
scenarios. NRC evaluates a reactor's design and related technical
specifications when it licenses the reactor's operation. Once
approved, these specifications become the requirements for the
operation of the reactor. If certain requirements cannot be met, NRC
requires the licensee to promptly shut down the reactor.
NRC'S SAFETY RESPONSIBILITY
--------------------------------------------------------- Appendix I:1
The act requires NRC to provide assurance that the public health and
safety is adequately protected from the consequence of the operation
of any commercial nuclear power reactor in the United States. NRC
does not precisely define nuclear plant safety. Instead plants are
assumed to be safe if they operate within their approved designs
(plant design) and in accordance with all regulatory requirements.
Also, NRC has promulgated regulations that provide a framework for
how the regulatory process is to work.
NRC's basic measure for determining if a reactor is operating safely
is whether it is operating as specified by its license. The license
incorporates requirements derived from the plant's required Safety
Analysis Report and the technical specifications. The Safety
Analysis Report contains the documentation of bases upon which the
plant and its safety systems are designed (the plant's design basis).
The technical specifications state the conditions under which the
plant must operate and what action is required if these operating
conditions cannot be met. If a plant is found to be operating
outside of its design basis, or technical specifications, the plant
can be required to shut down. For example, if a reactor's design or
technical specification requires a pump in standby status as a backup
to another pump used to cool the reactor's core in an emergency, and
it does not work when tested, the reactor may have to be shut down.
There are numerous similar requirements for reactor operations.
NRC'S INSPECTION PROGRAM
--------------------------------------------------------- Appendix I:2
In its implementing regulations, NRC established that licensees are
primarily responsible for ensuring that their reactors are operated
safely. NRC relies heavily on the licensees to identify and report
problems at their facilities. Thus, a licensee's corrective action
efforts (part of the required Quality Assurance program) are a
critical part of its safety responsibility. At each operating
nuclear reactor site, daily inspections are generally conducted by at
least two resident NRC inspectors. These inspectors are assigned to
a reactor site for up to five years on a rotational basis to provide
independent assurance that the licensees are operating their
facilities safely. If a reactor's performance declines, NRC may
assign additional resident inspectors to it. The resident inspectors
observe a variety of activities, including the licensee's (1)
operation of the reactor's control room and (2) testing and
maintenance of selected equipment. NRC inspects only a small
percentage of a reactor's myriad activities.
NRC's inspection program is intended to identify the underlying
safety problems at a reactor and, by doing so, to anticipate and
prevent significant events--events that could damage a reactor's core
and that could result in a release of radioactive materials. NRC
also uses its inspection results to (1) assess each licensee's
performance, (2) provide feedback to the licensees about their
performance, and (3) allocate its inspection resources among
facilities.
NRC's regional and headquarters inspection staff supplement the
resident inspectors' efforts, conducting more-detailed reviews of
selected areas. In addition to routine daily inspections by resident
inspectors, NRC conducts special inspections and, depending on the
severity of NRC's concerns, escalates the reporting levels to NRC
regional and headquarters officials. For example, an Augmented
Inspection Team (AIT), which reports to the Regional Administrator,
will conduct an investigation when certain incidents occur at a
reactor. The AIT members are technical experts from the region in
which the incident took place, augmented by personnel from
headquarters or other regions. For more serious concerns, an
Incident Investigation Team, which reports to the NRC Executive
Director for Operations and is independent of the regional and
headquarters office management, conducts the investigation. The
members of this team are technical experts who, to the extent
practicable, do not have previous significant involvement with the
target reactor.
If NRC finds that a licensee has violated the requirements for safe
operation, it can take enforcement actions against the licensee. NRC
categorizes violations according to four levels of severity--level I
violations are the most serious.\1 Once NRC finds a violation and
determines its severity, it can issue a notice of violation and
impose a civil penalty (fine) or require the reactor to stop
operations.\2
--------------------
\1 NRC considers severity-level I, II, and III violations "escalated
enforcement actions."
\2 While NRC is authorized to shut down nuclear power facilities, it
has done so only once. NRC ordered the Peach Bottom Plant in
Pennsylvania to shut down in 1987 after finding that personnel in the
control room were sleeping on the job.
NRC'S PROCESS FOR EVALUATING
NUCLEAR POWER REACTORS'
PERFORMANCE
--------------------------------------------------------- Appendix I:3
NRC has established formal management processes that it uses to
review and analyze the information its gathers, through its
inspection program, to evaluate the licensee's performance. These
include two key processes: the Systematic Assessment of Licensee
Performance (SALP) and the Senior Management Meeting (SMM).
SALPs evaluate each licensee's long-term performance and provide for
discussions of performance between the licensees and NRC. Regional
managers use the SALP for long-term resource allocation and to
identify areas for inspection emphasis. These assessments are
performed on a reactor-specific schedule every 12 to 24 months by
regional and headquarters staff and three-member SALP boards composed
of two regional managers and a headquarters manager. The boards
evaluate the information reviewed and summarized by the staff from
inspections, enforcement actions, performance indicators of the
safety condition of reactors (fig. I.1 illustrates some of NRC's
performance indicators), licensees' self-assessments, third-party
assessments, site visits by the board members, and management
meetings and discussions with the licensees. The SALP board reviews
the information available to it and gives its recommendations to the
Regional Administrator.
Figure I.1: NRC's Performance
Indicators Showing the Industry
Average for All Nuclear
Reactors, 1989-96
(See figure in printed
edition.)
Source: NRC's data.
(See figure in printed
edition.)
The SMM is held about every 6 months to review the individual
licensee's performances on a national basis and bring to the
attention of the highest levels of NRC management those reactors
whose operational safety performance is of the most concern. The
participants include the Executive Director for Operations, regional
administrators, and NRC headquarters office directors. The SMM
review includes information that was used by the SALP board for its
evaluations. Prior to the SMM, screening meetings are held in which
the regional administrators and the Director of Nuclear Reactor
Regulation review every reactor's data to determine if the reactor
should be discussed at the SMM. Generally, if the trend of a
reactor's performance appears to be declining significantly or there
are significant concerns about its performance, the reactor should be
targeted for discussion at the SMM. Senior headquarters and regional
staff together prepare an SMM notebook that is reviewed by the SMM
participants. The information in the notebook includes inspection
results, enforcement data, performance indicators, plant specific
risk insights, and other information that characterizes a licensee's
performance.
Senior NRC mangers plan actions for those reactors whose performance
is of most concern. Those actions include sending a "trending
letter" to the licensees whose reactors' performance is significantly
declining and putting the reactor on the Watch List.
PERFORMANCE INDICATORS
--------------------------------------------------------- Appendix I:4
Following a series of events, including the Three Mile Island nuclear
accident and the loss of reactor feedwater at the Davis-Besse, Ohio,
plant, NRC developed eight indicators for monitoring the safety
performance of licensees. According to NRC, the indicators were
intended to augment existing safety evaluations and to provide a
timely indication of reactors' safety trends. Developing the
indicators was mainly completed in the first 3 years. However, the
overall process stretched from the Commission's recommendation in
1986 to 1993. The current performance indicators, which consist of
eight measures of safety performance at all 110 U.S. commercial
reactors, are largely self-reported by licensees. NRC publishes
average trend data on seven of the eight performance indicators.
According to NRC officials involved with the Performance Indicator
and the inspection programs, there has been no concerted effort to
verify the data for completeness and accuracy.
NRC is currently considering additions to the set of performance
indicators to provide senior managers with a more objective basis for
monitoring the safety condition of reactors.
DEVELOPMENT OF THE PRESENT
SET OF INDICATORS
------------------------------------------------------- Appendix I:4.1
In an August 1986 memorandum, the NRC Executive Director for
Operations stated that NRC needed performance indicators because it
has not always been effective in promptly recognizing the symptoms of
a reactor's declining performance and taking appropriate action. NRC
set up an inter-office task group in 1986 to develop a set of
indicators to be monitored and evaluated by NRC for making timely
regulatory decisions about the performance of nuclear power reactors.
The task force used the following criteria for the initial set of
indicators used during the trial program:
The performance indicators should be related to nuclear safety and
regulatory performance, be worthy goals for licensees, reflect a
range of performance, be independent of each other, correlate
with SALP evaluations, and finally, be predictive of licensees'
future performance.
The data used should be readily available to NRC in a timely
manner, not subject to manipulation, and comparable among
licensees.
The logic behind the development of the indicators, according to
NRC's plans, was to focus on the key components of reactor safety.
NRC believed that nuclear reactor safety requires a low number of
unexpected, abnormal occurrences and the high reliability of key
systems that are important to the safe operation of a reactor.
In 1986, the task force identified eight indicators, after a trial
period with 50 nuclear reactor facilities in which 17 indicators were
considered. Two of the original selected indicators, an enforcement
measure and a maintenance indicator, have been dropped. The
indicator on enforcement actions was dropped, according to NRC staff
involved in the indicators' development, because it would have nearly
duplicated information that was available from the SALP process. The
indicator to measure the backlog of unresolved reactor maintenance
items was dropped, according to NRC documents, because of objections
from the industry.\3
The Commissioners, in approving the plan to develop and implement the
indicator effort, expressed the need to continue the development of
the performance indicators for such factors as reactor maintenance
and reactor staff training.
Ultimately, the number of indicators increased to eight. NRC added
collective radiation exposures, a measure of worker radiation
exposure. It also added cause codes, but NRC does not compute an
average trend for them. They are used to provide more detailed
information on specific incidents or events. The cause codes explain
deficiencies in six programmatic categories, which include licensed
operator errors, maintenance problems, and other deficiencies.
--------------------
\3 The industry's support for the indicator program was not strong.
For example, in a November 5, 1986, letter from the Institute of
Nuclear Power Operations, an industry trade group, to the Chairman of
the NRC, the Institute urged the Commission "not to adopt a separate
set of performance indicators for use in a formal regulatory sense."
Instead, they requested that the NRC use industry-developed data and
not use the performance indicators as part of its regulatory efforts.
CURRENT PERFORMANCE
INDICATORS
------------------------------------------------------- Appendix I:4.2
The following describes the seven performance indicators for which
NRC publishes annual trend data.
Automatic Scrams While Critical. The number of unplanned automatic
scrams that occurred while the affected reactor was operating. (An
automatic scram is a condition under which the reactor shuts down
automatically as a result of being programmed to do so under certain
conditions.)
Safety System Actuations. The number of certain Emergency Core
Cooling Systems or the Emergency AC Power System equipment
actuations, either manual or automatic.
Significant Events. The number of events that involved an actual or
potential threat to the health and safety of the public.
Safety System Failure. The number of events or conditions that could
have prevented the fulfillment of the safety functions of a structure
or system.
Forced Outage Rates. The fraction of time that a power plant could
have been generating electricity if it were not forced to be shut
down due to an off-normal condition.
Equipment Forced Outages per 1,000 Critical Hours. The number of
forced outages caused by equipment failures per each 1,000 hours of
operation.
Collective Radiation Exposure. The total radiation dose accumulated
by the employees operating the reactor.
According to NRC, the performance indicators are generally positively
correlated with NRC's other reactor safety performance measures, such
as the SALPs and NRC's Watch List for problematic reactors. For
example, during the trial period for indicators, NRC compared SALP
scores from reactors with performance indicator data being considered
then. NRC generally found that there was a positive correlation
between the performance levels as indicated by the indicators and the
NRC evaluations of the reactors.
A more recent NRC review comparing reactors on the Watch List and
good performing reactors concluded that, generally, the reactors on
the Watch List exhibited poorer performance as measured by their
performance indicators than good performing reactors. Moreover, the
study commented that, in many cases, the performance indicators for
reactors on the Watch List had shown a significant decline 1 to 2
years before the reactors were placed on the list. However, the
study cautions that the performance indicators are only one of many
tools that NRC uses to measure performance. For example, the study
points out that two reactors had similar levels of performance
indicators, but one had been on the good performer list for almost 4
years while the other had been on the Watch List. The NRC official
who conducted the study said that the similarities between the two
reactors' performance indicators are the result of the managers of
the reactor on the good performer list taking a conservative approach
to reporting on the indicators by, in effect, overreporting in
contrast to other plants.
SALEM NUCLEAR GENERATING STATION,
UNITS 1 AND 2
========================================================== Appendix II
The Salem nuclear power Units 1 and 2 are located on the Salem
Generating Station, 18 miles south of Wilmington, Delaware, in Salem,
New Jersey. The Public Service Electric and Gas Company (PSE&G) is
the owner and licensed operator of the plant. Each unit is a
four-loop pressurized light-water reactor that can produce 1,115
megawatts of electricity. The units were designed by Westinghouse
and were built by the United Engineers & Constructors, Inc. NRC
approved operating licenses for Salem's Units 1 and 2 on December 1,
1976, and May 20, 1981, respectively; Units 1 and 2 began operating
on June 30, 1977, and October 13, 1981, respectively.
SUMMARY
-------------------------------------------------------- Appendix II:1
NRC has been concerned with Salem's regulatory performance since
January 1990 when Salem was first discussed at its Senior Management
Meeting. NRC discussed the plant seven additional times before it
listed Salem on its Watch List in January 1997. NRC's records
document numerous conditions that demonstrated poor management of the
plant, including the operation of the plant outside of its design
bases for extended periods of time. The units are currently under an
NRC Restart Action Plan (RAP) that requires the licensee to correct a
long list of technical and programmatic issues to bring about
long-term performance improvement prior to receiving NRC's approval
to restart. The plan was developed after PSE&G shut down the units
in mid-1995. Salem's main problems include long-standing problems in
performance and equipment failures, units that are operated outside
of their design bases, and weak management by the licensee. NRC's
lack of more aggressive action on these problems when they were first
reported, compounded the worsening condition of the Salem units.
Salem's performance history compares unfavorably to the industry's
average. For example, NRC heavily fined Salem on seven occasions;
the fines ranged from none for several years to a high of $680,000.
The industry average annual fines assessed each plant during this
period ranged from $17,000 to $37,000. As the number of NRC's hours
of inspection of the Salem plant increased--an indication of NRC's
growing concern--Salem's Systematic Assessment of Licensee
Performance (SALP) scores worsened in 1993. Salem's performance
indicators also worsened during this period, and NRC discussed
Salem's performance every year except 1992 and 1993 at its SMMs. In
addition, from 1989 through 1996 Salem units reported an average of
about five safety system failures per year compared to an industry
average of about three per year. Since 1989, SALP scores,
performance indicators, and the number of safety system failures, on
average for the industry, have shown overall improvement, while the
number of inspection hours devoted to a plant have decreased. Figure
II.1 compares the performance of the Salem plant with the nuclear
industry as a whole.
Figure II.1: Salem's
Performance History Against the
Industry Average
(See figure in printed
edition.)
Source: GAO's analysis of
NRC's data.
(See figure in printed
edition.)
PERFORMANCE HISTORY
-------------------------------------------------------- Appendix II:2
DESIGN BASIS ISSUES
------------------------------------------------------ Appendix II:2.1
The licensee operated the Salem units outside of their design bases
and, in some instances, NRC was not aware of the degraded conditions
until months later when the licensee reported the conditions.
On April 7, 1994, the licensee experienced a significant condition
adverse to quality\4
when an equipment failure occurred during a reactor trip. (A reactor
trip is an action in which a reactor automatically shuts down because
it has been programmed to do so under certain conditions that could
challenge the reactor's safety if the unit continued to operate).
Prior to this event, the licensee did not promptly identify and
correct the cause of previous similar equipment failures during prior
reactor trips in June 1989, July 11, 1993, and February 10, 1994.
This was a recurring problem that the licensee and NRC failed to
ensure was corrected. NRC fined the licensee $150,000 for this
incident.
On December 12, 1994, a ventilation fan failed, creating a
significant condition adverse to quality at the Salem Unit 1.
Unit 1's design basis requires that the facility have two fans
capable of operating automatically and one other fan in a
standby condition. The utility did not report this incident to
NRC at the time nor did it determine the cause of the problem as
required by NRC's regulations. On May 12, 1995, another supply
fan became inoperable before the first fan that had failed was
fixed. These fans are crucial to keep important safety
equipment from overheating. The licensee's records show that
there had been two prior similar occurrences, in April 1990 at
Unit 2 and in December 1994 at Unit 1. NRC fined the licensee
$100,000 for these numerous fan violations.
On January 26, 1995, workers at Unit 2 discovered that a flow valve
would not open automatically as required, thus requiring a
shutdown within 12 hours by its technical specifications.
According to the technical specifications, the unit's problems
should have been fixed within 3 days or the unit should have
been shut down within 12 hours. However, the licensee did not
correct the problem and did not shut down the Unit 2 reactor
until June 7, 1995--128 days later. The licensee's staff
incorrectly determined that the valve was operating as required
because they could manually operate it. This situation also
should have been reported to the NRC within 1 hour because the
plant violated its technical specifications. However, it was
not reported.
On February 9, 1995, another valve failed to open automatically as
required. As in the previous case, this valve did not operate
as required but could be manually operated. At this point, two
valves were not operating as required. The plant's technical
specifications require at least one of the valves to be
operating as required within 1 hour or the plant must be shut
down. Eventually, the plant was forced to shut down in June
1995 because of these and other events. NRC fined the licensee
$100,000 for failing to handle the valve situations properly.
--------------------
\4 This is important terminology used by NRC in its regulations and
its inspection program. NRC defines the term by example. It lists
failures, malfunctions, deficiencies, deviations, defective material
and equipment, and nonconformances as examples of conditions adverse
to quality. NRC requires that as part of ensuring adequate
protection of the public's health and safety, these conditions be
promptly identified and corrected.
CORRECTIVE ACTION ISSUES
------------------------------------------------------ Appendix II:2.2
NRC's records cite a long history of the licensee not addressing
recurring reliability and operability issues at Salem. On June 9,
1995, after the two units shut down, NRC sent the utility a
Confirmatory Action Letter citing the need to organize a special team
to review the problem of long-standing equipment and operability
issues. The utility identified approximately 31,000 work items that
it felt it should complete before restarting the units. In February
1996, NRC developed a RAP citing numerous problems that NRC would
require to be fixed before it would approve a restart of the units.
Those items included weak management oversight, ineffective
corrective actions, and numerous technical-specification-related
items. The RAP cited examples of the long-standing decline of
Salem's plant performance in justifying the need for the units to
remain in a shutdown status until NRC would approve start-up. For
example:
NRC's SALP report for Salem for the period from June 20, 1993,
through November 5, 1994, which preceded the mid-1995 shutdown,
was particularly critical of the licensee's performance. The
report stated that overall performance had declined and that NRC
was particularly concerned with the challenges to the plants'
systems and operators caused by repetitive equipment problems
and personnel errors that had the potential to, or actually did,
adversely affect the safety of the plant or its personnel. The
report recognized that the licensee had, within the last year,
initiated several comprehensive actions that had the potential
to improve the plant's overall performance but that the efforts
had not resulted in any noticeable change in overall
performance.
The NRC's report said that in arriving at its assessment, NRC
determined that the following factors contributed to Salem's
condition: (1) the tendency of the licensee's operations staff
to accept and accommodate system performance that was not in
accordance with design; (2) the tendency of the licensee to not
aggressively question the validity of assumed causes of degraded
conditions or unexpected system performance and dismiss or not
adequately consider other possible contributors or factors
without a substantial technical basis or rationale; (3) the
general reticence of the licensee's maintenance and operations
organizations to solicit technical support from the engineering
organization to resolve system or equipment issues at the plant,
and the engineering organization's apparent reservation to
engage in the diagnosis or resolution of the plant's technical
problems without requirement or request; (4) the lack of value
attributed to, or expected from, nuclear safety review and
quality assurance activities and the consequent ineffectiveness
of these functions; (5) insufficient critical self-assessment
initiatives to evaluate the adequacy and performance of
personnel, procedures, and hardware; and (6) insufficient
supervisory oversight and poor communication of senior plant
management's expectations relative to the performance of
activities.
The performance report was particularly critical of the utility's
maintenance programs and activities. According to the report, the
utility's management oversight of corrective action program
activities had been weak, as evidenced by the high number of
recurrent equipment failure rates. Inconsistencies in
troubleshooting activities and a breakdown in the licensee's analysis
of root causes also contributed to the delay in correcting recurring
problems. Other examples of the utility's ineffective correction of
long-standing problems include the following:
Salem's units were heavily fined during 1994 and 1995. Annual
fines assessed on the Salem plant ranged from none for the
earlier years to $680,000 at the same time the industry average
for fines was about $30,000. One enforcement action in October
1994 involved six violations that NRC identified during several
inspections conducted at the facility. Five of the violations
were associated with the utility's failure to promptly respond
to and correct conditions involving numerous systems over
extended periods of time. In one case, the utility failed to
take action for 5 years.
NRC's RAP for Salem contained 43 technical restart issues (issues
having to do primarily with equipment and procedures as compared
to management and human resource issues), of which all but 5
were known by NRC before the units shut down. According to
Salem's current NRC Senior Resident Inspector, recurring
problems had been prevalent at Salem for years. Two of the
issues had been continuing problems for 6 to 7 years--the
control air system and the circulating water traveling screen
motor. One of the issues had been on NRC's information followup
system since 1989 and was addressed in three separate inspection
reports.
An NRC report entitled Engineering Evaluation Report Analysis of
Allegation Data, dated June 1996, showed that Salem experienced
a disproportionate number of employee allegations in 1995 about
the licensee's potential failure to follow safety procedures and
potential violations of the employees' rights. The report
concluded that the utility was a potential organization for
further NRC evaluation because it was in the top 10 percent of
NRC's groups with respect to increases in the number of total
allegations, including harassment and intimidation allegations
from 1994 to 1995.
MANAGEMENT WEAKNESSES ISSUES
------------------------------------------------------ Appendix II:2.3
NRC records show numerous examples of management weaknesses:
In NRC's October 1995 Notice of Violation and Proposed Imposition
of Civil Penalties to Salem, NRC noted that Salem's management
appeared to have tolerated an atmosphere that accepted degraded
conditions rather than establish the atmosphere of a
high-quality operating environment. NRC also recognized that
even after it became more imperative to address these component
issues, Salem's management delayed making decisions on whether
or not equipment was operating as required until it was apparent
that a rationale could not be established to justify the
continued operation of the equipment in its existing condition.
The licensee's Licensee Event Reports cited management as the cause
of the adverse quality events. According to the reports, the
apparent cause of the valve incident discussed earlier was
attributed to inadequate management oversight. The inadequate
management oversight led to operators and engineers not having
sufficient knowledge of the design basis of structures, systems,
and components to recognize problems and take timely corrective
actions. NRC cited these and numerous other examples, including
failures to perform adequate testing of modifications and
evaluation of changes as indicative of an attitude on the part
of both management and staff that was not conducive to the safe
operation of a nuclear power plant.
The utility industry's Institute of Nuclear Power Operations also
faulted management for the April 7, 1994, situation when marsh
grass clogged water intake screens, resulting in automatic trips
of circulating water pumps. These pumps are used to circulate
water to portions of the reactor's operations. The pumps'
failures caused significant safety concerns and ultimately
resulted in the shutdown of the reactor.
NRC's recent inspection reports were critical of the utility's lack
of effective management to correct the various long-standing
problems at Salem. NRC's first inspection report (July 14,
1995), issued right after the two plants shut down, contained
the following:
"During this period [May 7-June 23, 1995] Salem management and
staff continued to demonstrate significant weakness in
performing operability determinations . . . [making a
determination as to whether a component of the plant is
operating as required to operate according to NRC's rules and
regulations] for degraded safety-related equipment, and
implementing prompt and effective corrective actions . . . .
In these cases, your organization accommodated the conditions
without effective root cause assessment or understanding of the
nature of the problems since 1992."
WATCH LIST ISSUES
------------------------------------------------------ Appendix II:2.4
The Salem plant--Units 1 & 2--were first placed on NRC's Watch List
in January 1997. There is substantial evidence, however, that the
Salem plant should have been placed on the Watch List before the
utility shut down the units on May 16 and June 7, 1995. NRC's SMMs
show that NRC knew about the ineffectiveness of the licensee's
Quality Assurance program, which is designed to provide reasonable
assurance that the risk to the public from the utility's operation is
acceptably low.
In placing the Salem plant on the Watch List in January 1997, NRC
recognized that it had erred in not putting the plant on the Watch
List sooner. The SMM stated that NRC put the plant on the Watch List
for its past performance history and that it should have put the
plant on the Watch List much earlier. In January 1990, for example,
materials prepared for the SMM revealed NRC staff's concerns about
the plant's management and operational performance. Staff noted the
declining performance of Salem as demonstrated by an increasing
number of personnel errors, inadequate management oversight and
involvement, inadequate procedures, and weak root cause analyses.
They also noted that Salem's corrective action programs had
frequently been ineffective. Salem's problems continued to reflect
declining performance. In briefing materials prepared for senior
managers in 1994, NRC noted:
"stagnant, and sometimes declining performance relative to the
licensee's . . . initiative and ability to successfully
perform comprehensive and thorough root cause analysis of
abnormal conditions or situations affecting the operation of the
facility, or to recognize trends indicative of programmatic
weaknesses."
NRC concluded that corrective actions had not always been effective,
as evidenced by recurring deficiencies of a similar nature or
continuing performance weaknesses. NRC noted that while the licensee
stated that corrective actions appeared to have addressed the causal
factors, given past performance, there was no assurance that a
similar event would not recur. Also noted was that Salem continued
to experience recurring operational, design, and maintenance-related
problems with no indication that previously applied corrective
measures had been effective in resolving or causing a reduction in
the frequency or severity of the apparent problems.
Even after the Salem licensees shut down the units for violating
technical specifications and after NRC had placed the units under a
Confirmatory Action Letter (that documented the licensee's agreement
not to restart the units without NRC's concurrence) NRC did not list
Salem on its Watch List until January 1997, when NRC officials
acknowledged that they had made a mistake and that the plant should
have been listed on the Watch List sooner because of poor
performance.
CHRONOLOGY
-------------------------------------------------------- Appendix II:3
1989
NRC's inspection reports cited the poor material condition of the
Salem plant.
1990
Salem was first discussed in the SMM.
1991
NRC initiated an Augmented Inspection Team (AIT) review on Salem. An
AIT is an intensive special investigation of an event that NRC
requires, in addition to routine audit activities, when it determines
it needs more information to evaluate a situation.
NRC issued a violation as a result of the licensee's failure to
follow procedures and for insufficient preventative maintenance.
1992
A second AIT was performed that found that the licensee failed to
follow procedures.
1993
A third AIT was performed at Salem after the licensee aborted several
start-up attempts.
SALP ratings started to decline for the first time.
NRC met with PSE&G's management to discuss the licensee's weak root
cause analysis and ineffective corrective action history.
1994
PSE&G concurred that it had significant deficiencies in root cause
determination and established a Strategic Improvement Plan.
Marsh grass clogged the water intake screens and blocked the flow of
cooling water to part of the plant, leading to a shutdown of Unit 1.
In response to this event, NRC ordered a fourth AIT review at Salem,
in just four years, an unprecedented action. NRC fined Salem
$500,000 for its handling of the incident.
An NRC special performance assessment found weaknesses in maintenance
and management oversight activities.
1995
On January 3, 1995, Salem was notified that its SALP rating for the
period from June 20, 1993, through November 5, 1994, declined and
dropped to its lowest level. NRC senior officials met with PSE&G's
management to discuss the low SALP ratings and questioned
management's overall direction and performance.
NRC senior management met with the licensee's Board of Directors to
discuss serious concerns with lingering performance problems.
The licensee shut down Unit 1 because of technical specification
violations.
An NRC special inspection team concluded that the licensee's
management had been deficient in several keys areas and should have
taken strong action sooner.
The licensee shut down Unit 2 because of technical specification
violations.
NRC issued a Confirmatory Action Letter requiring its authorization
prior to restarting either unit.
1996
NRC issued its Restart Action Plan for both units citing 43 technical
and 21 programmatic items that had to be corrected before the units
could restart.
NRC cited fundamental design problems at Salem.
1997
After years of declining performance, NRC placed the Salem units on
the Watch List and acknowledged that Salem should have been on the
Watch List much sooner.
MILLSTONE NUCLEAR POWER STATION,
UNIT 2
========================================================= Appendix III
The Millstone Unit 2 nuclear power reactor is located at the
Millstone Nuclear Power Station on Long Island Sound, about three
miles from New London, Connecticut. The Northeast Nuclear Energy
Company (NU) is the owner and licensed operator of the plant that has
two other units--Millstone Units 1 and 3. Millstone 2 is a two-loop
pressurized light-water reactor that can produce 895 megawatts of
electricity. The unit was designed and built by the Bechtel
Corporation. NRC approved Millstone Unit 2's license to operate on
September 26, 1975, and the unit began commercial operations on
December 26, 1975.
SUMMARY
------------------------------------------------------- Appendix III:1
The NRC has been concerned with Millstone Unit 2's regulatory
performance since the late 1980s. In NRC's June 1991 Senior
Management Meeting, NRC observed that all three units' performance
had been declining over the last 2 years. NRC discussed Unit 2 seven
additional times at its SMMs before placing it on the Watch List in
January 1996. After several start-ups and shutdowns, the unit has
been under a NRC Restart Action Plan since June 1995. The RAP
requires the licensee to correct a long list of technical and
programmatic issues to bring about long-term performance improvement
before NRC will grant approval to restart the unit. To gain NRC's
approval to restart, the licensee needs to show NRC that it has
established and implemented adequate programs to ensure substantial
improvement. Millstone Unit 2 has had long-standing problems with
its performance. It has operated outside of its NRC-approved design
basis, has had an unusually high number of allegations from employees
about the potentially unsafe operation of the unit, and management
has been cited as the major cause of its performance weaknesses.
Millstone's performance history shows that its performance since 1989
has been significantly worse than the industry average. NRC fined
Millstone heavily during the period from 1989 through 1996. The
fines ranged from none to $325,000 annually. For this same period,
the industry average ranged from $17,000 to $37,000. Millstone's
scores on NRC's periodic Systematic Assessment of Licensee
Performance (SALP) generally worsened during the period. Millstone's
performance indicators also worsened in 1992, and NRC discussed
Millstone at every SMM, except for one, starting in June 1991. In
1993, the number of NRC's inspection hours at Millstone increased--an
indication of NRC's growing concern. In addition, since 1989,
Millstone has reported an average of about seven failures per year of
key safety systems compared with an industry average of about three
failures per year. Since 1989, the nuclear power industry's average
SALP scores, performance indicators, and the number of safety system
failures have shown an overall improvement, while the number of
inspection hours devoted to a plant have decreased. NRC's reluctance
to act aggressively on problems when first reported likely compounded
the worsening condition of Millstone. Figure III.1 compares the
performance of the Millstone 2 plant and the nuclear industry as a
whole.
Figure III.1: Millstone Unit
2's Performance History Against
the Industry Average
(See figure in printed
edition.)
Source: GAO's analysis of
NRC's data.
(See figure in printed
edition.)
PERFORMANCE HISTORY
------------------------------------------------------- Appendix III:2
DESIGN BASIS ISSUES
----------------------------------------------------- Appendix III:2.1
The licensee operated Millstone Unit 2 outside of its design basis,
and in some instances, NRC was not aware that degraded conditions had
existed for years (in one instance, as far back as 1975) until the
licensee brought the matters to NRC's attention. For example:
In November 1990, the owner failed to control the position of a
certain valve while starting up the unit. This error resulted
in the plant's operating outside of its design basis, and NRC
fined the utility $37,500.
On December 17, 1995, the licensee exceeded a technical
specification for the unit that required the temperature in one
of its components to heat up not more than 100 degrees F. The
same technical specification was also exceeded on July 28, 1995,
and December 17, 1995.
On May 22, 1996, an NRC special inspection team identified a number
of significant problems and concluded that Millstone had not
consistently maintained conformance with its license and
regulatory requirements.
On January 8, 1996, two sources of water for the plant's safety
systems could not be used because ice had jammed in a pipe.
When the condition was discovered by the licensee, the licensee
failed to declare that the service water system was not
operating as required by procedures.
NRC's January 1997 SMM pointed out that Millstone 2's licensing and
design basis was not maintained. NRC said that Millstone had
failed to ensure the accuracy of the documentation that
specifies the required operating conditions for the unit and did
not maintain the as-built configuration of the plant. The
licensee also failed to ensure that information on the design
basis of the unit was translated into programs, procedures,
practices, and hardware. Furthermore, NRC said the licensee was
weak in conducting design modifications because it did not
provide sufficient rigor, thoroughness, and attention to detail.
This inattention ultimately resulted in the unit's progressive
loss of design basis.
CORRECTIVE ACTION ISSUES
----------------------------------------------------- Appendix III:2.2
NRC's records cite a long history of the licensee's not addressing
recurring reliability and operability issues at Millstone 2.
Millstone 2 has been of concern to NRC for at least the last 6 years.
NRC has had 11 Senior Management Meetings since June 1991 at which
Millstone 2 was discussed. Three of the 11 times senior mangers
discussed Millstone 2, they decided it should be on NRC's Watch List.
In early 1992, in response to an overall decline in Millstone's
performance, the licensee set up a Performance Enhancement Program.
This action was taken as a long-term effort to ensure the effective
use of resources and implement the recommendations of four internal
performance assessment task forces. The program had only a limited
impact on improving Millstone's performance. As a result of NRC's
January 1995 SMM, NRC met on March 17, 1995, with the licensee's
Board of Trustees to express NRC's concern about Millstone 2's
continued poor performance.
Because of the licensee's failure to achieve a sustained level of
performance improvements and the continuing concerns about the
licensee's effectiveness in resolving safety concerns, NRC placed
Millstone 2 on its Watch List in January 1996. In June 1996, NRC
designated Millstone Unit 2 as a Category 3 facility. This
classification connotes a significant weakness that warrants
maintaining the plant in a shutdown condition until the licensee can
demonstrate to NRC that adequate programs have been established and
implemented to ensure substantial improvement. Prior to making this
designation, NRC advised the licensee that it had seen limited
success in resolving significant performance concerns about
procedural adherence, work control and tagging, ineffective
communications and teamwork between organizations, continued
weaknesses in correcting identified problems, poor self-assessment
and quality verification, and inappropriate response to the
employees' safety concerns.
Other pertinent examples of poor corrective actions included the
following problems:
The licensee acknowledged that weaknesses existed before 1991 in
its programs to report and resolve its deficiencies in a timely
manner.
NRC informed the licensee on June 21, 1996, that previous Millstone
performance concerns remained to be resolved and that recent
inspection findings disclosed significant problems with the
licensee's compliance with the requirements of its licenses. At
that time, NRC required all three Millstone units, which were
shut down, to receive NRC's approval prior to restart.
In August 1996, NRC issued a confirmatory order to the licensee
requiring it to complete an Independent Corrective Action
Verification Program that was acceptable to NRC before the
Millstone units could return to operation. This unusual step
occurred after several years of NRC's notifications to the
licensee that its corrective action program was not doing a good
job. The confirmatory order was issued after Millstone 2
voluntarily shut down in February 1996. According to a senior
NRC official, Millstone 2 was operating safely before it was
shut down. However, once the plant was shut down, NRC became
more aggressive in keeping it shut down, bringing pressure to
improve the units' corrective action program.
On September 20, 1996, a special NRC inspection of the engineering
and licensing activities at Millstone 2 reported that the most
significant issue at Millstone was the ineffective corrective
action process. The special inspection team identified degraded
and nonconforming conditions that had not been promptly
corrected. It also found that line management did not respond
to the findings of the unit's quality assurance organization and
that the root causes of problems and the programmatic
implications of identified issues had not been addressed in a
timely fashion. In addition, the team found that the licensee
did not establish an effective corrective action program for
Millstone as a whole. The review revealed weaknesses in the
ability to identify the unit's problems; delayed or inadequate
corrective actions for known deficiencies; problems in tracking
corrective actions; weaknesses in tracking nonconformances; and
a generally inadequate management response to quality assurance
audits and third-party assessments.
MANAGEMENT WEAKNESSES ISSUES
----------------------------------------------------- Appendix III:2.3
NRC's records show numerous examples of management weaknesses such as
the following:
An NRC Plant Status Report, dated March 21, 1996, stated that in
September 1994 the licensee recognized the performance
weaknesses delineated in the most recent SALP report and
generally concluded that the inability to correct long-standing
performance issues is rooted in cultural weaknesses in the
Millstone management and staff.
NRC's May 1996 special inspection found that while quality
assurance audits and third-party reviews were generally
effective in identifying programmatic weaknesses, the Millstone
management's responses to these findings and recommendations
were often slow and incomplete.
The Citizens Awareness Network, a nonprofit interest group
concerned with nuclear waste issues, reported in November 1996
that the licensee had decade-long, serious, chronic, systemic
mismanagement problems at Millstone. It also reported that
NRC's inspection program staff and management had failed over
the past decade to detect and deal with this problem.
A December 1996 Connecticut State report said that the licensee's
management was not sufficiently aggressive in identifying and
correcting deficiencies before problems occurred. It noted that
weaknesses in programs and procedures continued to contribute to
the degradation of safety-related equipment.
At January 1997 hearings at NRC, a nuclear industry veteran, hired
by the licensee after NRC required Commission approval for
restart, to manage Millstone and bring it into compliance with
NRC's requirements for restarting the units, testified about the
condition of Millstone upon his arrival. He said that when he
assumed his duties, Millstone was as close to a dysfunctional
organization as he had ever encountered. He said that the
fundamental problem was leadership.
The licensee's self-assessment cited the licensee's overemphasis on
cost containment as one primary root cause of poor performance
during 1990 and 1991. A December 1996 consultant's report also
concluded that the licensee's incentive compensation plans for
both management and staff placed undue emphasis on cost and
production issues and that the emphasis on safety in the
incentive and bonus plans was inadequate. The report also
concluded that the licensee's nuclear organization had been
mismanaged for the past 10 years. In addition, it concluded
that NRC had been too permissive and trusting in its dealings
with the licensee.
WATCH LIST ISSUES
----------------------------------------------------- Appendix III:2.4
NRC first placed Millstone 2 on the Watch List in January 1996. It
was discussed at every bi-annual SMM, except one, starting in June
1991. There is substantial evidence that Millstone 2 should have
been put on the Watch List before the licensee shut down the unit in
February 1996 because of the failure of a key safety system to
operate as required.
Starting in 1991, NRC's SMMs show that NRC had long-standing
performance concerns about Millstone, citing numerous events
demonstrating a pattern of the licensee's continued failure to
correct the root causes of programmatic problems. These events
included examples of significant long-term breakdown in the utility's
corrective action program, failure to determine and report when
certain components of the reactor were not operating as required by
NRC, and failure to implement appropriate procedures. Compounding
these concerns was a continuing high volume of employees' allegations
of safety issues that were not being appropriately resolved by the
licensee.
Documentation in NRC's files shows that the licensee was aware of
significant weaknesses in its oversight functions as early as 1991
but took no effective actions to correct the weaknesses. NRC's
routine on-site inspections identified a number of configuration
control, personnel error, work control, and procedure compliance
issues that contributed to five reactor trips and two forced
shutdowns experienced at Millstone 2 during 1993. (A reactor trip is
an action when the reactor automatically shuts down because it has
been programmed to do so under certain conditions that could
challenge the reactor's safety if the unit continued to operate. A
forced shutdown is a condition in which the reactor is shut down
because certain conditions have occurred that are not normal to the
reactor's operation.). The failures of Millstone 2's key safety
systems increased in the fourth quarter of 1990 and were well above
the industry average from 1993 through the second quarter of 1996.
Of more recent concern are examples of the licensee's failure to
comply with safety-related requirements to ensure that the Millstone
units were operating as designed.
Despite the increasing volume of information over the years that the
licensee was not managing Millstone well, NRC did not take timely and
decisive action. For example, between May 24 and August 5, 1993,
Millstone's licensee made over 30 attempts to repair a leaking valve
at Millstone Unit 2. The numerous attempts to repair the valve over
a period of time versus shutting down the reactor when it was clear
the valve could not be successfully fixed in a timely manner,
violated a number of NRC's rules and regulations. These unsuccessful
attempts to fix the valve ultimately resulted in sufficient damage to
the valve to require Millstone 2 to be shut down. Had the valve
failed catastrophically during the repeated attempted repairs, there
could have been serious safety consequences, such as the loss of
coolant, which would have challenged the safety systems of the plant.
As a result of this event, NRC issued a Notice of Violation to the
owner and proposed a fine of $237,500. In assessing the fine, NRC
said that the fine was so high because of the egregious nature of
management's failure to recognize the increased probability of valve
failure due to the repeated repair attempts. NRC cited other factors
in its decision, such as the necessity for NRC to prod the licensee
to get it to fully appreciate the implications of the incident and to
ensure that broad-based corrective actions were undertaken. NRC also
noted that overall performance at Millstone 2 had declined, including
continuing procedure adherence problems, a continuing inability to
identify and correct problems, and nine violations it issued to
Millstone in 1993.
According to some of Millstone's resident inspectors, NRC should have
ordered a shutdown in 1993 when the valve incident occurred. The
senior resident inspector had recommended that NRC shut down Unit 2,
but regional management disagreed because it said it could not cite a
regulatory basis to order a shutdown. Another resident inspector
said that although NRC had increased the number and severity of fines
on Millstone, increased the number of inspection hours, given
Millstone a low SALP score, and talked to Millstone management about
the plant's problems, Millstone's safety performance did not improve.
According to him, a trending letter, which is used to advise a
licensee that NRC is concerned because it has noted a decline in a
plant's performance, and/or the Watch List were the next regulatory
enforcement steps, but NRC's management hesitated to use these tools
because it did not think it had sufficient evidence to take stronger
action. A number of other NRC officials expressed the opinion that,
in retrospect, NRC should have added Millstone to its Watch List in
the aftermath of the incident.
CHRONOLOGY
------------------------------------------------------- Appendix III:3
1991
Millstone 2 was first discussed in the SMM.
NRC initiated an Augmented Inspection Team review on Millstone 2.
1992
Millstone's performance indicators began a significant downward
trend.
1993
The licensee reported to NRC that Millstone 2 may have operated
outside its design basis.
1994
The SALP covering the period from April 4, 1994, through July 9,
1994, noted that performance at Millstone 2 indicated significant
weaknesses in the plant's operations and maintenance and stated that
despite attempts to achieve consistent improvements, lasting
performance improvements were not achieved.
Millstone 2 is shut down for a routine refueling and maintenance
outage and the owner agrees not to restart Millstone 2 before meeting
with NRC to discuss readiness.
NRC increased its inspection hours at the plant by approximately 50
percent.
1995
NRC senior managers met with the licensee's Board of Trustees to
express its concerns about Millstone 2's continued poor performance.
After this meeting, the licensee replaced many senior managers and
began expending resources to fix items on the Restart Action List.
However, the changes and corrections that NRC sought did not occur.
NRC issued its Restart Action Plan for Millstone 2, citing items that
had to be reviewed by NRC before the unit could be restarted.
NRC agreed to permit restart after confirming that Millstone could be
operated safely.
Millstone 2 restarted with NRC's approval, although many of NRC's
long-term RAP items had not yet been resolved.
The licensee shut down Millstone 2 to repair a pipe that ruptured
because of significant erosion/corrosion of the pipe's wall.
Millstone Unit 2 was returned to full power operation.
Millstone Unit 2 was shut down to repair a leaking valve.
Millstone Unit 2 was returned to full power.
1996
NRC placed all the Millstone units on the Watch List.
Millstone Unit 2 was shut down by the licensee to investigate a
suspected design deficiency in a key safety system.
Time magazine's cover story, "Blowing the Whistle on Nuclear Safety,"
drew public attention to long-standing problems at Millstone.
NRC sent the licensee a letter requesting it to certify that it was
operating Millstone in compliance with its licensing basis.
After an SMM, NRC informed the licensee that Millstone remains on the
Watch List.
NRC required the approval of the Commission before Millstone could
restart any units.
NRC's Special Inspection found that a significant issue at Millstone
2 was its ineffective corrective action process.
NRC staff met with the licensee's staff and expressed concern about
programmatic weaknesses since 1991 at Millstone Units 1, 2, and 3.
These weaknesses were cited in design basis and control, corrective
actions, quality assurance, and NRC's own oversight of Millstone.
NRC issued an order requiring the Commission's approval for the
restart of any Millstone unit until the completion, to NRC's
satisfaction, of an Independent Corrective Action Verification
Program and verification that Millstone's physical and functional
characteristics are in conformance with the licensing conditions and
NRC-approved design bases of the units.
1997
Millstone Units 1, 2, and 3 remain closed and on the Watch List; they
require the Commission's approval for restart.
COOPER NUCLEAR STATION
========================================================== Appendix IV
The Cooper Nuclear Station is located in southeast Nebraska on the
west bank of the Missouri River, near the town of Brownville.
Nebraska Public Power District is the owner and licensed operator.
Cooper consists of one nuclear reactor, which is a boiling-water
reactor with a net generating capacity of 778 megawatts. Designed by
General Electric, Cooper was constructed by Burns and Roe. NRC
issued Cooper's license to operate on January 18, 1974, and
commercial operation began on May 10, 1974.
SUMMARY
-------------------------------------------------------- Appendix IV:1
NRC has been concerned about Cooper's regulatory performance since
the early 1990s. NRC discussed Cooper at every Senior Management
Meeting from June 1993 through January 1997, but NRC has never put
the plant on its Watch List. However, Cooper is one of two nuclear
power reactor sites to receive three successive trending letters
(letters reflecting declining performance) from NRC. These letters
were sent in January and June 1994 and January 1995. NRC's records
document the licensee's serious management problems, including that
the licensee allowed the plant to operate out of its NRC-approved
design basis for many years. The licensee shut down Cooper in 1994
because of three serious safety system failures that violated the
requirements under which it must operate. After Cooper shut down,
and as a result of these failures and their serious safety
significance, as well as a long list of other safety deficiencies,
NRC issued a lengthy NRC Restart Action Plan. NRC required that the
items cited on the RAP be resolved and that NRC's approval be
received prior to restarting the unit.
Cooper's main problems were long-standing. They included equipment
and performance failures, operating outside of its design basis, and
a history of a lack of commitment to excellent operations on the part
of the licensee's management. NRC's ineffectiveness in achieving
change compounded the effects of the licensee's poor performance.
Cooper's performance history shows that its performance since 1989
has been significantly worse than the industry average. NRC fined
Cooper heavily--a total of about $750,000--during the period from
1993 through 1996. This was an average of $94,000 per year from 1989
through 1996. For the same period, the industry average annual fines
paid by each unit ranged from $17,000 to $37,000. As the number of
NRC's hours of inspection of Cooper increased dramatically in
1993--an indication of NRC's growing concern--Cooper's scores on
NRC's Systematic Assessment of Licensee Performance also worsened.
Cooper's performance indicators were significantly worse than the
industry average for 4 of the 8 years from 1989 through 1996.
Furthermore, NRC discussed Cooper's performance at every SMM from
June 1993 through January 1997. Also, from 1989 through 1996, Cooper
had an average of about six safety system failures per year compared
to an industry average of about three per year. Since 1989, the
nuclear power industry's average SALP scores, performance indicators,
and the number of safety system failures have shown an overall
improvement, while the number of inspection hours devoted to a plant
have decreased. Figure IV.1 compares the performance of Cooper to
the nuclear industry as a whole.
Figure IV.1: Cooper's
Performance History Against the
Industry Average
(See figure in printed
edition.)
Source: GAO's analysis of
NRC's data.
(See figure in printed
edition.)
PERFORMANCE HISTORY
-------------------------------------------------------- Appendix IV:2
DESIGN BASIS ISSUES
------------------------------------------------------ Appendix IV:2.1
The following illustrates how Cooper operated outside of its design
basis for many years:
NRC found that for 20 years, from January 18, 1974, until May 27,
1994, Cooper did not ensure that its system to prevent leaks of
radioactivity was maintained at all times according to NRC's
requirements. NRC also found that NRC-required leak testing of
the system was not conducted. When the testing was done in
1994, the leak rate was three times NRC's allowable limit.
From January 18, 1974, until May 25, 1994, Cooper conducted tests
of its emergency power system to ensure that the system would
operate as intended in the event of a loss of electrical power.
This testing is required by NRC to ensure that the unit operates
within its design basis and can be permitted to operate. When
tested in May 1994, neither of the emergency generators operated
as required.
Cooper's control room emergency filter system did not operate at
all times, as required by NRC, during the period from June 1989
through April 28, 1994. On April 11, 1994, Cooper identified
numerous hardware deficiencies that resulted in the failure of
the control room to pressurize to NRC-required levels. When
Cooper ran a test to determine if the control room would
pressurize as required, it determined that it would not. NRC
found that in previous tests, Cooper had inappropriately
manipulated the air pressures in adjoining buildings in order to
obtain satisfactory test results. Cooper also masked the
hardware deficiencies that caused or contributed to this
inability to achieve the control pressures required by NRC.
The current NRC senior resident inspector advised us that Cooper's
major safety systems were not operating as designed and that,
therefore, the unit was operating outside of its design basis
prior to shutdown.
CORRECTIVE ACTIONS ISSUES
------------------------------------------------------ Appendix IV:2.2
NRC's inspections show that one of the most significant deficiencies
found at Cooper were untimely and ineffective corrective actions
taken on identified problems. Inspectors found instances in which
safety problems had existed at Cooper for up to 20 years while Cooper
took no effective corrective actions. An NRC special investigation
cited Cooper's weak corrective action program. On the basis of their
findings at that time, the inspection team reported that there may
still be a significant number of undiscovered problems.
NRC's Regional Administrator expressed concern with Cooper's
performance since restart, and the Deputy Administrator told Cooper
executives that the overriding problem was Cooper's "inability to
effectively implement corrective actions."
NRC believes, in hindsight, that the safety violations discovered at
Cooper in 1994 had existed for years, some as far back as the plant's
first start-up in 1974, and should have been discovered and corrected
by Cooper's management long ago. But because Cooper's management had
a poor safety culture and a weak quality assurance program, the
safety violations remained hidden, according to NRC.
NRC officials also believe that its resident inspectors could have
discovered these safety violations. But because NRC officials
assumed that Cooper was an above-average performer throughout the
1970s and 1980s, it rarely conducted special inspections targeted to
uncover safety deficiencies. In 1992, on the basis of its findings
during routine on-site inspections, NRC began to lose confidence in
the ability of Cooper's management to operate the plant safely.
However, NRC did not significantly increase its inspections until
1993. As a result of these inspections, Cooper was pressured by NRC
to shut down in 1994 on the basis that safety systems were not being
operated as required by NRC.
MANAGEMENT WEAKNESSES ISSUES
------------------------------------------------------ Appendix IV:2.3
NRC's investigation into the root causes of Cooper's problems
revealed substantial management weaknesses, especially management's
inability to ensure corrective actions. In NRC's opinion, the
problems associated with Cooper's significant safety system
violations in 1994 were the result of weak management. NRC stated
that chronic and fundamental weaknesses have negatively affected the
safety performance of Cooper for an unacceptably long period of time.
NRC also said that Cooper's long-standing violations were indicative
of long-term failures by senior managers to
implement effective safety processes and procedures;
institute a positive, stationwide attitude toward identifying and
correcting problems;
provide effective oversight and monitoring of Cooper's staff and
programs in order to ensure a high level of safety performance;
and
instill and maintain an attitude among plant staff that emphasizes
plant safety.
While NRC issued favorable reports on improved safety programs and
management practices in the first half of 1995, coinciding with
Cooper's restart, within months NRC reported serious weaknesses in
management's safety performance that could have been corrected prior
to the restart. NRC reported that management
failed to follow procedures,
lacked awareness of the plant's status, and
provided weak oversight of the engineering programs.
WATCH LIST ISSUES
------------------------------------------------------ Appendix IV:2.4
Cooper was discussed at every SMM from June 1993 through January
1997, but it has never been put on NRC's Watch List. NRC also sent
Cooper three successive trending letters in January and June of 1994
and in January 1995. Cooper's owner is one of two nuclear plant
licensees to receive three letters in consecutive SMM periods. The
next level of action in severity above the trending letter would be
to place Cooper on the Watch List.
CHRONOLOGY
-------------------------------------------------------- Appendix IV:3
1989
NRC's inspection hours for Cooper were about 1,500 hours above the
average inspection hours for other units; about 51 percent above the
average.
1992
An NRC inspection report cited growing evidence that management was
not proactively identifying the plant's problems and the licensee was
simply focusing its efforts on whatever NRC identified.
The number of key safety system failures took a dramatic turn for the
worse.
1993
Cooper is discussed for the first time at NRC's SMM. Its SALP
scores, numbers of NRC inspection hours devoted, and fines paid all
took a turn for the worse.
NRC fined the licensee twice for a total of $400,000 because it
provided inaccurate information, took inadequate corrective actions,
and had serious violations in its reactor safety program.
1994
The licensee shut down the unit, which remained closed for 9 months.
NRC issued a RAP requiring Cooper to obtain NRC's approval before
restarting the unit. The plan required an extensive list of
corrective actions and a special inspection to review Cooper's
long-standing equipment, operations, and management problems.
NRC issued two of the three trending letters to Cooper and cited the
unit's performance as marginally adequate.
An NRC special investigation team reported that Cooper's management
was the root cause of its problems, citing deficiencies such as low
standards, poor leadership skills, and improper corporate vision.
1995
The licensee hired a new management team to bring Cooper up to
standards in order to obtain NRC's approval for restarting the plant.
NRC approved restart and the licensee restarted the unit.
After the restart, an NRC inspection report stated that challenges
still remained. A refueling outage that had been scheduled for 54
days lasted 77 days because of problems with work on a turbine and an
emergency diesel generator.
NRC issued a third trending letter to Cooper covering a third
consecutive SMM period.
NRC fined Cooper a total of $300,000 for three violations, including
not keeping the emergency power generators, the control room air
filtration system, and the reactor containment systems in operating
condition as required. In issuing the violations, NRC noted that
unsafe conditions had existed at Cooper for up to 20 years and that
Cooper had been operating outside of its design basis for years.
1996
NRC and Cooper continued to find problems that existed prior to the
1994 shutdown. NRC reported that significant issues in all
functional areas did not appear to be indicative of further decline
in performance, but rather were attributable to preexisting problems.
In April, NRC fined Cooper $50,000 for operating with an unresolved
safety issue for about 10 years. NRC said that the material
condition of the plant continued to improve, but slowly.
1997
Cooper's performance ratings began to show some improvement, although
they are still below the industry average.
In January, Cooper was discussed for the eighth consecutive time at
NRC's SMM.
(See figure in printed edition.)Appendix V
COMMENTS FROM THE NUCLEAR
REGULATORY COMMISSION
========================================================== Appendix IV
(See figure in printed edition.)
(See figure in printed edition.)
(See figure in printed edition.)
(See figure in printed edition.)
(See figure in printed edition.)
(See figure in printed edition.)
(See figure in printed edition.)
GAO'S COMMENTS
-------------------------------------------------------- Appendix IV:4
The following are GAO's comments on NRC's letter dated May 23, 1997.
1. We agree with NRC's discussion on the safety margins afforded by
NRC's regulatory approach, and our report describes NRC's
defense-in-depth philosophy as the basic framework for ensuring the
adequate safety of nuclear plants. Our concern remains that NRC
cannot ensure that all plants have adequate documentation to support
that they are still operating in accordance with their plant designs.
Operating within approved plant design is at the heart of the
defense-in-depth philosophy. This deficiency in NRC's knowledge
base, especially in the light of substantial design deficiencies
discovered at Millstone and in other plants, erodes NRC's confidence
that its licensees are operating their plants in accordance with
their plant design.
Furthermore, NRC stated that the safety deficiencies at the plants we
examined were not serious enough to warrant shutting down the plant
while they were operating. Once the plants shut themselves down,
however, NRC then required the licensees to address their backlog of
problems before allowing them to restart the plants. For example,
Millstone must address a long list of technical and programmatic
issues, including weaknesses in correcting identified problems and
inappropriate response to employees' safety concerns. Salem must
also correct many long-standing safety problems prior to restarting
its plants, including ineffective corrective actions, weak management
oversight, and numerous equipment failures. Most of the problems
keeping these plants shut down are long-standing deficiencies known
to NRC. Forcing licensees to fix their problems before they
accumulated would have helped prevent these plants from reaching
conditions where safety margins were reduced.
2. We agree that these initiatives are worthwhile steps, but taken
together they do not address the fundamental issues raised in our
report. We continue to believe that NRC needs to take more
aggressive action to hold licensees accountable for fixing their
safety problems. For example, we recommend that NRC not only fully
document licensees' progress in addressing their problems, but also
show what sanctions NRC will impose for noncompliance. This
information should also be an important discussion area during the
Senior Management Meeting. In connection with the need to evaluate
management competency and performance as part of the inspection
process, we agree that this is a difficult area to quantify and
assess. We also believe that given the importance of management to
safety performance, ignoring this important factor during the
inspection process prevents NRC from being a more proactive and
therefore effective regulator. In connection with NRC's efforts to
improve its Senior Management Meeting Process, we support NRC's
current initiatives, as we stated in our report.
3. NRC's Enclosure 3 is not included in this appendix. These were
changes that parallel NRC's comments in Enclosure 2.
4. We have made appropriate changes to the report in response to
NRC's suggestions.
5. We agree that NRC does make attempts to have licensees fix
problems as they become known. However, as we document in our
report, NRC's actions were clearly not effective in the three
facilities we studied. The record shows that, for these problem
plants, deficiencies persisted over long periods of time, in some
instances, without being corrected by the licensee. NRC's sanctions
in the form of fines often came late, as did placing plants on the
Watch List, which is a tool used to force a change in behavior. Only
after plants were shut down did NRC use a restart order or plan to
force licensees to address deficiencies.
6. As we said in our report, in only one instance has NRC issued an
order to shut down an operating nuclear power plant--Peach Bottom in
1987. The five plants referred to by NRC were already shut down by
their licensees before NRC issued its order to shut down these
plants.
7. Our audit work clearly supports that there has not been a
concerted effort by NRC to verify the performance indicator data for
completeness or accuracy. We changed our report to show that more
than one official told us that in the Performance Indicator program,
there has been no concerted effort to verify the data for
completeness and accuracy.
8. Subsequent discussion with NRC disclosed that the information on
the number of inspection hours for the industry was 2,503 and for
Cooper was 4,013.
9. Although we modified our report to reflect the senior resident
inspector's new position, the staff who interviewed the inspector
clearly remember her stating that, in her opinion, the Cooper plant
was in an unsafe condition prior to its May 1994 shutdown because
several safety systems would not operate. The staff rechecked their
personal notes to verify these facts.
10. NRC misread our draft report to mean that Cooper's inspection
hours for 1989 were 1,500 hours. We changed our report to more
clearly read that Cooper's inspection hours for 1989 were about 1,500
above the industry average for that year. Also, subsequent
discussion with NRC disclosed that the information on the number of
hours for the industry average of approximately 3,900 hours, stated
in their comment, was fiscal year data. Our report uses calendar
year data.
OBJECTIVES, SCOPE, AND METHODOLOGY
========================================================== Appendix VI
Our objectives in this review were to determine how NRC (1) defines
nuclear safety, (2) measures and monitors the safety condition of
nuclear plants, and (3) uses its knowledge of safety conditions to
ensure the safety of nuclear plants.
To respond to the first objective, we reviewed the Atomic Energy Act,
which governs NRC activities, and pertinent regulations, promulgated
by NRC, that relate to safety. We also reviewed other written source
documents to gain insight into how NRC defines its safety role.
These documents included speeches by the Commission Chairman,
transcripts from hearings and meetings held by the Commissioners, and
other public documents, such as NRC's annual reports, accountability
report, and special publications. We supplemented these materials
with interviews of officials at different levels of the organization.
To respond to objective two, we asked senior NRC officials and
program managers what sources they used to measure and monitor the
safety of individual plants. These answers led us to examine aspects
of
NRC's plant inspection program, which includes on-site inspection
reports, plant performance reviews, and special inspections, and
NRC's performance indicator program, which includes the collecting
and reporting on eight indicators of the safety performance of
nuclear reactor licensees.
To respond to objective three, we interviewed nuclear plant officials
in three separate locations: the Salem Generating Station in Salem,
New Jersey; the Millstone Nuclear Power Station in Connecticut; and
the Cooper Nuclear Station in Nebraska. We chose these locations
because they represent sites that have had significant performance
problems and had been placed under an NRC restart order or plan. The
Cooper plant was chosen because it is in a different region from
Salem and Millstone. We chose plants under a restart order or plan
because these represent the most serious cases of performance
decline, and we wanted to measure the extent to which current
problems represent long-standing performance issues.
At these facilities, we interviewed NRC plant inspectors and utility
managers. We examined inspection reports and other documents
pertaining to restart document orders, including headquarters,
regional, and licensee correspondence. We also interviewed regional
staff in NRC's Region I in King of Prussia, Pennsylvania, and Region
IV in Arlington, Texas.
We also consulted experts in the field of commercial nuclear power,
which included representatives from trade associations, former NRC
commissioners and officials, and public interest groups.
MAJOR CONTRIBUTORS TO THIS REPORT
========================================================= Appendix VII
Gary Boss, Project Leader
Michael Gilbert, Deputy Project Leader
Phil Olson, Team Leader
Robin Reid, Professional Staff
John Cass, Professional Staff
Duane Fitzgerald, Technical Advisor
William Swick, Senior Advisor
Jackie Goff, Senior Attorney
*** End of document. ***