12/29/02

For more than two years, the radiation detectors at the Davis-Besse nuclear power plant insistently signaled that something was wrong inside the hulking gray bunker that houses the reactor. The plant's response to those repeated warnings signaled something as well.

The twin monitors constantly sniff the muggy air inside the containment building, searching for signs that the reactor's vital coolant might be leaking.

And from 1999 to 2001, the detectors' air filters - which normally require monthly changing - were clogging as often as every day with a fine yellow-brown dust. Consultants identified it as coolant residue and rusting metal, likely carried aloft by steam.

Although they suspected a coolant leak somewhere, Davis-Besse personnel couldn't find one. Instead of pursuing its cause, they moved the monitors' intakes to a different spot. They even bypassed one of the devices' three sensors because it kept triggering alarms.

To experts like Mario Bonaca, a top adviser to the Nuclear Regulatory Commission, the Davis-Besse detectors weren't just registering a leaking, rusting reactor lid, but a corroded attitude toward safety, too. "Those were almost daily events," the nuclear industry veteran fumed at a recent meeting. "Didn't somebody scratch their head and say, Why are we overriding these indications?' "

No one did, not the FirstEnergy Corp. managers of the Toledo-area reactor, not the NRC inspectors who were based there, not the analysts for the nuclear industry who gave the plant a clean bill of health. Despite years of obvious signs, the widespread breakdown at Davis-Besse of the "nuclear safety culture" escaped everyone's notice.

"There clearly were some issues with safety culture at that plant that had not been recognized by us, and not recognized by the top-most management of FirstEnergy," said NRC Chairman Richard Meserve. As he told an industry group in November, "the Davis-Besse episode presents the fundamental question as to whether the NRC's approach to assuring an adequate safety culture is sufficient."

Until now, the agency's inspections and rules have focused on hardware and procedures. The NRC has shied away from directly regulating the fuzzier concept of an appropriate safety mindset at the nation's 103 commercial nuclear plants - influenced, in part, by the industry's position that such attention would be meddling in management affairs.

But the shock waves from Davis-Besse have given new urgency to the safety culture debate inside White Flint, the NRC's fortress-like Rockville, Md., headquarters. Some members of the Advisory Committee on Reactor Safeguards, an influential panel of scientists and engineers that counsels Meserve and the four other NRC commissioners, have recently voiced concerns about a possible gap in safety culture regulation. The group will make recommendations this spring.

Meanwhile, the NRC must tackle the more immediate problem of making certain that something it does not yet know how to measure has been restored at Davis-Besse - before the idled plant is allowed to restart.

High stakes

Plumbing an organization's culture sounds better suited for a Harvard MBA thesis than for America's nuclear overseers. But the relative priority that workers and managers give to safety-mindedness is perhaps nowhere more important than at a nuclear plant, where an accident can affect millions of people.

"If it's an industry with catastrophic potential, any lapses are magnified," said Yale University sociologist Charles Perrow, author of "Normal Accidents," a book examining technological risk. With their immense complexity and domino-chain processes, nuclear plants have a built-in propensity for accidents, Perrow argues.

So the organizational sins that might only result in a bad burger or a burned finger at McDonald's - sloppy work, poor supervision, ignored warnings, unnecessary risk-taking - have profoundly greater consequences at a place like Davis-Besse.

The nuclear industry's opposition to formal regulation of the safety culture doesn't mean it thinks the concept is unimportant - quite the opposite. A confidential report in September by the industry's research arm, the Institute for Nuclear Power Operations, analyzed the 20 most significant "near misses" in American nuclear history. (Davis-Besse made the list twice, for its reactor lid hole in 2002 and a 1985 incident in which coolant pump failures brought the reactor's radioactive fuel rods to within two hours of melting.)

The study found that the most commonly reported cause - named in 14 of the 20 mishaps - was plant personnel lacking "an appreciation of the risks associated with their actions" and taking "a non-conservative approach toward reactor safety."

The term nuclear safety culture was introduced after the Chernobyl disaster in 1986. Pinning down exactly what it means has proved elusive.

"I think if you were to talk with five different people about what safety culture is, you'd probably get five different answers," Meserve said in a recent interview with The Plain Dealer. George Apostolakis, a respected Massachusetts Institute of Technology nuclear engineering professor who chairs the NRC's safety advisory panel, goes further.

"We really don't understand what an adequate safety culture is and how to measure it," Apostolakis said. "Some of my colleagues with long experience at nuclear plants tell me they walk into a facility, and 10 minutes later they know whether they have a good safety culture. But they can't tell me why."

Safety before profit

The general consensus is that the safety culture is a blend of attitude, behavior and values: a commitment to excellence; a questioning outlook; personal accountability; a willingness to raise or listen to safety concerns and fix them; a belief from the boardroom down to the broom-pushers that safety comes before everything, including profits.

David Collins, an engineering analyst at Connecticut's Millstone nuclear power station who studies safety culture, likens it to the moral and ethical code that guides doctors: "An attitude that ensures the [nuclear] technology first does no harm."

How do you measure an attitude, though? The NRC historically has avoided much work in the area, to the great frustration of people like Apostolakis, the agency's top safety adviser.

"For the last 20 to 25 years," he said, "this agency has started research projects on organizational-managerial issues that were abruptly and rudely stopped because, if you do that, the argument goes, regulations follow. So we don't understand these issues because we never really studied them."

Instead, the agency has staked its confidence on the ability of its routine equipment inspections and program reviews to act as an indirect barometer of safety culture. If its inspectors find a backlog of maintenance work, the NRC's thinking goes, or repeated failures by engineers to get to the bottom of a stuck valve, that should trigger alarms about an appropriate safety attitude and prompt greater agency scrutiny.

Going any further to impose specific safety culture requirements, the nuclear industry has argued, would force a cookie-cutter approach on plants that are as different as the Southerners or Rust Belt natives who populate them, robbing managers of the flexibility to achieve safety in the way that works best for their employees. A government regulation might also undercut the notion that nuclear plants themselves have the primary responsibility for safety.

Troubling events at the Millstone plant in the 1990s raised questions about utilities' commitment to safety culture and the NRC's capacity to catch its decline. Amidst equipment failures, internal warnings of a "cultural problem" and several dozen claims that workers were penalized for bringing up safety issues, the three-reactor complex landed on the NRC's "watch list" of problem plants in 1996.

The plant's owner, Northeast Utilities, shut it down for repairs and other operations. After Time Magazine exposed Millstone's flaws, the agency ordered Northeast to prove it had a comprehensive plan to ensure that workers who aired safety concerns wouldn't face retaliation before it could restart the reactors. In essence, the NRC demanded that Millstone establish an aspect of safety culture, without saying how to do it.

"Fortunately, Millstone was able to get the right people in there and work with management, with all the consultants we had, to come up with some kind of definition of safety culture," said Paul Blanch, an engineer and former Northeast whistleblower who was brought back to help address the problems.

The two-year effort required replacing about 40 managers and developing programs to re-educate those who remained on how to handle safety complaints and employee concerns. Workers and bosses had to learn to communicate and rebuild shattered trust.

"There were dramatic examples of people changing," but progress was halting and fragile, said MIT management professor John Carroll, who has studied the Millstone case. The lengthy shutdown cost Northeast more than $1 billion; in 1998 the utility decided for economic reasons that only two of Millstone's three reactors would return to service.

The Davis-Besse shock

The Millstone debacle was supposed to have heightened the nuclear industry's awareness of the safety culture issue.

The NRC also believed that its new approach to monitoring the nuclear fleet, launched in 2000, would be a more sensitive, less subjective indicator of how well reactors were operating. While the revamped Reactor Oversight Program still didn't directly rate plants' safety culture - or workers' ability to report safety concerns - the refocused inspections were supposed to be able to detect problems in those areas in plenty of time to avert a crisis.

Which is why Davis-Besse came as such a shock to regulators and the industry: Until the day the hole in the reactor lid was found in March, the plant got uniformly high marks from the NRC's inspections and, reportedly, the confidential ones done by the Institute for Nuclear Power Operations that deal even more directly with safety culture.

"It's a major failure of the system, in my view," Apostolakis said.

Even before the Davis-Besse event, the NRC was warming to the idea of requiring that all reactor operators put in place safety-conscious work environment programs to ensure employees' freedom to raise concerns. Senior agency officials have recommended such a rule, and the commissioners will take up the matter soon.

But a broader regulation mandating that plants have - and that the NRC verify - an adequate safety culture is much less likely any time soon. NRC rulemaking is typically a years-long process.

And the Nuclear Energy Institute, the industry's powerful lobbying arm, would oppose safety culture-related regulations because it believes that current rules are adequate, that new ones would be subjective and that Davis-Besse was a unique event, not a fleetwide problem.

"The NRC is excellent at regulating hardware. It's very difficult to regulate mindset," said Ellen Ginsberg," the industry group's deputy general counsel.

While that may be true, Meserve insists that the NRC is "not taking anything off the table" in its consideration of safety culture options.

"I can't tell you that we should change the way we do things," he said. "If we were to find tools" to measure a plant's culture objectively, "I think a lot of concerns of regulation in that area would diminish."

Do they care?

One such tool may spring from the advice that a legendary football coach offers leaders. Lou Holtz suggests that whether a business succeeds depends on how the boss measures up to these employee questions: "Can I trust you? Do you care about me? Are you committed to excellence?"

Collins, the Millstone analyst, realized from his experiences during the plant's recovery that workers' feelings about managers are a strong meter of the organization's culture. With input from MIT's Carroll, he fashioned a survey based on those themes. He and others believe that it can pinpoint trouble spots where leadership - and by extension, safety culture - have slipped.

Collins, who already has done a test run of the survey at Millstone, suggests that the survey could be done at least yearly, with the NRC reviewing summary results. If employee confidence fell below a certain level, the agency and utility could discuss remedies, with a time period for improvement before the NRC stepped up enforcement. In short, a measuring tool.

Davis-Besse has undertaken its own employee surveys since the shutdown. Though not based on Collins' model, they are one of the indicators that the NRC panel overseeing the plant's rehabilitation will use to judge its readiness to resume operating. Most are based on how well workers and managers perform while under the NRC's magnifying glass.

"That's the only way the NRC can make a (safety culture) determination - looking at decisions and whether they're made conservatively," said Andrew Kadak, an MIT nuclear engineering professor and former nuclear CEO.

"I don't know how to measure safety culture," said the NRC panel's chair, Jack Grobe, who's been through several restarts of troubled plants. Nonetheless, he is confident there are reliable proxies. An important one is the reports that workers file alerting their bosses to equipment problems or conditions needing attention.

"That's the guy in the field, having an itch," Grobe said. "How he writes it down, how the company responds to that, how they identify corrective actions and follow through - that is one key indicator."

Davis-Besse's response to the discovery several months ago of evidence that the bottom of the reactor - in addition to the lid - might also be leaking is another telling sign, Grobe said.

Chemical tests of rust on the vessel's base couldn't rule out that it came from bottom leaks rather than from running down from the lid. Instead of waiting for the NRC to tell it what to do, FirstEnergy on its own proposed a much more extensive test.

To Grobe, that was a watershed of sorts, a hint that Davis-Besse's wilted safety culture might be reviving. "It's very clear to me that the people in the plant (now) feel very comfortable raising difficult issues, in a very direct way."

But the recovery, which has already cost FirstEnergy nearly $400 million, will be long and difficult, warns Millstone veteran Blanch. "We really objectively did not observe significant improvement for more than two years," he said. "And it was a monumental effort."

For complete Davis-Besse coverage, go to www.cleveland.com/davisbesse/

To reach these Plain Dealer reporters:

jmangels@plaind.com, 216-999-4842

jfunk@plaind.com, 216-999-4138