United States General Accounting Office GAO Report to Congressional Requesters May 1997 NUCLEAR REGULATION Preventing Problem Plants Requires More Effective NRC Action GAO/RCED-97-145 United States GAO General Accounting Office Washington, D.C. 20548 Resources, Community, and Economic Development Division B-276754 May 30, 1997 The Honorable Joseph I. Lieberman United States Senate The Honorable Joseph R. Biden, Jr. United States Senate As requested, we reviewed the Nuclear Regulatory Commission’s (NRC) oversight of the nuclear power industry. NRC, an independent agency created by the Congress in 1974, is responsible for, among other things, ensuring that the operation of the nation’s 110 commercial nuclear power plants occurs in a manner that adequately protects the health and safety of the public. Identifying plants with safety problems and making sure that the owners of the plants (licensees) correct their safety deficiencies promptly is critical to NRC’s safety mission. As agreed with your offices, we focused our review on how NRC • defines nuclear safety, • measures and monitors the safety condition of nuclear plants, and • uses its knowledge of safety conditions to ensure the safety of nuclear plants. As part of our work, we looked at three plants that had long-standing histories of uncorrected safety concerns. Specifically, as agreed with your offices, we focused on the Salem Generating Station (Salem) in Salem, New Jersey; the Millstone Nuclear Power Station (Millstone) near New London, Connecticut; and the Cooper Nuclear Station (Cooper) near Brownville, Nebraska. We chose these three facilities because of your concerns that some nuclear plants have reached serious states of decline despite NRC’s oversight efforts. The Millstone and Salem plants were shut down by their licensees because they violated NRC regulations. The licensees of these plants must address many long-standing safety problems before NRC will allow them to restart operations. Cooper is currently operating but was shut down by its licensee in 1994 because of safety concerns. As with Millstone and Salem, Cooper could not restart without NRC’s approval. (App. I describes NRC’s regulatory program; apps. II, III, and IV describe these facilities in more detail.) Page 1 GAO/RCED-97-145 NRC’s Oversight of Nuclear Power Plants B-276754 To achieve NRC’s safety mission, it is critical that the Commission maintain Results in Brief a high degree of confidence in its regulatory program’s ability to ensure that the nuclear industry performs to high safety standards. While we are not making judgments on the safety of plants, the many safety problems identified in some plants raises questions about whether NRC’s regulatory program is working as it should. Determining the safety of plants is difficult because NRC does not precisely define safety. Instead, NRC presumes that plants are safe if they operate within their approved designs and in accordance with NRC’s regulations. Because of the many redundant safety systems built into the plants’ designs, NRC believes that plants are safe to operate even when some of their safety systems are not working properly. However, according to recent findings in some plants, including Millstone, NRC is no longer confident that all plants are still operating as designed and is requiring all 110 nuclear plant licensees to certify that they are maintaining their plants in accordance with their approved plant designs. NRC is also concerned that as nuclear plant owners pursue cost-cutting strategies to meet future competition, safety priorities may be jeopardized. NRC is responsible for laying out clear requirements for operating nuclear plants and for overseeing its licensees to ensure that they are performing as they should. NRC has on-site inspectors that prepare reports on the plants’ activities about every 6 weeks, and comprehensive assessments are assembled every 12 to 24 months for all nuclear plants. NRC also collects and publishes safety performance indicators, such as the number of safety system failures at all plants. These data, which are supplied by the licensees, show that the overall safety performance of the nuclear industry, as a whole, is good and improving but that some plants are chronically poor performers. Currently, NRC has placed 14 nuclear plants on its “Watch List,” which includes those plants whose declining safety performance triggers additional oversight attention by NRC. This is the highest number of plants on NRC’s Watch List since 1988. Thirty-seven percent of the nation’s nuclear plants have been on NRC’s Watch List at some point over the past 11 years, and many of these plants have stayed on the Watch List for many years. For example, Units 1 and 3 at the Browns Ferry site in Alabama have been on the Watch List for 10 years, and Dresden’s two plants in Illinois have been on the Watch List for 7 years. For some plants, NRC has not taken aggressive enforcement action to force the licensees to fix their long-standing safety problems on a timely basis. As a result, the plants’ conditions have worsened, making safety margins Page 2 GAO/RCED-97-145 NRC’s Oversight of Nuclear Power Plants B-276754 smaller. For example, Salem, Millstone, and Cooper were closed for safety deficiencies. In each of these cases, NRC’s inspection records show a pattern of licensees that are not adequately identifying and correcting their plants’ safety deficiencies over long periods of time. NRC allowed safety problems to persist because it was confident that redundant design features kept plants inherently safe and because it relied heavily on the licensees’ promises to make changes. NRC forced the licensees to correct their problems only after the licensees voluntarily shut down plants. In addition, NRC lacks a process for ensuring that the licensee uses competent managers, which is widely recognized by NRC and industry officials as important to ensuring plants’ safe performance. Finally, NRC was slow in placing plants on its Watch List, which it uses to trigger more regulatory attention at an early stage so that a plant’s performance conditions can be improved. Salem was not placed on the Watch List until after the licensee shut it down for safety reasons. Millstone was eventually placed on the Watch List years after first being recognized as having many safety problems. Cooper was never on the Watch List, even though it was shut down by the licensee in 1994 because of many safety deficiencies. NRC’songoing reforms, which include expanding its inspection program and revamping its process for identifying plants with long-standing safety problems, show a strong commitment by the current Chairman and Commission to strengthen the Commission’s oversight capability. However, changing NRC’s culture of tolerating problems will not be easy. Achieving fundamental reform starts with holding the licensees accountable for fixing their plants’ problems more promptly and addressing management issues more directly. Under the authority of the Atomic Energy Act, the NRC licenses the Background construction and operation of nuclear power plants; develops, implements, and enforces the rules and regulations that govern nuclear activities; inspects facilities to ensure compliance with legal requirements; and conducts research to support its programs. NRC also maintains at least two inspectors at every operating nuclear reactor site and supplements their inspection activities with staff from any of its four regions and from NRC headquarters. NRC’s fiscal year 1997 budget is estimated at $477 million. Its staff of about 3,000 is responsible to five Commissioners appointed by the President and approved by the Senate. About 55 percent of NRC’s professional staff is dedicated to nuclear reactor activities. The 110 licensed nuclear plants Page 3 GAO/RCED-97-145 NRC’s Oversight of Nuclear Power Plants B-276754 operate in 32 states and provide about 22 percent of the nation’s electricity. Six states (Connecticut, New Jersey, Maine, Vermont, South Carolina, and Illinois) rely on nuclear power for over half of their electricity. The utility companies that own and operate nuclear plants include both public and private enterprises. Utility experts agree that aggressively attending to safety deficiencies is good business strategy because safety problems are a significant economic burden on both licensees and ratepayers. Plants that perform poorly must shut down for repairs more often than those that perform well. According to NRC, a shutdown costs a licensee between $249,000 and $310,000 per day in operating costs and in purchases of alternate power. Also, NRC reports that the nuclear industry has matured to the point that plants have been in operation long enough for reactors’ aging to be a major issue that can affect cost and safety. Aging affects all of a plant’s structures, systems, and components. These conditions can cause safety concerns that, if not appropriately addressed, would require a licensee to shut down the plant. NRC officials are also worried that safety levels may be compromised as licensees cut costs to stay competitive. A private research report concluded that because competition will result in lower electricity prices in the future, as many as 37 of the nation’s nuclear sites are vulnerable to shutdown because their production costs are higher than the projected prices in the market.1 Together, these sites represent over 40 percent of the nuclear generating capacity of the United States. NRC’s statutory obligation when it grants an operating license is to require Nuclear Plant Safety sufficient information from the licensee to enable NRC to “provide adequate protection to the health and safety of the public.” NRC approves the plant’s design, monitors the plant’s performance, reports on conditions, and inspects the plant to ensure compliance with its regulations as part of its statutory responsibility. NRC has three primary enforcement sanctions—notices of violation; civil penalties; and orders to modify, suspend, or revoke licenses: • A notice of violation informs the licensee of one or more violations of legal or regulatory requirements. • Depending on the severity of the violation, a notice can be accompanied by a civil penalty (fine) of up to $110,000 per violation per day. The 1 Nuclear Power Plant Shutdowns and Implications for Future Natural Gas Demand, Washington International Energy Group (Feb. 1997). Page 4 GAO/RCED-97-145 NRC’s Oversight of Nuclear Power Plants B-276754 amount of the fine, if any, depends on the safety significance of the violation and on the licensee’s responsiveness to the violation, including any corrective action that the licensee has already taken. In fiscal year 1996, NRC levied fines totaling $3,700,000 on 28 plants; Salem led all plants with fines of $600,000. • NRC uses orders to demand more information from the licensees concerning potential hazardous conditions, in more severe cases to require a licensee to shut down or, to prevent a licensee from restarting its plant’s reactors if the NRC feels it would be prudent to force the licensee to fix an accumulation of safety problems while the reactors are idle. Only once in its history has NRC issued an order to shut down an operating plant (Peach Bottom, Pennsylvania, in 1987). On other occasions, NRC issued a shut down order after the licensee suspended operations. Typically, licensees shut down a plant when they violate certain regulations or their plant specifications. They may also shut down a plant if they believe such an action is appropriate for safety reasons, usually as a result of substantial involvement by NRC. Once a plant is shut down, NRC can keep it shut down until the licensee addresses its problems to NRC’s satisfaction. NRC can also place plants on its Watch List when the plants’ performance indicators and other data show a pattern of deteriorating safety performance. This action prompts additional oversight by NRC and more intensive inspection activity. NRC’s regulations and other guidance do not provide either the licensees or the public with the specific definitions and conditions that define the safety of a plant. According to NRC, nuclear plants are presumed to be safe if they operate as designed. NRC reasons that the many safety features and systems built into a plant’s design provide an adequate level of safety, even when some of them are not functioning. System redundancies—the duplication of a plant’s safety systems and components—provide in-depth protection to help prevent an accident from releasing radiation to the public. The concept of defense-in-depth forms the foundation of NRC’s confidence that nuclear plants are safe, even those that may be shut down for safety problems. The conditions found at Millstone, however, have challenged NRC’s confidence that it can rely on licensees to ensure that the plants are operating within their approved design basis. In 1996, NRC discovered that Millstone had been operating outside of its plant design for many years, a condition that contributed to the licensee’s decision to shut down the plant. NRC’s on-site inspectors were unaware of the extent to which Page 5 GAO/RCED-97-145 NRC’s Oversight of Nuclear Power Plants B-276754 Millstone was operating outside of its design basis because, according to NRC’s Chairman, the agency stopped doing design basis inspections too early (NRC is now re-emphasizing design basis issues in its inspection program). The Chairman also said that NRC should have put more resources into discovering the problems at Millstone at an earlier stage. Concerned that Millstone’s conditions exist in other plants, NRC is now no longer confident that all nuclear plants have accurate information on the extent to which they are operating as designed. As a result, NRC is requiring all licensees to certify that they are in compliance with their approved design basis.2 At the time of our review, the licensees were in the process of reporting back to NRC on this requirement. NRC collects an enormous amount of information on nuclear plants, both NRC’s Safety from its own inspectors and from the nuclear plant licensees. Taken Performance Data together, these sources provide NRC with an extensive knowledge base Show That Several with which to measure and monitor a plant’s safety conditions and safety performance. These data characterize an industry that has improving Plants Are Poor safety trends overall but that also has several chronically poor performers. Performers Inspections and NRC’s on-site inspectors prepare reports about every 6 weeks on a plant’s Performance Indicators performance, using a comprehensive guide covering the aspects of nuclear Provide Extensive plant operations. These reports are then rolled up into a Systematic Assessment of Licensee Performance (SALP) approximately every 12 to 24 Information on Nuclear months. SALPs, which form NRC’s basic performance rating for each nuclear Plant Safety Conditions plant, cover broad areas, including operations, maintenance, and and Performance engineering. NRC also conducts special inspections if they are warranted by a plant’s conditions. The plants with histories of poor performance are often the subject of additional inspection activity (app. I describes SALPs and other inspection activities in more detail). NRC also prepares a summary of plant performance at least every 6 months. NRC uses the summary as a guide for determining the plants’ need for additional inspection attention. In addition to these NRC activities, licensees report daily to NRC on the plants’ conditions and events. Unusual events, such as equipment failures and accidents, are included in these daily reports. Performance indicators are an important tool to gauge plants’ safety trends. Following a series of events, including the Three Mile Island nuclear accident and a loss of feedwater at the Davis-Besse, Ohio, plant, 2 A plant is designed to operate according to a “design basis,” which includes the specific functions to be performed by the plant’s structure, systems, and components. Page 6 GAO/RCED-97-145 NRC’s Oversight of Nuclear Power Plants B-276754 NRC developed eight indicators for monitoring the safety performance of licensees (see app. I for a description of these indicators). The indicators were needed, according to NRC, to improve its ability to predict declining performance. Collected quarterly from the plants’ reports, the indicators cover many safety performance aspects of operating reactors, such as the number of safety system failures and the extent of workers’ exposure to radiation. Several Plants Continually While NRC’s indicators show generally improving safety conditions Perform Poorly throughout the nuclear power industry, the indicators on a plant-specific basis also show that several nuclear power plants continue to plague NRC with chronically poor performance. Currently, 14 plants are on NRC’s Watch List, which contains those plants identified by NRC as needing close attention because of their declining performance.3 This is the highest number of problem plants listed since 1988 (see fig. 1). 3 NRC develops the Watch List semi-annually at its Senior Management Meeting, which is discussed in more detail later in this report. Page 7 GAO/RCED-97-145 NRC’s Oversight of Nuclear Power Plants B-276754 Figure 1: The History of NRC’s Watch List Number of plants 15 10 5 0 1987 1988 1989 1990 1991 1992 1993 1994 1995 1996 1997 Years Source: GAO’s analysis of NRC’s data. Over the past 11 years, 41 plants, or 37 percent of the nation’s nuclear power plants, have been placed on the Watch List by NRC, as shown in figure 2. Page 8 GAO/RCED-97-145 NRC’s Oversight of Nuclear Power Plants B-276754 Figure 2: The Nuclear Plants on NRC’s Watch List Nuclear plants Maine Yankee Salem 1 Salem 2 Crystal River Davis-Besse Fort St. Vrain Palisades Lasalle 2 Surry 2 Fort Calhoun Lasalle 1 Surry 1 Millstone 1 Millstone 2 Millstone 3 S. Texas 1 S. Texas 2 Fitzpatrick Brunswick 2 Zion 1 Zion 2 Brunswick 1 Nine Mile Pt 2 Rancho Seco Nine Mile Pt 1 Fermi 2 Calvert Cliffs 1 Calvert Cliffs 2 Turkey Pt. 4 Turkey Pt. 3 Sequoyah 2 Sequoyah 1 Peach Bottom 2 Peach Bottom 3 Pilgrim Indian Point 3 Browns Ferry 2 Dresden 2 Dresden 3 Browns Ferry 1 Browns Ferry 3 0 1 2 3 4 5 6 7 8 9 10 11 Total years on Watch List Source: GAO’s analysis of NRC’s data. Page 9 GAO/RCED-97-145 NRC’s Oversight of Nuclear Power Plants B-276754 Twenty-four plants have been on the Watch List for 2 or more years. However, about half of the plants that NRC placed on the Watch List were known by NRC to be poor performers long before they were placed on the list. NRC’s senior managers formally discuss plants that are experiencing declining safety performance. Although about half of these plants are eventually placed on the Watch List, NRC has not precisely defined the criteria for when a plant is formally discussed and/or placed on the Watch List. Salem and Millstone were under discussion by NRC for 3 to 4 years before they were placed on the Watch List in 1996 and 1997, respectively. NRC discussed Cooper as a problem plant but never placed it on the Watch List. In their letter commenting on a draft of this report, NRC said that 43 other plants have been discussed but not placed on the Watch List (see app. V for NRC’s letter). Our review of three facilities with a history of poor performance shows NRC Is Not that NRC has not gotten licensees to fix safety problems at these plants in a Effectively Overseeing timely manner. Identifying and correcting safety deficiencies are among the Plants That Have the licensees’ most important safety responsibilities and a major focus of NRC’s inspection program. Yet NRC allows licensees repeated opportunities Problems to correct their safety problems, often waiting for a significant problem or series of events to occur at a plant before taking tough enforcement action. We found that NRC fined licensees, in some cases long after problems became apparent, and was very slow to place problem plants on its Watch List. NRC also lacks an effective process for ensuring that licensees have competent management in place, which is considered by NRC and nuclear experts as an important influence on a plant’s safety performance. Finally, the Senior Management Meeting process, a tool created by NRC to provide an early warning of problem plants, is not working effectively. NRC Is Not Getting NRC’s regulations require nuclear plants to have an effective program to Licensees to Fix “assure that conditions adverse to quality . . . are promptly identified and Deficiencies in a Timely corrected.” NRC places importance on evaluating plants’ corrective action programs to ensure that they will lead to timely correction of the identified Manner problems. However, in all three facilities we examined (Millstone, Salem, and Cooper), the licensees did not fix their substantial and recurring safety problems in a timely manner. For example, NRC concluded in its 1995 performance review of Salem that Page 10 GAO/RCED-97-145 NRC’s Oversight of Nuclear Power Plants B-276754 “. . . overall performance has declined and . . . the challenges to plant systems and operators caused by repetitive equipment problems and personnel errors . . . had the potential to, or actually did, adversely affect plant or personnel safety.” Of the 43 deficiencies that NRC required to be addressed before the Salem reactors can be restarted, all but 5 were conditions that were present when the reactor was operating. Two of these deficiencies had been continuing problems for 6 to 7 years—a control air system and circulating water for a motor—and one had been on NRC’s followup system since 1989 and was addressed in three separate NRC inspection reports. The licensee has identified approximately 31,000 work items that it feels should be completed before restarting the units. Similarly, at Millstone, a special NRC inspection team reported in 1996 that it found several instances in which the licensee failed to identify safety problems and lacked an adequate system to track corrective actions. The team also reported that the licensee inappropriately closed corrective actions before they were completed. A former Senior Resident Inspector at Millstone told us that the plant’s managers were notoriously late in correcting problems. Also, the unpublished 1995 SALP on Millstone was very critical of Millstone’s inattention to a growing backlog of unresolved safety concerns.4 Like Salem’s, Millstone’s problems were also long-standing and well known to NRC. Moreover, NRC acknowledges that Millstone’s performance declined for years before the plant was first discussed as a potential Watch List candidate in 1991. In a 1990 meeting in which NRC officials determined which plants should be placed on the Watch List, they noted that “[Millstone] . . . has acknowledged that weaknesses existed prior to 1991 in their programs for timely resolution and reporting of deficiencies.” A former Millstone Senior Resident Inspector also told us that he saw performance slip over several years as maintenance backlogs grew, violations increased, and management’s responsiveness to NRC waned. He also said that NRC should have pursued more aggressive enforcement action. A 1996 independent auditor’s report summed up the Millstone situation as follows: “[Millstone’s] attempts to regain [confidence that it can operate safely] will be complicated by the fact that the NRC has also publicly admitted that, by failing to take more aggressive 4 In accordance with NRC’s policy, Millstone’s latest performance assessment was not published because Millstone is shut down. Page 11 GAO/RCED-97-145 NRC’s Oversight of Nuclear Power Plants B-276754 action against [Millstone] over the years, the agency itself has lost the confidence of the public it serves.”5 Similarly, problems in identifying and correcting the deficiencies at Cooper were long-standing and were well known to NRC. Cooper was shut down for 9 consecutive months in 1994 and 1995 because of safety system failures that were, according to NRC, of long standing. Some of Cooper’s problems dated back to the plant’s first start-up in 1974—problems that Cooper’s management should have addressed years earlier, according to the NRC inspectors we interviewed. An NRC audit reported that the plant’s managers were “living with problems, not fixing them” and that “ineffective self-assessment” and a “weak corrective action program” characterized operations. Several reasons may account for why NRC tolerated safety problems in these plants. As previously discussed, NRC believes that the multiple safety systems gives NRC and its licensees confidence that plants are safe even when they have many safety problems. Therefore, unless an accident or serious event poses an obvious safety or health risk to workers or the public, NRC appears reluctant to take swift enforcement action. In addition, since NRC does not precisely define safety, perceptions of safety levels and risk are subjective and are not always consistent from inspector to inspector. Several current and former NRC inspectors told us that they cannot easily distinguish a safe plant from an unsafe one and that the guidance on when to shut down a plant does not cover all situations. Finally, as discussed below, NRC inspectors are heavily influenced by licensees’ promises to fix identified problems. As a result, NRC inspectors allow licensees’ managers considerable time and effort to fix a problem before enforcement action is considered. NRC’s Chairman has expressed concern about the consequences of NRC’s past patience with licensees. The Chairman has stated that nuclear plant safety is based on full compliance with all of NRC’s regulations. Relying on Plant Managers NRC gives licensees considerable latitude to fix their problems. This to Fix Problems Is Not strategy works well when the licensees’ managers place priority on Always Effective maintaining a strong safety culture. However, we found that this condition was not present in the problem plants we examined and that the conditions worsened when NRC did not hold the licensees accountable for fixing their problems. 5 Focused Audit of the Connecticut Light and Power Company: Nuclear Operations, prepared for the State of Connecticut’s Department of Public Utility Control (Dec. 31, 1996). Page 12 GAO/RCED-97-145 NRC’s Oversight of Nuclear Power Plants B-276754 For example, Salem’s managers developed several action plans over time to correct deficiencies and, at one point, established an independent team to evaluate why prior action plans had failed to correct ongoing problems. Salem also made changes to its senior management team several times and met with NRC officials many times with promises to make improvements. After several years of recurring problems, management changes, and disappointing action plans, failures in several of the plant’s safety systems forced the managers to shut down the plant. NRC then stepped in and conditioned restarting the plants on correcting previously identified problems. Similar conditions existed at Cooper. Relying on the licensee’s promises to fix the problems, NRC allowed Cooper to restart its reactors after the plant was shut down in 1994. After a period of improvement over several months, the plant’s performance quickly declined. A subsequent NRC audit report discovered that many of the safety problems that Cooper’s management had promised to correct had not been corrected. NRC inspectors told us that NRC’s restart decision relied not only on Cooper’s plans and promises, but also on Cooper’s monitoring its own progress. At Millstone, NRC relied on the licensee’s plans to correct deficient conditions without success. The NRC’s OIG found that “[Millstone’s] change in program initiatives and management reorganizations lulled the NRC staff into allowing an excessive amount of time for [the licensee’s] proposed corrective actions to take effect. [Millstone’s] sporadic improvements in some areas neutralized the NRC staff’s willingness to take prompt action.”6 The OIG also noted that Millstone managers would often identify a problem and develop a “grandiose” plan to address the issue. Although some improvement would occur, permanent change was never achieved. According to the OIG, NRC would then take a “year or two” to determine the effectiveness of the plan or a change in management. A Connecticut State audit described how NRC was influenced by management’s promises and was reluctant to place Millstone on its Watch List: 6 Management Implications Report-NRC Staff Handling of Millstone/Maine Yankee Issues, Office of Inspector General, NRC (98/MIR-1, June 13, 1996). Page 13 GAO/RCED-97-145 NRC’s Oversight of Nuclear Power Plants B-276754 “The NRC did not advance any of the Millstone units to its Watch List, as various combinations of improvement initiatives and management changes led the NRC to believe that sustained improvements at the site would be forthcoming.”7 A 1993 incident at Millstone illustrates how NRC’s tolerance of the efforts of the licensee’s management to fix problems can affect safety. A May 1993 leak in a high-pressure steam line was discovered by workers at the plant. To avoid shutting down the reactor to fix this valve, workers made about 30 unsuccessful attempts over 74 days to fix the leak. Eventually, the workers’ attempts worsened the condition, causing the reactor to be shut down. NRC later fined Millstone $237,500 for its actions, referencing three violations of the law and noting the “egregious” nature of this event, which NRC said had placed the workers at an unacceptable level of risk. NRC inspectors and regional management were aware of the attempts to fix the leak but took no immediate action, deferring instead to the management’s efforts to make repairs. An NRC inspector assigned to Millstone during this incident told us that NRC should have taken more aggressive enforcement action at the time. He also told us that NRC’s Senior Resident Inspector had recommended a shut down but was overruled by regional management, who believed there was not a regulatory basis for shutting down the plant. NRC’s former Executive Director of Operations, told us that he would have ordered the reactor shut down immediately if he had known that the plant’s managers were struggling to fix a problem that had potentially very serious safety consequences. NRC Enforcement Actions NRC’s enforcement program is designed to ensure compliance with NRC’s Are Too Late to Be regulations, obtain prompt correction of violations, deter future violations, Effective and encourage licensees to operate their plants safely. Salem, Millstone, and Cooper were all fined amounts well above the industry average (see fig. 3). However, Salem’s fines were levied by NRC well after the plants were in periods of significant decline. Furthermore, NRC still has not completed its enforcement action against Millstone for violations that were first discovered in 1995, partially due to, according to NRC, the need for close coordination with the U.S. Attorney for consideration of criminal prosecution. 7 Focused Audit of the Connecticut Light and Power Company: Nuclear Operations, prepared for the State of Connecticut Department of Public Utility Control (Dec. 31, 1996). Page 14 GAO/RCED-97-145 NRC’s Oversight of Nuclear Power Plants B-276754 Figure 3: Fines That NRC Levied Against Three Nuclear Plants 700 Total fines ($000) 600 500 400 300 200 100 0 1989 1990 1991 1992 1993 1994 1995 1996 Year Salem Millstone Cooper Average Source: GAO’s analysis of NRC’s data. Another NRC enforcement action is to prevent shutdown plants from restarting until all of their safety deficiencies are addressed. This is an effective strategy for correcting long-standing problems. Unfortunately, this NRC action sometimes occurs long after plants’ performances are in significant decline. Usually, a specific incident or a series of problems causes plants to shut down. The economic impact of keeping a plant idle—$249,000 to $310,000 daily—is significantly more than the fines levied on a licensee. The Importance of Quality The nuclear industry and NRC officials widely agree that the competency of Management to a Plant’s a nuclear plant’s management is a critical factor in safety performance. Safety Performance Despite the importance of management, NRC does not have an effective process for ensuring that licensees maintain competent management in Page 15 GAO/RCED-97-145 NRC’s Oversight of Nuclear Power Plants B-276754 their nuclear plants. Although NRC’s regulations do not require the evaluation of plant management before a license to operate a nuclear plant can be issued, NRC must determine if the prospective licensee is “technically and financially qualified to engage in the activities authorized by the operating license . . . .” These are important components of management that could also be part of a licensee’s overall ability to manage a facility competently on an ongoing basis. NRC’s audits frequently cite management weaknesses as the major cause of the declining performance of nuclear plants. For example, NRC’s audits made many references to management’s performance in the Commission’s reviews of why conditions deteriorated at Cooper, including a “poor management safety culture,” “weak management oversight of engineering programs,” a “fragmented approach” to problem resolution, and failure to provide an “adequate level of oversight.”8 Cooper’s own self-assessment team also reported many management-related problems in its 1994 report, including “management’s ineffectiveness in establishing a corporate culture that encourages the highest standards of safe nuclear plant operation” and the “failure of management to establish the vision supported by adequate direction and performance standards to improve station performance.” The self-assessment also noted the “. . . failure to direct critical self assessment activities that recognize program and process deficiencies and identify necessary improvements.”9 At Salem, NRC’s audit reports also cited the licensee’s management as a cause of safety problems. Inspection reports indicated that Salem’s problems could have been addressed. We believe a shutdown could have been avoided if more competent management were in place. Also, audit reports frequently cited management weaknesses as a root cause of Salem’s performance problems. The management’s decisions in the late 1980s were the cause of Millstone’s current conditions, according to a 1996 comprehensive review by an independent auditor.10 Concerned about the need to trim costs in the face of future competition, the managers chose to manage close to the regulatory margin. This decision translated into deferring maintenance and allowing corrective action backlogs to grow, eventually creating a 8 Supplemental Plant Performance Review, NRC (95-04, Oct. 3, 1995). 9 Diagnostic Self Assessment, Nebraska Public Power District, Cooper Nuclear Station (Sept. 1, 1994). 10 Focused Audit of the Connecticut Light and Power Company: Nuclear Operations, prepared for the State of Connecticut Department of Public Utility Control (Dec. 31, 1996). Page 16 GAO/RCED-97-145 NRC’s Oversight of Nuclear Power Plants B-276754 situation that led to a shutdown and several hundred million dollars worth of repairs. Senior NRC managers are aware of the importance of competent management to safety performance. For example, the NRC Chairman recently stated that the “. . . recent events at Maine Yankee . . . resulted in a failure to identify and promptly correct problems arising in areas that management viewed, not always correctly, as having low safety significance.”11 From the minutes of NRC’s January 1997 public meeting on operating reactors to discuss the nuclear industry’s safety performance (the Senior Management Meeting), NRC stated that safety performance problems were found at the LaSalle and Zion nuclear plants in Illinois and that the principal reasons for the problems were weak management processes and a lack of management involvement. Despite the clear importance of management to safety performance, NRC does not assess management factors in its plant inspection program. Individual inspection reports specifically avoid any references to management’s competency. NRC’s references to management weaknesses are usually made retrospectively, often after the licensee admits to management deficiencies, or by NRC audit teams or special investigations—long after the window of opportunity to provide an early warning of potential management weaknesses has passed. NRC’s inspection guidance once contained a management assessment component, but this requirement was eliminated when NRC streamlined its inspection process in the early 1990s. Both industry and NRC officials have advised us that management competency is considered the licensee’s responsibility and that NRC lacks the skills and experience to properly assess management. NRC officials also told us that they agree that management competency is a key to plant performance and that they discuss managerial competency in meetings involving senior NRC management. Furthermore, they cite instances in which senior NRC officials interact with the licensee’s management to discuss matters that lead to management improvements and, in some cases, to changes in management. We recognize the sensitivity of this issue and the technical challenges posed by assessing management factors. To assess management, 11 Remarks by NRC Chairman Shirley Jackson, November 7, 1996. Page 17 GAO/RCED-97-145 NRC’s Oversight of Nuclear Power Plants B-276754 professionals with the proper training and experience would be needed, along with objective criteria for making judgments. We also believe that gauging management factors is critical to the goal of the early identification of the problems in nuclear plants. A 1996 Arthur Andersen report to NRC agrees. Arthur Andersen noted the importance of management, stating that “To assess plant performance proactively, the NRC needs to remain fully aware of plant management activities.”12 Andersen recommended that NRC hire experts or train staff to evaluate management performance and changes, which they viewed as necessary steps to allow NRC to be more proactive. They also noted that by evaluating management factors (and other factors as well), NRC would be better positioned to identify problems earlier, which would in turn reduce safety risks to the public and lead to an earlier and less costly resolution of problems. NRC is currently evaluating Arthur Andersen’s recommendations. The Senior Management A major tool for intervening in plants before they become major Meeting Needs Revamping problems—the Senior Management Meeting (SMM)—is not working to Aid Early Intervention effectively. The SMM process was created in 1986 for the purpose of providing NRC with an early warning on plants exhibiting declining performance. SMM meetings, which are held twice every year, include NRC’s senior managers from headquarters and regional directors. Data on plant performance are drawn from NRC’s performance indicator program and from inspection and audit reports so that senior managers can take steps to prevent the problems at these plants from worsening. An important outcome of the SMM is the Watch List. A plant’s inclusion on the Watch List can lead to more oversight by NRC in the form of additional inspections, letters to licensees expressing NRC’s concern about declining performance, or other actions. Being on the Watch List also brings significant public attention to the plant. NRC also prepares a list of plants that are discussed during its SMM meetings but not placed on the Watch List. NRC informs the senior management of affected licensees that their plants were discussed. The Watch List has not produced a consistent inventory of plants with performance problems. As noted earlier, Millstone and Salem exhibited clear performance declines long before NRC placed them on the Watch List in 1996 and 1997, respectively. Salem was placed on the Watch List after they were forced to shut down for safety problems. Millstone was shut down several times before they were placed on the Watch List. The Watch 12 Recommendations to Improve the Senior Management Meeting Process, Arthur Andersen (Dec. 30, 1996). Page 18 GAO/RCED-97-145 NRC’s Oversight of Nuclear Power Plants B-276754 List actions were far too late to achieve the objective of “early identification of declining performance.” Other plants that were shut down, such as Cooper and Haddam Neck, were never on the Watch List. Still other plants, such as Washington Nuclear Power II, had performance indicators that were consistently worse than some plants on the Watch List. In fact, Arthur Andersen identified 10 plants that were not placed on the Watch List but whose performance indicators are similar to those on the Watch List. Recognizing the weaknesses in its SMM process, NRC is making improvements. For example, NRC asked Arthur Andersen to examine how the Commission can improve the timeliness and thoroughness of its plant-safety assessments through the SMM decision-making process. Andersen reported findings that parallel our observations, noting that many procedural problems prevent the process from working as intended. These problems include a lack of rigor and discipline in the process; unclear criteria for placing plants on the Watch List; and the confusion among some NRC managers about their role in the process. Also noted was the highly subjective nature of the process. NRC is currently examining Arthur Andersen’s recommendations. NRC is making other changes to its oversight program to aid early intervention. For example, future inspections will determine if plants are still operating within their design basis. Also, NRC is attempting to improve its knowledge base on the plants’ conditions by better integrating its many sources of information on performance information into a more consistent data format. NRC also reports that it is piloting a program that identifies, tracks, and verifies licensee commitments. Moreover, NRC is conducting an internal strategic reassessment, in which all current programs and activities are being re-examined. These are useful efforts that illustrate a commitment by the current Chairman and Commission to improve how NRC operates. There are a number of instances in which NRC has neither taken aggressive Conclusions enforcement action nor held nuclear plant licensees accountable for correcting their problems on a timely basis. NRC’s practice of giving licensees extensive time to fix their problems allows nuclear plants to continue to operate and the problems to grow worse. Fines levied against licensees for violations of regulations often occur long after problems are first identified. In the plants we examined, NRC forced the licensees to correct their problems only after they had voluntarily shut down their Page 19 GAO/RCED-97-145 NRC’s Oversight of Nuclear Power Plants B-276754 plants. In addition, by not evaluating the competency of the licensees’ plant managers as part of the on-going plant inspection process, NRC is missing an opportunity to act on the plants’ safety performance problems at an early stage, when problems are easier and cheaper to address. Finally, NRC’s process to focus attention on those plants with declining safety performance—the Senior Management Meeting—needs substantial revisions to achieve its goal of an early warning tool. By intervening early and taking aggressive enforcement action when warranted, NRC can prevent declines in nuclear plants’ long-term performance and better assure itself that the plants are meeting high safety standards. With concern growing that some licensees are pursuing aggressive cost-cutting strategies at the risk of reducing safety margins, now is the time to take steps to make sure that NRC’s regulatory program is working as effectively as it can. The changes that the Commission has under way provide a basic framework for making its regulatory strategy work, but additional measures are needed if NRC’s culture of tolerating problems is to change. Ensuring that licensees fix their safety deficiencies promptly and have high-quality management in place is the key for NRC to fulfill its mission of adequately protecting the public’s health and safety from the dangers inherent in nuclear power plants. To enhance licensees’ accountability, we recommend that the Recommendations Commissioners of NRC direct NRC staff to develop strategies to more aggressively act on safety deficiencies when they are discovered. To achieve this goal, NRC should take the following steps: • Require inspection reports to fully document for all plants the status of the licensees’ actions to address identified problems under NRC’s corrective action requirements, including timetables for the completion of corrective actions and how NRC will respond to nonconformance with planned actions. • Make licensees’ responsiveness to identified problems a major feature of the information provided to the participants of the Senior Management Meetings, including how NRC will respond if problems go uncorrected. For example, NRC should describe the range of sanctions that it will impose on the licensees on the basis of the potential seriousness of their failure to resolve problems within a predetermined time. These sanctions should range from assessing fines to involuntary shutdown of the plant. • Require that the assessment of management’s competency and performance be a mandatory component of NRC’s inspection process. Page 20 GAO/RCED-97-145 NRC’s Oversight of Nuclear Power Plants B-276754 In commenting on a draft of this report (see app. V for NRC’s letter), NRC Agency Comments acknowledged that safety margins fell in the plants we examined. NRC also stated that their defense-in-depth regulatory approach provides an adequate safety margin even in plants with safety deficiencies. Our concern is that NRC cannot ensure that all plants have adequate documentation to support that they are still operating in accordance with their plant designs. Operating within approved plant design is critical to the defense-in-depth philosophy. This deficiency in NRC’s knowledge base, especially in light of substantial design deficiencies discovered at Millstone and in other plants, erodes NRC’s confidence that its licensees are operating their plants in accordance with their plant design and, thereby, within adequate safety margins. Further, NRC stated that the safety deficiencies at plants we examined were not serious enough to warrant shutting down the plants while they were operating. Once the plants shut themselves down, however, NRC then required them to address their backlog of safety deficiencies before allowing them to restart. For example, Millstone must address a long list of technical and programmatic issues including weaknesses in correcting identified safety problems and responding to employees’ safety concerns. Salem must also correct many long-standing safety problems prior to restarting their plants, including ineffective corrective actions, weak management oversight, and numerous equipment failures. Most of the problems keeping these plants shut down are longstanding deficiencies known by NRC. Forcing licensees to fix their problems before they accumulated would have helped prevent these plants from reaching conditions where safety margins were reduced. NRC agreed with the “basic thrust” of our recommendations, and described a number of actions underway that they believe address some of the issues raised in this report. For example, NRC cited improvements in their inspection program and a pilot program to track and verify licensee commitments. We agree that the actions NRC have underway are worthwhile steps, but they do not address the fundamental issues raised in our report. NRC needs to be stronger in holding licensees accountable for fixing their safety problems. This can be accomplished by fully documenting licensee progress in addressing their problems, and then outlining sanctions NRC will impose for noncompliance. We agree with NRC that evaluating management competency and performance is difficult. However, evaluating this influence on plant safety performance, which NRC admits is important, would allow NRC to be a more proactive and effective regulator. Page 21 GAO/RCED-97-145 NRC’s Oversight of Nuclear Power Plants B-276754 In response to NRC’s detailed comments, we have made changes to our report where appropriate. NRC’s letter and our response to their specific comments are provided in appendix V. As arranged with your offices, unless you publicly announce its contents earlier, we plan no further distribution of this report until 30 days after the date of this letter. At that time, we will send copies to the Commissioners, Nuclear Regulatory Commission, and the Director, Office of Management and Budget. We will make copies available to other interested parties on request. Our review was performed from March 1996 through April 1997 in accordance with generally accepted government auditing standards. See appendix VI for a description of our scope and methodology. If you or your staff have any questions about this report, please call me on (202) 512-3841. Major contributors to this report are listed in appendix VII. Victor S. Rezendes Director, Energy, Resources, and Science Issues Page 22 GAO/RCED-97-145 NRC’s Oversight of Nuclear Power Plants Page 23 GAO/RCED-97-145 NRC’s Oversight of Nuclear Power Plants Contents Letter 1 Appendix I 26 NRC’s Safety Responsibility 26 NRC’s Regulatory NRC’s Inspection Program 27 Framework NRC’s Process for Evaluating Nuclear Power Reactors’ 28 Performance Performance Indicators 30 Appendix II 34 Summary 34 Salem Nuclear Performance History 37 Generating Station, Chronology 42 Units 1 and 2 Appendix III 45 Summary 45 Millstone Nuclear Performance History 48 Power Station, Unit 2 Chronology 53 Appendix IV 56 Summary 56 Cooper Nuclear Performance History 59 Station Chronology 61 Appendix V 64 GAO’s Comments 72 Comments From the Nuclear Regulatory Commission Appendix VI 75 Objectives, Scope, and Methodology Page 24 GAO/RCED-97-145 NRC’s Oversight of Nuclear Power Plants Contents Appendix VII 77 Major Contributors to This Report Figures Figure 1: The History of NRC’s Watch List 8 Figure 2: The Nuclear Plants on NRC’s Watch List 9 Figure 3: Fines That NRC Levied Against Three Nuclear Plants 15 Figure I.1: NRC’s Performance Indicators Showing the Industry 29 Average for All Nuclear Reactors, 1989-96 Figure II.1: Salem’s Performance History Against the Industry 36 Average Figure III.1: Millstone Unit 2’s Performance History Against the 47 Industry Average Figure IV.1: Cooper’s Performance History Against the Industry 58 Average Abbreviations AIT Augmented Inspection Team GAO General Accounting Office OIG Office of Inspector General NRC Nuclear Regulatory Commission NU Northeast Utilities PSE&G Public Service Electric and Gas Company RAP Restart Action Plan SMM Senior Management Meeting SALP Systematic Assessment of Licensee Performance Page 25 GAO/RCED-97-145 NRC’s Oversight of Nuclear Power Plants Appendix I NRC’s Regulatory Framework The Atomic Energy Act of 1954, as amended, authorizes the Nuclear Regulatory Commission (NRC) to license, regulate, and inspect the design, construction, and operation of commercial nuclear power plants. NRC’s regulations are intended to ensure the safe operation of the 110 nuclear reactors operating in the United States. For example, NRC requires nuclear reactors to have multiple safety systems to control and contain the radioactive materials used in each reactor’s operation. NRC also requires the owner of the reactor (the licensee) to test and maintain safety equipment to help ensure that the equipment, such as a reactor’s emergency safety systems, will operate when needed. The requirements are intended to protect workers and the public from the harmful effects of radiation. Reactors have specific operating requirements (technical specifications), depending on their design. These requirements are intended to provide a high margin of safety under all operating scenarios. NRC evaluates a reactor’s design and related technical specifications when it licenses the reactor’s operation. Once approved, these specifications become the requirements for the operation of the reactor. If certain requirements cannot be met, NRC requires the licensee to promptly shut down the reactor. The act requires NRC to provide assurance that the public health and safety NRC’s Safety is adequately protected from the consequence of the operation of any Responsibility commercial nuclear power reactor in the United States. NRC does not precisely define nuclear plant safety. Instead plants are assumed to be safe if they operate within their approved designs (plant design) and in accordance with all regulatory requirements. Also, NRC has promulgated regulations that provide a framework for how the regulatory process is to work. NRC’s basic measure for determining if a reactor is operating safely is whether it is operating as specified by its license. The license incorporates requirements derived from the plant’s required Safety Analysis Report and the technical specifications. The Safety Analysis Report contains the documentation of bases upon which the plant and its safety systems are designed (the plant’s design basis). The technical specifications state the conditions under which the plant must operate and what action is required if these operating conditions cannot be met. If a plant is found to be operating outside of its design basis, or technical specifications, the plant can be required to shut down. For example, if a reactor’s design or Page 26 GAO/RCED-97-145 NRC’s Oversight of Nuclear Power Plants Appendix I NRC’s Regulatory Framework technical specification requires a pump in standby status as a backup to another pump used to cool the reactor’s core in an emergency, and it does not work when tested, the reactor may have to be shut down. There are numerous similar requirements for reactor operations. In its implementing regulations, NRC established that licensees are NRC’s Inspection primarily responsible for ensuring that their reactors are operated safely. Program NRC relies heavily on the licensees to identify and report problems at their facilities. Thus, a licensee’s corrective action efforts (part of the required Quality Assurance program) are a critical part of its safety responsibility. At each operating nuclear reactor site, daily inspections are generally conducted by at least two resident NRC inspectors. These inspectors are assigned to a reactor site for up to five years on a rotational basis to provide independent assurance that the licensees are operating their facilities safely. If a reactor’s performance declines, NRC may assign additional resident inspectors to it. The resident inspectors observe a variety of activities, including the licensee’s (1) operation of the reactor’s control room and (2) testing and maintenance of selected equipment. NRC inspects only a small percentage of a reactor’s myriad activities. NRC’s inspection program is intended to identify the underlying safety problems at a reactor and, by doing so, to anticipate and prevent significant events—events that could damage a reactor’s core and that could result in a release of radioactive materials. NRC also uses its inspection results to (1) assess each licensee’s performance, (2) provide feedback to the licensees about their performance, and (3) allocate its inspection resources among facilities. NRC’s regional and headquarters inspection staff supplement the resident inspectors’ efforts, conducting more-detailed reviews of selected areas. In addition to routine daily inspections by resident inspectors, NRC conducts special inspections and, depending on the severity of NRC’s concerns, escalates the reporting levels to NRC regional and headquarters officials. For example, an Augmented Inspection Team (AIT), which reports to the Regional Administrator, will conduct an investigation when certain incidents occur at a reactor. The AIT members are technical experts from the region in which the incident took place, augmented by personnel from headquarters or other regions. For more serious concerns, an Incident Investigation Team, which reports to the NRC Executive Director for Operations and is independent of the regional and headquarters office management, conducts the investigation. The members of this team are Page 27 GAO/RCED-97-145 NRC’s Oversight of Nuclear Power Plants Appendix I NRC’s Regulatory Framework technical experts who, to the extent practicable, do not have previous significant involvement with the target reactor. If NRC finds that a licensee has violated the requirements for safe operation, it can take enforcement actions against the licensee. NRC categorizes violations according to four levels of severity—level I violations are the most serious.1 Once NRC finds a violation and determines its severity, it can issue a notice of violation and impose a civil penalty (fine) or require the reactor to stop operations.2 NRC has established formal management processes that it uses to review NRC’s Process for and analyze the information its gathers, through its inspection program, to Evaluating Nuclear evaluate the licensee’s performance. These include two key processes: the Power Reactors’ Systematic Assessment of Licensee Performance (SALP) and the Senior Management Meeting (SMM). Performance SALPs evaluate each licensee’s long-term performance and provide for discussions of performance between the licensees and NRC. Regional managers use the SALP for long-term resource allocation and to identify areas for inspection emphasis. These assessments are performed on a reactor-specific schedule every 12 to 24 months by regional and headquarters staff and three-member SALP boards composed of two regional managers and a headquarters manager. The boards evaluate the information reviewed and summarized by the staff from inspections, enforcement actions, performance indicators of the safety condition of reactors (fig. I.1 illustrates some of NRC’s performance indicators), licensees’ self-assessments, third-party assessments, site visits by the board members, and management meetings and discussions with the licensees. The SALP board reviews the information available to it and gives its recommendations to the Regional Administrator. 1 NRC considers severity-level I, II, and III violations “escalated enforcement actions.” 2 While NRC is authorized to shut down nuclear power facilities, it has done so only once. NRC ordered the Peach Bottom Plant in Pennsylvania to shut down in 1987 after finding that personnel in the control room were sleeping on the job. Page 28 GAO/RCED-97-145 NRC’s Oversight of Nuclear Power Plants Appendix I NRC’s Regulatory Framework Figure I.1: NRC’s Performance Indicators Showing the Industry Average for All Nuclear Reactors, 1989-96 Automatic Scrams Collective Radiation Exposure Equipment-Forced Outage While Critical (in person REM) Rate-per 100 Critical Hours 2 400 1 1.8 332 336 1.6 1.5 1.5 1.4 300 0.75 267 255 243 1.1 1 1 203 199 0.5 1 200 0.5 0.8 0.4 0.4 129 0.3 0.3 0.3 0.5 100 0.25 0.2 0.2 0 0 0 1989 1990 1991 1992 1993 1994 1995 1996 1989 1990 1991 1992 1993 1994 1995 1996 1989 1990 1991 1992 1993 1994 1995 1996 Significant Events Safety System Actuations 1 2 0.8 0.75 1.5 1.3 0.5 1 1 0.5 1 0.8 0.8 0.3 0.3 0.3 0.5 0.5 0.25 0.2 0.5 0.4 0.1 0.1 0 0 1989 1990 1991 1992 1993 1994 1995 1996 1989 1990 1991 1992 1993 1994 1995 1996 Forced Outage Rate % Safety System Failures 11 4 9.9 3.7 10 9.2 3.5 3.5 8.9 8.9 3.4 9 8.6 3.3 8 7.6 3 2.9 7.2 7 6 5.9 2.1 5 2 1.9 4 3 1 2 1 0 0 1989 1990 1991 1992 1993 1994 1995 1996 1989 1990 1991 1992 1993 1994 1995 1996 Source: NRC’s data. Page 29 GAO/RCED-97-145 NRC’s Oversight of Nuclear Power Plants Appendix I NRC’s Regulatory Framework The SMM is held about every 6 months to review the individual licensee’s performances on a national basis and bring to the attention of the highest levels of NRC management those reactors whose operational safety performance is of the most concern. The participants include the Executive Director for Operations, regional administrators, and NRC headquarters office directors. The SMM review includes information that was used by the SALP board for its evaluations. Prior to the SMM, screening meetings are held in which the regional administrators and the Director of Nuclear Reactor Regulation review every reactor’s data to determine if the reactor should be discussed at the SMM. Generally, if the trend of a reactor’s performance appears to be declining significantly or there are significant concerns about its performance, the reactor should be targeted for discussion at the SMM. Senior headquarters and regional staff together prepare an SMM notebook that is reviewed by the SMM participants. The information in the notebook includes inspection results, enforcement data, performance indicators, plant specific risk insights, and other information that characterizes a licensee’s performance. Senior NRC mangers plan actions for those reactors whose performance is of most concern. Those actions include sending a “trending letter” to the licensees whose reactors’ performance is significantly declining and putting the reactor on the Watch List. Following a series of events, including the Three Mile Island nuclear Performance accident and the loss of reactor feedwater at the Davis-Besse, Ohio, plant, Indicators NRC developed eight indicators for monitoring the safety performance of licensees. According to NRC, the indicators were intended to augment existing safety evaluations and to provide a timely indication of reactors’ safety trends. Developing the indicators was mainly completed in the first 3 years. However, the overall process stretched from the Commission’s recommendation in 1986 to 1993. The current performance indicators, which consist of eight measures of safety performance at all 110 U.S. commercial reactors, are largely self-reported by licensees. NRC publishes average trend data on seven of the eight performance indicators. According to NRC officials involved with the Performance Indicator and the inspection programs, there has been no concerted effort to verify the data for completeness and accuracy. NRC is currently considering additions to the set of performance indicators to provide senior managers with a more objective basis for monitoring the safety condition of reactors. Page 30 GAO/RCED-97-145 NRC’s Oversight of Nuclear Power Plants Appendix I NRC’s Regulatory Framework Development of the In an August 1986 memorandum, the NRC Executive Director for Present Set of Indicators Operations stated that NRC needed performance indicators because it has not always been effective in promptly recognizing the symptoms of a reactor’s declining performance and taking appropriate action. NRC set up an inter-office task group in 1986 to develop a set of indicators to be monitored and evaluated by NRC for making timely regulatory decisions about the performance of nuclear power reactors. The task force used the following criteria for the initial set of indicators used during the trial program: • The performance indicators should be related to nuclear safety and regulatory performance, be worthy goals for licensees, reflect a range of performance, be independent of each other, correlate with SALP evaluations, and finally, be predictive of licensees’ future performance. • The data used should be readily available to NRC in a timely manner, not subject to manipulation, and comparable among licensees. The logic behind the development of the indicators, according to NRC’s plans, was to focus on the key components of reactor safety. NRC believed that nuclear reactor safety requires a low number of unexpected, abnormal occurrences and the high reliability of key systems that are important to the safe operation of a reactor. In 1986, the task force identified eight indicators, after a trial period with 50 nuclear reactor facilities in which 17 indicators were considered. Two of the original selected indicators, an enforcement measure and a maintenance indicator, have been dropped. The indicator on enforcement actions was dropped, according to NRC staff involved in the indicators’ development, because it would have nearly duplicated information that was available from the SALP process. The indicator to measure the backlog of unresolved reactor maintenance items was dropped, according to NRC documents, because of objections from the industry.3 The Commissioners, in approving the plan to develop and implement the indicator effort, expressed the need to continue the development of the performance indicators for such factors as reactor maintenance and reactor staff training. 3 The industry’s support for the indicator program was not strong. For example, in a November 5, 1986, letter from the Institute of Nuclear Power Operations, an industry trade group, to the Chairman of the NRC, the Institute urged the Commission “not to adopt a separate set of performance indicators for use in a formal regulatory sense.” Instead, they requested that the NRC use industry-developed data and not use the performance indicators as part of its regulatory efforts. Page 31 GAO/RCED-97-145 NRC’s Oversight of Nuclear Power Plants Appendix I NRC’s Regulatory Framework Ultimately, the number of indicators increased to eight. NRC added collective radiation exposures, a measure of worker radiation exposure. It also added cause codes, but NRC does not compute an average trend for them. They are used to provide more detailed information on specific incidents or events. The cause codes explain deficiencies in six programmatic categories, which include licensed operator errors, maintenance problems, and other deficiencies. Current Performance The following describes the seven performance indicators for which NRC Indicators publishes annual trend data. Automatic Scrams While Critical. The number of unplanned automatic scrams that occurred while the affected reactor was operating. (An automatic scram is a condition under which the reactor shuts down automatically as a result of being programmed to do so under certain conditions.) Safety System Actuations. The number of certain Emergency Core Cooling Systems or the Emergency AC Power System equipment actuations, either manual or automatic. Significant Events. The number of events that involved an actual or potential threat to the health and safety of the public. Safety System Failure. The number of events or conditions that could have prevented the fulfillment of the safety functions of a structure or system. Forced Outage Rates. The fraction of time that a power plant could have been generating electricity if it were not forced to be shut down due to an off-normal condition. Equipment Forced Outages per 1,000 Critical Hours. The number of forced outages caused by equipment failures per each 1,000 hours of operation. Collective Radiation Exposure. The total radiation dose accumulated by the employees operating the reactor. According to NRC, the performance indicators are generally positively correlated with NRC’s other reactor safety performance measures, such as the SALPs and NRC’s Watch List for problematic reactors. For example, during the trial period for indicators, NRC compared SALP scores from Page 32 GAO/RCED-97-145 NRC’s Oversight of Nuclear Power Plants Appendix I NRC’s Regulatory Framework reactors with performance indicator data being considered then. NRC generally found that there was a positive correlation between the performance levels as indicated by the indicators and the NRC evaluations of the reactors. A more recent NRC review comparing reactors on the Watch List and good performing reactors concluded that, generally, the reactors on the Watch List exhibited poorer performance as measured by their performance indicators than good performing reactors. Moreover, the study commented that, in many cases, the performance indicators for reactors on the Watch List had shown a significant decline 1 to 2 years before the reactors were placed on the list. However, the study cautions that the performance indicators are only one of many tools that NRC uses to measure performance. For example, the study points out that two reactors had similar levels of performance indicators, but one had been on the good performer list for almost 4 years while the other had been on the Watch List. The NRC official who conducted the study said that the similarities between the two reactors’ performance indicators are the result of the managers of the reactor on the good performer list taking a conservative approach to reporting on the indicators by, in effect, overreporting in contrast to other plants. Page 33 GAO/RCED-97-145 NRC’s Oversight of Nuclear Power Plants Appendix II Salem Nuclear Generating Station, Units 1 and 2 The Salem nuclear power Units 1 and 2 are located on the Salem Generating Station, 18 miles south of Wilmington, Delaware, in Salem, New Jersey. The Public Service Electric and Gas Company (PSE&G) is the owner and licensed operator of the plant. Each unit is a four-loop pressurized light-water reactor that can produce 1,115 megawatts of electricity. The units were designed by Westinghouse and were built by the United Engineers & Constructors, Inc. NRC approved operating licenses for Salem’s Units 1 and 2 on December 1, 1976, and May 20, 1981, respectively; Units 1 and 2 began operating on June 30, 1977, and October 13, 1981, respectively. NRC has been concerned with Salem’s regulatory performance since Summary January 1990 when Salem was first discussed at its Senior Management Meeting. NRC discussed the plant seven additional times before it listed Salem on its Watch List in January 1997. NRC’s records document numerous conditions that demonstrated poor management of the plant, including the operation of the plant outside of its design bases for extended periods of time. The units are currently under an NRC Restart Action Plan (RAP) that requires the licensee to correct a long list of technical and programmatic issues to bring about long-term performance improvement prior to receiving NRC’s approval to restart. The plan was developed after PSE&G shut down the units in mid-1995. Salem’s main problems include long-standing problems in performance and equipment failures, units that are operated outside of their design bases, and weak management by the licensee. NRC’s lack of more aggressive action on these problems when they were first reported, compounded the worsening condition of the Salem units. Salem’s performance history compares unfavorably to the industry’s average. For example, NRC heavily fined Salem on seven occasions; the fines ranged from none for several years to a high of $680,000. The industry average annual fines assessed each plant during this period ranged from $17,000 to $37,000. As the number of NRC’s hours of inspection of the Salem plant increased—an indication of NRC’s growing concern—Salem’s Systematic Assessment of Licensee Performance (SALP) scores worsened in 1993. Salem’s performance indicators also worsened during this period, and NRC discussed Salem’s performance every year except 1992 and 1993 at its SMMs. In addition, from 1989 through 1996 Salem units reported an average of about five safety system failures per year compared to an industry average of about three per year. Since 1989, SALP scores, performance indicators, and the number of safety system Page 34 GAO/RCED-97-145 NRC’s Oversight of Nuclear Power Plants Appendix II Salem Nuclear Generating Station, Units 1 and 2 failures, on average for the industry, have shown overall improvement, while the number of inspection hours devoted to a plant have decreased. Figure II.1 compares the performance of the Salem plant with the nuclear industry as a whole. Page 35 GAO/RCED-97-145 NRC’s Oversight of Nuclear Power Plants Appendix II Salem Nuclear Generating Station, Units 1 and 2 Figure II.1: Salem’s Performance History Against the Industry Average Enforcement - Fines Paid (in thousands of dollars) Inspection Hours 700 4,500 Salem fines 600 4,000 Industry Salem average 500 3,500 400 3,000 300 2,500 Industry average 200 2,000 100 1,500 0 1,000 1989 1990 1991 1992 1993 1994 1995 1996 1989 1990 1991 1992 1993 1994 1995 1996 Performance Indicators Senior Management Meeting Decisions 5.5 1.2 Bad 5 1 Discussed 4.5 Trending letter Salem 0.8 Watch-listed 4 w 3.5 0.6 3 w 0.4 2.5 Industry average 0.2 2 Good 1.5 0 1989 1990 1991 1992 1993 1994 1995 1996 1989 1990 1990 1991 1991 1992 1992 1993 1993 1994 1994 1995 1995 1996 1996 1997 May Jan June Jan June Jan June Jan June Jan June Jan June Jan June Jan SALP Scores Safety System Failures 3 Adequate 10 Salem 2.5 Salem 8 2 6 1.5 Industry average 1 4 0.5 2 Excellent Industry average 0 0 1989 1990 1991 1992 1993 1993 1994 1995 1996 1989 1990 1991 1992 1993 1994 1995 1996 Source: GAO’s analysis of NRC’s data. Page 36 GAO/RCED-97-145 NRC’s Oversight of Nuclear Power Plants Appendix II Salem Nuclear Generating Station, Units 1 and 2 Performance History Design Basis Issues The licensee operated the Salem units outside of their design bases and, in some instances, NRC was not aware of the degraded conditions until months later when the licensee reported the conditions. • On April 7, 1994, the licensee experienced a significant condition adverse to quality4 when an equipment failure occurred during a reactor trip. (A reactor trip is an action in which a reactor automatically shuts down because it has been programmed to do so under certain conditions that could challenge the reactor’s safety if the unit continued to operate). Prior to this event, the licensee did not promptly identify and correct the cause of previous similar equipment failures during prior reactor trips in June 1989, July 11, 1993, and February 10, 1994. This was a recurring problem that the licensee and NRC failed to ensure was corrected. NRC fined the licensee $150,000 for this incident. • On December 12, 1994, a ventilation fan failed, creating a significant condition adverse to quality at the Salem Unit 1. Unit 1’s design basis requires that the facility have two fans capable of operating automatically and one other fan in a standby condition. The utility did not report this incident to NRC at the time nor did it determine the cause of the problem as required by NRC’s regulations. On May 12, 1995, another supply fan became inoperable before the first fan that had failed was fixed. These fans are crucial to keep important safety equipment from overheating. The licensee’s records show that there had been two prior similar occurrences, in April 1990 at Unit 2 and in December 1994 at Unit 1. NRC fined the licensee $100,000 for these numerous fan violations. • On January 26, 1995, workers at Unit 2 discovered that a flow valve would not open automatically as required, thus requiring a shutdown within 12 hours by its technical specifications. According to the technical specifications, the unit’s problems should have been fixed within 3 days or the unit should have been shut down within 12 hours. However, the licensee did not correct the problem and did not shut down the Unit 2 reactor until June 7, 1995—128 days later. The licensee’s staff incorrectly determined that the valve was operating as required because they could manually operate it. This situation also should have been reported to the 4 This is important terminology used by NRC in its regulations and its inspection program. NRC defines the term by example. It lists failures, malfunctions, deficiencies, deviations, defective material and equipment, and nonconformances as examples of conditions adverse to quality. NRC requires that as part of ensuring adequate protection of the public’s health and safety, these conditions be promptly identified and corrected. Page 37 GAO/RCED-97-145 NRC’s Oversight of Nuclear Power Plants Appendix II Salem Nuclear Generating Station, Units 1 and 2 NRC within 1 hour because the plant violated its technical specifications. However, it was not reported. • On February 9, 1995, another valve failed to open automatically as required. As in the previous case, this valve did not operate as required but could be manually operated. At this point, two valves were not operating as required. The plant’s technical specifications require at least one of the valves to be operating as required within 1 hour or the plant must be shut down. Eventually, the plant was forced to shut down in June 1995 because of these and other events. NRC fined the licensee $100,000 for failing to handle the valve situations properly. Corrective Action Issues NRC’s records cite a long history of the licensee not addressing recurring reliability and operability issues at Salem. On June 9, 1995, after the two units shut down, NRC sent the utility a Confirmatory Action Letter citing the need to organize a special team to review the problem of long-standing equipment and operability issues. The utility identified approximately 31,000 work items that it felt it should complete before restarting the units. In February 1996, NRC developed a RAP citing numerous problems that NRC would require to be fixed before it would approve a restart of the units. Those items included weak management oversight, ineffective corrective actions, and numerous technical-specification-related items. The RAP cited examples of the long-standing decline of Salem’s plant performance in justifying the need for the units to remain in a shutdown status until NRC would approve start-up. For example: • NRC’s SALP report for Salem for the period from June 20, 1993, through November 5, 1994, which preceded the mid-1995 shutdown, was particularly critical of the licensee’s performance. The report stated that overall performance had declined and that NRC was particularly concerned with the challenges to the plants’ systems and operators caused by repetitive equipment problems and personnel errors that had the potential to, or actually did, adversely affect the safety of the plant or its personnel. The report recognized that the licensee had, within the last year, initiated several comprehensive actions that had the potential to improve the plant’s overall performance but that the efforts had not resulted in any noticeable change in overall performance. • The NRC’s report said that in arriving at its assessment, NRC determined that the following factors contributed to Salem’s condition: (1) the tendency of the licensee’s operations staff to accept and accommodate system performance that was not in accordance with design; (2) the tendency of the licensee to not aggressively question the validity of assumed causes of Page 38 GAO/RCED-97-145 NRC’s Oversight of Nuclear Power Plants Appendix II Salem Nuclear Generating Station, Units 1 and 2 degraded conditions or unexpected system performance and dismiss or not adequately consider other possible contributors or factors without a substantial technical basis or rationale; (3) the general reticence of the licensee’s maintenance and operations organizations to solicit technical support from the engineering organization to resolve system or equipment issues at the plant, and the engineering organization’s apparent reservation to engage in the diagnosis or resolution of the plant’s technical problems without requirement or request; (4) the lack of value attributed to, or expected from, nuclear safety review and quality assurance activities and the consequent ineffectiveness of these functions; (5) insufficient critical self-assessment initiatives to evaluate the adequacy and performance of personnel, procedures, and hardware; and (6) insufficient supervisory oversight and poor communication of senior plant management’s expectations relative to the performance of activities. The performance report was particularly critical of the utility’s maintenance programs and activities. According to the report, the utility’s management oversight of corrective action program activities had been weak, as evidenced by the high number of recurrent equipment failure rates. Inconsistencies in troubleshooting activities and a breakdown in the licensee’s analysis of root causes also contributed to the delay in correcting recurring problems. Other examples of the utility’s ineffective correction of long-standing problems include the following: • Salem’s units were heavily fined during 1994 and 1995. Annual fines assessed on the Salem plant ranged from none for the earlier years to $680,000 at the same time the industry average for fines was about $30,000. One enforcement action in October 1994 involved six violations that NRC identified during several inspections conducted at the facility. Five of the violations were associated with the utility’s failure to promptly respond to and correct conditions involving numerous systems over extended periods of time. In one case, the utility failed to take action for 5 years. • NRC’s RAP for Salem contained 43 technical restart issues (issues having to do primarily with equipment and procedures as compared to management and human resource issues), of which all but 5 were known by NRC before the units shut down. According to Salem’s current NRC Senior Resident Inspector, recurring problems had been prevalent at Salem for years. Two of the issues had been continuing problems for 6 to 7 years—the control air system and the circulating water traveling screen motor. One of the issues had been on NRC’s information followup system since 1989 and was addressed in three separate inspection reports. Page 39 GAO/RCED-97-145 NRC’s Oversight of Nuclear Power Plants Appendix II Salem Nuclear Generating Station, Units 1 and 2 • An NRC report entitled Engineering Evaluation Report Analysis of Allegation Data, dated June 1996, showed that Salem experienced a disproportionate number of employee allegations in 1995 about the licensee’s potential failure to follow safety procedures and potential violations of the employees’ rights. The report concluded that the utility was a potential organization for further NRC evaluation because it was in the top 10 percent of NRC’s groups with respect to increases in the number of total allegations, including harassment and intimidation allegations from 1994 to 1995. Management Weaknesses NRC records show numerous examples of management weaknesses: Issues • In NRC’s October 1995 Notice of Violation and Proposed Imposition of Civil Penalties to Salem, NRC noted that Salem’s management appeared to have tolerated an atmosphere that accepted degraded conditions rather than establish the atmosphere of a high-quality operating environment. NRC also recognized that even after it became more imperative to address these component issues, Salem’s management delayed making decisions on whether or not equipment was operating as required until it was apparent that a rationale could not be established to justify the continued operation of the equipment in its existing condition. • The licensee’s Licensee Event Reports cited management as the cause of the adverse quality events. According to the reports, the apparent cause of the valve incident discussed earlier was attributed to inadequate management oversight. The inadequate management oversight led to operators and engineers not having sufficient knowledge of the design basis of structures, systems, and components to recognize problems and take timely corrective actions. NRC cited these and numerous other examples, including failures to perform adequate testing of modifications and evaluation of changes as indicative of an attitude on the part of both management and staff that was not conducive to the safe operation of a nuclear power plant. • The utility industry’s Institute of Nuclear Power Operations also faulted management for the April 7, 1994, situation when marsh grass clogged water intake screens, resulting in automatic trips of circulating water pumps. These pumps are used to circulate water to portions of the reactor’s operations. The pumps’ failures caused significant safety concerns and ultimately resulted in the shutdown of the reactor. • NRC’s recent inspection reports were critical of the utility’s lack of effective management to correct the various long-standing problems at Salem. NRC’s Page 40 GAO/RCED-97-145 NRC’s Oversight of Nuclear Power Plants Appendix II Salem Nuclear Generating Station, Units 1 and 2 first inspection report (July 14, 1995), issued right after the two plants shut down, contained the following: “During this period [May 7-June 23, 1995] Salem management and staff continued to demonstrate significant weakness in performing operability determinations . . . [making a determination as to whether a component of the plant is operating as required to operate according to NRC’s rules and regulations] for degraded safety-related equipment, and implementing prompt and effective corrective actions . . . . In these cases, your organization accommodated the conditions without effective root cause assessment or understanding of the nature of the problems since 1992.” Watch List Issues The Salem plant—Units 1 & 2—were first placed on NRC’s Watch List in January 1997. There is substantial evidence, however, that the Salem plant should have been placed on the Watch List before the utility shut down the units on May 16 and June 7, 1995. NRC’s SMMs show that NRC knew about the ineffectiveness of the licensee’s Quality Assurance program, which is designed to provide reasonable assurance that the risk to the public from the utility’s operation is acceptably low. In placing the Salem plant on the Watch List in January 1997, NRC recognized that it had erred in not putting the plant on the Watch List sooner. The SMM stated that NRC put the plant on the Watch List for its past performance history and that it should have put the plant on the Watch List much earlier. In January 1990, for example, materials prepared for the SMM revealed NRC staff’s concerns about the plant’s management and operational performance. Staff noted the declining performance of Salem as demonstrated by an increasing number of personnel errors, inadequate management oversight and involvement, inadequate procedures, and weak root cause analyses. They also noted that Salem’s corrective action programs had frequently been ineffective. Salem’s problems continued to reflect declining performance. In briefing materials prepared for senior managers in 1994, NRC noted: “stagnant, and sometimes declining performance relative to the licensee’s . . . initiative and ability to successfully perform comprehensive and thorough root cause analysis of abnormal conditions or situations affecting the operation of the facility, or to recognize trends indicative of programmatic weaknesses.” NRC concluded that corrective actions had not always been effective, as evidenced by recurring deficiencies of a similar nature or continuing performance weaknesses. NRC noted that while the licensee stated that Page 41 GAO/RCED-97-145 NRC’s Oversight of Nuclear Power Plants Appendix II Salem Nuclear Generating Station, Units 1 and 2 corrective actions appeared to have addressed the causal factors, given past performance, there was no assurance that a similar event would not recur. Also noted was that Salem continued to experience recurring operational, design, and maintenance-related problems with no indication that previously applied corrective measures had been effective in resolving or causing a reduction in the frequency or severity of the apparent problems. Even after the Salem licensees shut down the units for violating technical specifications and after NRC had placed the units under a Confirmatory Action Letter (that documented the licensee’s agreement not to restart the units without NRC’s concurrence) NRC did not list Salem on its Watch List until January 1997, when NRC officials acknowledged that they had made a mistake and that the plant should have been listed on the Watch List sooner because of poor performance. 1989 Chronology NRC’s inspection reports cited the poor material condition of the Salem plant. 1990 Salem was first discussed in the SMM. 1991 NRC initiated an Augmented Inspection Team (AIT) review on Salem. An AIT is an intensive special investigation of an event that NRC requires, in addition to routine audit activities, when it determines it needs more information to evaluate a situation. NRC issued a violation as a result of the licensee’s failure to follow procedures and for insufficient preventative maintenance. 1992 A second AIT was performed that found that the licensee failed to follow procedures. Page 42 GAO/RCED-97-145 NRC’s Oversight of Nuclear Power Plants Appendix II Salem Nuclear Generating Station, Units 1 and 2 1993 A third AIT was performed at Salem after the licensee aborted several start-up attempts. SALP ratings started to decline for the first time. NRC met with PSE&G’s management to discuss the licensee’s weak root cause analysis and ineffective corrective action history. 1994 PSE&G concurred that it had significant deficiencies in root cause determination and established a Strategic Improvement Plan. Marsh grass clogged the water intake screens and blocked the flow of cooling water to part of the plant, leading to a shutdown of Unit 1. In response to this event, NRC ordered a fourth AIT review at Salem, in just four years, an unprecedented action. NRC fined Salem $500,000 for its handling of the incident. An NRC special performance assessment found weaknesses in maintenance and management oversight activities. 1995 On January 3, 1995, Salem was notified that its SALP rating for the period from June 20, 1993, through November 5, 1994, declined and dropped to its lowest level. NRC senior officials met with PSE&G’s management to discuss the low SALP ratings and questioned management’s overall direction and performance. NRC senior management met with the licensee’s Board of Directors to discuss serious concerns with lingering performance problems. The licensee shut down Unit 1 because of technical specification violations. An NRC special inspection team concluded that the licensee’s management had been deficient in several keys areas and should have taken strong action sooner. Page 43 GAO/RCED-97-145 NRC’s Oversight of Nuclear Power Plants Appendix II Salem Nuclear Generating Station, Units 1 and 2 The licensee shut down Unit 2 because of technical specification violations. NRC issued a Confirmatory Action Letter requiring its authorization prior to restarting either unit. 1996 NRC issued its Restart Action Plan for both units citing 43 technical and 21 programmatic items that had to be corrected before the units could restart. NRC cited fundamental design problems at Salem. 1997 After years of declining performance, NRC placed the Salem units on the Watch List and acknowledged that Salem should have been on the Watch List much sooner. Page 44 GAO/RCED-97-145 NRC’s Oversight of Nuclear Power Plants Appendix III Millstone Nuclear Power Station, Unit 2 The Millstone Unit 2 nuclear power reactor is located at the Millstone Nuclear Power Station on Long Island Sound, about three miles from New London, Connecticut. The Northeast Nuclear Energy Company (NU) is the owner and licensed operator of the plant that has two other units—Millstone Units 1 and 3. Millstone 2 is a two-loop pressurized light-water reactor that can produce 895 megawatts of electricity. The unit was designed and built by the Bechtel Corporation. NRC approved Millstone Unit 2’s license to operate on September 26, 1975, and the unit began commercial operations on December 26, 1975. The NRC has been concerned with Millstone Unit 2’s regulatory Summary performance since the late 1980s. In NRC’s June 1991 Senior Management Meeting, NRC observed that all three units’ performance had been declining over the last 2 years. NRC discussed Unit 2 seven additional times at its SMMs before placing it on the Watch List in January 1996. After several start-ups and shutdowns, the unit has been under a NRC Restart Action Plan since June 1995. The RAP requires the licensee to correct a long list of technical and programmatic issues to bring about long-term performance improvement before NRC will grant approval to restart the unit. To gain NRC’s approval to restart, the licensee needs to show NRC that it has established and implemented adequate programs to ensure substantial improvement. Millstone Unit 2 has had long-standing problems with its performance. It has operated outside of its NRC-approved design basis, has had an unusually high number of allegations from employees about the potentially unsafe operation of the unit, and management has been cited as the major cause of its performance weaknesses. Millstone’s performance history shows that its performance since 1989 has been significantly worse than the industry average. NRC fined Millstone heavily during the period from 1989 through 1996. The fines ranged from none to $325,000 annually. For this same period, the industry average ranged from $17,000 to $37,000. Millstone’s scores on NRC’s periodic Systematic Assessment of Licensee Performance (SALP) generally worsened during the period. Millstone’s performance indicators also worsened in 1992, and NRC discussed Millstone at every SMM, except for one, starting in June 1991. In 1993, the number of NRC’s inspection hours at Millstone increased—an indication of NRC’s growing concern. In addition, since 1989, Millstone has reported an average of about seven failures per year of key safety systems compared with an industry average of about three failures per year. Since 1989, the nuclear power industry’s average SALP scores, performance indicators, and the number of safety system Page 45 GAO/RCED-97-145 NRC’s Oversight of Nuclear Power Plants Appendix III Millstone Nuclear Power Station, Unit 2 failures have shown an overall improvement, while the number of inspection hours devoted to a plant have decreased. NRC’s reluctance to act aggressively on problems when first reported likely compounded the worsening condition of Millstone. Figure III.1 compares the performance of the Millstone 2 plant and the nuclear industry as a whole. Page 46 GAO/RCED-97-145 NRC’s Oversight of Nuclear Power Plants Appendix III Millstone Nuclear Power Station, Unit 2 Figure III.1: Millstone Unit 2’s Performance History Against the Industry Average Enforcement - Fines Paid (in thousands of dollars) Inspection Hours 700 5,500 Millstone 2 Millstone 2 fines 5,000 600 Industry average 4,500 500 4,000 400 3,500 300 3,000 200 2,500 Industry average 100 2,000 0 1,500 1989 1990 1991 1992 1993 1994 1995 1996 1989 1990 1991 1992 1993 1994 1995 1996 Performance Indicators Senior Management Meeting Decisions 4.5 1.2 Bad Millstone 2 4 1 Discussed 3.5 Trending letter 0.8 Watchlisted 3 w 2.5 0.6 2 w w w 0.4 Industry average 1.5 0.2 1 Good 0.5 0 1989 1990 1991 1992 1993 1994 1995 1996 1989 1990 1990 1991 1991 1992 1992 1993 1993 1994 1994 1995 1995 1996 1996 1997 May Jan June Jan June Jan June Jan June Jan June Jan June Jan June Jan SALP Scores Safety System Failures 3 Adequate Millstone 2 15 Millstone 2 2.5 2 10 1.5 Industry average 1 5 Industry average 0.5 Excellent 0 1989 1990 1991 1992 1993 1993 1994 1995 1996 0 1989 1990 1991 1992 1993 1994 1995 1996 Source: GAO’s analysis of NRC’s data. Page 47 GAO/RCED-97-145 NRC’s Oversight of Nuclear Power Plants Appendix III Millstone Nuclear Power Station, Unit 2 Performance History Design Basis Issues The licensee operated Millstone Unit 2 outside of its design basis, and in some instances, NRC was not aware that degraded conditions had existed for years (in one instance, as far back as 1975) until the licensee brought the matters to NRC’s attention. For example: • In November 1990, the owner failed to control the position of a certain valve while starting up the unit. This error resulted in the plant’s operating outside of its design basis, and NRC fined the utility $37,500. • On December 17, 1995, the licensee exceeded a technical specification for the unit that required the temperature in one of its components to heat up not more than 100 degrees F. The same technical specification was also exceeded on July 28, 1995, and December 17, 1995. • On May 22, 1996, an NRC special inspection team identified a number of significant problems and concluded that Millstone had not consistently maintained conformance with its license and regulatory requirements. • On January 8, 1996, two sources of water for the plant’s safety systems could not be used because ice had jammed in a pipe. When the condition was discovered by the licensee, the licensee failed to declare that the service water system was not operating as required by procedures. • NRC’s January 1997 SMM pointed out that Millstone 2’s licensing and design basis was not maintained. NRC said that Millstone had failed to ensure the accuracy of the documentation that specifies the required operating conditions for the unit and did not maintain the as-built configuration of the plant. The licensee also failed to ensure that information on the design basis of the unit was translated into programs, procedures, practices, and hardware. Furthermore, NRC said the licensee was weak in conducting design modifications because it did not provide sufficient rigor, thoroughness, and attention to detail. This inattention ultimately resulted in the unit’s progressive loss of design basis. Corrective Action Issues NRC’s records cite a long history of the licensee’s not addressing recurring reliability and operability issues at Millstone 2. Millstone 2 has been of concern to NRC for at least the last 6 years. NRC has had 11 Senior Management Meetings since June 1991 at which Millstone 2 was discussed. Three of the 11 times senior mangers discussed Millstone 2, they decided it should be on NRC’s Watch List. In early 1992, in response to an overall decline in Millstone’s performance, the licensee set up a Performance Page 48 GAO/RCED-97-145 NRC’s Oversight of Nuclear Power Plants Appendix III Millstone Nuclear Power Station, Unit 2 Enhancement Program. This action was taken as a long-term effort to ensure the effective use of resources and implement the recommendations of four internal performance assessment task forces. The program had only a limited impact on improving Millstone’s performance. As a result of NRC’s January 1995 SMM, NRC met on March 17, 1995, with the licensee’s Board of Trustees to express NRC’s concern about Millstone 2’s continued poor performance. Because of the licensee’s failure to achieve a sustained level of performance improvements and the continuing concerns about the licensee’s effectiveness in resolving safety concerns, NRC placed Millstone 2 on its Watch List in January 1996. In June 1996, NRC designated Millstone Unit 2 as a Category 3 facility. This classification connotes a significant weakness that warrants maintaining the plant in a shutdown condition until the licensee can demonstrate to NRC that adequate programs have been established and implemented to ensure substantial improvement. Prior to making this designation, NRC advised the licensee that it had seen limited success in resolving significant performance concerns about procedural adherence, work control and tagging, ineffective communications and teamwork between organizations, continued weaknesses in correcting identified problems, poor self-assessment and quality verification, and inappropriate response to the employees’ safety concerns. Other pertinent examples of poor corrective actions included the following problems: • The licensee acknowledged that weaknesses existed before 1991 in its programs to report and resolve its deficiencies in a timely manner. • NRC informed the licensee on June 21, 1996, that previous Millstone performance concerns remained to be resolved and that recent inspection findings disclosed significant problems with the licensee’s compliance with the requirements of its licenses. At that time, NRC required all three Millstone units, which were shut down, to receive NRC’s approval prior to restart. • In August 1996, NRC issued a confirmatory order to the licensee requiring it to complete an Independent Corrective Action Verification Program that was acceptable to NRC before the Millstone units could return to operation. This unusual step occurred after several years of NRC’s notifications to the licensee that its corrective action program was not doing a good job. The confirmatory order was issued after Millstone 2 voluntarily shut down in February 1996. According to a senior NRC official, Millstone 2 was Page 49 GAO/RCED-97-145 NRC’s Oversight of Nuclear Power Plants Appendix III Millstone Nuclear Power Station, Unit 2 operating safely before it was shut down. However, once the plant was shut down, NRC became more aggressive in keeping it shut down, bringing pressure to improve the units’ corrective action program. • On September 20, 1996, a special NRC inspection of the engineering and licensing activities at Millstone 2 reported that the most significant issue at Millstone was the ineffective corrective action process. The special inspection team identified degraded and nonconforming conditions that had not been promptly corrected. It also found that line management did not respond to the findings of the unit’s quality assurance organization and that the root causes of problems and the programmatic implications of identified issues had not been addressed in a timely fashion. In addition, the team found that the licensee did not establish an effective corrective action program for Millstone as a whole. The review revealed weaknesses in the ability to identify the unit’s problems; delayed or inadequate corrective actions for known deficiencies; problems in tracking corrective actions; weaknesses in tracking nonconformances; and a generally inadequate management response to quality assurance audits and third-party assessments. Management Weaknesses NRC’s records show numerous examples of management weaknesses such Issues as the following: • An NRC Plant Status Report, dated March 21, 1996, stated that in September 1994 the licensee recognized the performance weaknesses delineated in the most recent SALP report and generally concluded that the inability to correct long-standing performance issues is rooted in cultural weaknesses in the Millstone management and staff. • NRC’s May 1996 special inspection found that while quality assurance audits and third-party reviews were generally effective in identifying programmatic weaknesses, the Millstone management’s responses to these findings and recommendations were often slow and incomplete. • The Citizens Awareness Network, a nonprofit interest group concerned with nuclear waste issues, reported in November 1996 that the licensee had decade-long, serious, chronic, systemic mismanagement problems at Millstone. It also reported that NRC’s inspection program staff and management had failed over the past decade to detect and deal with this problem. • A December 1996 Connecticut State report said that the licensee’s management was not sufficiently aggressive in identifying and correcting deficiencies before problems occurred. It noted that weaknesses in Page 50 GAO/RCED-97-145 NRC’s Oversight of Nuclear Power Plants Appendix III Millstone Nuclear Power Station, Unit 2 programs and procedures continued to contribute to the degradation of safety-related equipment. • At January 1997 hearings at NRC, a nuclear industry veteran, hired by the licensee after NRC required Commission approval for restart, to manage Millstone and bring it into compliance with NRC’s requirements for restarting the units, testified about the condition of Millstone upon his arrival. He said that when he assumed his duties, Millstone was as close to a dysfunctional organization as he had ever encountered. He said that the fundamental problem was leadership. • The licensee’s self-assessment cited the licensee’s overemphasis on cost containment as one primary root cause of poor performance during 1990 and 1991. A December 1996 consultant’s report also concluded that the licensee’s incentive compensation plans for both management and staff placed undue emphasis on cost and production issues and that the emphasis on safety in the incentive and bonus plans was inadequate. The report also concluded that the licensee’s nuclear organization had been mismanaged for the past 10 years. In addition, it concluded that NRC had been too permissive and trusting in its dealings with the licensee. Watch List Issues NRC first placed Millstone 2 on the Watch List in January 1996. It was discussed at every bi-annual SMM, except one, starting in June 1991. There is substantial evidence that Millstone 2 should have been put on the Watch List before the licensee shut down the unit in February 1996 because of the failure of a key safety system to operate as required. Starting in 1991, NRC’s SMMs show that NRC had long-standing performance concerns about Millstone, citing numerous events demonstrating a pattern of the licensee’s continued failure to correct the root causes of programmatic problems. These events included examples of significant long-term breakdown in the utility’s corrective action program, failure to determine and report when certain components of the reactor were not operating as required by NRC, and failure to implement appropriate procedures. Compounding these concerns was a continuing high volume of employees’ allegations of safety issues that were not being appropriately resolved by the licensee. Documentation in NRC’s files shows that the licensee was aware of significant weaknesses in its oversight functions as early as 1991 but took no effective actions to correct the weaknesses. NRC’s routine on-site inspections identified a number of configuration control, personnel error, work control, and procedure compliance issues that contributed to five Page 51 GAO/RCED-97-145 NRC’s Oversight of Nuclear Power Plants Appendix III Millstone Nuclear Power Station, Unit 2 reactor trips and two forced shutdowns experienced at Millstone 2 during 1993. (A reactor trip is an action when the reactor automatically shuts down because it has been programmed to do so under certain conditions that could challenge the reactor’s safety if the unit continued to operate. A forced shutdown is a condition in which the reactor is shut down because certain conditions have occurred that are not normal to the reactor’s operation.). The failures of Millstone 2’s key safety systems increased in the fourth quarter of 1990 and were well above the industry average from 1993 through the second quarter of 1996. Of more recent concern are examples of the licensee’s failure to comply with safety-related requirements to ensure that the Millstone units were operating as designed. Despite the increasing volume of information over the years that the licensee was not managing Millstone well, NRC did not take timely and decisive action. For example, between May 24 and August 5, 1993, Millstone’s licensee made over 30 attempts to repair a leaking valve at Millstone Unit 2. The numerous attempts to repair the valve over a period of time versus shutting down the reactor when it was clear the valve could not be successfully fixed in a timely manner, violated a number of NRC’s rules and regulations. These unsuccessful attempts to fix the valve ultimately resulted in sufficient damage to the valve to require Millstone 2 to be shut down. Had the valve failed catastrophically during the repeated attempted repairs, there could have been serious safety consequences, such as the loss of coolant, which would have challenged the safety systems of the plant. As a result of this event, NRC issued a Notice of Violation to the owner and proposed a fine of $237,500. In assessing the fine, NRC said that the fine was so high because of the egregious nature of management’s failure to recognize the increased probability of valve failure due to the repeated repair attempts. NRC cited other factors in its decision, such as the necessity for NRC to prod the licensee to get it to fully appreciate the implications of the incident and to ensure that broad-based corrective actions were undertaken. NRC also noted that overall performance at Millstone 2 had declined, including continuing procedure adherence problems, a continuing inability to identify and correct problems, and nine violations it issued to Millstone in 1993. According to some of Millstone’s resident inspectors, NRC should have ordered a shutdown in 1993 when the valve incident occurred. The senior resident inspector had recommended that NRC shut down Unit 2, but regional management disagreed because it said it could not cite a regulatory basis to order a shutdown. Another resident inspector said that Page 52 GAO/RCED-97-145 NRC’s Oversight of Nuclear Power Plants Appendix III Millstone Nuclear Power Station, Unit 2 although NRC had increased the number and severity of fines on Millstone, increased the number of inspection hours, given Millstone a low SALP score, and talked to Millstone management about the plant’s problems, Millstone’s safety performance did not improve. According to him, a trending letter, which is used to advise a licensee that NRC is concerned because it has noted a decline in a plant’s performance, and/or the Watch List were the next regulatory enforcement steps, but NRC’s management hesitated to use these tools because it did not think it had sufficient evidence to take stronger action. A number of other NRC officials expressed the opinion that, in retrospect, NRC should have added Millstone to its Watch List in the aftermath of the incident. 1991 Chronology Millstone 2 was first discussed in the SMM. NRC initiated an Augmented Inspection Team review on Millstone 2. 1992 Millstone’s performance indicators began a significant downward trend. 1993 The licensee reported to NRC that Millstone 2 may have operated outside its design basis. 1994 The SALP covering the period from April 4, 1994, through July 9, 1994, noted that performance at Millstone 2 indicated significant weaknesses in the plant’s operations and maintenance and stated that despite attempts to achieve consistent improvements, lasting performance improvements were not achieved. Millstone 2 is shut down for a routine refueling and maintenance outage and the owner agrees not to restart Millstone 2 before meeting with NRC to discuss readiness. NRC increased its inspection hours at the plant by approximately 50 percent. Page 53 GAO/RCED-97-145 NRC’s Oversight of Nuclear Power Plants Appendix III Millstone Nuclear Power Station, Unit 2 1995 NRC senior managers met with the licensee’s Board of Trustees to express its concerns about Millstone 2’s continued poor performance. After this meeting, the licensee replaced many senior managers and began expending resources to fix items on the Restart Action List. However, the changes and corrections that NRC sought did not occur. NRC issued its Restart Action Plan for Millstone 2, citing items that had to be reviewed by NRC before the unit could be restarted. NRCagreed to permit restart after confirming that Millstone could be operated safely. Millstone 2 restarted with NRC’s approval, although many of NRC’s long-term RAP items had not yet been resolved. The licensee shut down Millstone 2 to repair a pipe that ruptured because of significant erosion/corrosion of the pipe’s wall. Millstone Unit 2 was returned to full power operation. Millstone Unit 2 was shut down to repair a leaking valve. Millstone Unit 2 was returned to full power. 1996 NRC placed all the Millstone units on the Watch List. Millstone Unit 2 was shut down by the licensee to investigate a suspected design deficiency in a key safety system. Time magazine’s cover story, “Blowing the Whistle on Nuclear Safety,” drew public attention to long-standing problems at Millstone. NRC sent the licensee a letter requesting it to certify that it was operating Millstone in compliance with its licensing basis. After an SMM, NRC informed the licensee that Millstone remains on the Watch List. Page 54 GAO/RCED-97-145 NRC’s Oversight of Nuclear Power Plants Appendix III Millstone Nuclear Power Station, Unit 2 NRC required the approval of the Commission before Millstone could restart any units. NRC’s Special Inspection found that a significant issue at Millstone 2 was its ineffective corrective action process. NRC staff met with the licensee’s staff and expressed concern about programmatic weaknesses since 1991 at Millstone Units 1, 2, and 3. These weaknesses were cited in design basis and control, corrective actions, quality assurance, and NRC’s own oversight of Millstone. NRC issued an order requiring the Commission’s approval for the restart of any Millstone unit until the completion, to NRC’s satisfaction, of an Independent Corrective Action Verification Program and verification that Millstone’s physical and functional characteristics are in conformance with the licensing conditions and NRC-approved design bases of the units. 1997 Millstone Units 1, 2, and 3 remain closed and on the Watch List; they require the Commission’s approval for restart. Page 55 GAO/RCED-97-145 NRC’s Oversight of Nuclear Power Plants Appendix IV Cooper Nuclear Station The Cooper Nuclear Station is located in southeast Nebraska on the west bank of the Missouri River, near the town of Brownville. Nebraska Public Power District is the owner and licensed operator. Cooper consists of one nuclear reactor, which is a boiling-water reactor with a net generating capacity of 778 megawatts. Designed by General Electric, Cooper was constructed by Burns and Roe. NRC issued Cooper’s license to operate on January 18, 1974, and commercial operation began on May 10, 1974. NRC has been concerned about Cooper’s regulatory performance since the Summary early 1990s. NRC discussed Cooper at every Senior Management Meeting from June 1993 through January 1997, but NRC has never put the plant on its Watch List. However, Cooper is one of two nuclear power reactor sites to receive three successive trending letters (letters reflecting declining performance) from NRC. These letters were sent in January and June 1994 and January 1995. NRC’s records document the licensee’s serious management problems, including that the licensee allowed the plant to operate out of its NRC-approved design basis for many years. The licensee shut down Cooper in 1994 because of three serious safety system failures that violated the requirements under which it must operate. After Cooper shut down, and as a result of these failures and their serious safety significance, as well as a long list of other safety deficiencies, NRC issued a lengthy NRC Restart Action Plan. NRC required that the items cited on the RAP be resolved and that NRC’s approval be received prior to restarting the unit. Cooper’s main problems were long-standing. They included equipment and performance failures, operating outside of its design basis, and a history of a lack of commitment to excellent operations on the part of the licensee’s management. NRC’s ineffectiveness in achieving change compounded the effects of the licensee’s poor performance. Cooper’s performance history shows that its performance since 1989 has been significantly worse than the industry average. NRC fined Cooper heavily—a total of about $750,000—during the period from 1993 through 1996. This was an average of $94,000 per year from 1989 through 1996. For the same period, the industry average annual fines paid by each unit ranged from $17,000 to $37,000. As the number of NRC’s hours of inspection of Cooper increased dramatically in 1993—an indication of NRC’s growing concern—Cooper’s scores on NRC’s Systematic Assessment of Licensee Performance also worsened. Cooper’s performance indicators were significantly worse than the industry average for 4 of the 8 years from 1989 Page 56 GAO/RCED-97-145 NRC’s Oversight of Nuclear Power Plants Appendix IV Cooper Nuclear Station through 1996. Furthermore, NRC discussed Cooper’s performance at every SMM from June 1993 through January 1997. Also, from 1989 through 1996, Cooper had an average of about six safety system failures per year compared to an industry average of about three per year. Since 1989, the nuclear power industry’s average SALP scores, performance indicators, and the number of safety system failures have shown an overall improvement, while the number of inspection hours devoted to a plant have decreased. Figure IV.1 compares the performance of Cooper to the nuclear industry as a whole. Page 57 GAO/RCED-97-145 NRC’s Oversight of Nuclear Power Plants Appendix IV Cooper Nuclear Station Figure IV.1: Cooper’s Performance History Against the Industry Average Enforcement - Fines Paid (in thousands of dollars) Inspection Hours 700 6,000 Cooper fines 600 5,500 Industry average 5,000 500 Cooper 4,500 400 4,000 300 3,500 200 3,000 Industry average 100 2,500 0 2,000 1989 1990 1991 1992 1993 1994 1995 1996 1989 1990 1991 1992 1993 1994 1995 1996 Performance Indicators Senior Management Meeting Decisions 6 1.2 Bad 5 Cooper 1 Discussed Trending letter 4 0.8 Watchlisted w 3 0.6 2 0.4 Industry average 1 0.2 Good 0 0 1989 1990 1991 1992 1993 1994 1995 1996 1989 1990 1990 1991 1991 1992 1992 1993 1993 1994 1994 1995 1995 1996 1996 1997 May Jan June Jan June Jan June Jan June Jan June Jan June Jan June Jan SALP Scores Safety System Failures 3 12 Adequate Cooper 2.5 10 2 8 1.5 6 Cooper Industry average 1 4 0.5 2 Excellent Industry average 0 0 1989 1990 1991 1992 1993 1993 1994 1995 1996 1989 1990 1991 1992 1993 1994 1995 1996 Source: GAO’s analysis of NRC’s data. Page 58 GAO/RCED-97-145 NRC’s Oversight of Nuclear Power Plants Appendix IV Cooper Nuclear Station Performance History Design Basis Issues The following illustrates how Cooper operated outside of its design basis for many years: • NRC found that for 20 years, from January 18, 1974, until May 27, 1994, Cooper did not ensure that its system to prevent leaks of radioactivity was maintained at all times according to NRC’s requirements. NRC also found that NRC-required leak testing of the system was not conducted. When the testing was done in 1994, the leak rate was three times NRC’s allowable limit. • From January 18, 1974, until May 25, 1994, Cooper conducted tests of its emergency power system to ensure that the system would operate as intended in the event of a loss of electrical power. This testing is required by NRC to ensure that the unit operates within its design basis and can be permitted to operate. When tested in May 1994, neither of the emergency generators operated as required. • Cooper’s control room emergency filter system did not operate at all times, as required by NRC, during the period from June 1989 through April 28, 1994. On April 11, 1994, Cooper identified numerous hardware deficiencies that resulted in the failure of the control room to pressurize to NRC-required levels. When Cooper ran a test to determine if the control room would pressurize as required, it determined that it would not. NRC found that in previous tests, Cooper had inappropriately manipulated the air pressures in adjoining buildings in order to obtain satisfactory test results. Cooper also masked the hardware deficiencies that caused or contributed to this inability to achieve the control pressures required by NRC. • The current NRC senior resident inspector advised us that Cooper’s major safety systems were not operating as designed and that, therefore, the unit was operating outside of its design basis prior to shutdown. Corrective Actions Issues NRC’s inspections show that one of the most significant deficiencies found at Cooper were untimely and ineffective corrective actions taken on identified problems. Inspectors found instances in which safety problems had existed at Cooper for up to 20 years while Cooper took no effective corrective actions. An NRC special investigation cited Cooper’s weak corrective action program. On the basis of their findings at that time, the Page 59 GAO/RCED-97-145 NRC’s Oversight of Nuclear Power Plants Appendix IV Cooper Nuclear Station inspection team reported that there may still be a significant number of undiscovered problems. NRC’s Regional Administrator expressed concern with Cooper’s performance since restart, and the Deputy Administrator told Cooper executives that the overriding problem was Cooper’s “inability to effectively implement corrective actions.” NRC believes, in hindsight, that the safety violations discovered at Cooper in 1994 had existed for years, some as far back as the plant’s first start-up in 1974, and should have been discovered and corrected by Cooper’s management long ago. But because Cooper’s management had a poor safety culture and a weak quality assurance program, the safety violations remained hidden, according to NRC. NRC officials also believe that its resident inspectors could have discovered these safety violations. But because NRC officials assumed that Cooper was an above-average performer throughout the 1970s and 1980s, it rarely conducted special inspections targeted to uncover safety deficiencies. In 1992, on the basis of its findings during routine on-site inspections, NRC began to lose confidence in the ability of Cooper’s management to operate the plant safely. However, NRC did not significantly increase its inspections until 1993. As a result of these inspections, Cooper was pressured by NRC to shut down in 1994 on the basis that safety systems were not being operated as required by NRC. Management Weaknesses NRC’s investigation into the root causes of Cooper’s problems revealed Issues substantial management weaknesses, especially management’s inability to ensure corrective actions. In NRC’s opinion, the problems associated with Cooper’s significant safety system violations in 1994 were the result of weak management. NRC stated that chronic and fundamental weaknesses have negatively affected the safety performance of Cooper for an unacceptably long period of time. NRC also said that Cooper’s long-standing violations were indicative of long-term failures by senior managers to • implement effective safety processes and procedures; • institute a positive, stationwide attitude toward identifying and correcting problems; • provide effective oversight and monitoring of Cooper’s staff and programs in order to ensure a high level of safety performance; and Page 60 GAO/RCED-97-145 NRC’s Oversight of Nuclear Power Plants Appendix IV Cooper Nuclear Station • instill and maintain an attitude among plant staff that emphasizes plant safety. While NRC issued favorable reports on improved safety programs and management practices in the first half of 1995, coinciding with Cooper’s restart, within months NRC reported serious weaknesses in management’s safety performance that could have been corrected prior to the restart. NRC reported that management • failed to follow procedures, • lacked awareness of the plant’s status, and • provided weak oversight of the engineering programs. Watch List Issues Cooper was discussed at every SMM from June 1993 through January 1997, but it has never been put on NRC’s Watch List. NRC also sent Cooper three successive trending letters in January and June of 1994 and in January 1995. Cooper’s owner is one of two nuclear plant licensees to receive three letters in consecutive SMM periods. The next level of action in severity above the trending letter would be to place Cooper on the Watch List. 1989 Chronology NRC’sinspection hours for Cooper were about 1,500 hours above the average inspection hours for other units; about 51 percent above the average. 1992 An NRC inspection report cited growing evidence that management was not proactively identifying the plant’s problems and the licensee was simply focusing its efforts on whatever NRC identified. The number of key safety system failures took a dramatic turn for the worse. Page 61 GAO/RCED-97-145 NRC’s Oversight of Nuclear Power Plants Appendix IV Cooper Nuclear Station 1993 Cooper is discussed for the first time at NRC’s SMM. Its SALP scores, numbers of NRC inspection hours devoted, and fines paid all took a turn for the worse. NRC fined the licensee twice for a total of $400,000 because it provided inaccurate information, took inadequate corrective actions, and had serious violations in its reactor safety program. 1994 The licensee shut down the unit, which remained closed for 9 months. NRC issued a RAP requiring Cooper to obtain NRC’s approval before restarting the unit. The plan required an extensive list of corrective actions and a special inspection to review Cooper’s long-standing equipment, operations, and management problems. NRC issued two of the three trending letters to Cooper and cited the unit’s performance as marginally adequate. An NRC special investigation team reported that Cooper’s management was the root cause of its problems, citing deficiencies such as low standards, poor leadership skills, and improper corporate vision. 1995 The licensee hired a new management team to bring Cooper up to standards in order to obtain NRC’s approval for restarting the plant. NRC approved restart and the licensee restarted the unit. After the restart, an NRC inspection report stated that challenges still remained. A refueling outage that had been scheduled for 54 days lasted 77 days because of problems with work on a turbine and an emergency diesel generator. NRC issued a third trending letter to Cooper covering a third consecutive SMM period. NRCfined Cooper a total of $300,000 for three violations, including not keeping the emergency power generators, the control room air filtration Page 62 GAO/RCED-97-145 NRC’s Oversight of Nuclear Power Plants Appendix IV Cooper Nuclear Station system, and the reactor containment systems in operating condition as required. In issuing the violations, NRC noted that unsafe conditions had existed at Cooper for up to 20 years and that Cooper had been operating outside of its design basis for years. 1996 NRC and Cooper continued to find problems that existed prior to the 1994 shutdown. NRC reported that significant issues in all functional areas did not appear to be indicative of further decline in performance, but rather were attributable to preexisting problems. In April, NRC fined Cooper $50,000 for operating with an unresolved safety issue for about 10 years. NRC said that the material condition of the plant continued to improve, but slowly. 1997 Cooper’s performance ratings began to show some improvement, although they are still below the industry average. In January, Cooper was discussed for the eighth consecutive time at NRC’s SMM. Page 63 GAO/RCED-97-145 NRC’s Oversight of Nuclear Power Plants Appendix V Comments From the Nuclear Regulatory Commission Note: GAO comments supplementing those in the report text appear at the end of this appendix. See comment 1. Page 64 GAO/RCED-97-145 NRC’s Oversight of Nuclear Power Plants Appendix V Comments From the Nuclear Regulatory Commission See comment 2. See comment 3. Page 65 GAO/RCED-97-145 NRC’s Oversight of Nuclear Power Plants Appendix V Comments From the Nuclear Regulatory Commission See comment 4. Page 66 GAO/RCED-97-145 NRC’s Oversight of Nuclear Power Plants Appendix V Comments From the Nuclear Regulatory Commission Now on p. 1. See comment 4. Now on p. 2. See comment 4. Now on p. 3. See comment 5. Now on p. 5. See comment 6. Now on p. 5. See comment 4. Page 67 GAO/RCED-97-145 NRC’s Oversight of Nuclear Power Plants Appendix V Comments From the Nuclear Regulatory Commission Now on pp. 6-7. See comment 4. Now on p. 6. See comment 4. Now on p. 10. See comment 4. Now on p. 9. See comment 4. Now on p. 10. See comment 4. Page 68 GAO/RCED-97-145 NRC’s Oversight of Nuclear Power Plants Appendix V Comments From the Nuclear Regulatory Commission Now on p. 14. See comment 4. Now on p. 18. See comment 4. Now on p. 30. See comment 4. Now on p. 30. See comment 4. Now on p. 30. See comment 7. Now on pp. 32-33. See comment 4. Page 69 GAO/RCED-97-145 NRC’s Oversight of Nuclear Power Plants Appendix V Comments From the Nuclear Regulatory Commission Now on p. 34. See comment 4. Now on p. 41. See comment 4. Now on p. 42. See comment 4. Now on p. 43. See comment 4. Now on p. 54. See comment 4. Page 70 GAO/RCED-97-145 NRC’s Oversight of Nuclear Power Plants Appendix V Comments From the Nuclear Regulatory Commission Now on p. 54. See comment 4. Now on p. 58. See comment 8. Now on p. 59. See comment 9. Now on p. 60. See comment 4. Now on p. 61. See comment 10. Page 71 GAO/RCED-97-145 NRC’s Oversight of Nuclear Power Plants Appendix V Comments From the Nuclear Regulatory Commission The following are GAO’s comments on NRC’s letter dated May 23, 1997. GAO’s Comments 1. We agree with NRC’s discussion on the safety margins afforded by NRC’s regulatory approach, and our report describes NRC’s defense-in-depth philosophy as the basic framework for ensuring the adequate safety of nuclear plants. Our concern remains that NRC cannot ensure that all plants have adequate documentation to support that they are still operating in accordance with their plant designs. Operating within approved plant design is at the heart of the defense-in-depth philosophy. This deficiency in NRC’s knowledge base, especially in the light of substantial design deficiencies discovered at Millstone and in other plants, erodes NRC’s confidence that its licensees are operating their plants in accordance with their plant design. Furthermore, NRC stated that the safety deficiencies at the plants we examined were not serious enough to warrant shutting down the plant while they were operating. Once the plants shut themselves down, however, NRC then required the licensees to address their backlog of problems before allowing them to restart the plants. For example, Millstone must address a long list of technical and programmatic issues, including weaknesses in correcting identified problems and inappropriate response to employees’ safety concerns. Salem must also correct many long-standing safety problems prior to restarting its plants, including ineffective corrective actions, weak management oversight, and numerous equipment failures. Most of the problems keeping these plants shut down are long-standing deficiencies known to NRC. Forcing licensees to fix their problems before they accumulated would have helped prevent these plants from reaching conditions where safety margins were reduced. 2. We agree that these initiatives are worthwhile steps, but taken together they do not address the fundamental issues raised in our report. We continue to believe that NRC needs to take more aggressive action to hold licensees accountable for fixing their safety problems. For example, we recommend that NRC not only fully document licensees’ progress in addressing their problems, but also show what sanctions NRC will impose for noncompliance. This information should also be an important discussion area during the Senior Management Meeting. In connection with the need to evaluate management competency and performance as part of the inspection process, we agree that this is a difficult area to quantify and assess. We also believe that given the importance of management to safety performance, ignoring this important factor during the inspection process prevents NRC from being a more proactive and Page 72 GAO/RCED-97-145 NRC’s Oversight of Nuclear Power Plants Appendix V Comments From the Nuclear Regulatory Commission therefore effective regulator. In connection with NRC’s efforts to improve its Senior Management Meeting Process, we support NRC’s current initiatives, as we stated in our report. 3. NRC’s Enclosure 3 is not included in this appendix. These were changes that parallel NRC’s comments in Enclosure 2. 4. We have made appropriate changes to the report in response to NRC’s suggestions. 5. We agree that NRC does make attempts to have licensees fix problems as they become known. However, as we document in our report, NRC’s actions were clearly not effective in the three facilities we studied. The record shows that, for these problem plants, deficiencies persisted over long periods of time, in some instances, without being corrected by the licensee. NRC’s sanctions in the form of fines often came late, as did placing plants on the Watch List, which is a tool used to force a change in behavior. Only after plants were shut down did NRC use a restart order or plan to force licensees to address deficiencies. 6. As we said in our report, in only one instance has NRC issued an order to shut down an operating nuclear power plant—Peach Bottom in 1987. The five plants referred to by NRC were already shut down by their licensees before NRC issued its order to shut down these plants. 7. Our audit work clearly supports that there has not been a concerted effort by NRC to verify the performance indicator data for completeness or accuracy. We changed our report to show that more than one official told us that in the Performance Indicator program, there has been no concerted effort to verify the data for completeness and accuracy. 8. Subsequent discussion with NRC disclosed that the information on the number of inspection hours for the industry was 2,503 and for Cooper was 4,013. 9. Although we modified our report to reflect the senior resident inspector’s new position, the staff who interviewed the inspector clearly remember her stating that, in her opinion, the Cooper plant was in an unsafe condition prior to its May 1994 shutdown because several safety systems would not operate. The staff rechecked their personal notes to verify these facts. Page 73 GAO/RCED-97-145 NRC’s Oversight of Nuclear Power Plants Appendix V Comments From the Nuclear Regulatory Commission 10. NRC misread our draft report to mean that Cooper’s inspection hours for 1989 were 1,500 hours. We changed our report to more clearly read that Cooper’s inspection hours for 1989 were about 1,500 above the industry average for that year. Also, subsequent discussion with NRC disclosed that the information on the number of hours for the industry average of approximately 3,900 hours, stated in their comment, was fiscal year data. Our report uses calendar year data. Page 74 GAO/RCED-97-145 NRC’s Oversight of Nuclear Power Plants Appendix VI Objectives, Scope, and Methodology Our objectives in this review were to determine how NRC (1) defines nuclear safety, (2) measures and monitors the safety condition of nuclear plants, and (3) uses its knowledge of safety conditions to ensure the safety of nuclear plants. To respond to the first objective, we reviewed the Atomic Energy Act, which governs NRC activities, and pertinent regulations, promulgated by NRC, that relate to safety. We also reviewed other written source documents to gain insight into how NRC defines its safety role. These documents included speeches by the Commission Chairman, transcripts from hearings and meetings held by the Commissioners, and other public documents, such as NRC’s annual reports, accountability report, and special publications. We supplemented these materials with interviews of officials at different levels of the organization. To respond to objective two, we asked senior NRC officials and program managers what sources they used to measure and monitor the safety of individual plants. These answers led us to examine aspects of • NRC’s plant inspection program, which includes on-site inspection reports, plant performance reviews, and special inspections, and • NRC’s performance indicator program, which includes the collecting and reporting on eight indicators of the safety performance of nuclear reactor licensees. To respond to objective three, we interviewed nuclear plant officials in three separate locations: the Salem Generating Station in Salem, New Jersey; the Millstone Nuclear Power Station in Connecticut; and the Cooper Nuclear Station in Nebraska. We chose these locations because they represent sites that have had significant performance problems and had been placed under an NRC restart order or plan. The Cooper plant was chosen because it is in a different region from Salem and Millstone. We chose plants under a restart order or plan because these represent the most serious cases of performance decline, and we wanted to measure the extent to which current problems represent long-standing performance issues. At these facilities, we interviewed NRC plant inspectors and utility managers. We examined inspection reports and other documents pertaining to restart document orders, including headquarters, regional, and licensee correspondence. We also interviewed regional staff in NRC’s Page 75 GAO/RCED-97-145 NRC’s Oversight of Nuclear Power Plants Appendix VI Objectives, Scope, and Methodology Region I in King of Prussia, Pennsylvania, and Region IV in Arlington, Texas. We also consulted experts in the field of commercial nuclear power, which included representatives from trade associations, former NRC commissioners and officials, and public interest groups. Page 76 GAO/RCED-97-145 NRC’s Oversight of Nuclear Power Plants Appendix VII Major Contributors to This Report Gary Boss, Project Leader Michael Gilbert, Deputy Project Leader Phil Olson, Team Leader Robin Reid, Professional Staff John Cass, Professional Staff Duane Fitzgerald, Technical Advisor William Swick, Senior Advisor Jackie Goff, Senior Attorney (170270) Page 77 GAO/RCED-97-145 NRC’s Oversight of Nuclear Power Plants Ordering Information The first copy of each GAO report and testimony is free. Additional copies are $2 each. Orders should be sent to the following address, accompanied by a check or money order made out to the Superintendent of Documents, when necessary. VISA and MasterCard credit cards are accepted, also. Orders for 100 or more copies to be mailed to a single address are discounted 25 percent. Orders by mail: U.S. General Accounting Office P.O. Box 6015 Gaithersburg, MD 20884-6015 or visit: Room 1100 700 4th St. NW (corner of 4th and G Sts. NW) U.S. General Accounting Office Washington, DC Orders may also be placed by calling (202) 512-6000 or by using fax number (301) 258-4066, or TDD (301) 413-0006. Each day, GAO issues a list of newly available reports and testimony. To receive facsimile copies of the daily list or any list from the past 30 days, please call (202) 512-6000 using a touchtone phone. A recorded menu will provide information on how to obtain these lists. For information on how to access GAO reports on the INTERNET, send an e-mail message with "info" in the body to: firstname.lastname@example.org or visit GAO’s World Wide Web Home Page at: http://www.gao.gov PRINTED ON RECYCLED PAPER United States Bulk Rate General Accounting Office Postage & Fees Paid Washington, D.C. 20548-0001 GAO Permit No. G100 Official Business Penalty for Private Use $300 Address Correction Requested
Nuclear Regulation: Preventing Problem Plants Requires More Effective NRC Action
Published by the Government Accountability Office on 1997-05-30.
Below is a raw (and likely hideous) rendition of the original report. (PDF)