Safety culture

Hana's last assignment of the term is not a calculation. Lise asks her to help analyze Meridian's own safety culture survey for the BWRX-300 project team and to sit in on the plant's monthly safety culture review with Marcel Thibodeau. "Every accident we studied had a safety culture failure behind it," Lise says. "The design, the procedures and the PRA all depend on people who notice problems, say so and are listened to. That is what we are trying to measure, and it is the hardest thing in this course to get right."

What safety culture is

The term safety culture was introduced by the International Nuclear Safety Advisory Group in its 1986 report on Chernobyl, INSAG-1, and defined in INSAG-4 in 1991 as that assembly of characteristics and attitudes in organizations and individuals which establishes that, as an overriding priority, nuclear plant safety issues receive the attention warranted by their significance. The definition makes two points. Safety culture belongs both to organizations and to individuals, and it is about priorities: when safety competes with schedule, cost or production, safety comes first in proportion to its importance.

Culture is the shared set of values, beliefs and assumptions that shape how people behave when no rule tells them exactly what to do. In a nuclear plant, much of the work is governed by procedures, but no procedure covers everything. Whether a technician stops work when something looks wrong, whether a supervisor asks for the reason behind an unusual reading, and whether a manager accepts a schedule delay to investigate a concern are all questions of culture. Most organizations believe they have a strong safety culture; the accidents studied in this course show how easily that belief can be wrong.

Traits of a healthy nuclear safety culture

In the United States, the NRC's Safety Culture Policy Statement of 2011 sets out the Commission's expectation that individuals and organizations performing regulated activities establish and maintain a positive safety culture, and describes the traits in the table. It is a policy statement rather than a rule. Safety culture is assessed through the Reactor Oversight Process, through cross-cutting aspects identified in inspection findings, and, when performance declines, through independent safety culture assessments required as part of supplemental inspections.

Lessons from the accidents

Each accident in this course had cultural causes. At Three Mile Island, an earlier relief valve event at Davis-Besse had been analyzed by engineers who saw its importance, but the warning did not reach the operators of other plants. At Chernobyl, a test was carried out under production and schedule pressure, outside the conditions intended, with protective trips disabled, in an organization that did not encourage questioning of designers or managers. At Fukushima Daiichi, evidence of larger historical tsunamis had been discussed, but countermeasures were deferred, and the shared belief that a severe accident was unthinkable limited preparation. In each case, information that could have prevented the accident existed somewhere in the system but was not acted on.

Events in North America show the same patterns. In 2002, inspectors at the Davis-Besse plant in Ohio found that boric acid leaking from cracked control rod drive nozzles had corroded a cavity about the size of a football through the carbon steel head of the reactor vessel, leaving only the thin stainless steel cladding to hold the pressure. Signs of leakage had been visible for years, and earlier inspections had been limited partly because of pressure to keep the plant running. The NRC's investigations identified weaknesses in safety culture at the licensee and in its own oversight, and the plant was shut down for about two years for repairs and organizational change.

TVA's own history includes a long shutdown of all five of its operating reactors in 1985, after concerns about management, quality assurance and employee concerns programs. The recovery took years and reshaped TVA's nuclear organization, and the experience is a reminder that a culture can erode slowly while plants continue to run without major events.

Measuring safety culture

Safety culture cannot be measured directly, so organizations use several methods together: surveys of staff perceptions, interviews and focus groups, observation of meetings and work, review of documents such as corrective action records, and indicators such as the number and quality of condition reports raised, the backlog of corrective actions, and the frequency of repeat events. Each method has limits. Surveys capture what people are willing to say; observations can change behavior; indicators can be gamed if they become targets. Triangulating between methods gives a more reliable picture.

# Safety culture survey statistics: percent positive with a 95 % confidence interval.
import math
answers = {  # positive answers, total respondents
    "leadership commitment": (164, 200), "questioning attitude": (128, 200),
    "raising concerns freely": (116, 200), "learning from experience": (142, 200),
    "work planning": (132, 200), "decision making": (148, 200),
    "respectful workplace": (158, 200)}
for trait, (k, n) in answers.items():
    p = k / n; se = math.sqrt(p * (1 - p) / n)
    lo, hi = p - 1.96 * se, p + 1.96 * se
    flag = "follow up" if hi < 0.70 else ("watch" if p < 0.70 else "")
    print(f"{trait:26s} {p*100:5.1f} %  (95 % CI {lo*100:4.1f} to {hi*100:4.1f}) {flag}")

leadership commitment       82.0 %  (95 % CI 76.7 to 87.3) 
questioning attitude        64.0 %  (95 % CI 57.3 to 70.7) watch
raising concerns freely     58.0 %  (95 % CI 51.2 to 64.8) follow up
learning from experience    71.0 %  (95 % CI 64.7 to 77.3) 
work planning               66.0 %  (95 % CI 59.4 to 72.6) watch
decision making             74.0 %  (95 % CI 67.9 to 80.1) 
respectful workplace        79.0 %  (95 % CI 73.4 to 84.6)

In the illustrative survey, raising concerns freely is flagged for follow-up because even the upper end of its confidence interval is below the threshold. Questioning attitude and work planning are watched because their intervals straddle it. The statistics matter: a difference of a few points between groups or years may be noise. More important than the numbers, however, is what the organization does next. Focus groups would explore why people feel less free to raise concerns, whether in particular departments, about particular kinds of issues or because of how earlier concerns were handled.

Building and sustaining a strong culture

A strong safety culture is built mainly by what leaders do rather than what they say. When a supervisor thanks a worker for stopping a job over a concern that turns out to be unfounded, the message to everyone is that stopping is right. When a manager pushes a schedule ahead of an unresolved safety question, the message is the opposite, whatever the posters on the wall say. Corrective action programs that treat every reported issue seriously, feedback to people who raise concerns, independent oversight, and the willingness to learn from other plants all reinforce a healthy culture.

Many organizations distinguish between a blame culture, in which errors are punished and therefore hidden, and a just culture, in which honest mistakes are treated as opportunities to improve the system, while reckless or deliberate violations remain unacceptable. A just culture encourages reporting, which provides the information that probabilistic assessment, operating experience programs and human reliability analysis need. Safety culture also links to security culture, which applies the same ideas of vigilance and reporting to the protection of facilities, though security culture is a separate topic beyond this course.

Complacency is the long-term threat. A plant that runs well for many years can come to believe that its good record proves it is safe, and stop asking difficult questions. Organizations counter this with peer reviews by WANO and INPO, international missions such as the IAEA's Operational Safety Review Team, benchmarking against other plants, and deliberate efforts to keep a chronic unease, the sense that something could go wrong even when everything appears normal.

Bringing the course together

Safety culture ties together everything in this course. Defense in depth depends on people maintaining every level, not only the ones that are inspected. Deterministic and probabilistic analyzes depend on honest inputs and on analysts willing to report unwelcome results. Human reliability depends on the conditions organizations create. Severe accident management depends on preparation done long before an accident. The three accidents studied show what happens when any of these fail, and the improvements made after each show that the industry can learn. The goal for every engineer is to be part of an organization in which the next accident is prevented because someone noticed, spoke up and was heard.

Safety culture in design and projects

Safety culture is not only a matter for operating plants. Design organizations, suppliers and construction projects also shape safety, sometimes decades before a plant operates. A designer who does not report an uncertainty in an analysis, a supplier who ships a component with falsified test records, or a project that compresses a review to meet a schedule can introduce weaknesses that are hard to find later. Counterfeit, fraudulent and suspect items have been found in the nuclear supply chain in several countries, and regulators expect licensees to extend their safety culture expectations to their suppliers. For a new design such as an SMR, the safety culture of the design team is part of the safety case.

Large projects face particular pressures. Schedules are tight, budgets are visible, and many organizations with different cultures work together. Clear ownership of safety decisions, independent review, and a project leadership that visibly supports raising issues are essential. The same questioning attitude that operators need at the plant is needed in the design office: asking what could go wrong, what assumptions underlie a calculation, and whether the evidence really supports a conclusion.

Human performance tools

Many plants support safety culture with a set of human performance tools that individuals use in daily work. A pre-job briefing reviews the task, its hazards and the critical steps before work begins. Self-checking, often summarized as stop, think, act and review, asks the worker to pause before an action and confirm it is the right one on the right component. Peer checking adds a second person for critical steps. Three-way communication, in which the receiver repeats an instruction and the sender confirms it, reduces misunderstandings. A post-job review captures lessons while they are fresh. These tools reduce the chance of error, but their deeper value is that they make attention to safety a routine part of work.

Human performance tools work only if the culture supports them. If workers feel rushed or believe that a pause will be criticized, the tools become formalities. Leaders reinforce them by using them themselves, by recognizing people who stop work when uncertain, and by investigating events to find the conditions that made errors likely rather than only identifying who made them. Over time, the combination of good tools and a supportive culture creates an organization in which errors are rare, caught early and learned from.