Inspection and enforcement

Marcel Thibodeau spent five years as an NRC resident inspector before returning to industry, and he still talks about the job with affection. "You live near the plant, you badge in every morning, you walk the plant, you sit in on the morning meeting," he tells Hana. "You get to know which supervisor fixes problems and which one hides them. The license and the safety analysis report say what the plant should be. The inspector's job is to find out what it actually is."

Why inspection matters

A license is a set of promises. The licensee promises to operate within limits, maintain its equipment, train its staff, keep records, report events and run its programs as described. Inspection checks that the promises are kept. It is the regulator's main source of first-hand information about a facility, complementing the reports the licensee submits. Inspection also has a deterrent effect: a licensee that knows it may be inspected at any time has a strong incentive to keep its house in order. And inspection findings, analyzed across many facilities, show the regulator where its rules or guidance may need to change.

Inspections take several forms. Routine baseline inspections follow a planned program that covers every important area over a cycle of a year or more. Reactive inspections follow an event or a performance problem. Special team inspections look in depth at a topic such as fire protection, design basis or emergency preparedness. Desktop reviews examine documents and data without a site visit. And on-site inspectors carry out continuous observation of daily activities. Inspections may be announced, to allow the right people and documents to be available, or unannounced, to see the plant as it normally is.

The reactor oversight process

The NRC's reactor oversight process, introduced in 2000, organizes inspection and assessment around seven cornerstones of safety: initiating events, mitigating systems, barrier integrity, emergency preparedness, occupational radiation safety, public radiation safety and security. Two kinds of information feed the assessment. Performance indicators, reported quarterly by licensees, measure things like unplanned shutdowns, safety system unavailability and emergency drill performance against thresholds. Inspection findings come from a baseline program carried out at every plant by at least two resident inspectors and by teams from the regional office. Each indicator and each finding is assigned a color reflecting its safety significance: green for very low, white for low to moderate, yellow for substantial and red for high.

The colors determine where each plant sits in the action matrix, which sets the NRC's response. A plant with only green inputs is in the licensee response column and receives the baseline inspection program. One or two white inputs in different cornerstones move it to the regulatory response column, with a supplemental inspection to check the licensee's root cause evaluation. A yellow input, or several whites in one cornerstone, moves it further, to the degraded cornerstone column, with a larger inspection. Multiple degraded cornerstones, a red input or repeated problems lead to the multiple or repetitive degraded cornerstone column, with an extensive team inspection and possible orders. The last column, unacceptable performance, means the plant is not allowed to operate.

Judging significance

The significance determination process assigns colors to inspection findings. For a finding that affects equipment or procedures used to prevent or mitigate accidents, analysts estimate the increase in core damage frequency the deficiency caused over the time it existed, usually with plant-specific risk models. Thresholds on the change separate the colors: below about one in a million per year is green, up to about one in a hundred thousand white, up to about one in ten thousand yellow and above that red. Other cornerstones, such as emergency preparedness and security, use qualitative flow charts in place of risk numbers.

# Color findings from their change in core damage frequency and place the plant in the action matrix.
def color(dcdf):
    if dcdf < 1e-6: return "green"
    if dcdf < 1e-5: return "white"
    if dcdf < 1e-4: return "yellow"
    return "red"
COLUMNS = ["licensee response", "regulatory response", "degraded cornerstone",
           "multiple/repetitive degraded cornerstone", "unacceptable performance"]
def column(inputs):  # inputs: list of (cornerstone, color)
    whites = {}; yellow = red = 0
    for c, col in inputs:
        if col == "white": whites[c] = whites.get(c, 0) + 1
        if col == "yellow": yellow += 1
        if col == "red": red += 1
    degraded = sum(1 for n in whites.values() if n >= 2) + yellow
    if red or degraded >= 2: return COLUMNS[3]
    if degraded == 1: return COLUMNS[2]
    if whites: return COLUMNS[1]
    return COLUMNS[0]
findings = [("mitigating systems", "emergency diesel failed to start, exposure 40 days", 4.0e-6),
            ("barrier integrity", "minor containment penetration leak", 3.0e-7)]
inputs = []
for c, text, d in findings:
    col = color(d); inputs.append((c, col))
    print(f"{text:50s} dCDF {d:.1e}/y -> {col}")
inputs.append(("initiating events", "white"))  # performance indicator: unplanned scrams
print("performance indicator initiating events -> white")
print("action matrix column:", column(inputs))

emergency diesel failed to start, exposure 40 days dCDF 4.0e-06/y -> white
minor containment penetration leak                 dCDF 3.0e-07/y -> green
performance indicator initiating events -> white
action matrix column: regulatory response

The output shows a plant with one white finding in mitigating systems and a white performance indicator in initiating events. The two whites in different cornerstones put it in the regulatory response column. Marcel stresses that the color is about what the deficiency meant for risk, not about how much the licensee is to blame; blame is handled separately through enforcement.

Enforcement tools

The NRC's enforcement policy is separate from the reactor oversight process but uses its significance results. Most minor violations are not cited at all. Green findings that are violations are normally treated as non-cited violations, recorded but not requiring a formal response, if the licensee has entered them into its corrective action program. More significant violations lead to a notice of violation, which requires the licensee to respond in writing. Violations not assessed through the oversight process, such as willful violations or those affecting the regulatory process, are given a severity level from IV, the least serious, to I. Civil penalties can exceed three hundred thousand dollars per violation per day, adjusted annually for inflation. The NRC can also issue orders to modify, suspend or revoke a license, and refer willful violations to the Department of Justice.

The corrective action program

The most important mechanism for fixing problems at a nuclear plant is not the regulator but the licensee's own corrective action program. Every worker can raise a condition report about anything that looks wrong, from a dripping valve to a confusing procedure. Each report is screened for significance, assigned to an owner, investigated in proportion to its importance, and closed when the fix is verified. Significant problems get a root cause analysis that looks beyond the immediate cause to the organizational factors behind it. A healthy plant raises thousands of condition reports a year. Regulators look closely at the corrective action program, because a licensee that finds and fixes its own problems is far safer than one that waits for the inspector.

Event reporting

Licensees must report events to the NRC. Under 10 CFR 50.72, some events, such as the declaration of an emergency, must be reported by telephone to the NRC Operations Center within one hour, and others within four or eight hours. Under 10 CFR 50.73, licensees submit written licensee event reports within 60 days for events such as reactor trips, operation prohibited by the technical specifications and conditions that could have prevented a safety function. Event reports are public and are analyzed by the NRC and the industry for trends and lessons.

Prompt and honest reporting is one of the most important obligations of a licensee. Regulators treat a failure to report, or a misleading report, far more seriously than the event itself in many cases, because the whole system of oversight depends on the regulator being able to trust what licensees tell it. Marcel tells Hana about a case early in his career in which a minor equipment fault became a significant enforcement matter because a shift supervisor had delayed the report to avoid embarrassment. "The fault was trivial," he says. "The delay was not."

Raising concerns

Workers who see a safety problem must be able to raise it without fear. Section 211 of the Energy Reorganization Act protects employees of NRC licensees and contractors from retaliation for raising safety concerns, with complaints investigated by the Department of Labor. The NRC runs an allegation program that receives concerns from workers and the public, protects the identity of the person raising them where possible, and follows them up through inspection or by asking the licensee to investigate. It also expects licensees to maintain a safety-conscious work environment, in which people feel free to raise concerns, and it inspects for signs that the environment has deteriorated, such as workers saying they fear raising issues.

A strong reporting culture inside the plant is one of the clearest signs of a healthy safety culture. When workers raise many small concerns, the organization learns about problems while they are still small. When workers stop raising concerns, because they think nothing will happen or because they fear the consequences, problems grow unseen. Inspectors therefore pay attention not only to the problems a licensee finds but to how many it finds, who finds them and what happens next.

What an inspector looks for

Experienced inspectors look beyond individual requirements to patterns. A missed test is a finding; three missed tests in different systems may point to a weakness in work planning. A procedure that operators routinely work around may point to a procedure that is wrong. Repeated equipment failures may point to an aging problem that the maintenance program has not caught. Inspectors also watch how the organization behaves: whether the morning meeting discusses safety honestly, whether supervisors challenge each other, whether management visits the plant floor, and whether problems raised by workers are fixed or ignored. These observations feed into the regulator's assessment of safety culture, which both regulators now treat as an inspectable area.

Hana asks Marcel how an inspector avoids becoming too close to the plant after years on site. "It is a real risk," he says. "You get to like the people. You start to see the plant through their eyes. That is why regulators rotate site inspectors every few years, send teams from headquarters who see things fresh, and review the site team's work. The best protection is to keep asking the simple question: if this were the first day I saw it, would I accept it?"

Enforcement in practice

The NRC issues hundreds of non-cited violations each year across the reactor fleet, a smaller number of notices of violation, and a handful of civil penalties, many of them in the materials program, where violations by industrial radiographers and medical users can quickly cause significant doses. Escalated enforcement actions are published with the licensee's name. The largest penalties have followed cases where serious problems were hidden or ignored. In 2005 the agency fined the operator of the Davis-Besse plant more than five million dollars after corrosion from a leaking boric acid deposit ate a cavity through the steel of the reactor vessel head, leaving only the thin stainless steel cladding to hold the pressure, a case lesson 12 returns to.

Elena adds one more point. "Enforcement is not the goal. Compliance is the goal, and beyond compliance, safety. A regulator that issues many penalties is not necessarily doing a better job than one that issues few. What matters is whether problems are found early and fixed for good."

Is oversight working?

Regulators also have to judge whether their own oversight is effective. A falling number of findings could mean that plants are getting safer, or that inspectors are looking less hard. Regulators therefore look at several kinds of evidence together: trends in performance indicators such as unplanned shutdowns and safety system failures, the number and significance of events, the results of international peer reviews, surveys of their own staff and of licensees, and independent audits. They compare the issues their inspectors found with the issues that later caused events, to see whether the inspection program is looking in the right places.

Over the past few decades the performance of the reactor fleets in both countries has improved markedly by most measures. Unplanned shutdowns have become rarer, capacity factors have risen and significant events have declined. Regulators and industry both claim part of the credit, and both are probably right: oversight that focuses on what matters, combined with licensees' own programs for learning from experience, has driven steady improvement. The danger that both warn about is complacency. A long period without serious events can lead organizations to believe that they are safer than they are, and to cut back on the very activities that kept them safe.

For this reason the NRC reviews the reactor oversight process each year through a self-assessment, adjusts the baseline inspection program as risks change, and has reduced inspection in some areas where performance has been consistently good while keeping the ability to increase it quickly if performance slips.