United States General Accounting Office Testimony Before the Subcommittee on Clean Air, Wetlands, Private Property, and Nuclear Safety,
Committee on Environment and Public Works, U.S. Senate

NUCLEAR REGULATORY COMMISSION

Preventing Problem Plants Requires More Effective Action by NRC
Statement of Gary Jones, Associate Director, Energy, Resources, and Science
Issues, Resources, Community, and Economic Development Division GAO/T-RCED-98-252

Mr. Chairman and Members of the Subcommittee: We are pleased to testify on how the Nuclear Regulatory Commission (NRC) oversees the nuclear power industry. Among other things, NRC is responsible for ensuring that the operation of the nation's 103 commercial nuclear power plants occurs in a manner that adequately protects public health and safety. Identifying nuclear plants with safety problems and making sure that their owners-the licensees correct safety problems promptly are essential to NRC's safety mission. This becomes even more critical as NRC begins to regulate safety in an environment of electricity deregulation.

Our testimony is based on our May 1997 report about preventing problems at nuclear power plants.\1\ Our testimony discusses how NRC defines nuclear safety, some of the causes for weaknesses in how NRC oversees nuclear plants that have problems, and the challenges ahead for NRC safety regulation.

\1\[Nuclear Regulation: Preventing Problem Plants Requires More Effective NRC Action (GAO/RCED-97-145, May 30, 1997).

In summary, our 1997 report points out that the Congress and the public need confidence in NRC's ability to ensure that the nuclear industry performs to high safety standards. While our report did not make judgments about the safety of nuclear plants or the appropriateness of NRC's current regulatory structure, the many safety problems identified at plants we examined raised questions about whether NRC's regulatory program was working as it should, and we made recommendations to strengthen it. Specifically we found that:

NRC assumes plants are safe if they operate as designed and follow NRC's regulations. However, all three facilities we examined-the Millstone Nuclear Power Station in Connecticut, the Salem Generating Station in New Jersey, and the Cooper Nuclear Station in Nebraska-were operating outside of their approved designs. NRC reasoned that these plants were still safe because the many safety features and systems built into a plant's design provide an adequate margin of safety. However, changes made to plants over time, such as replacing components with different parts and reconfiguring systems, can alter a plant's design, thus potentially affecting how certain safety systems might work in an emergency. NRC has found other plants that are not operating as designed and is exploring the reasons that the licensees have not maintained current information on their design changes and have not examined the impact of such changes on the safe operation of plants. Ambiguity over "how safe is safe" arises because NRC does not have an effective way to quantify the safety of plants that deviate from their approved designs.

The three nuclear plant facilities that we examined had longstanding safety problems, and NRC did not take aggressive action to ensure that the licensees fixed their safety problems in a timely way. These problems ranged from failures of equipment to work properly when tested, to weaknesses in how licensees' conducted their maintenance programs. As a result, the plants' conditions worsened, reducing safety margins. NRC staff repeatedly extended the amount of time it allowed the plants' operators to make corrective actions. In addition, although nuclear industry and NRC officials agree that the competency of a nuclear plant's management is a critical factor in safety performance, in the early 1990s, NRC eliminated management assessment in streamlining its inspection guidance. Furthermore, NRC was slow to place plants with declining performance on its "Watch List," which is a tally of plants whose declining performance trends require closer regulatory attention.

NRC faces many challenges to make its regulatory program work as effectively as it can, particularly in light of major changes taking place in the nuclear industry. As the electric utility industry deregulates, safety margins may be compromised when licensees cut costs to stay competitive. According to one utility industry study, as many as 37 of the nation's nuclear sites are vulnerable to shutdown because production costs are higher than the projected electricity prices in the market. Decisions that NRC will be making include how safe is safe, and what should be the nuclear plant regulatory approach of the future. NRC's regulatory approach needs to be anchored in goals and objectives that are clearly articulated, and performance measures that hold NRC managers as well as licensees accountable.

BACKGROUND

Commercial nuclear plants in the U.S. operate in 31 states and provide about 20 percent of the nation's electricity. Five states (Connecticut, New Jersey, Vermont, South Carolina, and Illinois) rely on nuclear power for about half of their electricity. NRC licenses the construction and operation of nuclear power plants, which are owned and operated by both public and private utility companies; develops, implements, and enforces the rules and regulations that govern nuclear activities; inspects facilities to ensure compliance with legal requirements; and conducts research to support its programs. NRC's fiscal year 1998 budget authorization is $472.8 million, and it has requested $488.6 million for fiscal year 1999. Its staff of about 3,000 is responsible to five Commissioners appointed by the President and approved by the Senate. About 55 percent of NRC's professional staff are dedicated to nuclear reactor activities.

NRC DOES NOT PRECISELY DEFINE NUCLEAR PLANT SAFETY

Determining the safety of plants is difficult because NRC does not precisely define it. Instead, NRC presumes that nuclear plants are safe if they operate within their approved designs (design basis) and meet NRC's regulations. However, NRC's regulations and other guidance do not provide either the licensees or the public with the specific definitions and conditions that define the safety of a plant. As a result, NRC does not have an effective way to quantify the safety of plants that deviate from their approved designs or violate regulations. Determining a plant's safety condition is, therefore, a subjective judgment.

NRC reasons that the many safety features and systems built into a plant's design provide an adequate margin of safety, even when some of them are not working properly. System redundancies-the duplication of a plant's safety systems, structures, and components provide in-depth protection to help prevent an accident from releasing radiation to the public. This concept, also known as defense-in-depth, forms the foundation of NRC's confidence that nuclear plants are safe, even those that may be shut down for safety problems.

The conditions found at Millstone in 1996, however, challenged NRC's confidence that it can rely on licensees to ensure that the plants are operating within their approved design basis. A special NRC inspection team found a number of significant equipment problems and concluded that the licensee had not consistently met its license and regulatory requirements. NRC's inspectors were unaware of the extent of these problems-some of which were not reported by plant managers-and thus discovered that the Millstone plants were operating outside their design bases. As a result of the conditions found at Millstone and at other nuclear plants, NRC is now reemphasizing the need to determine if plants are still operating within their

design bases. The safety significance of design basis issues are hard to quantify because NRC does not precisely define safety. Perceptions of safety levels and risk are subjective and are not always consistent from inspector to inspector. Several current and former NRC inspectors told us that they cannot easily distinguish a safe plant from an unsafe one, and that the guidance on when to shut down a plant does not cover all situations.

NRC has incomplete knowledge about the extent to which nuclear plants are operating within their design basis. Since the mid- to late-1980s, NRC has found that some licensees were not documenting changes made to their plants that could affect their approved design basis. However, it was not until October 1996, after the problems were discovered with Millstone, that NRC required licensees to certify that their plants were operating within the plant's design basis. To follow up on licensees' certifications, as of May 1998, NRC had inspected 16 sites to verify that the plants were operating under the terms and conditions of their licenses.\2\ Generally, NRC found that some utilities had not maintained current information on the design basis and had not examined the impact of modifications on safe plant operations. NRC identified significant problems during these inspections, including instances in which licensees had not properly tested safety related components, and had made errors in their analyses for how emergency cooling systems would work during a potential accident. NRC has concluded that the majority of the problems resulted from errors in the original design or from design modifications, inadequate testing, and discrepancies in documentation.

\2\These represent sites that NRC has identified for follow up inspections.

NRC IS NOT EFFECTIVELY OVERSEEING PROBLEM PLANTS

Identifying and correcting safety deficiencies are among the licensees' most important responsibilities, and these are a major focus of NRC's nuclear plant

inspection program. NRC's regulations require that nuclear plants have an effective program to "assure that conditions adverse to quality . . . are promptly identified and corrected." And NRC places importance on evaluating plants' corrective action programs to ensure that they will lead to timely correction of the identified problems.

For the three facilities with a history of poor performance that we examined (Millstone, Salem, and Cooper), we found that the licensees failed to fix their substantial and recurring safety problems in a timely manner. Most of these problems were equipment failures. At Salem, for example, an air control system and a water pump motor had not worked properly for over 6 years. NRC allowed these licensees repeated opportunities to correct their safety problems, by relying on licensees' corrective action plans that were never fully completed, by accepting management's promises to fix problems (though these promises were not always met), and by using enforcement actions too late to effect change. For example, some of the problems causing the 1994/1995 shutdown of the Cooper Nuclear Station dated to the plant's first start-up in 1974-problems Cooper's management should have addressed years earlier, according to the NRC inspectors we interviewed. An NRC audit reported that the plant managers were "living with problems, not fixing them" and that "ineffective self-assessment" and a "weak corrective action program" characterized operations. However, NRC allowed Cooper to restart its reactors after the 1994/1995 shutdown on the basis of the licensee's promises to fix these recurrent problems and contingent upon Cooper's monitoring of its own progress. After showing improvements over several months, the plant's performance quickly declined. Then NRC discovered that many of the safety problems that Cooper's management had promised to correct had not been corrected.

Another tool NRC uses to obtain compliance with its regulations is its enforcement program of fines and sanctions, which is designed to correct violations promptly, deter future violations, and encourage licensees to operate their plants safely. However, NRC was very slow imposing fines on the three plants we examined.

Salem's fines were levied by NRC well after the plants were in periods of significant decline, and at the time our report was issued, NRC still had not completed its enforcement action against Millstone for violations that were first discovered in 1995. NRC can also prevent shutdown plants from restarting until all of their safety deficiencies are addressed, but this action sometimes has occurred long after plants' deficiencies were documented.

We recommended that NRC aggressively act on identified problems and then document what it will do if safety problems go uncorrected. NRC's Chairman has complained about the consequences of NRC's patience with some problem licensees, adding that the Commission is reviewing its internal processes to strengthen its ability to identify and act on licensees' corrective action programs. NRC officials agree that they need to do a better job of making licensees fix their problems, and will bring licensees' unresponsive to corrective actions to the attention of NRC's senior managers.

Management Competency Critical to Safety

The nuclear industry and NRC officials widely agree that Me competency of a nuclear plant's management is perhaps the most critical factor in safe performance. NRC's audits and reviews frequently cite management weaknesses as the major cause of the declining performance at nuclear plants. For example, NRC cited a "poor management safety culture," "weak management oversight of engineering programs," a "fragmented approach" to resolving problems, and a failure to provide an "adequate level of oversight"\3\ as underlying causes for deteriorated conditions at Cooper. Similarly, safety problems found at the LaSalle and Zion nuclear plants in Illinois in January, 1997, were attributed by NRC to weak management processes and a lack of managements involvement.

\3\Supplemental Plant Performance Review, NRC (95-04, Oct. 3, 1995).

Yet, despite the importance of competent management, NRC does not have an effective process for ensuring that licensees maintain it for their nuclear plants. NRC does not assess management in its plant inspection program, and individual inspection reports specifically avoid any references to management's competency. NRC's references to management weaknesses are usually made retrospectively, and often only after a licensee admits to such deficiencies, or by NRC audit teams or special investigations-long after the NRC has lost the opportunity to give an early warning about potential management weaknesses. NRC's guidance to its inspectors once contained a management assessment component, but this was eliminated in the early 1990s when NRC streamlined its inspection process.

Although NRC's regulations do not require the evaluation of plant management before a license to operate a nuclear plant can be issued, NRC must determine if the prospective licensee is "technically and financially qualified to engage in the activities authorized by the operating license." Because such qualifications could also reflect on a licensee's overall ability to manage a facility competently and safety, we recommended that NRC assess management competency and performance as part of its inspection process. A 1996 report to NRC by Arthur Andersen also points out the importance of evaluating management, particularly for NRC to be effective in actively assessing plant performance. The report recommended that NRC hire experts or train staff to evaluate management's performance and changes in management.

NRC agrees that management's competency is critical to a licensee's operational safety performance and told us that its existing evaluation processes draw conclusions about the effectiveness of licensees' management. NRC staff have proposed options to assess the performance and competency of licensees' management, which include changes in inspection procedures, more staff training, and use of consultants. But the Commission rejected these options in June 1998, and instead directed NRC staff to continue with the current practice of inferring licensee performance from existing plant inspections and other routine assessments. The Commission also withdrew resources specifically directed at developing a systematic method to assess licensees' competency and management. While we are continuing to study NRC's rationale for its decision as part of our ongoing work, we continue to believe that evaluating licensees' management competency as part of plant inspection would provide a important early warning of potentially unsafe practices.

Early Intervention Could Result In Fewer Problem Plants

NRC's process to focus attention on those plants with declining safety performance- the semiannual Senior Management Meeting-needs substantial revisions to achieve its purpose as an early warning tool. NRC collects enormous amounts of information on nuclear plants, both from its own inspectors and from the nuclear plant licensees. Taken together, these sources provide NRC with a database to measure and monitor plants' safety conditions and safety performance. Despite this database, NRC has been slow to identify and place problem plants on its "Watch List." The Watch List is NRC's tally of plants whose declining performance trends require closer regulatory attention. Yet, the List is an important early warning tool for NRC to target its regulatory emphasis, allowing small problems to be corrected before they lead to costly shutdowns.

The Salem and Millstone plants were under discussion by NRC for 3 to 4 years before they were placed on the Watch List in 1996 and 1997, respectively. NRC discussed the Cooper facility as a problem plant but never placed it on the Watch List, even though it was eventually shut down for safety reasons. As of May 1997, when we did our analysis, 41 plants, or more than a third of the nation's nuclear power plants, had been placed on the Watch List by NRC since 1986. Twenty-four plants had been on the list for 2 or more years. However, about half of the plants on the Watch List were known by NRC to be poor performers long before being listed. Moreover, the Arthur Andersen report identified 10 plants that were not placed on the Watch List but whose performance indicators were similar to those that are listed.

This inconsistency has been attributed, in part, to the lack of specific criteria for making decisions on a consistent basis, the subjective nature of the process, and some NRC managers' confusion about their role in the process. Industry and private interest groups alike have criticized NRC for not having specific criteria with which to decide when plants should be placed on the Watch List.

NRC acknowledges that it should do a better job of identifying plants deserving attention for and listing on the Watch List. NRC is developing a new process for assessing plants' performance. Among other things, the new process would eliminate the Watch List, replacing it with a process that would include a decision model or criteria so that, according to NRC, its actions are predictable, informed regarding risk, simple, nonredundant, and efficient. NRC expects to publish the proposed process for comment early in August 1998, and hopes it will be in place by 1999.

CHALLENGES NRC FACES REGULATING IN AN EVOLVING ENVIRONMENT

At the heart of safe operations is holding the licensees accountable for fixing their plants' problems more promptly and addressing management issues more directly. However, changing NRC's culture will not be easy. The need to ensure that NRC's regulatory program works as effectively as it can is extremely important, particularly in light of mayor changes taking place in the nuclear industry.

NRC officials are concerned that as the electric utility industry is deregulated, safety margins may be compromised as licensees cut costs to stay competitive. As an example, an independent auditor's review of the Millstone plant in 1996 noted that the need to trim costs in the face of future competition resulted in managers' choosing to defer maintenance and allow backlogs of corrective actions to grow, eventually creating a situation that led to a shutdown and several hundred million dollars worth of repairs.

Several estimates have been made about the number of plants that might no longer be economically competitive. A private research report concluded that because competition will result in lower electricity prices in the future, as many as 37 of the nation's nuclear sites are vulnerable to shutdown because production costs are higher than the projected electricity prices in the market.\4\ Together, these sites represent over 40 percent of the U.S. nuclear generating capacity.

\4\Nuclear Power Plant Shutdowns and Implications for Future Natural Gas Demand, Washington International Energy Group (Feb. 1997).

For those plants that will continue to operate, NRC reports that the nuclear industry has matured to the point that plants have been in operation long enough for aging to be a major issue that can affect cost and safety. Aging, which affects all of a plant's systems and components, can bring conditions causing safety concerns that, if not appropriately addressed, could require licensees to shut down plants. Already, two plants have formally requested a license extension and others plan to operate beyond their original 40 year operating lives.

NRC is moving to "risk-informed" and "performance based" reactor regulation, which aims to focus regulatory resources on areas of the highest safety significance and its regulatory framework more results oriented. It is also making changes to the Senior Management Meeting process. These changes illustrate an effort by the current Chairman and Commissioners to improve NRC's ability to help ensure safe operation of the nation's nuclear power industry as well as address industry concerns regarding excessive regulation.

Questions that NRC will be facing include how safe is safe, what will the future NRC regulatory approach be, and what level of resources will be needed to regulate the Department of Energy's nuclear facilities? Whatever NRC decides in answering such questions needs to be anchored in goals and objectives that are clearly articulated and performance measures that hold NRC managers as well as licensees accountable. In addition, NRC needs reliable information on which to determine safe operations, training for its staff, and an enforcement structure that clearly lays out a range of sanctions that it will impose on the basis of the potential seriousness of the safety problems found.

A framework within which NRC can accomplish its missions has been provided by the Government Performance and Results Act of 1993. The Results Act requires federal agencies to develop goals, objectives, strategies, and performance measures in the form of strategic and performance plans. In our review of NRC's first annual performance plan, which covers the program activities set out in its fiscal year 1999 budget\5\, we noted that the plan could provide a clearer picture of the intended performance across NRC and better discuss the strategies and resources the agency will use to achieve its performance goals. For example, nuclear reactor safety is a "strategic arena" in NRC's strategic plan. While the plan lists specific strategies NRC will use against licensees that fail to meet regulatory standards, including halting operations if licensee performance falls below an acceptable level\6\, NRC has not developed specific criteria for "acceptable." Moreover, the performance plan does not provide confidence that the agency's performance information will be credible. The development of strategic and performance plans is a dynamic process. As the Congress and NRC gain more experience in setting goals and measuring results, better information will be available to evaluate progress towards improving NRC performance.

\5\Results Act: NRC's Annual Performance Plan for Fiscal year 1999 (GAO/RCED- 98-195R, May 27, 1998)

\6\0nly once has NRC issued an order to shut down an operating plant, at Peach Bottom, Penn. in 1987. On other occasions, NRC has issued such orders only after the licensees had suspended operations.

Mr. Chairman and Members of the Subcommittee, this concludes our statement. We would be pleased to respond to any questions you may have.

(141240)