An intrinsically motivated safety culture does not usually emerge fully formed. Decisions and actions affecting behaviors are often linked to entrenched attitudes and beliefs within companies. Commitment and accountability are required throughout the organization to recognize, challenge, and resolve issues, thereby providing true safety benefits to work groups.

Accurate workforce performance measurement requires reliable, quantifiable, and reproducible performance indicators. Often, the indicators can be divided into historical (lagging) or predictive (leading) metrics that provide a snapshot of performance at a given point in time.

Accidents, or system failures, which can appear technical in nature, often result from an accumulation of “weak signals.” Performance indicators might not even recognize those weak signals, if the immediate consequences are not serious. However, the inability to take action because of too much information, or lack thereof, can yield major accidents or system failures.

Simply adding more safety devices, a standard response to an unanticipated failure, may paradoxically reduce safety margins by adding system complexity. That fact means abandoning a program may not be justified, but instead, suggests focus should be shifted to the organization and its employees.

From Organizational Culture to Safety Culture

Scrutiny increases dramatically after a disastrous event, which can flesh out some important lessons learned. Using the Fukushima accident as an instructive example, the principal causes that contributed to the severity of the event, as identified by an independent investigation commission, were organizational culture and regulatory systems that supported faulty rationales for decisions and actions. The commission said an insular group mindset had developed at the site, which resulted in the larger-than-projected tsunami’s significance being minimized, allowing flooding and a station blackout to disable reactor-cooling functions, leading to disaster.

Organizational culture is considered to be the shared perception of the organization, including traditions, values, and socialization processes that endure over time. Various models have been developed to explain the phenomenon. One example is known as Schein’s model. It divides organizational culture into three layers—innermost, middle, and outermost.

The innermost layer represents the core component of culture, which is invisible and effectively unconscious. It is inferred from espoused values (middle layer) and artifacts (outermost layer). The artifacts are visible and easily measured, but they can still be hard to interpret without digging below the surface to uncover why a group behaves a certain way.

Organizational climate is used to measure selected employee perceptions and characteristics of their environment, that is, an overt manifestation of culture within an organization. These abstract concepts—that climate is culture in the making and organizational culture expresses itself through organizational climate—are often used interchangeably and risk becoming virtually meaningless unless properly defined (Table 1).

Table 1. Culture versus climate. In his article “The nature of safety culture: a review of theory and research” published in Safety Science, F.W. Guldenmund suggests that there are several characteristic differences between organizational culture and climate. Source: F.W. Guldenmund

Organizational culture and climate, specifically applied to safety, form subsets referred to as safety culture and safety climate, respectively. These are common constructs to discuss safety events (see sidebar).

Safety culture and climate have been extensively researched creating numerous definitions, theories, and models, some of which even conflict. The diversity of the conclusions results from the variable ways in which safety culture and climate can be framed and studied. Although no single definition, theory, or model has been universally accepted; many of them discuss tentative relationships following layered models.

Safety Culture Goes Nuclear

The term “safety culture” as part of the nuclear lexicon can be traced back to the Chernobyl-4 graphite-moderated nuclear reactor post-accident review in 1986. An autopsy of the accident—a steam explosion and fire that released radioactive reactor core fragments and fission products into the atmosphere—determined that the event was caused by the concurrence of rector physical characteristics; control element design features; an unauthorized state not specified by procedures or investigated by an independent safety body; and communication inadequacies between operators and regulators, coupled with a lack of clear lines of responsibility.

The International Nuclear Safety Advisory Group, an advisory group to the Director General of the International Atomic Energy Agency, was tasked with investigating the accident. It found, “The vital conclusion drawn is the importance of placing complete authority and responsibility for the safety of the plant on a senior member of the operational staff of the plant. Formal procedures properly reviewed and approved must be supplemented by the creation and maintenance of a ‘nuclear safety culture.’ This is a reinforcement process which should be used in conjunction with the necessary disciplinary measures.”

The Chernobyl accident demonstrated that lessons learned from the Three Mile Island (TMI) accident in 1979 had not been implemented. Following TMI, the Nuclear Regulatory Commission (NRC) and U.S. nuclear industry, under the heading of human factors, focused on improving operator qualifications and training, staffing levels and working conditions, man-machine interfaces, emergency operating procedures, and organizational/management effectiveness. Although not labeled “safety culture” at the time, the TMI investigation report concluded that the principal deficiencies in commercial reactor safety were not hardware problems, but management problems.

In the late 1990s, the NRC incorporated “risk-informed” elements into its oversight process. The NRC defines risk-informed as an approach where risk insights, engineering analysis and judgment, and performance history are used to align activities with areas posing greater risk. That decision led to the NRC’s reactor oversight process (ROP) replacing the systematic assessment of licensee performance (SALP) evaluations that had been held less frequently.

The ROP makes use of both inspection information and monitored performance indicators to identify widespread issues rather than just isolated incidents, and it encourages licensees to take action before significant performance degradation occurs. Crosscutting areas, such as human performance, problem identification and resolution, and safety-conscious work environment are considered conceptually related to safety culture. The framework supports seven “cornerstones” reflecting essential safety and safeguard aspects of facility operation (Figure 1).

1. Reactor oversight framework. The Nuclear Regulatory Commission’s (NRC’s) mission is to protect public heath and safety in the use of nuclear power. The framework shown here is used to help it meet that objective. Source: NRC

The ROP action matrix has five columns of increasing oversight. Individual plants are organized in the matrix based on their effectiveness in meeting objectives measured quarterly by performance indicators and inspection findings. Findings are color-coded using green, white, yellow, or red in increasing significance (Figure 2).

2. Facilities are risk-categorized using color-coded indicators. Under the reactor oversight process (ROP), the NRC links regulatory actions to performance criteria. The process uses five levels of response with NRC regulatory review increasing as plant performance declines. Source: NRC

Licensees in column one are subject to the NRC’s baseline inspection program. As licensees move to higher columns, they are subject to supplemental inspections focusing on areas of declining performance including regulatory actions ranging from management meetings up to and including orders for plant shutdown.

The NRC published its definition of a nuclear safety culture in 2011. It said, “The core values and behaviors resulting from a collective commitment by leaders and individuals to emphasize safety over competing goals to ensure protection of people and the environment.” It included nine traits important to a healthy safety culture (Table 2). Stakeholder feedback later identified an additional trait—decision-making—to be of equal importance to the NRC-identified items.

Table 2. Traits of a healthy safety culture. The Nuclear Regulatory Commission (NRC) identified the nine items shown in this table as important traits for developing a positive safety culture. Source: NRC

Assessing Safety Culture

Safety culture is distinct from compliance-based control. To explore the relationship between safety culture and performance indicators, the NRC conducted a survey in 2010 involving 97% of the operating U.S. nuclear plants. General results of the survey, as reported in the article “Exploring the relationship between safety culture and safety performance in U.S. nuclear power operations” published by Safety Science in November 2014, included the following:

■ Organizations where employees perceived less of a questioning attitude were more likely to receive higher numbers of allegations. When employees are more likely to report safety concerns through the allegation program, it may be an indicator that they have less confidence in their internal processes for identifying and resolving safety issues.

■ Fostering a questioning attitude may be a particularly important component of the overall safety culture of an organization.

■ Organizations with lower overall scores were more likely to have higher counts of unplanned scrams, and have inspection findings related to inadequacies in problem identification and resolution.

■ The correlation between safety culture and unplanned scrams seemed to be driven by training quality; and the correlation with problem identification and resolution was related to management’s commitment to safety.

■ Sites with lower scores were likely to receive substantive crosscutting issues, and to be in an elevated oversight condition within the ROP action matrix the following year. Lower scores may indicate problems that are starting to add up, and it is only at future points in time that those problems, if not adequately addressed, require NRC response and movement in the ROP action matrix.

■ The only safety performance measure not significantly correlated with safety culture was the industrial safety accident rate. Accident rates are one of the most commonly used independent measures of safety performance. However, many have noted concerns with using accident rates to represent performance, primarily that accidents may be few and far between and do not capture the frequency of microevents, that is, weak signals, such as near misses or minor incidents that do not meet accident reporting requirements. The industrial safety accident rate seems to be a less-relevant measure of performance to an organization’s safety culture.

There are no established thresholds for determining whether a safety culture is “healthy” or “unhealthy.” However, there are factors mentioned throughout safety literature that contribute to a positive safety culture. Such factors include:

■ Senior management commitment to safety over production

■ Participative management leadership style

■ Shared values and contributions among all organizational levels

■ Multilevel communication to elicit varied viewpoints

■ Regulatory-driven and conservative practices for mitigating defined and undefined hazards

■ Procedural adherence

■ Continuous organizational learning

■ Corrective actions are implemented in a timely manner with minimum extensions

■ Scanning for unintended consequences/worst-case scenarios

■ Suspending assumptions about past activity practices

■ Recognizing ambiguity, because newly emerging safety issues may not be clear

■ Visualizing near-miss situations developing into accidents

■ An environment that rewards safety issue identification

Likewise, many factors have been identified that contribute to a negative safety culture. Some of those include:

■ Failure to include design safety standards or in some cases even incorporating unsafe features

■ Inadequate safety analysis

■ Insufficient attention given to independent safety reviews

■ Operating procedures not founded in safety analysis

■ Inadequate and ineffective internal and external exchange of safety information between groups

■ Inadequate worker understanding of plant safety aspects

■ Insufficient respect for the formal requirements of operational and test procedures

■ An ineffective regulatory regime that is unable to counter production pressures

Turning a Culture Around

In December 2016, Entergy Nuclear Operations Inc. announced its intention to shutter the Palisades nuclear plant permanently on October 1, 2018. The plant (shown in the opening photo of this article) is located in Covert, Mich., on the Lake Michigan shorline. It is expected to continue operating with current staffing levels—about 600 employees—until it suspends operations. The plant will then transition to a decommissioning crew.

In any work environment, a plant closure announcement can be a major disruption, impacting a plant’s safety culture. The management at Palisades would like to avoid such distractions, because it knows how difficult it can be to enact change.

In 2012, the NRC placed the plant under an intensified inspection program following “yellow” and “white” inspection findings. The biggest issue leading to the change in oversight stemmed from an event in which the left train of the plant’s direct-current bus lost power, resulting in a reactor trip in the fall of 2011.

Furthermore, the NRC’s allegation program annual trends report in 2013 indicated that a chilled work environment existed in the plant’s security organization following the termination of some security supervisors. The NRC determined that members of the workforce perceived the terminations as retaliation for the supervisors having raised concerns.

Although it appears the licensee did not recognize the breadth of the condition of the weakening work environment until the NRC brought the problem to its attention, management had independently engaged a third-party investigator to reevaluate its actions regarding the terminations, and it had communicated the results to several concerned individuals. The investigator confirmed that the actions taken against the supervisors were not discriminatory. Nonetheless, in response to the NRC’s observations, the licensee developed an action plan to further address the perceptions of the workforce in the areas of communications, training, process improvements, and monitoring activities.

Following a safety-conscious work environment issue of concern follow-up visit during the last quarter of 2015, no findings were identified. Interviews and a licensee-initiated safety culture survey indicated that most individuals felt free to raise safety or regulatory issues without fear of retaliation. Also, the inspectors did not identify any further indications of a chilled work environment.

The safety culture assessment survey indicated that the culture of the station had improved since the previous assessment conducted approximately three years earlier. Overall, Palisades has seen the number of allegations decrease from 11 in 2013 to two in 2016. Improvements were certainly made, and by the end of 2016, the NRC’s end-of-cycle performance assessment concluded that Palisades’ overall performance preserved public health and safety.

In addition, the NRC determined that performance during the most recent quarter fell within the licensee response column—the highest performance category of the NRC’s ROP action matrix—because all inspection findings had very low safety significance and all performance indicators were within expected ranges. Thus, Palisades elicited the lowest level of regulatory scrutiny and only regular baseline inspections are required.

Palisades has demonstrated how a facility can refocus its efforts on maintaining the health and safety of the public as its number one priority, with the expectation for all employees to embrace the Institute of Nuclear Power Operations’ traits of a healthy nuclear safety culture. Palisades’ employees chose the theme “Palisades Proud—Excellent to Elite” as a philosophy adopted for the final months of operation.

Its peers currently regard Palisades as an excellent plant, but its employees are striving to finish with elite status. The idea is that excellent individuals and organizations have great success, but sometimes stop short of their full potential. The elite are constantly driven to achieve that next goal with extraordinary results. Over the next 18 months, Palisades hopes that by conducting successful operations and supporting its employees through the upcoming transition, standard metrics will confirm that it is an elite organization. ■

—James M. Hylko (JHylko1@msn.com) specializes in safety, quality, and emergency management issues and is a frequent contributor to POWER.