Brazil-U.S. Workshop on Strengthening the Culture of Nuclear Safety and Security: Summary of a Workshop (2015)

Below is the uncorrected machine-read text of this chapter, intended to provide our own search engines and external engines with highly rich, chapter-representative searchable text of each book. Because it is UNCORRECTED material, please consider the following text as a useful but insufficient proxy for the authoritative book pages.

I The Relationship Between Safety Culture and Security Culture The first session of the conference covered the relationship between safety culture and security culture from the perspective of the synergy between them, the regulation to support both, and the (undesirable) side effects of new technol- ogies. Dr. Salati moderated a panel that consisted of Dr. Michael L. Corradini, Mr. Luiz Fernando Bloomfield Torres, Mr. William Tobey, and Dr. Claudio Almeida. Why a Safety Culture Matters – Michael Corradini, University of Wisconsin Dr. Corradini began the panel by presenting an overview of why safety culture matters. He started the discussion by talking about engineering safety in general. Engineering safety is an integral part of any sort of system design. However, there are a number of safety levels. Firstly, the system has to embed safety in its basic design. Secondly, the system operation has to strive for high reliability, such that if a reliable system is operating as designed, safety has been automatically integrated and is considered, and components work well together. All systems also have to think about “off-normal” events. The aeronautical in- dustry is a good way to illustrate to a wide audience how to think about safety. The first leg of Dr. Corradini’s flight to São Paulo was on a two-engine passenger jet, designed and built by Embraer, the Brazilian aviation company. An off-normal event for this aircraft would be an event where something goes wrong with one engine, but there is no failure because of the two-engine system design. A twin engine plane is a robust system engineered to account for rare events. Nuclear facilities have adopted the concept of defense-in-depth. The purpose of defense-in-depth is to create multiple diverse and redundant layers of defense, hopefully as independent as possible, so that you can protect against accidents and threats if one level of defense—one barrier for radioactive re- lease—is defeated. Dr. Corradini said: 7 

8 Brazil-U.S. Workshop on Strengthening the Culture of Nuclear Safety and Security “But the thing that people tend to forget is that risk analysis, that is, the concept of what can go wrong and the frequency of things going wrong, is inherently part of defense-in-depth, because if you think of defense-in- depth without risk analysis, you always can come up with an additional barrier. But, as you do that, the probability, the frequency of it happening gets smaller and smaller. So, eventually, you have to come to a decision as to what is safe enough and risk analysis is the only method to think that through.” In nuclear power operation, operational safety is the first tool that plant owners and operators have to minimize incidents and improve reliability. In the United States, the Institute of Nuclear Power Operations (INPO) uses this as a metric to think about things, look at the root cause of what would be reportable events, and prevent future events by improving maintenance and operation pro- cedures and continued and credible responsible regulation by the U.S. Nuclear Regulatory Commission (NRC). Not only does the plant operator review and report the events and try to keep the number of unanticipated events to a mini- mum, but these become elements of reliable and responsible regulation. There is always a focus on early detection of generic safety issues. If a problem arises at one institution and one installation, and it continues at others, there should be an integrated approach in the industry to address these generic issues. In the United States, many of the more than 100 reactors have just gone through their 40-year license renewal or are in the process of either going into license renewal or asking for license renewal for another 20 years. A key safety issue that is assessed is material age, whether it be concrete structures, steel structures, electrical cabling, or systems. Dr. Corradini also discussed measuring safety performance. In the United States, safety is measured quantitatively, whether by the industry and INPO, the first-line of operators at the operating plants, or the NRC. This is a risk-informed oversight process. Risk analysis helps to categorize events and find out what is important based on not only the event but also its potential frequency of occur- rence. Seeing more adverse events indicates that operators are getting into a re- gion that requires improvement. The NRC uses quantitative performance indica- tors, an inspection program, and an enforcement program that is geared toward safety significance. It is very important that it is a combination of not only ob- serving the events and trying to understand their root causes but also intervening by working with the operator if something potentially dangerous becomes too frequent. Performance indicators should dictate a level of regulatory oversight beyond the baseline program. When people talk about nuclear safety defense-in-depth, they always think about physical barriers, such as containment, a vessel, or fuel rods. Dr. Corradini stated that good defense-in-depth actually goes into the human element of nu- clear safety (see Figure 1-1). This is probably the most important part. First, we need to continuously improve engineering: simpler designs, better instrumenta- tion, more robust materials for harsh environments, which will not require re- 

The Relationship Between Safety Culture and Security Culture 9 placing or changing out materials that are aging. Next, we need reliable opera- tion. Safety is foremost in all of these and it includes culture. Culture means “do it right,” and doing it right means that at times we are going to have to shut something down and reduce performance so that we can understand a safety issue better. Dr. Corradini brought up the necessity of credible regulation. It is not just having a good design or operating that design reliably and safely. We also need a third party, a different individual or a different organization, that reports to the public and openly communicates on safety performance. If the safety perfor- mance does not meet expectations, then this third party intervenes. It is im- portant that the public be able to look at the regulator, look at almost everything the regulator is looking at, and come to some of their own judgments. We need top-notch people to continue to be part of these organizations, explained Dr. Corradini. He presented definitions of safety culture, noting that the International Atomic Energy Agency (IAEA) and the U.S. NRC definitions are similar. Fun- damentally safety culture is a set of core values and behaviors that result in a collective commitment by the leaders and the workers to emphasize safety over other goals. We cannot help but realize that performance is key. If an operating plant has to produce electricity for the utility, the industry, and the public, that is clearly a performance goal. But, if something is not going as expected, safety has to take precedence. Human Defense-in-Depth Recruit and retain top-notch people for all sectors FIGURE 1-1 Human defense-in-depth model. 

10 Brazil-U.S. Workshop on Strengthening the Culture of Nuclear Safety and Security Dr. Corradini made several statements to stimulate discussion. Firstly, im- provements to safety and effectiveness falter through efforts to overly prescribe correct behavior. It is not always clear that there is an exactly correct behavior, and rigid scoring systems can be counterproductive. He posed that as a question because there is a diversity of views. Secondly, we need to emphasize thinking and safety awareness over scorecards and metrics that can induce complacency and compliance. Sometimes the measures are right, but the awareness and robust thinking process is not there, which is not a proper safety culture. Thirdly, quali- tative evidence suggests that there are cultural traits that lead to improvements in safety. It is not clear whether we can measure them or not, but, clearly, there is qualitative evidence. And finally, culture cannot be legislated, but is actually seen. That culture among organizations and utilities with different leadership, and how they emphasize safety within performance, goes a long way to improve and actually maintain safety culture. Nuclear Security Culture – William Tobey, Harvard University Mr. Tobey’s presentation covered factors influencing nuclear security cul- ture, the definition of good nuclear security culture, and practical examples. He drew on the World Institute for Nuclear Security (WINS) 1 “best practices” for nuclear security culture. He qualified that best practices are provisional: They are the best that can be done at a given time or place. In fact, they will almost certainly be superseded by better ideas as both offensive and defensive capabili- ties improve. Also they are an invitation to dialog to improve those practices through sharing. Mr. Tobey discussed the IAEA's definition of security culture: “the as- sembly of characteristics, attitudes, and behaviors of individuals, organizations, and institutions which serve as a means to support and enhance nuclear securi- ty.” Nuclear security culture is important because a good or bad culture can make systems that are in place more or less effective. A robust nuclear security culture and sense of professional responsibility are necessary for effective im- plementation of the procedures, which are developed and, in some cases, man- dated by regulation. A poor culture can undermine those practices and regula- tions. The factors influencing nuclear security culture can be divided into three basic categories: the beliefs, the principles, and the values held by an organiza- tion, usually set by the highest leadership. These key components are implemented through characteristics of behav- ior and realization within the organization. Critical to security culture are the beliefs that credible threats exist, that nuclear security plays a vital role to the success of the organization, that a strong security culture is essential, and that 1 See https://www.wins.org/. 

The Relationship Between Safety Culture and Security Culture 11 independent oversight strengthens security—it is not simply a nuisance. An or- ganization also must demonstrate value learning. Mr. Tobey explained that security is everyone’s responsibility, not only the chief executive officer (CEO) or the security guards. Ongoing effective secu- rity training is essential, and teamwork is important. Important characteristics include leadership and motivation, accountability, professionalism and compe- tence, integration of security within the operations, and learning and improve- ment. Most important is what an organization actually does—what policies, roles, responsibilities, and operating procedures are put into place, and what communication tools, leadership, and learning are used in the implementation of good security culture. Good security culture is made up of 10 factors, Mr. Tobey said: 1. A commitment is seen at the top of the organization and in publicly available policies and statements about the importance of security to the organization. 2. Good security is implemented because it is important, not simply be- cause it is required by regulators. 3. There is a senior committee of directors that reviews the security pro- gram and performance measures. 4. Security is given the same priority as safety. 5. Good security is seen as everyone's responsibility throughout the or- ganization. All employees and contractors understand their role to make security effective. 6. There are good and open relationships with the police and joint, prac- tical exercises conducted that demonstrate the effectiveness of securi- ty. 7. Security problems are reported honestly, so that lessons can be learned. This is particularly challenging in that security is a law enforcement is- sue. 8. Surveys are conducted to assess the security culture. 9. Costs are fully understood, and improvements in effectiveness are sought continuously: How can we do this better and more efficiently? 10. The security department is respected and seen as an important part of the management team. Analysis of effective nuclear security culture has to be empirically based and has to depend on practical experience of operators. If it does not, it will be essentially dissociated from those operations and therefore less effective. In sum, a good security culture establishes the corporate strategy and ensures that governance arrangements are in place to explain and enforce that culture. It en- sures that there are cross-functional lines within the organization, that there is a comprehensive program, and that there are metrics to establish both successes and failures in order to learn from them and to improve the organization. 

12 Brazil-U.S. Workshop on Strengthening the Culture of Nuclear Safety and Security The mission statement of WINS is to provide those who are accountable for nuclear security with a forum to share and promote best security practice. The organization has produced 32 international Best Practice Guides, held 51 workshops, and published its guides in 10 languages. The guides are empirically based and are meant to be practical for actual operators. It exists at the intersec- tion of nuclear security and safety culture. Safety culture is well understood, well developed, and largely successful. An aspiration for those who work on nuclear security culture would be that the culture become just as well under- stood, well developed, and largely successful. He hoped that the two could be considered together. Safety and Security Culture from a Regulatory Perspective – Claudio Almeida, Comissão Nacional de Energia Nuclear (CNEN, National Nuclear Energy Commission) Dr. Almeida covered several topics. He spent 14 years at the IAEA, and helped develop safety and security culture there. He shared some of the history about safety culture and how security culture was developed and presented the perspective of the regulatory bodies, especially the position of CNEN with re- spect to safety culture. He began by detailing the origin of the concept of safety culture in the nu- clear industry. He noted that the Chernobyl Report is widely known to be where the nuclear community worked on safety culture for the first time. This is where the IAEA first started addressing safety culture and the difficulties of improving this culture. People believed that the nuclear energy industry was the first to use the safety culture concept, but that the word was used before. The Bhopal acci- dent at Union Carbide in India occurred before Chernobyl and was a toxic dis- persion of methyl isocyanate gas from a Union Carbide plant, killing many and still causing problems today. The first time the term safety culture appeared was in a 1985 evaluation seminar about the cause of this disaster. The report issued concluded that the plant lacked a culture of safety. The lesson is that safety in one place does not necessarily mean safety in others, as in this case a multina- tional corporation did not follow the safety culture of the home country while operating abroad. On April 26, 1986, 1 year after this Bhopal seminar, the Cher- nobyl accident occurred. An internal group from the IAEA put together a report on the Chernobyl accident. This document talks about the lack of safety culture, claiming the first mention of the term. This lack of safety culture prompted the IAEA International Nuclear Safe- ty Group (INSAG) to highlight safety culture as one of the critical principles in nuclear installations. When INSAG put together a second report on the Cherno- byl accident, the report corrected mistakes from the first report, which analyzed the consequences of the accident, but not the accident itself. And in 1992, INSAG made a further correction to the report, showing that design aspects con- tributed significantly to the accident. 

The Relationship Between Safety Culture and Security Culture 13 Around this time, safety culture started to be discussed in many IAEA documents, especially from INSAG. But, internally the agency started asking, What does safety culture really mean? What does it describe? An April 1998 document that Dr. Almeida put together about safety culture asks, “How can one practically identify the existence of a ‘safety culture’?” Is safety culture an at- tribute of the plant, of the management, of the operating organization, of a coun- try, of each individual, or all of the above? Are there different levels of safety culture in plants? And how could we assess the safety culture of a plant, a coun- try, or an individual? Could one define safety culture indicators? And if so, are those different from the safety indicators that the agency had developed at that time? Are the INSAG safety principles required for a safety culture? Is there a single safety culture for siting, design, construction, and operation, or different safety cultures in operation, siting, and design? Would an effective implementa- tion of all the quality assurance requirements, such as the definition of responsi- bilities, training, qualification, and accountability, be sufficient for the existence of a safety culture? Is the Operational Safety Review Team (OSART) method- ology capable of identifying the existence of a safety culture or lack thereof? Could a regulatory body lack a safety culture? Dr. Almeida stated that at the time many on the IAEA staff working in safety recognized that we cannot measure safety culture. For a sense of the per- spective at that time, as IAEA staff members were discussing these documents, they were also discussing INSAG reports and the Nuclear Safety Standards (NUSS), which were documents prepared by a group of consultants. The docu- ments were prepared and published without international review. Others at the IAEA thought that INSAG did not have detailed knowledge or perspective and that the safety culture documents only covered past practices, and were not be- ing incorporated into best practices. Interestingly, although these documents describe what a safety culture is, they were not able to identify the criteria to determine whether an organization or facility has one. So, these documents are a list of questions without answers. They should be asked, but are not definite determinants of a good safety culture. An example is the question, “Do you have a resident inspector in the plant?” Some answer yes, and this is good, and others no, but this can be okay, too, in the right circumstances. So many questions in INSAG 4 do not have a right or wrong answer. He stated that the same phenomenon occurs in security culture. It is not addressed in the NUSS documents, nor in the IAEA Safety Standards. The IAEA Safety Standards today mention the physical security of fissile materials and radioactive materials of nuclear power plants where appropriate, but it is not treated in detail with supplements in the IAEA Safety Standards or agency doc- uments addressing security. At the Convention on Nuclear Safety, the gathering of experts in nuclear safety, the Review Meeting of 2002 directly followed the 9/11 terrorist attacks, and there is one statement in the Review Meeting Sum- mary that says, “In light of the events of 11 September 2001, the issue of assur- ing the security of nuclear installations from terrorist attacks was a matter of 

14 Brazil-U.S. Workshop on Strengthening the Culture of Nuclear Safety and Security significant concern to contracting parties.” However, noting that security and physical protection matters do not lie within the scope of the Convention, do not relate to safety, and do not readily allow for meaningful discussion in the current forum due to the sensitivity of the information involved, the Review Meeting decided to exclude consideration of these issues from the scope of the Country Group Sessions. 2 Contracting parties were to address these issues in other ap- propriate international fora or in bilateral consultation. This justification is used to separate safety and security culture. The safety professionals recognized that there are synergies and interfaces between security and safety, but for a long time refused to combine the two. Amidst pressure, particularly from the United States, to amend statements to include security, more and more agencies started to build on security meth- ods. First, in 2006 the IAEA issued guidelines on border monitoring equipment. Next, in 2007 the IAEA issued documents on combating illicit trafficking of nuclear and other radioactive material. Then, in 2008, for the first time, security culture was mentioned in a document stating the objective and essential ele- ments of a state’s nuclear security regime. The definition shown by Mr. Tobey was issued in 2013. The challenges encountered in developing guidance on safe- ty culture persist here. The current regulatory perspective is that safety and secu- rity can be regulated, but safety culture and security culture cannot, because they depend on behaviors. Instead, they can be assessed. CNEN does not have specific regulations about safety culture. CNEN monitors safety culture by the way that resident inspectors observe plant behav- ior, by analysis of operational experience and daily events, and by performance indicators. Safety culture is not mentioned explicitly in CNEN licenses. Opera- tional safety regulations require that the management of power plants consider safety culture, but they do not define or specify requirements or implementation details. CNEN has developed safety culture principles and conducted seminars with the help of IAEA, but it does not have specific requirements. In conclusion, Almeida said, defining safety culture or security culture is not the solution to the problem, but just the beginning. The regulatory body and the operator have to ensure that these ideas are a commitment of the organiza- tion and permeate throughout the staff. But CNEN does not intend to measure, monitor, or make requirements for safety or security culture as a rule. 2 In order to expedite reviews of National Reports, the Convention stipulates organiza- tion of the Review Meeting into Country Groups. These groups are not limited by geo- graphical area and should contain Contracting Parties with equivalent expertise in the management of spent fuel and radioactive waste. Country Group Sessions discuss each country’s National Report, beginning with a presentation on the report and followed by questions and discussion. (Available at https://www.iaea.org/sites/default/files/publica tions/documents/infcircs/2002/infcirc603.pdf.) 

The Relationship Between Safety Culture and Security Culture 15 DISCUSSION Dr. Barroso began the discussion with Dr. Corradini’s concept of human defense-in-depth, which dealt with reliable cooperation, engineering, improved engineering, and mainly credible regulation open to the public. He asked Dr. Corradini to expound further, if possible with an example, on credible regula- tions based on risk assessment and how people should be granted access to in- formation. Dr. Corradini discussed a couple of examples, including the corrosion in- cident and near accident at Davis-Besse Nuclear Power Station in the United States. The operator postponed the replacement until a future refueling outage when, on March 5, 2002, a football-sized pit was discovered in the vessel head of the Davis-Besse reactor. It was a result of unmanaged corrosion. Before the event there was a focus on the corrosion issues on the reactor vessel head, with the replacement of the vessel head identified as the best option to assure reliabil- ity. The incident was an indication that Davis-Besse was missing the roots of safety culture, because the utility allowed the operation to continue knowing that they did not understand the root cause of the problem until it became a very pub- lic matter. Any of three independent groups should have prevented this, and eventually the regulatory agency and the Institute of Nuclear Power Operations came in to hold people accountable. At least in the United States, if it is not a public discussion, the public immediately starts thinking that something is being hidden. All of the interactions among the designer, the operator, and the regula- tor have to be in the public eye. Another quick example is spent fuel pool storage and potential disposition of where spent fuel should be stored—in wet pools or in dry cask storage. There is a current debate in the United States about design and operation, as well as where waste should be stored. All of this discussion has to be done in the open, questions have to be asked as to whether the current designs are safe and how safe they are. The regulator has looked at calculations and studies and made some decisions. This issue will be debated continually because there is still a concern about how security measures could affect the safety of spent fuel pools. One of the speakers raised the point that the Portuguese language has a single word, segurança, for “security” and “safety.” This causes confusion in some circumstances. This is common to several languages. In the nuclear envi- ronment it is useful to separate these two terms to avoid confusion. In Portu- guese, physical protection is used as a substitute for “security.” All three presentations mentioned the interfaces and synergy between these two concepts. The speaker put forth his view that the security and safety approach is focused on a single threat. When we talk about safety, we are trying to protect the installation from several different threats, from all kinds of sources, such as from external natural sources. There are external threats that are human as well, and security deals with this specific niche. He expressed a small concern about separating these two concepts, as they are separate more because 

16 Brazil-U.S. Workshop on Strengthening the Culture of Nuclear Safety and Security of politics than because of techniques. He called for further discussion on the interaction of these two concepts. Dr. Salati suggested that this difference among safety, nuclear safety, and nuclear security is an older concept that has been enriched with newer approach- es. Physical protection or security some time ago was more focused on protect- ing the installation, and the concept encompasses more aspects. It may be a little bit closer to the word safety. He asked the presenters for more depth on these concepts. Dr. Corradini said that while protecting against human attack can be re- garded as a niche element of the overall responsibility for the safety of an instal- lation, there is at least one important difference: In many respects, safety judg- ment is based on preventing against the combined probability of multiple actions occurring at the same time. For example, if one looks at the Fukushima accident, several things, all of which were expected to be very rare occurrences, went wrong simultaneously. In the security realm, would-be terrorists do not respect the laws of combined probability; they attempt to defeat them by design. There- fore, while robust safety measures can help prevent against security problems, they are probably not sufficient. Because the chance of a human threat or human intervention is the key as- pect of security, analysts would look at what the risk world would term common mode failures multiple safety measure that can be compromised by a single event. The concern right now is not that there is inadequate spent fuel safety because of extreme external events, an imprecise design, or some sort of internal event. Rather, this safety may be inadequate because of the potential for human intervention. To even think about that, we have to think about it from a risk per- spective. There will always be some residual risk that we have to accept. We cannot protect against everything. Dr. Almeida expressed tensions arising between security and safety. For instance, in the interests of safety, a facility should allow easy access in an emergency, while security interests might be best served by controlling and ex- cluding most access. In addition, from a safety perspective, a facility would want to limit the number of people entering a central area with a high radiation field. But, from a security point of view, that facility would demand as much supervision as possible to ensure nothing is sabotaged. This competition be- tween safety and security means one has to be very careful about selecting pro- cedures that fulfill the requirements for both. This tension becomes pronounced in the realm of public information as well. While we strive for openness and transparency in safety, in security we often require secrecy. Just after 9/11 the latitude and longitude of nuclear power plants were removed from the public information domain. There is a very fine line between public information for safety measures and secrecy for security measures, and it is difficult to manage these sometimes contradictory commitments. Dr. Lowenthal asked a question about measurements and indicators men- tioned in several of the talks and how one goes beyond checklists alone when measuring safety culture or security culture. As Dr. Almeida mentioned, an of- 

The Relationship Between Safety Culture and Security Culture 17 fice could have a mission of quality assurance, but that does not mean that there is a culture of quality within the organization. So, how does an organization get beyond just a checklist of: “Do you have this, yes or no?” Mr. Tobey relayed his experience on an accreditation board for INPO, where utility executives and their staffs would discuss training. There would be interesting connections among measures, such as the U.S. NRC’s Reactor Oper- ational Performance Measures and INPO’s own set of measures. For a plant with a lot of unanticipated SCRAMs (emergency reactor core shutdowns), an apparently larger amount of radiation dose per unit or per capita for the workers, and a lot of corrective actions, one starts to wonder whether the management sees the importance of a cross-cutting emphasis on safety. For INPO, that trig- gers another visit. For the U.S. NRC, the response would be similar. Even without a direct measure, if the U.S. NRC senses cross-cutting issues and behavior associated with a number of unaddressed corrective actions, there might be reportable per- formance measures that would take them from, in the U.S. world, green to white to yellow. A qualitative sense of a cross-cutting issue will trigger a visit by the U.S. NRC as part of their inspections and a conversation with the leadership will be necessary. Dr. Almeida stated that the definition of safety culture is a question with- out answers and evidence. The most important elements for managers and regu- lators are • To instill a questioning attitude in their staff so that whatever they do, before doing it, they question, Why are we doing it? Are we doing it the right way? • To maintain a good record, as was mentioned, but what next? • To realize that excellence is not only fulfilling minimum requirements, but trying to do better. Dr. Corradini drew an analogy with a checklist as bricks in a wall, and cul- ture as the mortar that holds the bricks together. Strong mortar comes from lead- ership by management and responsibility by implementers. Both the leadership and the sense of responsibility have to pervade every corner of an organization. General Alston asked about the ability to measure safety and security, but not safety culture and security culture. He postulated that the next Chernobyl- type disaster would have a summary assessment on whether its cause was prin- cipally a safety failure or a security failure; that words in that next failure report would point toward a summary appraisal of safety culture or security culture. So as difficult as it may be to measure the strength of the mortar, it seems that it is a worthwhile pursuit. It is difficult in the way that we have created the regulation apparatus and the objective assessments to see the empirical evidence to justify the evaluation. It seems that much more work needs to be done to actually be able to measure the culture strength of the organization. And it is right and prop- 

18 Brazil-U.S. Workshop on Strengthening the Culture of Nuclear Safety and Security er to do so, as that next failure report will describe a failure in safety culture or security culture. He inquired as to whether in the continuum of intellectual de- velopment for evaluating cultural readiness, we are in the early stages and have a long way to go or we ought not to put energy here into expanding or develop- ing our regulatory competencies. The discussion then shifted to value judgements about culture and distinc- tions between national or ethnical culture and corporate safety and security cul- ture. Dr. Torres began by disagreeing with the idea that cultures can be better or worse. They can only be different. Bach is not more culturally advanced than a drum song of an African tribe, he said. They are different. In this sense, it is difficult to measure. After the buzzword safety culture appeared, there was a group that developed the Assessment of Safety Culture in Organizations Team (ASCOT) service, which was similar to the Operational Safety Review Team. The OSART examines facility operation. Now there is the Integrated Regulatory Review Service, which is similar to regulators. There was also a group that cre- ated ASCOT, which was supposed to be a team that examined and assessed fa- cility safety culture. They developed guidelines on how to do it, based on the INSAG 4 documents and the characteristics and the questions without answers. Then they produced several seminars where they said to countries, “This is what we can do for you. We can assess your culture.” No nations accept it. Nobody accepts that someone can come and look at their culture and try to compare it with another, so that one is better than the other, Dr. Torres said. Since we cannot compare cultures, Dr. Torres argued, individual’s cultures must use characteristics, do self-assessments, know themselves, and ask the questions. They must compare their cultures with the whole culture of the coun- try, including engineering and safety and fire protection and security. But it is not possible to measure the culture or to compare safety cultures, Dr. Torres concluded. Dr. Haber stated a preference for discussing understanding a culture, as opposed to measuring it. We are not actually measuring the culture, she said, but trying to understand the community outcomes or safety and security perfor- mance aspects of the culture. We understand the culture through the behaviors that we observe and measure. In Brazil, self-assessments of safety culture using the IAEA as the guide have been successful. 3 But she does not think they would pretend to say that they are measuring culture. Rather, they would say that they 3 In the late 1990s and early 2000s, Brazil undertook efforts to determine safety culture traits and characteristics and to remedy deficiencies at the nuclear utility Eletronuclear and at the fuel cycle facilities of Industrias Nucleares do Brasil (INB). This was done with the assistance of the IAEA by conducting safety culture self-assessments in both companies. Results of these projects were discussed extensively at the IAEA Internation- al Conference on Safety Culture in Nuclear Installations (Rio de Janeiro, Brazil, Decem- ber 2002). 

The Relationship Between Safety Culture and Security Culture 19 are helping the organization understand the behaviors that drive that perfor- mance that results in safety or security. Mr. Tobey noted that the beliefs and principles that guide an organization are typically set by the most senior management. The practices for how to im- plement them occur at the middle-management level. And finally, what actually happens because of the actions of the majority of the employees is very im- portant. He argued that we should not confuse national cultures and security and safety culture. Nations can have different cultures and have features in common with both their safety and security cultures. And by the same token, it is possible that not all security cultures are equal. Some are more successful than others. It is also possible for a security culture to fail. The reviewers of the recent failure at the U.S. Y-12 National Security Complex concluded that the culture had allowed peo- ple to tolerate the intolerable. 4 There were multiple false alarms that came to be ignored by guards and a subsequent revelation of cheating on internal assessments. Those are attributes of a failed culture. While nations may differ in their emphasis on ideas such as the use of humans versus technology to advance security, it is important that whatever culture is in place be a successful one. Dr. Barroso said that it is unfortunate that there was not IAEA ASCOT ac- tion in Brazil. It would be valuable to make longitudinal observations and cross- cutting quantitative research comparing groups. Regardless of the type of as- sessment, it can be repeated in the future to track progress on the characteristics that are identified. Safety culture might not have been created by the IAEA, but it is the term that the agency emphasized greatly in general conferences, guidelines, and rec- ommendations. The nuclear area has been left very far behind. It may not be appropriate to talk about measuring culture, but we need to have good instru- ments to assess. The medical field is far more advanced, Dr. Barroso said. They have validated instruments. The nuclear field does not, and IAEA work is not validated statistically. This does not mean that it is wrong, and there are other ways to evaluate and assess culture for this type of mission. The observation and ethnographic studies of people interacting are very important. For the last 5 years, Dr. Barroso has been trying to use the type of statistics normally applied to social sciences to deal with this aspect. When you have a quantitative instru- ment, it can be standardized and adapted to different cultures, Dr. Barroso said. Dr. Salati said we cannot measure safety culture, but we can measure re- sults, and results are achieved through different indicators that can be assessed. Maybe the culture can be assessed indirectly through the performance indicators for the facility. He mentioned the idea he posed earlier on the interferences be- tween safety and security, when looking at the culture. Safety culture is based on transparency and openness, and very much on internal, bottom-up discussions. But security culture or physical safety is the opposite. It is based on 4 The Y-12 security failure is described in Chapter 5. 

20 Brazil-U.S. Workshop on Strengthening the Culture of Nuclear Safety and Security “closedness.” It is not transparent. It tries to be as hidden as possible. It is al- ways top-down. It is traditionally not very adapted or adaptable to discussions. So, the question is, how can we combine these characteristics from safety and the security characteristics, how can we combine them both? Mr. Tobey agreed that it would be a mistake to underplay the differences. At a certain level, secrecy has to be maintained to have good security, and that is dif- ferent from his understanding of safety. On the other hand, he stated that there are ways in which the two realms can learn from each other. For example, with re- spect to the idea that security must be top-down, that is actually a potential prob- lem because it may be that those in the field will have ideas either how to imple- ment more effective security for a given cost or to implement the same level of security at a lower cost. We have learned those lessons in the safety realm, and there can be some sharing between the two. Mr. Tobey highlighted the importance of Dr. Torres’s comment on self-assessment. Effective cultures practice self- assessment, and that is a way in which we can both resolve some of the differences between those two realms and the difficulties in measuring culture. Dr. Corradini stated his view that there are two spheres of influence. Secu- rity has a sphere of influence, safety has a sphere of influence, and there are in- teraction points. One interaction point after the terrorist attacks in the United States on September 11, 2001, was that human interventions in a nuclear power plant had to be considered. In the United States, Section B.5.b of the Interim Compensatory Measures Order (U.S. NRC Order EA-02-026, February 25, 2002) dealt with nuclear power plant protection after 9/11. We can have all the attributes of safety within a security framework. In Section B.5.b, the questions are loss of large areas of a plant due to causes of large fires and explosions. As long as the audience is appropriate, we can have a very open and vigorous dis- cussion about what is good, what is bad, what works, and what does not work under that framework. All the elements of safety, where a technical discussion is necessary can be conducted openly. Such a discussion can be shared across cultures and across nations, if they are interested. When this discussion began within the Advisory Committee on Reactor Safeguards of the Nuclear Regulatory Commission, there were questions and they received information about what was happening in France and in other countries. Dr. Corradini believes information sharing can be accomplished, and where these realms intersect, as long as the audience is ap- propriate, good discussion and the positive attributes of safety are possible.