Brazil-U.S. Workshop on Strengthening the Culture of Nuclear Safety and Security: Summary of a Workshop (2015)

Below is the uncorrected machine-read text of this chapter, intended to provide our own search engines and external engines with highly rich, chapter-representative searchable text of each book. Because it is UNCORRECTED material, please consider the following text as a useful but insufficient proxy for the authoritative book pages.

IV Training and Education for Safety and Security Culture The fourth session at the conference covered training and education for safety and security culture—training for culture as distinct from procedure. The session included presentations from Alan Hanson, Robert Bari, and Filomena Ricco, and was moderated by Michael O’Brien. Teaching Safety and Security Cultures – Alan Hanson, Massachusetts Institute of Technology Mr. Hanson began by asking the audience two questions: How many knew the location of the emergency exits for the auditorium, and how many examined the fire instructions on the back of the door in their hotel room. When in a new environment, one of the first things you should do from a safety point of view is be aware of where you are and be aware of how you get out if you need to. This is what it means to be safety conscious. In industry in the United States, every meeting starts with a safety message, such as the one just delivered. The point of this practice is not only to get the message across but to make it very clear to everyone that safety is the first priority. Mr. Hanson recommended that the Insti- tuto de Pesquisas Energéticas e Nucleares (IPEN, the Institute of Nuclear and Energy Research)and other organizations around the world consider a similar practice. Mr. Hanson focused his talk primarily on safety and mentioned that, at the university level, teaching security is difficult. Universities are by their nature open environments, whereas security requires a potentially incompatible level of secrecy. Mr. Hanson described the often-missed distinction between training and education. Training requires that in response to a known stimulus you get an expected response. You can train dogs, parrots, elephants, and seals. Education is different in that it involves applying knowledge to devise a solution. He chose to discuss education rather than training. 43 

44 Brazil-U.S. Workshop on Strengthening the Culture of Nuclear Safety and Security One purpose of education is to inculcate fundamental principles so that the individual later makes the proper decision when confronted with a new situation. Inculcation means that through a process of repetition, admonition, and practice you press an idea into your mind so as to make the right decisions. That is one of the reasons to repeat safety messages, because it keeps safety in the forefront of one’s thoughts. Until recently, university engineering programs offered no classes focused on security and no discussion whatsoever on safety education. These issues were not important at that time. Their education was focused on technology and creat- ing exceptional engineers, and it was only by accident or by later experience that engineering programs were introduced to important societal issues. Today though, the Massachusetts Institute of Technology (MIT) mission statement has a focus on the imperative of public debate and humane uses of technology. Mr. Hanson said that the MIT Department of Nuclear Science and Engi- neering is built on three focus areas: (1) science, which consists of basic science, such as physics and radiation science; (2) systems and engineering, such as thermodynamics and heat transfer; and now, (3) society. The addition of that third leg distinguishes the department at MIT, and the society category is being built into the curriculum by recruiting new faculty and students specifically in this area. It is an important part of the future of nuclear education. Mr. Hanson then described the executive education programs he leads at MIT. MIT offers a 1-week Nuclear Plant Safety Course that has been running annually for more than 50 years. Members of IPEN have attended this particular course, including two last year. MIT also partners with the Institute of Nuclear Power Operations (INPO) to educate senior executives within the nuclear com- munity in the United States through their joint Reactor Technology Course for Utility Executives. This 3-week, intensive course on what it means to be a nu- clear executive has been offered for 23 years and is aimed at new executives moving into higher positions in the nuclear industry. Often, course participants come from legal and finance departments or from general management and without a nuclear or engineering background are asked to manage technology they are not trained in. MIT organizes the Emirates Nuclear Energy Corporation executives pro- gram, a 2-week course created at the request of the United Arab Emirates that is based on the course for U.S. utility executives. MIT also offers the International Nuclear Leadership Education Program, designed for participants in countries recently involved in nuclear energy, with most students coming from developing countries in the Middle East, Africa, and South Asia that are starting nuclear programs. It is not unusual for a country interested in developing a nuclear energy program to designate a university physics professor to make the nuclear power program work. That individual may not understand the large difference between physics and engineering, and especially the large infrastructure issues associated with creating a nuclear power program. MIT hosts these senior leaders in the United States for a 3-week intensive program on nuclear energy, taught by out- 

Training and Education for Safety and Security Culture 45 standing subject-matter experts. The course covers the entire range of setting up a nuclear power program, from the basic technology to how to create nuclear infrastructure, how to create a legal framework, how to meet nonproliferation norms, and how to provide physical protection for materials and facilities. This program came about after the Fukushima disaster, which made some but not all countries reconsider nuclear power. We all have a common interest that new nuclear states “do nuclear right” or make an informed decision to not go down that path. Even as a proponent of nuclear power, Mr. Hanson stated that not every country in the world should be developing nuclear power. The focus is to bring leaders from these countries into the nuclear world to talk about safety and security. MIT’s goal is to provide education and training in governance structures and business strategies to develop successful, safe, and secure programs. The program is in its second year and has been largely suc- cessful, cooperating with the International Atomic Energy Agency (IAEA) to bring not just academics but also practitioners to the course. University profes- sors teach nuclear physics, but the practitioners with real-world experience are invaluable for teaching nuclear leadership and security. The course reinforces the lessons in several ways, beginning sessions with regular safety messages like the one delivered at the outset of Mr. Hanson’s presentation. These messages might come from Mr. Hanson and an INPO repre- sentative on the first and second days of the course, followed by participants delivering the daily safety messages on remaining days. This practice of involv- ing the students builds thinking about safety into their regular thought processes. The course also distributes useful teaching documents like the INPO Pocket Guide, “Traits of a Healthy Nuclear Safety Culture.” 1 Finally, the course creates a number of active role-playing case studies that detail real accidents that oc- curred in the United States and elsewhere. To encourage spontaneous thought processes, many scenarios detail historic and somewhat obscure incidents so that the participants do not already know the outcome. Experts run a tabletop exer- cise with participants playing their specific roles, and then compare the response of the participants to the actual accident. It is a learning tool that could be repli- cated in other places in the world. The course concludes with a quiz to assess the quality of learning. Mr. Hanson closed by saying that the most important aspect of safety and security are the people involved. After the courses, students are asked what is most important when constructing a regulatory regime: independence, transpar- ency, or a dedication to safety above all. If at the end of the course, the students do not select a dedication to safety, then the course has failed. The course also asks who in a nuclear organization has the primary responsibility for safety, and there are two good answers: the leader and everybody. The focus of the course and the focus of the department at MIT has shifted dramatically from when it was just teaching technology in the “technosocial” 1 Available at http://pbadupws.nrc.gov/docs/ML1303/ML13031A707.pdf. 

46 Brazil-U.S. Workshop on Strengthening the Culture of Nuclear Safety and Security areas of safety and security. A unique feature of nuclear power is the need for overwhelming emphasis on safety and security. While not historically a strength, this emphasis is very important for the future of nuclear power, Mr. Hanson said. Metrics for Safety and Security Culture – Robert Bari, U.S. Brookhaven National Laboratory Dr. Bari discussed metrics for nuclear safety and security from a “neutral, agnostic standpoint of raising questions.” It is clear that there is no generally accepted set of metrics that can be translated into qualitative or quantitative lev- els of safety or security. Many believe that it is not possible to establish metrics in this field. When nuclear power was still in its infancy, there was a concern over how to protect the companies that operate nuclear power plants and insure against liability from extreme accidents. The U.S. government passed the Price- Anderson Act in 1957. The severity of possible accidents was assessed in terms of radiological emissions from the plants, but the likelihood of these accidents was not. It was acknowledged that events would be very unlikely, but it was unknown how unlikely they were, and many took the view that one could not calculate the unknown unknowns or even the known unknowns very well. Then in 1975, under the impetus of the liability of utilities that were pro- ducing electric power, Norman Rasmussen and around 50 specialists developed the WASH-1400 Reactor Safety Study. It was the first study with real risk as- sessment that addressed the safety of nuclear power plants in the United States. Today, there is a general feeling that a good safety or security culture promotes good performance overall and perhaps improves basic production from an engineering system. It may or may not be possible to correlate accident probability with a metric to safety and security culture. Is there a need for a bet- ter assessment of a safety culture or a security culture? Metrics have proven use- ful in the safety of plants already. After the Three Mile Island accident, nuclear operators in the United States began to understand the value of risk assessment tools, independent of their inter- actions with the regulator. An owner-operator wants high reliability in a plant and a high-capacity factor for plants. The risk assessment tools actually helped owners and operators run plants more cost effectively because they helped highlight what was important in terms of system reliability and availability. Operators also found that regulations in some areas placed undue burden on them, and they were able to make arguments using risk assessments for relief of some of these regulatory bur- dens. This use of risk assessment then pushed the regulator to systematically ad- dress the requests for relaxation of certain parts of regulation, and forced them to develop decision-making tools to understand uncertainties and how to deal with the risk results that the utilities were putting forth. To a large extent, risk as- 

Training and Education for Safety and Security Culture 47 sessment is successful in the United States and perhaps in other countries be- cause the utilities found it to be useful for their own operation. Dr. Bari raised another question of whether there are risk assessment ap- proaches that can be incorporated into safety or security culture. Can these cul- tures be taught? Can a person who is not in a good safety or security culture environment be taught to be more savvy, more aware, and more safety and secu- rity conscious? Can one person possess a culture, or is it more of a collective phenomenon of an organization? Dr. Bari explained that emergent behavior is behavior that is not part of a single individual element but belongs collectively to the whole. He gave the example of turbulence, which is a complex phenomenon that cannot be under- stood from the study of a single drop of water. Similarly, magnetic behavior cannot be understood from examining a single atom and its transition from a nonmagnetic state to a magnetic state. He discussed the Wisdom of Crowds study, 2 which notes that you can ob- tain a better answer to a question by polling a group of experts than by asking a single individual. The average displays the full collective wisdom that is not seen in a single element. While this workshop has extolled safety culture and security culture as wholly positive, in Dr. Bari’s personal interactions across the nuclear enterprise over many years, he has not encountered a strong safety or security culture in the design of nuclear power plant systems. One would think that designing good safety features and building a plant in a way that would not require later retrofits of the plant by the regulator would make a lot of sense. But some designers want to build to a specification, and performance is the real driver. Others view the system as safe enough and do not think that adding costs for safety and security revisions is necessary. During a recent plant safety study review, one stakeholder was concerned that doing a study questioning the safety of the plant would drive up the cost of nuclear pow- er. Organizations are multifaceted; some employees are concerned about per- formance, some are cost analysts, and others are environmental specialists. Safe- ty and security are sometimes seen as a different part of the organization that is not part of the core mission. Dr. Bari concluded his presentation with a series of questions: How do we make a more convincing case when safety and security culture is really difficult to execute successfully? Why consider safety and security together? Safety has the notion of openness and transparency, and security tends to be closed by na- ture. Is this a complex business (difficult to get to useful answers or extrapolate from experience) or just a complicated one? What motivates safety and security 2 Surowiecki, James, 2004. The Wisdom of Crowds: Why the Many Are Smarter Than the Few and How Collective Wisdom Shapes Business, Economies, Societies and Nations. Doubleday. 

48 Brazil-U.S. Workshop on Strengthening the Culture of Nuclear Safety and Security professionals, and what drives a professional to become interested in safety and security culture? Beyond Procedures: Safety and Security Culture as a Preparation for the Unexpected – Filomena Ricco, DCTA/UNIFA – Air Force University Dr. Ricco contributed a new perspective geared towards improving behav- ior and using safety and security culture in preparation for the unexpected. To ensure the safety and security of their personnel and facilities, organi- zations that work with hazardous materials have risk management systems in- volving accident control and mitigation. Two important aspects of these systems are appropriate technical training and instructions. Technical training is based on responses to past problems, and written instructions are based on situations that have already happened or can be foreseen or are considered possible. However, procedures and instructions modeled on the past are not necessarily appropriate to deal with new, unexpected situations. Dr. Ricco showed a short video in which an acrobatic aircraft loses a wing—a completely new situation for the pilot. This video illustrated how peo- ple in unexpected situations take new actions to prevent an accident or minimize the negative results from this accident. In situations where we experience some- thing new or unexpected, there can be a high cognitive cost for those involved, depending on technical issues, organizational structures, and cultural aspects. In unfamiliar situations, decisions are still based on rules, but they are no longer the known rules or procedures for a specific situation. Instead, they are the rules the individual invents. Individual personal characteristics come to the surface in a moment of stress, and at that moment the situation is in the hands of those making the decisions. People in very stressful situations can react in unexpected ways. Some freeze, indicating a loss of cognitive control. People need to recognize and un- derstand their own capabilities and limitations during stressful, unexpected sit- uations so that they know to what extent to rely on themselves, others involved, or systems in such cases. In psychology this is called metacognition—knowledge about self- knowledge. How much do I actually know about myself? Have I been through similar experiences? What was my reaction in those situations? Metacognition drives the outcome when a person experiences the unexpected. It consists of inductive and deductive reasoning, interpreting and understanding information that is available, trying to identify the targets or the objectives, and reaching a solution to the problem and identifying and choosing the course of action. To illustrate this phenomenon where maintaining cognitive control might lead to a positive outcome, Dr. Ricco described a kidnapping scenario. The kid- napped person is inside his own vehicle sitting in the passenger seat. The kid- napper is driving the car at high speed and the second kidnapper is sitting in the backseat with a gun. The kidnapped person realizes that he is very unlikely to 

Training and Education for Safety and Security Culture 49 survive that situation. If he is able to maintain cognitive control, the victim might notice that the kidnappers are not wearing seatbelts and at some point pulls the emergency brake so that the car gets into an accident. This action might create a positive outcome for the victim because he was able to maintain cogni- tive control and, after interpreting the available information, he established a target, which was to come out of that situation alive, and decided that the solu- tion to that problem would be to cause a car accident because he was wearing a seatbelt. He evaluated the situation and chose the course of action when he was in the position to pull the emergency brake. This cognitive control is desired when a nuclear professional encounters an unexpected experience. An environment’s organizational culture (artifacts, adopted values, and assumed values, using Edgar Schein’s terminology) dictates decisions on systems and equipment, human resources, and procedures to strengthen safety and security. DISCUSSION A participant responded by saying that some organizations do not highly value safety culture or security culture, whereas others do. Often this internaliza- tion depends on whether an organization knows that safety and security are im- portant to its vitality. Creating a good culture will work to the benefit of the enter- prise. A proper safety culture will provide incentives for safe behavior and disincentives for behavior detrimental to safety. One important metric for reim- bursement of costs on a large construction project is the number of hours without a “lost-time accident” as it applies to the U.S. Occupational Safety and Health Ad- ministration guidelines. Working for a long period of time without a lost-time ac- cident is not easy, and a large construction force has the potential to create many accidents, due in part to workers not always exhibiting desired behavior. Mr. Hanson described how his team created incentives on such a project. After each one of the million-hour milestones, they had a celebration and held a lottery for prizes, escalating in value with the number of hours without a lost- time accident. When they crossed the 5-million man-hour mark, there was a lottery for a pickup truck. The workers were fully aware that they had the poten- tial to win the truck, and behaved as desired. Not only did the group have 5 mil- lion accident-free man-hours, the project is now in excess of 11 million hours without a lost-time accident (which is extraordinary). This example demon- strates an ability to produce a cultural environment that incentivizes people to internalize behavior. Dr. Ricco discussed the analogy between personality for a person and cul- ture for an organization. Both personality and culture define behavior. She ad- vocated for an investment in behavior training to show good behavior and edu- cation of what good behavior looks like so that desired behaviors increase in frequency and become a habit. The culture of the organization is directly related to the attitude of its members. 

50 Brazil-U.S. Workshop on Strengthening the Culture of Nuclear Safety and Security A participant described a system where an organization examines safety and security issues on work activities, including travel. Many people in his organiza- tion often travel to risky locations, so there is an approval process that helps trav- elers understand the safety concerns in a given location. The organization discuss- es concerns with health officials, and then the director decides whether the travel should take place. Employees expressing their concerns represents good commu- nication and an important element of overall security culture. A participant stated his belief that the greatest threat and the greatest diffi- culty in implementing an effective safety culture is the culture of guilt and blame in our society. When a problem happens, the first thing we look for is the cause and a person to blame. To maintain a good safety culture, one has to look for the cause and not the person to blame, which is difficult in some countries with a judicial view of the problem. An important lesson is how to make engineering decisions in an emergen- cy situation. Fukushima was different from Chernobyl and Three Mile Island in that personnel in Fukushima had to make engineering decisions under very stressful situations. How can we train people to act like the kidnapped person in Dr. Ricco’s example? What can we do to improve or create this capacity of making complex decisions under stress? Mr. Hanson concurred with the observation that there is a human tendency varying from culture to culture to seek a scapegoat when something goes wrong. In a good safety culture, he said, the management does not seek a scapegoat, but the root cause of the mishap. For an inadvertent mistake, an employee should not be fired with a public display, but reeducated, so that the individual can un- derstand what went wrong and prevent it from recurring. If the same mistake is made twice by the same individual, an entirely different response is called for, but a proper safety culture is tolerant of mistakes. In order for employees to self- report mistakes, an organization must be tolerant of a certain degree of unsafe behavior. It is difficult to achieve a good balance. An organization that moves too quickly is an organization that will not function properly. In an environment with a dictatorial commander, no one will self-report mistakes because of fear. One cannot create a good safety culture if employees fear their management. Dr. Bari noted that the notion of guilt and blame transcends an operation and an organization, and can be part of a larger society. It becomes beyond the organization’s control. It satisfies a certain sense of justice, but has negative effects on the safety culture of, and individuals in, the organization. He recount- ed an experience of chairing a safety committee that examined mishap causes. Politicians wanted to find the culprits and assign blame, and the media reported that the committee was formed to find the culprits. This messaging did not help uphold a strong safety culture for the people in the organization. Dr. Ricco noted that there is an element of personal choice in what kind of person decides to work with safety and security. She then addressed the question of training for engineering decisions in emergency situations. Competence de- pends on having skills and knowledge, as well as the will to employ them. The former attributes come from experience, which an organization can develop in 

Training and Education for Safety and Security Culture 51 its employees by simulating relevant scenarios. The latter quality is both in the hands of the organization and in the hands of the individual. We must also consider our subconscious element. For example, in a sce- nario where an individual needs to stay awake for 24 hours, he or she might take certain drugs to stay awake for longer. At a certain point, the person will fall asleep either with or without drugs, as the subconscious takes over and shuts down the conscious will of the individual. To prepare oneself for stressful situa- tions, it is important to remember this subconscious element and invest in being physically prepared. Training self-knowledge is a personal responsibility, as well as the respon- sibility of an organization focused on safety and security culture, Dr. Ricco said. Trainings, scenarios, and dynamic activities in which employees can experiment with stressful situations can teach them about how they will act in stressful sit- uations. Given this knowledge, an organization can construct teams with the requi- site leadership skill sets for unexpected situations. If a team’s primary leader has deep technical and organizational knowledge, but on a personal level has seem- ingly less cognitive control during unexpected stressful situations, a secondary leader with greater personal capacity to take adequate actions during such situa- tions can be designated to assume temporary control if an emergency occurs. A participant commented that in his work with utilities protecting critical energy infrastructure, the safety culture is strong due to the hazardous nature of the industry, but a security culture is absent. It is difficult to motivate people to monitor their security to maintain their own personal safety. Often, electrical providers need to enter high-crime urban locations or other dangerous environ- ments. An individual’s understanding of personal safety and how it relates to security situational awareness helps to create a security culture that sees poten- tial security hazards in addition to safety hazards. Mr. Hanson noted that personal responsibility is an important part of safe- ty culture. However, in a fire where a death occurred because the individual could not identify the exit, the mistake was the architect’s or system construc- tor’s because the exit was not clearly marked. Individuals should be sharing re- sponsibility for safety, he said, and a large number of individuals contribute to the creation of a safety culture. It is rare when one single individual bears the entire responsibility for an undesirable outcome.