HM Nuclear Installations Inspectorate

An Investigation into the Falsification of Pellet Diameter Data in the MOX Demonstration Facility at the BNFL Sellafield Site and the Effect of this on the Safety of MOX Fuel in Use

INVESTIGATION FINDINGS

3.1 Extent of Falsification
3.2 Who was Involved
3.3 Why Falsification Happened
3.4 Adequacy of BNFL's own Investigation
3.5 Management Shortcomings in Control and Supervision

38. Discussions with BNFL management and interviews with MDF staff clearly demonstrated that several process workers had not been following quality control procedures for the quality assurance checks on the diameter of a sample of each 'Lot' of pellets produced in the manufacturing process. Instead of carrying out the required diameter measurements and recording them on a spreadsheet for the customer (to confirm that the fuel pellets were within the tolerances specified by the customer), some process workers simply used previous spreadsheets, manipulated the data and recorded it as if they were measurements of the designated Lot. These false spreadsheets were then authorised by Quality Controllers who might have been the same individuals as those who make the measurements.

39. There is no doubt that data falsification took place and MOX fuel assemblies have been produced and in some cases delivered to the customer with Quality Assurance documentation which included falsified data.

Extent of Falsification

40. The extent of the data falsification was initially determined through the EMSU statistical analysis. The results of this analysis were then discussed and compared with BNFL's own statistical analysis to give the complete story.

41. The EMSU analysis found that:

the 22 Lots identified by BNFL as falsified had indeed been falsified by the type (a) method as described in Section 1.4 above;
in addition to these 22 Lots, there was firm evidence that a further two Lots contained false data of type (a);
there were an additional two Lots which had high numbers of duplications within a spreadsheet, type (b), one of them being one of the Lots originally declared by BNFL as unusual and later discounted by BNFL; and
the internal tests devised to find type (c) faults confirmed the two Lots under type (b), but did not identify any further falsified Lots. 42. A manual check by NII of line repeats across BNFL's original list of 10 unusual datasets also identified an additional four Lots as containing 'suspect' data.
43. The HSE statistical analysis was shared with BNFL, which passed it on to its customer Kansai. The results were also explained in some detail to the Japanese Nuclear Regulators in the Ministry of International Trade and Industry, MITI. BNFL carried out further statistical analysis of the data and informed NII that a further Lot (P814) contained falsified fuel pellet diameter data. NII checked the method of falsification to see why its own statistical analysis had not identified this Lot. The reason was that the protocol adopted for HSE's analysis would not have identified this method of falsification which was to copy a large section of one spreadsheet to a different location in the other. The existence of Lot P814 does not invalidate the analysis or conclusions of HSE's statistical work. Table 1 lists all the Lot numbers that have been found to contain falsified data. This shows that there are 31 Lots known to be affected. Pellets from these Lots have been used to produce a number of fuel assemblies, some of which remain at Sellafield. Eight assemblies have been delivered to Kansai, of which four assemblies contain pellets from Lots known to have been affected.

Who was Involved

44. The NII investigation into who was involved in data falsification centred mainly on the statistical analysis report. It was possible from the data to identify when each AQL sample was 'measured' and hence from the staffing records identify which of the five shifts working in MDF were involved. This analysis showed that four of the five shifts were involved to varying extents with the data concerned.

45. Initially BNFL only identified one shift responsible for the falsification. Three process workers from this shift, one of whom admitted falsifying records, were subsequently dismissed. NII has had discussions with BNFL on the more widespread involvement of MDF staff. BNFL has confirmed that some members of staff have been told that they face potential disciplinary action.

46. The above shows that not only were some of the process workers who were given the tasks of measuring the pellet diameters and recording them on the computer spreadsheet involved, but also some of the process workers who carried the Quality Control Stamps were either party to the falsification or were not checking that measurements were being taken. The conclusion is that a number of these individuals were also negligent and not carrying out their duties properly. There are also implications for some members of Shift Management. Either they were not doing their jobs properly by failing to supervise adequately and control activities on their shifts, or they were party to the falsification of records.

47. NII interviewed MDF's management, shift team managers, shift team leaders and process workers in the area of MDF where the AQL measurements take place. None of the management or supervisors admitted to any prior knowledge of falsification. Of the process workers interviewed, only one admitted to falsifying data. NII also interviewed QA and QC staff including the person who originally identified falsification of data. Up to that point none of the people interviewed admitted being aware that falsification was happening.

Why Falsification Happened

48. There can be no excuse for anyone falsifying records, particularly on a nuclear licensed site. NII's investigation therefore was not looking for mitigating circumstances: rather it was trying to establish factors which may have contributed to the environment which led people to falsify records rather than follow procedures. NII was also keen to see if there were circumstances which had lessons for other parts of the Sellafield Site. The Site Inspector and NII experts in quality assurance and human factors interviewed BNFL staff in MDF.

49. The NII investigation revealed inadequacies in the working environment and in BNFL's systems and procedures, which may have led some process workers and QC inspectors to look for ways of bypassing the fuel pellet diameter secondary measurement tasks. These are discussed below.

Control and Supervision

50. The control and supervision of operations in MDF was one of the key areas where NII found the BNFL arrangements to be inadequate. Managers did not spend enough time talking to and observing workers, particularly in the fuel rod fabrication area. Shift Team Managers (STMs) tended to spend more of their time in the area of the plant where the MOX fuel pellets were being produced, because of 'bottle neck' problems, rather than in the fuel rod fabrication area where the secondary measurements of pellet diameter took place.

51. From interviews, NII learned that little supervision of this task took place other than to simply do ad hoc checks on progress. One Shift Team Leader (STL) said he had little involvement with the pellet diameter inspection, even when covering for the STM, other than to look at the speadsheet to check that the number of out-of-specification readings was acceptable. The general view amongst managers was that the secondary check on pellet diameters was considered to be a low risk job not requiring supervision. NII also found that the STL's knowledge of the 'QC Overinspection Instruction' was limited. Two of the three STLs interviewed had never read it and one STL had not seen it until the day of the interview. This showed deficiencies in the training of key staff within MDF and raised concern about the overall safety culture on the plant.

52. It was clear that the level of control and supervision of fuel pellet diameter inspection had been virtually non existent. This may have sent out entirely the wrong message to the process workers and QC inspectors regarding the importance of the task, and acted as a demotivator.

Training and Awareness

53. It was clear to NII that for some process workers and QC inspectors the awareness training for the fuel pellet overinspection measurement task was ineffective. NII also found non-compliance with BNFL's own procedures for authorising persons to carry out the overinspection task. It was also obvious to NII that some of the procedures were themselves deficient.

54. Five out of the six STMs and STLs interviewed believed that those process workers who carry out overinspection tasks were aware that it is used to confirm the validity of the automatic 100% measurements (avoiding problems at the rod load stage) and gives confidence in the quality of the product to the customer. However, when NII questioned the training provided to staff undertaking inspection of fuel pellet diameter, no reference was made to awareness of the importance of the task.

55. Without effective awareness training or briefing to the process workers carrying out these fuel pellet diameter measurement tasks, such individuals are unlikely to appreciate the importance of the task or take ownership of it. This was another example of management failure within MDF.

Workload and Deadlines

56. It had been suggested that one of the reasons for falsifying the data, eg copying previously measured diameter data rather then measuring the 200 pellet sample in each Lot, was because of high workload. NII inspectors discussed workload with the STMs and STLs. All those interviewed reported a gradual increase in throughput taking place, but all believed that the higher throughput was within the capacity of the plant and the workforce, and did not put an uncomfortable workload on staff. None of the STMs or STLs believed that falsification of quality checks was a result of excessive workload.

57. NII examined the list of operations surrounding the 200 fuel pellet sample measurements with their duration times. Whilst there was little margin between shift length (3 x 8 hours) ie three people on the shift allocated to these duties, and the summated man hours for the various tasks (23.8 hours), NII could find no evidence to prove workload was a significant factor in falsification.

Tedious Nature of the Task

58. The system adopted in MDF for carrying out the overinspection task of the 200 fuel pellet diameter sample was tedious and could have been made easier for the process workers involved. A system where one operator places a pellet in a laser micrometer, calls out the diameter reading and another operator enters this manually into a computer spreadsheet is clearly far from ideal. Automation of the laser readout straight to the computer would have eliminated one tedious task, reduced the likelihood of errors and allowed the sharing of the remaining task of placing the pellets in the micrometer for measurement. The failure to recognise and redesign this during the years of operation is another example of BNFL's failure to manage MDF properly.

Ergonomics

59. NII examined the ergonomics aspects of the task and found the following:

The overinspection task, although not overly demanding in a purely physical sense, was sufficiently badly designed to make almost all of the task steps more than a minor nuisance to anyone who has to perform them on a repetitive basis for any extended period of time.
The amount of eye-to-hand co-ordination, precision, general dexterity and patience that is required on the part of the operators, over what is potentially a long period of sustained concentration for the operator, is non-trivial and is likely to be regarded as being more than a minor nuisance after the first few initial task cycles.
Other than the prospect of an eventual QC stamp which is, in effect, an internally generated record, and ultimate payment for completing the shift, there is no obvious recognition for diligent performance.
Other workstations within the plant have also been poorly designed

60. In the light of these findings and with the benefit of hindsight, NII concluded that the occurrence of non-compliant behaviour is not at all surprising. This should have been recognised by BNFL during the design and commissioning of the plant and steps taken to improve the ergonomic design to reduce the deleterious impact on the process workers.

Computer Security

61. During NII inspection of the overinspection process, BNFL staff demonstrated how a spreadsheet or part thereof could be copied and how randomly 'invented' data could be easily input or copied. Because of human frailty, the ease with which falsified data could be entered into the computer was clearly a contributory factor to this event.

Quality Control

62. The procedures for QC inspection of fuel pellets were inspected. NII found that:

The Quality Control Plans (QCPs) for the manufacture of fuel pellets and MOX fuel rods were developed to meet customer requirements and were approved by the customer;
The first discovery of potentially falsified data was made by a member of the MDF QC team and reported to management, who then started their own investigation;
Lloyds Register Quality Assurance had not withdrawn or suspended its quality certification of the plant on the basis that 'there was no evidence of a failure of the 'Quality Management System'; and
There was no sign that any of the other key records or data used to measure and confirm the quality of the final product ie the MOX fuel assembly had been falsified. 63. NII is satisfied that the overall approach to quality control and quality assurance is appropriate, but the procedures and supervision for the AQL pellet diameter measurement need improvement as detailed above. The issue of allowing process workers to check their own work, without adequate management control and supervision, needs to be reassessed.

Adequacy of BNFL's Own Investigation

64. NII has closely monitored BNFL's own investigation to satisfy itself that BNFL has adequately investigated the falsification issue and to check compliance with the requirements placed upon a nuclear site licensee to ensure all events are properly investigated and lessons are learned. From the outset, BNFL has clearly expended considerable effort to establish the extent of the problem and why it occurred. Since 10 September 1999, when BNFL first informed NII of the situation at MDF, there has been considerable dialogue with the Company in order to monitor and track developments.

65. Like HSE, BNFL developed a computerised checking method to determine the number of matches between pellet Lots. Initially BNFL focused on matching values for the 600 data points in Lots within a given Batch: this was then extended to cover matches between all the pellet Lots, which for some 400 Lots involved some 80,000 dataset comparisons. The BNFL methodology initially only investigated two other ways of copying/fabricating data in addition to the above matching process. These were the direct copying of a single line of three data entries to other lines in the same spreadsheet, and the random copying into other spreadsheets. More recently, BNFL has looked at repeat entries between columns of spreadsheets. This analysis method identified an additional Lot (P814) containing falsified data.

66. Although BNFL has done a thorough investigation into direct copying of information within and between spreadsheets, it recognised that the analysis could not be exhaustive. However, it is unlikely that even a much more sophisticated investigation into methods of falsification would identify, with complete confidence, every spreadsheet containing falsified data.

67. BNFL's management investigation was set up to determine, inter alia, the circumstances surrounding the event, the root causes and to make recommendations to prevent recurrence. The BNFL investigation made the following recommendations.

Automation of the transfer of measurements from the laser micrometer to QC datasheets and consideration of automation of other aspects of fuel pellet diameter overinspections.
Raise awareness of the expectations of standards in the nuclear industry.
Review the workload of STMs to ensure they have adequate time for supervision of all operations under their control.
Review of accountability for Quality Control between QC inspectors and the STM.
Re-accreditation of QC stamp holders including a review and re-education of the understanding and application of QA systems and QC standards.
Improve computer security to eliminate the potential for copying of QC data between spreadsheets.

Implement a hierarchical reporting system for product QC issues.

NII studied the investigation report and whilst it supports much of what is recommended as being sensible, prudent and achievable, it identified a fundamental limitation in scope, ie the assumption in BNFL's initial investigation that the problem was caused by three individuals on one shift. BNFL had in parallel initiated other investigations to establish the extent of the problem in terms of the Lot numbers and shifts involved. As shown above, the NII analysis identified four out of the five shifts as being involved to varying extents.

68. Further, the initial BNFL Management Investigation seemed to attribute the main cause to shortcomings amongst some process workers and QC inspectors, rather than look at the broader management responsibilities which allowed the falsification to happen. However, worthy of specific note was the recognition that training, use of instructions and supervisory control had not been adequate. The BNFL team also recognised that there was a need to produce a fundamental change in QC inspection functions with the appointment of accountable persons to oversee QC inspections and check QC related data on each shift.

69. Overall, NII concluded that BNFL has carried out a thorough investigation into the circumstances surrounding MOX fuel pellet diameter data falsification. BNFL's initial investigation was too hurried and limited in scope but this has since improved: generally the investigation has been well conducted and has identified the key areas for preventing further falsification.

Management Shortcomings in Control and Supervision

70. NII has interviewed a number of operational and QA staff in MDF. It was obvious that there had been little supervision of the pellet diameter overinspection. The demarcation of effort between shift team leaders and managers was generally that the manager oversaw operations in the fuel pellet production area (the bottleneck), and the leader those in the fuel rod assembly area. NII has some concerns that there may be a conflict of loyalties for shift team leaders. The conflict arises from STLs being members of management yet not wishing to be alienated from the process workers. NII found no evidence of this in MDF.

71. The shift team managers had insufficient time to both manage staff and keep the plant operating. As a result, effort was given to resolving plant problems, and jobs which were seen as a lesser priority were allowed to slip. One of these was supervision of the AQL measurements. BNFL has recognised the overload by removing the task of preparing 'permits to work' from shift managers and appointing an additional process engineer.

72. Management presence on MDF was clearly insufficient in terms of both time on plant and in having a questioning attitude to what was happening. For example during one inspection, conditions were seen by NII which should not be allowed in a plant manufacturing nuclear fuel. Once pointed out to the management, matters were quickly remedied. The issue of time on plant remains. NII concludes that there is insufficient management resource to ensure effective management of MDF.

73. The problems of MDF are not all recent: some, such as the poor ergonomics of the workstation, have existed since the plant was built. The implication of this is that managers of one of Sellafield's key businesses did not have the necessary time to devote to supervision of front line production activities. These events demand careful consideration at the most senior levels within BNFL.

Added to the HSE website on 18th February 2000