HM Nuclear Installations Inspectorate

HSE TEAM INSPECTION OF THE CONTROL AND SUPERVISION OF OPERATIONS AT BNFL's SELLAFIELD SITE

3.INSPECTION

During the latter stages of the inspection, it became evident that a number of common themes were emerging. It was therefore decided to set out this section of the report based on these themes rather than deal with the work of each of the three groups in turn. As a consequence a number of recommendations in this section are of a more global nature, based on a larger number of specific recommendations identified by each group. Furthermore, some of these recommendations apply across all of the themes. Each recommendation is made immediately after the first finding to which it relates. Further relevant examples may be found in later parts of the text. Throughout the inspection, team members were prepared to take immediate enforcement if they thought it necessary. One Improvement Notice was served on BNFL for inadequate practices while working at heights and a senior BNFL manager voluntarily stopped a plant when serious deficiencies were brought to his attention. BNFL initiated immediate corrective actions in a number of other areas during the inspection. It has also agreed to undertake a systematic assessment of the baseline resource levels it requires for undertaking its current activities before any further changes are made to its organisational structure.

3.1 Safety Management Systems

Corporate Policy

BNFL has issued a Company Manual which contains its company vision statement and a set of BNFL values. The Manual states that one of BNFL's values is being "focused on continuous improvement". We understand that a revision to the Company Manual has been awaiting the Chief Executive's acceptance for some while. In addition, the vision statement had been awaiting an update since 1997. The Company Manual also contains policy statements on a range of matters including one on Safety and Health. This written statement is a requirement of Section 2 of the Health and Safety at Work etc Act 1974. The Health and Safety Commission (HSC) has produced guidance on what it would expect to see in a safety policy statement⁹. BNFL's safety and health policy statement makes a clear commitment to health and safety by stating that "The Company considers that none of its activities is more important than the health and safety of its employees, its contractors, the general public, and the protection of the environment". This is consistent with HSC's guidance. However, the use of the phrase "The Company", which appears throughout the safety and health policy statement, is contrary to the guidance. HSC's guidance expects the senior officer of the company who is responsible for the implementation of the policy to be identified, something which we only found in a lower tier document. We consider that the use of the phrase "The Company" can obscure the responsibility of the relevant senior officer. We also found no indication on the statement of who had authorised it to be issued. We are concerned that these statements could give an impression of distancing the Board of Directors from the objectives of the policy. <> We were unable to find a number of items significant to safety within the safety and health policy or other policy statements. Examples of policies we would expect to have seen include those for dealing with safety aspects of changes to organisational structure, use of contractors and learning from experience.

Recommendation 1 - BNFL should improve and reissue its policies on health and safety and related matters.

Safety Documentation

The various policy statements are amplified by the Corporate Safety, Health and Environment Manual (known as CSHEM). A supporting manual, the Corporate Methods and Guidance Manual exists alongside the CSHEM manual providing advice on the implementation of the CSHEM. The CSHEM covers a range of topics including specifying systems of work and setting risk criteria
Although the CSHEM covers a number of specific topics, BNFL as a matter of policy only puts into the manual those topics where it wishes to achieve standards of performance above those which are required by law, or to set its own corporate standard. This means for example that there is no corporate specification on compliance with most of the licence conditions. We note that other nuclear licensees do provide a corporate specification for meeting the requirements of licence conditions. This approach has generally resulted in acceptable arrangements being found at their licensed sites. BNFL should adopt such an effective practice.
BNFL told us that it has adopted the model for a safety management system described in HSE's document Successful Health and Safety Management⁷, though its description has some minor differences. One feature we would expect in implementing this safety management system is its consistent usage in documentation such as CSHEM so as to ensure that all aspects of the model are covered. For example the identification of performance standards is minimal. Without defined performance standards associated with each responsibility, it is not possible for people to know the criteria for success in discharging their responsibilities, let alone to hold them accountable. We are pleased to note that BNFL Sellafield has recognised that a lack of accountability is a contributory underlying cause to many of the findings made elsewhere in this report. We discuss accountability more fully later.
We were told that BNFL derives its CSHEM statements by consultation, a process which can draw on best practice but is open to the potential weakness of adopting the lowest common standards. We were advised that the Corporate Director's Environment, Health and Safety Unit has delegated the task of revising sections in CSHEM to site-based staff. We consider that this could weaken the effectiveness of the corporate unit for providing company leadership on best practice.
Beneath the CSHEM, BNFL Sellafield has produced a set of Sellafield Safety Regulations. These not only derive their material from the CSHEM, but also from elsewhere, including relevant health and safety legislation and the Sellafield Site Management Manual and Arrangements. The aim of the Sellafield Safety Regulations is to provide a single location where managers can identify the duties placed on them. The Sellafield Safety Regulations are more comprehensive than the CSHEM; a subset of these, the Site Licence Regulations, covers for example all of the licence conditions. BNFL Sellafield emphasised that the Sellafield Safety Regulations were intended to be comprehensive, removing the need for the reader to consult other documentation when producing arrangements.
We found the site had substantially failed to meet its declared intention of reviewing the Sellafield Safety Regulations every three years. The Sellafield Safety Regulations were not comprehensive in a number of other respects. We are aware of the continuing difficulties which BNFL Sellafield has in ensuring that its Industrial Safety Regulations, another subset of the Sellafield Safety Regulations, are kept up to date. We found unissued Industrial Safety Regulations covering legislation issued a number of years ago. We did not find consistent usage of BNFL's safety management system in the Sellafield Safety Regulations. For example, although the regulations place duties on Heads of Departments, we consider that there is a lack of performance standards associated with the responsibilities associated with these duties. In view of this omission, we consider it will be difficult to hold people accountable.
We note that the Sellafield Safety Regulations are written in a style which places duties on Heads of Departments. Whilst supplementary annexes, appendices and guidance notes exist for most of the Sellafield Safety Regulations, we consider that they are not written in a manner to ensure common standards are achieved. For example we found sufficient variation in the systems leading to the appointment of suitably qualified and experienced and duly authorised persons to bring into question the arrangements across the site for their appointment. This view was reinforced by the poor level of knowledge that we found in some people on the topic of operating rules, as discussed elsewhere in this Section.

Recommendation 2 - BNFL should improve and implement its safety management system to be consistent with its chosen model.

Management Structure

The management structure from the Board of Directors through to plant level on the Sellafield site is very complex. Beneath the Board of Directors is an Executive Team which is led by the Chief Executive. There are three members of this Executive Team who manage Business or Functional Groups which undertake nuclear operations on the site. Two of these are also members of the Board. The Groups generally comprise several Business Units: similarly the Business Units consist of several Departments. As previously noted, BNFL's arrangements for compliance with licence conditions and other legal matters place the duty of compliance on the Heads of these Departments. BNFL also has a Sellafield Head of Site who has a management structure beneath him.
Given that the Board is not located on the nuclear licensed site, NII expects an individual on the site to be designated as the "Agent for the Licensee". The Head of the Site has accepted the role of Agent for the Licensee. However, he does not have full management control over the Business Units. We were advised that the Head of Site has operational control whilst business control remains through the Head of each Business Unit to the relevant Business Group Director. We understand that the Head of Site has a "dotted line" link to two of the three Group Directors to provide this empowerment. We do not consider this division of responsibilities is sufficiently clear, or necessarily the best structure to withstand the tensions which will inevitably arise between operational and business needs.
We note that several Business Unit Heads have up to 8 people directly reporting to them. Clearly this reflects a demanding role when the average is less than 5 and several have only 2 people reporting to them. Although there are some 37 Heads of Departments, we were advised that 24 of them have duties which directly relate to nuclear operations. We found anomalies with the structure at levels below Head of Business Unit. The most significant example was the equivalent of a Shift Team Leader reporting to a Head of Department. Whilst we accept that situations will exist where a single level can be omitted from a management structure, we question the omission of two levels. In our work on management of change, we found examples where the workload associated with posts was not sufficiently transparent to allow a fully informed decision of the adequacy of resources in a given area. Our underlying concern relates to the question of how each manager can adequately supervise his or her subordinates.
As part of its continuing drive to reduce costs, BNFL has embarked on a major programme called Beyond 2000. We note that the new contract of employment which forms part of the Beyond 2000 programme impacts on organisational structure and work patterns by removing the post (Chargehand) between that of Shift Team Leader (typically equivalent to the role of Foreman) and Team members. One intent of the new contract is to remove the role of existing Chargehand which has provided an important contribution to the supervisory role of the Shift Team Leader. Subsequent to the team inspection, we were advised that generally the functions which a Chargehand performs will either be undertaken by a suitably qualified and experienced team member, or by enhancing the skill base of the team so as to reduce the supervisory demands on the Shift Team Leader. BNFL is still developing this topic. We discuss the topic further later in this report.
We questioned if the Business Groups had an accountability system in place for the management chain. By this we mean, do line managers actually check that their staff are carrying out the tasks for which they are responsible, including meeting the relevant performance standards? Discussions with the two Board Directors with responsibility for operations on the Sellafield site confirmed that they are accountable for safety as well as business matters to the Company Chief Executive. Safety targets and safety-related key performance indicators were stated as being included in their personal objectives. This accountability was continued through the individuals reporting directly to the Executive Directors. Both Directors acknowledged the importance of the independent Heads of Safety within their Business Groups, these being regarded as providers of independent advice to the Director. Discussions with staff at lower levels in many areas of the site revealed an absence of clear and comprehensive accountability statements for both safety and operational matters. BNFL has already acknowledged the lack of accountabilities at senior and middle management level and has begun to develop accountability chains. However, these plans did not include people at lower levels in the organisation.
Prior to the inspection in discussion with NII, the previous and current Heads of Site had accepted that there were shortcomings with the site's safety performance and recognised the need for remedial action. In doing so, they acknowledged the NII view that the operation of the site as a number of disparate business units was a contributory factor. Following this, BNFL began to take steps to provide better integration of the operation of the site. A significant feature in the move towards an integrated site is the recognition of the need for the Head of Site to have executive authority over the operations which take place on the site. We comment further on this later in this report. During the inspection we asked about the progress and impact of the plans to better integrate the site. We found that the management system was being changed, with new arrangements being implemented at the time of the inspection. We found little evidence of any knowledge of the proposals or of progress to date from people below the more senior levels of management on the site. It is therefore too early to comment on BNFL's progress with the integration of the site.

Recommendation 3 - BNFL should continue to develop and implement a clearer management structure from Board level downwards which identifies the safety responsibilities for each post and how post holders will be held accountable.

Independent Inspection, Audit and Review

The Chief Executive is designated as being "...responsible to the Board of Directors for Safety, Health and Environment management of the company's activities". He, along with Business and Functional Group Directors, is a member of the Executive Team which is responsible for "...providing overall direction, agreeing key policies, strategies and targets in Safety Health and Environment." As well as operational management, BNFL has a corporate Environment, Health and Safety function. The Corporate Director of Environment, Health and Safety reports directly to the Chief Executive and has right of access to the Board of Directors. However, we learned that the Corporate Director of Environment, Health and Safety is no longer a full time member of the Executive Team. His removal from the Executive Team could be seen to imply a diminution of the importance with which this role is viewed within the Company. We have reservations over the recent insertion of another layer of management between the Corporate Director of Safety, Health and Environment and the Sellafield site in terms of the directness of an independent reporting chain.
We have deliberately used the words "independent inspection" in addition to "audit and review" in the title to emphasise that the role is much more than that usually associated with quality assurance. We consider this independent function is needed to perform inspection duties on all nuclear operations on the licensed sites so as "...to draw to the attention of management any failure..."¹⁰, whilst being unambiguously independent of the operational management. The key difference between this function and that of auditing is that auditing only needs a degree of independence sufficient to ensure that an objective assessment is made. We believe that people charged with the independent inspection role should have the necessary understanding of the process requirements so that they can, if necessary, challenge the adequacy of those procedures and safety cases, as well as simply the compliance with them. NII considers that the person who heads the management chain providing health and safety advice independent of operations, should report to a Board member who is responsible for developing policies for meeting health and safety responsibilities, as well as having direct access to the entire Board.
Within the Sellafield Head of Site management structure are two site-based and related posts. The long established post of Head of Environment, Health and Safety has the responsibilities the title would suggest. The newly created role of Operations and Compliance Manager was said by the Head of Site to be capable of development to include some form of site-based environmental health and safety compliance inspection function. We welcome this development but from the information available to us we question whether the reporting lines of this proposed function are sufficiently independent from operational management. Secondly, we consider that the level of these posts, if reporting to the Operations and Compliance Manager, will not be sufficiently senior to attract the level of competence that we would expect in people carrying out this form of independent inspection.
We sought evidence of audit by the corporate unit. We were advised that although there is a corporate audit programme, this programme is merged with other audit programmes required by other parts of the company. Furthermore, the output by the audit team is then used by several parts of the company to record that an audit was undertaken in accordance with its own programme. We note that this approach does lead to an economy of effort and reduction in revisiting specific topics or areas of the company. However, it also leads to double counting the effort. We specifically sought evidence of an audit on the topic of reporting, recording and investigation of incidents. Whilst we were shown a number of audit reports covering the action tracking system, we were shown no evidence that BNFL had audited the complete topic. We therefore question whether sufficient effort is being provided by BNFL to the task of auditing.
The value of a strong audit regime was demonstrated in the Resident Engineer's area. Although Superintending Officers located within other Departments are responsible for contracts, the Resident Engineer still retains the authority to set the health, safety and welfare standards which contractors must meet in order to work on the site, and also carries out audits for compliance with those standards. We found a good level of implementation and compliance with these standards for contractors, and as a consequence high standards of safety on the construction sites. We were also impressed by the quality evident in the Safety and Analytical Services Department which is no doubt related to the external accreditation and technical audit requirements. We conclude that in the areas where we saw such good safety performance, there was a strong audit process in existence. When coupled with our findings in other areas, the correlation was clear. Other licensees who have achieved high standards in compliance with licence conditions have rigorous systems for independently monitoring compliance, in the form of independent inspectors reporting to the corporate safety management and spending substantial time on site.
As previously mentioned, we consider the resources which the Corporate Director of Safety, Health and Environment commands are insufficient both in numbers and expertise. They do not have the capacity to directly perform an auditing and review system. They rely upon delegating their work to other people within the company, who may be competent but who lack the degree of independence we would wish to see.

Recommendation 4 - BNFL should develop and implement an effective system for the independent inspection, audit and review of health and safety.

Site Implementation

The Sellafield Safety Regulations are required to be implemented by the 24 Heads of Departments who are in charge of nuclear operations on the Sellafield site. Although there are now two Business Units which have imposed some degree of uniformity across their Departments in the implementation of the Sellafield Safety Regulations, we consider that generally the standard of achievement across the site is only just tolerable. This divergence has built up since the introduction of the Sellafield Safety Regulations some time before 1990. For example, BNFL found 58 different sets of arrangements for the same topic in use across the site. Whilst we acknowledge that instructions which relate to specific plant need to be customised to reflect that plant, we do not consider the majority of arrangements which are in place across the site to implement the nuclear site licence and other health and safety legislation need to be different. We note that other licensees have in place systems which require uniformity in the arrangements which implement licence conditions. BNFL Sellafield should do likewise.
We were pleased to be told by BNFL Sellafield that in recognition of this problem, it had announced just prior to the inspection that common systems would be introduced initially covering 11 of the 36 Licence Conditions. However even in the few cases where the Sellafield Safety Regulations have supposedly imposed common systems, this has not in reality been achieved. For example we note that one plant does not use the isolation certificate system to mechanically isolate and hand over items of nuclear plant, contrary to the relevant Radiation Protection Regulation, which is part of another subset of the Sellafield Safety Regulations.

Recommendation 5 - BNFL should ensure that so far as is reasonably practicable, only one set of detailed working arrangements is used across the site so as to ensure uniform implementation of the Sellafield Safety Regulations.

3.2 Safety Management Practices

Management Tasks

BNFL staff interviewed told us they knew of no guidance on what is expected of managers in terms of control and supervision of operations. Whether or not this was universal, we found considerable variation in the arrangements for control and supervision adopted on various plants across the site. This was due to a lack of commonality in organisational structure at junior and middle manager level.
As a consequence of these different structures there was variation between Plant Managers in the level of control of work that he or she could be expected to exercise. It was clear at all levels that job titles did not always reflect job content or responsibilities. We could find no clear and comprehensive accountability statements for both safety and operational matters. We consider that everyone should know what is expected of them and that there should be a clear definition of an individual's responsibilities and how the individual is accountable. BNFL had recently begun to introduce accountability statements at middle and senior management levels but not at lower levels within the organisation. We found a paucity of established mechanisms for identifying good management practices and sharing them across the site. We consider that without proper performance standards, a consistent and high quality system of control and supervision cannot be demonstrated or maintained.

Recommendation 6 - BNFL should develop and implement performance standards and define responsibilities for the control and supervision of operations across the site.

During the inspection, it was not possible to make a quantitative assessment of management's workload. However some qualitative views emerged from this inspection. There is a variety of structures at junior and middle management level across the site. In particular, the role of the Shift Team Leader differs markedly from plant to plant. For example, in some areas the Shift Team Leader had an active role in the self-audit process, which individuals said took a significant proportion of their time. In other areas we were told that self-audits were simply limited to routine housekeeping matters. We found that the presence or absence of a Shift Team Manager within a structure affected the role undertaken by the Shift Team Leader. Where Shift Team Managers were absent, the Shift Team Leaders were relying on Chargehands to undertake supervisory duties, and in some cases on the job training, so as to allow themselves to undertake other management duties. We found in areas where Shift Teams are geographically split, there was significant reliance on the Chargehands to carry out supervisory duties.
In discussions with a range of managers it was obvious that site- and company-wide programmes were diverting a substantial amount of their effort from matters which may affect plant safety. Typically, people interviewed estimated that 50% of their time was being spent on such tasks. This is of particular concern where the organisational structure is very flat. For example we found some Departments where Shift Team Leaders were reporting directly to the Head of Department on operational matters. We found that these Shift Team Leaders had very little day to day contact with their Heads of Departments who have a range of non plant-related activities competing for their attention. We consider that such a management structure is inappropriate as it significantly weakens the adequacy of control and supervision of operations. This gap may also be one reason why corporate safety expectations are not reaching staff at working level.

Recommendation 7 - BNFL should review its organisation structure and implement changes to ensure that appropriate reporting lines are in place.

Key tasks of managers include reviewing logs, investigating events and monitoring close-out of findings. We found examples where minor incidents recorded in plant log books were not reported as Happenings (a Happening is defined by BNFL as "...where something has happened outside the norm"). We have observed that some more notable incidents were not recorded as Happenings. This is indicative of a lack of a questioning attitude by staff as well as suggesting that practices exist that bring into question the effectiveness of the monitoring role of managers.
We found the range of uncompleted recommendations from incident investigations was variable. We acknowledge that some recommendations will take longer than anticipated and hence may not meet the expected completion dates. Although we found information on the state of close-out was being passed to managers, we found little evidence of it being used by managers. Often the only people we could find who were concerned about overdue recommendations were relatively junior staff tasked with keeping the action tracking database up to date. Generally we saw no effective monitoring by managers of those people responsible for closing out recommendations.
We found some evidence that delays in dealing with recommendations were due to an inability of ma nagers to acquire or retain resources to undertake work. We suspect that in many of these cases the action needed was overtaken by a subsequent task which was seen to be more pressing. We saw that such problems more often seem to arise when the Head of Department is dependent on resources outwith his management chain of command.
We conclude that most of the managers we interviewed had an excessive workload which affected their ability to monitor safety adequately.
The BNFL decision-making process on when to employ contractors is primarily based on the judgeme nt of the manager. Although BNFL has procedures for the use of contractors on site, there is no clearly defined policy or guidance to managers on the use of contractors. The policy should provide guidance to BNFL staff in order that clear decisions can be made on when contractors can be used. It is important that BNFL manages this situation against defined licensing and safety criteria so that managers can always demonstrate the day to day control arrangements required of a nuclear licensee, and that the dependence on contractors is not detrimental to safety. One true test of whether a licensee has adequate control is a proven contingency plan that demonstrates how the licensee will put the plant into a safe state if contractors' staff became unavailable or prematurely left the site.
BNFL contracts a number of individuals from employment agencies to undertake roles within its organisation. We were told these individuals constituted 13% of the workforce. In some instances we found that some of the agency people were responsible for the direct control of contractors undertaking work on the site. We found that in some areas, contractor organisations determined daily staffing needs for projects without consulting BNFL staff. The licensee was therefore not aware in advance of how many contractors would be engaged in work on the site. NII's expectation is that day to day control of operations must be retained by the licensee to reflect the licensee's absolute liability under the law.

Recommendation 8 - BNFL should develop and implement arrangements to ensure that it retains day to day control of operations across the site.

Management Availability and Visibility

Throughout the inspection, people at all levels were questioned on the subject of management visibility on the site. Managers were also asked what inhibited them from having a greater presence on their plants. We consider that management visibility, communication and feedback at the workplace can have a significant influence on safety performance. Whilst managers accepted that it was important to be seen on the plant, it was a commonly held opinion by them that they were not sufficiently visible on the plant. Plant-based staff confirmed that they did not consider that they saw managers on the plant frequently. As stated before, we were informed by the managers we spoke to that site- and company-wide programmes which are business driven (for example, one element of the Beyond 2000 change programme is driving towards a 25% cut in costs) were diverting as much as 50% of their time from operational matters which may adversely affect plant safety. This led to them being unable to dedicate sufficient time to being on plant. BNFL does not have any expectation of managers as to how visible they should be on the plants, although it had declared its intention to set such standards following earlier criticism by NII.
The Site Head of Environment, Health and Safety is championing the recently introduced 'safety inspection' process. This process is intended to encourage line managers to monitor operations on their plants in order to confirm compliance with instructions and rules, and to identify potential hazards. It also serves to encourage managers to spend time on the plants which they manage and to make managers more visible to their staff. We see this as a positive initiative which should be developed across the site. NII consider that managers should be able to lead by example by actively involving themselves in team and workplace activities in order to promote a positive safety culture. BNFL must ensure that managers have time to undertake the task effectively.
As stated previously, we found some very flat organisational structures within some departments, where Shift Team Leaders were reporting directly to Plant Managers or above on operational matters. In these areas, the workload of the managers was high and they were spending a large proportion of their time on non-operational matters. As a consequence of this, the Shift Team Leaders had very little day to day contact with them. One manager said he tried to visit the plant every other day: another made weekly or fortnightly visits. This is an unsatisfactory situation which does not demonstrate an acceptable level of control and supervision of operations.

Recommendation 9 - BNFL should develop and implement arrangements to ensure that its managers have sufficient time to manage the safe operation of their plants.

We have already noted that substantial effort is being diverted to non safety- related tasks at all management levels. We found at lower management levels additional tasks are being imposed without an adequate analysis of workload being undertaken beforehand. In general, we found the workload associated with identified posts was not sufficiently transparent to allow a fully informed decision on the adequacy of resources in a given area. In a number of areas it is clear that the reduction in staff numbers had gone too far and this view was echoed by managers. We found failure to adequately prioritise work and meet commitments. These all had a negative effect on the availability and visibility of the managers concerned.

Recommendation 10 - BNFL should develop and implement arrangements to ensure that for each person whose activities may affect safety, there is a systematic assessment of roles, responsibilities and workload.

Role of Duly Authorised Persons

The nuclear site licence requires that only suitably qualified and experienced persons (SQEPs) perform duties which may affect the safety of operations on the site. It also requires the appointment of duly authorised persons (DAPs) to control and supervise operations which may affect plant safety.
As part of our inspection we looked for evidence of a clear auditable route from the identification of posts within the structure which are required to be DAPs and SQEPs. We would expect to see a post description, a post training profile and finally a record of satisfactory completion of this training and assessment by the relevant manager that the person fulfilled the requirements of the post. We inspected the processes employed by BNFL to assess and appoint DAPs and how these appointments were periodically reviewed. We inspected to see how BNFL ensured that work carried out by contractors was managed in relation to ensuring that only SQEPs were employed.
We found evidence of the beginnings of good practice relating to producing an auditable trail for SQEPs within the Magnox Reprocessing business area. The development of training profiles, assessment and competence based training in this area should be encouraged. BNFL plans to extend the application of this process to include the more senior grades. THORP also demonstrated good procedures, training packages and enthusiastic training coordinators. However most areas that we inspected could not provide a clear auditable trail with clear up to date records confirming that the required training had been defined, completed and remained in date, and that the person had been formally recognised as a SQEP.
The most common approach to compiling training requirements and records into a job profile was to list the competency requirements in a tabular form and record completion of training, whether local or central, by job holder and line manager adding their signatures against the appropriate requirement. In one area, the bottom of each such page certifies the completion of the essential training requirement and was declared to be the SQEP certificate. However, it was not clear from this approach for what tasks the individual was deemed to be a SQEP. Training records which we examined in another area had not been updated to show refresher training. The individuals concerned stated that they had received refresher training and this was subsequently backed up by the print out from central records. However the absence of up to date records within the plant concerned, weakens the usefulness of associated SQEP certificate.
Some evidence was found of BNFL following up CVs of contractors to ensure they were suitably qualified and experienced to undertake the work. We could find little evidence to suggest that this approach is universally adopted.
We challenged operators', supervisors' and managers' knowledge of operating rules and found that it was variable and sometimes poor. For example we asked a newly-appointed plant manager in one area about his Duly Authorised Person status. He was not certain what this meant with respect to his new job. We found that there was confusion about the appointment and relevance of DAPs and SQEPs across the site. In one area, staff were being told that there were no DAPs, but that they were all SQEPs, which could not be the case. From these observations we challenge the adequacy of BNFL's arrangements for appointing DAPs and SQEPs.
On a site the size of Sellafield with the potential to transfer people between areas and the necessary interactions between business groups, it is surprising that a common transferable system is not in use. We found no site-wide system for ensuring SQEP status, and no common system for assessing and appointing DAPs. We were told that there is scope for using the centrally held training data on the Peoplesoft computer system, though subsequently BNFL has informed us that it is not feasible.
We concluded that apart from pockets of good practice, the maintenance of local training records, the certification of SQEP status and the appointment of DAPs needs to be more clearly defined and controlled. The adoption of common approaches to job profiles and maintenance of DAP and SQEP records would also improve the flexibility of staff across the site.

Recommendation 11 - BNFL should develop and implement a consistent and effective system for the definition, control and recording of safety-related training.

Recommendation 12 - BNFL should develop and implement a consistent and effective system for the appointment of DAPs and SQEPs.

Safety Management Systems

We have noted that lack of time spent on plant by managers can adversely affect safety performance. Safety monitoring is needed to maintain and improve performance thus meeting one of the company's values. It includes reviewing work practices against procedures, and compliance with performance standards. In some safety support functions we were told that only reactive rather than proactive work was being undertaken. We found a lack of monitoring, audit and review which was allowing inappropriate practices to continue. There was evidence of managers condoning poor practice such as operation of a plant with multiple alarms showing in the control room. It was not clear how staff, including managers, could monitor compliance with operating rules which require specific plant configurations to maintain the plant in a safe state. Scrutiny of log books showed tolerance of deviations from intended operational status. We found considerable variability in the follow-up to entries in the hazard log book, including evidence of lack of follow-up and close-out of recommendations. We noted that some events and been inaccurately classified, which indicates a lack of questioning attitude by line management.
We discussed earlier, under Management Structure (see Section 3.1), accountabilities of management staff. We would expect the principles of accountability to apply equally throughout BNFL's staff structure. At the lower levels of the management chain, we questioned if the Business Groups had an accountability system in place. We looked for the robust system mentioned earlier and for evidence of reporting to higher management any significant problems with achieving the accountability targets.
Discussions with staff at lower levels in many areas of the site indicate an absence of clear and comprehensive accountability statements for them on both safety and operational matters. The accountability chains BNFL was developing for senior and middle management levels did not include people at lower levels in the organisation. We found little evidence of an effective system in use across the site for proactively confirming that safety is being managed on plants. As before, we consider this to be a significant deficiency within the safety management system.
As well as the diversity of management arrangements described earlier, there has until recently been a lack of any comprehensive mechanism for identifying good management practices on the Sellafield site and sharing these across the site. Shortcomings with the Sellafield approach to learning from experience are discussed in the paragraphs which follow.

Recommendation 13 - BNFL should develop and implement an effective system to proactively monitor that safety is being managed on plant.

Operational Experience

BNFL has in place arrangements for incident investigation and learning from experience, the phrase it uses to describe Operational Experience Feedback. However we found many problems associated with the implementation of these arrangements. We found examples of events where intended operational control had been lost although safety had not been substantially affected: these events had not been considered by the plants to be reportable. The lack of a formal reporting of these events means that the potential for learning from them can be lost. It is a truism t hat minor events which are not reported cannot be investigated and therefore lessons cannot be learned. The absence of reporting can also be seen as an indication of a poor safety culture and lack of a questioning attitude.
We looked at three incidents which occurred in the past two years and which had previously been investigated by NII. The purpose of the work was to compare BNFL's investigations with those carried out by NII. The comparison involved reviewing BNFL's investigation report, the folder of evidence collected by BNFL's investigation team, NII's internal record of its investigation into the incident and interviewing people in volved in the investigation. This work showed that BNFL's investigations failed to identify some features of those events which NII considered to be of significance.
Many incidents provide a starting point for consideration of alternative outcomes from the initial event. We identified a number of such alternatives which held significant potential for improvement and which we consider that a more inquiring mind should have identified during the course of investigation. Although the team's sample size may be small, the fact that deficiencies were found in most of the cases looked at during this inspection is sufficient for us to conclude that BNFL's investigations are not sufficiently thorough.
We concluded that BNFL's investigations tend to focus on the specific effects of the event and fail to address the safety system failures which led to the event. We also noted the low quantity and the questionable quality of evidential information contained in BNFL's folders of evidence.
Any investigation into an incident needs to identify the immediate or direct causes of the incident, together with the associated root or underlying causes. We found that some of the investigations did not correctly identify some of the immediate and root causes of the incident. We were told that BNFL's training in this area had not produced the quality of investigation it wishes to achieve, and that it is now considering creating a special group of people to manage the investigation of events.
We looked at a sample of reports to see to what extent the investigation considered the relevance of the safety case. Whilst deficiencies in the safety case were identified in a minority of the sample, the majority did not adequately consider this topic. We are aware that another Site Licence Regulation does specifically require the annual review of the safety case to consider the consequences of incidents during the year on the case. However, this approach suffers from the potential loss of the first- hand understanding of the original investigation team.
We looked at a sample of BNFL's investigation reports to see how the potential for learning from experience had been dealt with. We found a large proportion where the features of the incident were not "defocused" out of the specific situation within the incident into a broader statement containing relevant learning points. However, defocusing too far can simply produce "motherhood style" statements. A careful balance of detailed analysis, coupled with an element of lateral thinking and a more open mind, is needed if other departments are to share in the learning from experience process.

Recommendation 14 - BNFL should improve and implement arrangements for the recording, reporting and investigation of incidents

A learning from experience system was set up by BNFL in late 1998. It uses propriety software which provides a multi-access database for recording the event, recommendations, follow-up actions and an action tracking system. The system has problems which BNFL has recognised and is working to rectify. We found signs of frustration in users due to the system's limitations in some areas. We found a substantial shortfall of information on the system even though it existed on paper. In addition following a preliminary sift by the feedback coordinator, only a small fraction of the information on the database is subsequently considered by event review teams. We were concerned that some managers were not aware of incidents elsewhere on the site which had important learning points for them. It was apparent that the system was overlooking what we considered to be substantial learning points and that the learning from experience process is not fully meeting its design intent.

Recommendation 15 - BNFL should improve the learning from experience system and demonstrate to NII that it has become an effective and accepted tool across the site.

As well as learning from events on the site, it is important that a licensee can learn from the experiences of other organisations. We found only informal links exist between BNFL and other licensees to obtain information on lessons learnt from the chemical and nuclear industry at large. Although we understand that BNFL has some formal links which obtain information from the chemical industry, we were unable to find any formal means of disseminating this information within the company. We are aware that there are formal information exchange systems for nuclear reactors which cover not only the UK but also the whole world. BNFL contributes to these systems. We know that BNFL feeds information into a worldwide nuclear chemical plant information exchange system, but there is no equivalent UK based system for nuclear chemical plants.

Recommendation 16 - BNFL should negotiate with other nuclear chemical plant licensees to establish a formal system for the exchange of information.

3.3 Management of Change

Baseline for Safe Operation

The business operations at Sellafield have in recent years been the subject of considerable organisational change with large reductions in staffing levels. The driving force behind identification of staffing levels has been the development of individual business plans to meet the requirements of company targets including cost reductions, including Beyond 2000. This has not allowed identification of resource requirements for the site as a whole. We consider that in order to assess the effects of change to organisational structures or staffing levels, the licensee needs to have defined its baseline resource requirements. The baseline is that level of resource which at a particular point in time is adequate to enable a nuclear licensee to demonstrate that it can operate safely and has the necessary supporting infrastructure in place. The resource analysis should include a clear definition of safety-related tasks and use processes such as task and functional analysis, post profiling and training profile techniques.
We note that BNFL is introducing a process of post-specific technical and behavioural competencies, but does not require the workload of a given post to be analysed. We consider this to be a key parameter for post definition. We were concerned that BNFL does not appear to have evaluated or monitored the potential negative effects on safety that could arise from the introduction of multi-skilling increasing the workload on individuals. Neither has it considered the loss of in-depth experience or the dilution of skills that could arise through the introduction of multi-skilling. The importance we place on the need for a systematic baseline analysis was demonstrated by the introduction in the Summer of 1999 of Licence Condition 36 on management of change.
Except in a limited number of areas where posts were to be lost, we found that BNFL has not undertaken a systematic analysis of its business operations. The purpose of such an analysis is to establish a baseline resourcing level against a defined level of activities. A direct consequence of BNFL only carrying out a systematic resource analysis in a limited number of areas means that in general a baseline level of resourcing has not been established. We consider that this means that it is not possible to make an informed comparison with an existing position when carrying out an organisational or staff change. Establishing a baseline would clearly be of benefit and would enable the required substantiation to be produced in a straightforward way and with the necessary degree of transparency. We consider that BNFL cannot justify any further reduction in staff numbers until it has assessed its baseline resource level..

Recommendation 17 - BNFL should undertake a systematic assessment of the baseline resource levels it requires to undertake its current activities before any further changes to its organisational structure are made

During the inspection we found an inconsistent approach across the site for the identification of minimum staffing levels. Within some plants instructions had been produced detailing a transparent process which had been followed to define staffing levels. However some plant managers we spoke to did not know the basis of the staffing levels that were specified for their plant and could produce no supporting evidence. We consider this latter situation to be a failure to adequately demonstrate that safe operation/shutdown can be maintained.
BNFL informed us that it has in place a new procedure to define minimum staffing levels for both the normal plant operating envelope and for its safe shut down. NII sees the introduction of this procedure as a significant step forward as it will actually require plant managers to be knowledgeable about the process and basis for defining staffing levels, and significantly, it requires an assessment of day to day operations. This should therefore be complementary to the overall baseline assessment of resources discussed earlier in this report. It should also bring about the required consistency of approach across the site, achieve best practice and be transparent to audit.

Recommendation 18 - BNFL should implement its arrangements for the identification of minimum staffing levels

We were informed that skills shortages have been identified in some areas and disciplines which have been brought to the attention of the recently introduced Site Resource Forum. We found in some areas that vacancies have existed for a long time. External recruitment has not been able to be initiated due to managers in other business areas having declared a surplus of staff. We were told that the release of these "surplus" staff has rarely been sanctioned. We consider this to be an unsatisfactory situation and demonstrates the continuing weakness of a business area-focused rather than a site-focused resource strategy.
In order to have confidence that resource shortfalls may not adversely affect safety, managers need to identify those posts which are key to the maintenance of safety. In addition, a licensee needs to have adequate succession plans to fill such posts if a vacancy arises. The concept of key roles and succession planning is included in the Sellafield Site Arrangements Company Human Resources Policy. We were provided with a guidance note produced by HR People Development Group in May 1999. This document identifies key roles to meet business needs and identifies key roles where scarce skills might adversely affect safety if gaps occur, and where senior roles are of "strong regulatory interest".
We found the formal identification of key personnel with roles in the maintenance of safety at plant level to be patchy. We were informed that this requirement, together with that for formal succession planning, is being developed. We welcome BNFL's move towards identification of key roles and formal succession planning .

Recommendation 19 - BNFL should improve and implement its arrangements for the identification of key roles and to fill identified vacancies.

We were informed of an internal review of technical and managerial resource which had identified gaps in particular skill areas. We welcome this development and whilst we are unable to comment on the number of staff that it is proposed to recruit, we would expect to see a systematic assessment of the resource shortfall. We support the Head of Site's view that it is time to take stock of resource, and look forward to seeing BNFL's assessment of the situation and the company's proposals for redressing identified shortfalls.

Management of Change Procedure

BNFL has introduced a management of change procedure which has many of the aspects we would expect to find in a management system for identifying, controlling and managing organisational an d resou rce changes which may affect safety. In order to be effective, such a procedure needs to be systematically applied to an acceptable standard and monitored. We found its application at both organisational and plant level to be of variable quality. For example the process is not always being applied proactively. In some instances we found it had been used to justify reductions in numbers of staff which had already taken place.
We found that insufficient account is being taken during the initial screening process of the potential for a proposal to affect safety if, for example, it were ill-conceived or poorly executed. We looked at examples of changes, some of which had been given major and some minor safety categorisations. We considered that the production of detailed implementation plans to identify timescales, prerequisites (sometimes called "enablers") and contingency plans would have been appropriate in these cases, but they had not been developed. In particular for the major changes required by BNFL's Beyond 2000 change programme, we found that only the highest level aspects of the change had been considered.
We were unable to find implementation plans for the introduction of such significant changes as the new contract although BNFL has informed us that one exists. The new contract, amongst other things, includes the removal of the Chargehands from the organisational structure and introducing new working arrangements. We consider that both of these changes have the potential to affect safety. We were told that the successful implementation of the majority of the corporate level changes is dependent on the completion of enterprise-wide software projects, collectively named Systems Application and Processes, which integrate a number of different software systems for finance, procurement, human resources, operations and maintenance. We were subsequently advised by BNFL that this is not now the case. The implementation of the Systems Application and Processes is a major activity in its own right, and BNFL has a series of projects progressively to bring these into service. No management of change assessments were found providing implementation plans for these projects. We consider that for a project of this nature, the management of change process should have identified the need for implementation plans.
We found that although the process required review of the implementation of the management of change procedure, in the samples examined, a systematic and questioning review of the process had not been undertaken. We consider that any review should cover all stages of the process including categorisation and initial screening, as well as looking at the cumulative effect of any changes.
We found that adequate consultation with stakeholders including plant operators was not always evident. We conclude that although BNFL has the basis of an adequate management of change system in place, it must be more fully developed, implemented, maintained and monitored. We support BNFL's imminent intention to revise the management of change process, and look to the new revision to address application problems which are still evident on the site.

Recommendation 20 - BNFL should improve and implement its management of change procedure.

3.4 Control and Supervision of Safety Related Operations

Plant Operations

Licence condition 26 places a specific requirement on licensees for operations which may affect safety to be carried out under the control and supervision of suitably qualified and experienced persons. For the purposes of this inspection however, we set out to examine the wider aspects of BNFL's arrangements for the management of operations.
We were unable to find any arrangements in place relating to the wider aspects of the control and supervision of operations, other than its arrangements for compliance with licence condition 26. BNFL had recognised this deficiency and set up an initiative to develop standards and establish processes for the control and supervision of operations. At the time of the inspection, this project was still in its infancy .
HSE has published a statement of the criteria which NII uses to judge the adequacy of systems for the Management for Safety at Nuclear Installations⁸. This includes guidance on the subject of operational control. Amongst the features relevant to the control and supervision of operations are, operation of the plant within the operating constraints of the safety case and in line with appropriate instructions, visible supervisory control, competent staff and good communications. The effective monitoring and review of performance is also key to maintaining and improving performance.
During the inspection we found that amongst plant operators and supervisors, the knowledge and visibility of operating rules and safety mechanisms was variable and at times poor. The ability of operators and supervisors to demonstrate positive compliance with operating rules was generally poor. Operating rules define the limits and conditions of the safety case and it is therefore important that the plant operators comply with these limits and conditions.
Best practice within the nuclear industry for demonstrating positive compliance with the operating rules employs an operating rule compliance schedule. Such a system is based on a systematic process which takes each operating rule in turn and defines in a schedule who is responsible for compliance, how this compliance is achieved, how it is recorded and how frequently it should be checked. The rigour of such an approach has additional benefits; it raises the profile of operating rules with the plant managers and operators and often leads to the plant operators challenging the safety case producers to derive operating rules that are less complicated and more simple to comply with.
We found little evidence of routine monitoring or auditing by supervisors and managers to ensure that operating instructions and safety related documentation were being complied with. We also observed poor practices with the use of controlled copies of instructions and unauthorised summaries of operating rules at the point of work. From these observations we conclude that BNFL's arrangements for ensuring that plants are operated within the constraints of the safety case, and in line with appropriate instructions, are generally only just tolerable.
The quality of operational logs and records was sampled on a number of different plants. There was little guidance in the local instructions as to what should be in the logs. We saw a number of plant record sheets that had no identifying references on them. Generally logs were well filled in and contained a reasonable level of detail. Some adopted what we consider as best practice in that both the outgoing and incoming shifts signed the logs.

Recommendation 21 - BNFL should develop and implement a proactive system for operators to confirm that plant is being operated within its safety envelope.

In reviewing the operational logs for a number of plants, we found several examples where it was recorded that some degree of operational control had been lost. Although we note that safety had not been affected in those cases, no follow- up action was taken by plant managers. We consider this to be indicative of a lack of effective monitoring of plant performance.

Recommendation 22 - BNFL should develop and implement a system for following up deviations from normal operations.

We noted a lack of systems for controlling the configuration of plant and equipment in its intended operational state. Such systems are widely used elsewhere in the nuclear industry as part of the arrangements for ensuring that plant and operations remain within the safety envelope. In several plants we also observed that the state of labelling of plant and equipment was poor, particularly in the older plants, which we consider is not conducive to safe operations.
A number of good practices are used elsewhere in the industry to ensure that the correct plant configuration is maintained, with the detailed arrangements depending on whether the security of the plant is paramount or whether the plant might need to be reconfigured during an emergency or abnormal condition. For example where the security of the plant is paramount, it might be appropriate to padlock valves or even insert blanking plates into the pipelines. On the other hand, where swift reconfiguration of a number of valves is required to bring alternative systems into use, it may be more appropriate to use easy to break plastic chains with identification tags. (The purpose of the identification tag is to provide adequate control over the valves during maintenance through a "tag out" system).

Recommendation 23 - BNFL should develop and implement a system for the control of plant configuration, which includes appropriate labelling of plant and equipment.

Maintenance

Licence condition 28 requires a licensee to put in place arrangements for the regular and systematic maintenance of plant. In response BNFL has put in place a set of arrangements which are subject to ongoing inspection as part of NII's routine inspection programme. For the purposes of this team inspection therefore we focused on BNFL's arrangements for ensuring the nuclear safety of operational plant and the protection of personnel whilst undergoing maintenance. BNFL effects such control by means of safe systems of work. A Code of Practice for safe systems of work is well established at Sellafield and is used to describe the mandatory methods and guidance for use by people working on plants. BNFL carried out a review of its safe systems of work earlier in 1999 and concluded that whilst the systems themselves were generally satisfactory, improvements were required with implementation of the systems across the site.
We examined the use of a variety of safe systems of work on plants undergoing maintenance at the time of the inspection. The various types of safe systems of work covered by the code of practice include : 'Do It', Approved Scheme of Work, Permit to Work, Plant Instruction and Operating Instruction. We found that there were significant variations across the site in the application of these safe systems of work.
The 'Do It' system is by design relatively informal. If appropriately applied, as in THORP, it can still provide an auditable trail for the work. However in some of the examples examined, the absence of written information meant that no auditable trail was available.
Guidance on Permit to Work systems in the petroleum industry¹¹ defines a Permit to Work system as "a formal written system used to control certain types of work which are identified as potentially hazardous. It is also a means of communication between management, plant supervisors and operators and those who carry out the hazardous work. A Permit to Work system aims to ensure that proper consideration is given to the risks of a particular job. The Permit is a written document which authorises certain people to carry out specific work, at a certain time, and which sets out the main precautions needed to complete the job safely. Some jobs may also require the production of a detailed written method statement".
We found a tendency to use Permits for routine tasks, rather than Approved Schemes of Work, which would be more appropriate for jobs of a routine nature where the risk assessment can be standardised. The wider use of Approved Schemes of Work would reduce the workload on Permit issuers and allow them to devote more time to the preparation of assessments for non-routine work which require a Permit. We also found that in general, Permit Offices hold insufficient information to support Permit issuers in maintaining an adequate control regime. Overall, we concluded that BNFL could bring about a significant improvement by adopting current best practices for the implementation of these various systems of work on a site-wide basis.

Recommendation 24 - BNFL should identify its best practices on the application of safe systems of work and implement them on a site-wide basis.

An important feature for ensuring the safe state of the plant when carrying out maintenance activities is the control of the removal/isolation of safety related equipment to allow maintenance, and of the subsequent return of the plant or equipment to service. Failure to safely control removal/isolation could result in an immediate radiological risk to staff and possibly the public. In some plants, a formal document was prepared for the handover of plant, but in other areas handover was limited merely to verbal confirmation of the state of the plant. We consider that BNFL should have a single effective system for controlling the removal from service and return to duty of safety-related equipment.
We found variable application of the arrangements for the isolation of plant and equipment. In several instances, we found that isolation certificates were being used as a means of specifying the work to be done, rather than as a means of confirming that plant had been satisfactorily isolated from the nuclear hazard and was safe to work on. We found that the responsibility for achieving isolations was given to the maintenance teams and did not reside, as we would have expected, with the operations teams.

Recommendation 25 - BNFL should improve and implement a system for the isolation, handover and handback of plant and equipment.

Construction/Commissioning

Most of the large scale construction work on the Sellafield site is carried out under the control of the Resident Engineer's Department. At the time of the inspection, approximately 2,500 people were employed on construction projects. The Resident Engineer's Department does not actually manage contractors' work directly: its role is to set down the requirements for construction work and to ensure compliance with these. In order to achieve this, separate management arrangements have been established for construction work, with the requirements of the relevant Sellafield Safety Regulations being implemented through a set of Sellafield Site Instructions which are mandatory for all contractors. These management arrangements are reinforced by regular compliance audits carried out independently by the Resident Engineer's staff.
We inspected a number of construction projects looking at compliance with relevant legal requirements and industry standards. In general we found that compliance was of a high standard. We consider that these standards were being achieved because of the existence of a Resident Engineer's system for the management of contractors, including the regular auditing of compliance with these arrangements .

[back to top]

3.5 Safety Culture

We did not specifically look at safety culture using the HSE's Health and Safety Climate Survey Tool. Rather we have derived our views based on observations whilst undertaking the inspection. We therefore report on a number of specific observations.
Elements we would expect to see in a good safety culture include learning from experience, encouragement to report minor happenings (no blame culture), a proactive management and good communications. We inspected a number of activities which had previously been subject to incidents to see how learning points had been picked up. We were disappointed to find failures to learn from experience in most of our sample. We were more concerned to observe that the learning points from two Improvement Notices served by HSE within the past year on BNFL had not been effectively taken up across the company.
An example of particular concern was the considered response of a senior level manager to justify one such failure He based his justification on a claim that the risk was under control and hence was acceptable. This argument was fundamentally flawed given that for the particular situation, action could have been taken to remove the risk at the point in time it was created. Furthermore, if proper planning had taken place, the risk would have never been created in the first place.
We found plant log book entries which in our opinion warranted being reported as either a happening or event. Although the numbers were not large given the small size of our sample, we consider that these observations are indicative of a failure by people who are responsible for reporting happenings or events, which is not acceptable. We noted the tolerance by management on a number of plants of the Hazard Log book entry not being properly closed-out in a timely manner. We found examples where staff on plant were not aware of incidents elsewhere on site which had substantive learning points for them. It appeared to us that there were too many occasions where the event review teams failed to derive lessons from events. We recognise that BNFL is aware of this shortfall and is putting in efforts to improve its learning from experience system.
In one plant we noted that staff were of the view that if safety had not been affected at the time, then an occurrence where the intended operational control had been lost was not reportable under the site system for reporting happenings, events and incidents. We consider this reflects a lack of understanding of the need to learn from such occurrences. In another plant we observed that this view had even been reinforced by the provision of an operating instruction which covered a recovery operation to bring the product back within specification. We suggest that BNFL should be spending effort to minimise such events rather than putting the effort in to recover the situation or more succinctly, "get it right first time".
In one example we learned that one of two duplicate pieces of equipment, which was a safety mechanism, had been defective for a considerable period of time. Staff argued that it was not necessary to repair it, as the safety case was based on the availability of a single piece of equipment. We consider that given duplicated equipment had been provided, it would have been reasonably practicable to repair or replace the defective item, so as to maintain the levels of safety which had initially been designed into the plant.
We observed operators in some of the older plants running them with a number of systems in an alarm state. The numbers involved were sufficient to be poor practice. We noted operators using uncontrolled copies of operating instructions at work locations and in one case a temporary instruction, posted up for use despite it having been formally withdrawn. We believe that if copies of instructions are required at work locations, normal quality assurance requires that they should be subject to control procedures.
We found that there were widely varying working cultures and practices across the site, particularly apparent with the general process worker and skilled trade positions. We noted a relationship between the age of the plant and the working practices adopted. In some of the more modern plants, there was a flexible approach to worker skilling and the basis of allocating tasks to individuals. We understand this flexibility was possible because staff had been trained and encouraged to build up actual work experience in different skills from those for which they were originally trained or that their jobs formerly required. We observed in some of the older plants, the practice was to retain an approach of almost single skill areas for process workers and skilled trade positions. We found that the staff in these areas in general felt less valued than those in the areas of more flexible working.
An important indicator of a safety culture is the so called no blame culture. This encourages people who have found something wrong or done something inappropriate to report the matter so that colleagues can learn to avoid the event. It is important to emphasise that there is a difference between a no blame and a no discipline culture. There will be times in a no blame culture where disciplinary action has to be considered because of the nature of the event. We looked at a small number of investigations for evidence of this no blame culture.
Whilst not wishing to comment on the appropriateness or otherwise of any specific disciplinary action, we note from the sample of incidents studied that the effect of BNFL Sellafield's shift in attitude to following-up events is often to challenge either the individual, or his or her immediate supervisor. This can be seen to be in line with BNFL's recent exhortations that people must comply with their instructions. However, in the sample of incidents we specifically examined, we observed that behind any deficiency in an individual's performance was often a trail of poor standards which had been tolerated by management. In the sample of incidents we examined, it appeared that higher levels of management were unaware of day to day custom and practice. When the custom and practice was brought to their attention by an incident, they considered the custom and practice to be unacceptable. We note that concern amongst employees and others such as contractors at BNFL Sellafield, and the sense of injustice which is engendered, has grown within the past year.
We noted a lack of critical questioning attitude by staff, for example when considering the potential impact of a modification proposal if it were inadequately conceived or executed

Recommendation 26 - BNFL should implement a programme to improve the safety behaviour of staff and management.

It is inevitable that some staff will fall short of perfection in matching their deeds with their words. For example we have already noted that at the highest level, the company has not reissued the company vision statement or updated the Company Manual. We have examples of similar failings across all levels within BNFL. We consider the shortcomings are sufficient to warrant BNFL taking remedial action. Key areas which we have identified during our inspection are ensuring consultation with all stakeholders, delivering the requirements of high level company documentation, ensuring that a better balance of communication is achieved (good news versus bad news reporting), dealing with incidents and associated potential disciplinary action, and ensuring actions are properly closed out.

Recommendation 27 - BNFL should review the resources available to and the expertise of management and demonstrate to NII that this is sufficient to ensure that management's actions match their words.

[back to top]

3.6 Recent BNFL Safety Initiatives

During preparations for the inspection in discussions with NII, both the previous and current Heads of Site had acknowledged the need for significant improvements in safety performance at Sellafield. This recognition, developed by the new senior management team at Sellafield, had led to the introduction of several safety initiatives during the months immediately prior to the inspection. The more significant of these are being brought together under the "Sellafield Site Safety Project". The initiatives covered by this project include;
- review of requirements for control and supervision;
- behavioural safety;
- compliance workshops;
- management of regulatory commitments;
- communication improvements;
- safety partnership forum;
- learning from experience;
- peer reviews;
- Sellafield annual safety conference;
- Sellafield management seminars.

Each initiative, when viewed in isolation, has the potential to bring about an improvement in safety performance at Sellafield. However we consider that the totality of these initiatives is adversely affecting the management resources required to consider, develop and implement them, as well as creating an 'initiative overload' on the people who are expected to respond to these initiatives.

Recommendation 28 - BNFL should rationalise and prioritise the current safety initiatives in order to avoid initiative overload and minimise the impact on the workload of management.

4. CONCLUSIONS

Many of the findings and recommendations reported in Section 3 confirm the four common observations made by NII during its routine inspection activities prior to the team inspection, namely :
- lack of consistency across the site;
- inadequate control and supervision of operations;
- overloading of supervisors and middle managers;
- poor safety culture in many areas of the site.
A number of good points were identified during the inspection and we highlight as a notable example, the quality of safety management on the construction sites. This shows that BNFL can achieve a quality safety management system delivering high standards, and we attribute this in large measure to the strength of auditing in the areas for which the Resident Engineer has responsibility.
We are pleased to see that BNFL has initiated a number of improvements to its safety management system at the site. We agree with a need to focus on accountability, i.e. ensuring that those people responsible for delivering a product, do deliver it and to the required standard. These changes are still being developed and thus we are unable to make any comment on the extent to which they may be effective. We observe however that holding people accountable may be insufficient to ensure that the required standards are maintained. Unless there are proactive systems for checking that the required standards are being maintained, non-compliances are likely either to go undetected, or may have caused significant problems by the time they are detected.
We consider that there are three key conclusions from this inspection. The first is that there is a lack of a high quality safety management system across the site which is compounded by an overly complex management structure. The second is that there are insufficient resources to implement even the existing safety management system. The third is a lack of an effective independent inspection, auditing and review system within BNFL. Without a vigorous independent inspection, auditing and review system, we do not see how BNFL can make acceptable and timely progress in delivering a high quality safety management system across the site.
NII has required BNFL to produce a programme within 2 months for responding to the recommendations of this report. Progress will be monitored as part of NII's normal process of regulation. Should progress be inadequate, NII will not hesitate to use its enforcement powers.

Added to the HSE website 18th February 2000

Nuclear home