The situation (1996 to 1999)
Clinton Power Station, operated by Illinois Power six miles east of Clinton, Illinois, shut down in September 1996. It stayed down.
In August 1997 the NRC proposed a $110,000 civil penalty over the failure of safety-related electrical breakers. The fine is not the part worth reading. The staff declined to give the plant credit for its corrective actions, on the stated grounds that the fixes the licensee proposed addressed the specific breakers and did not address the broader problem of repetitive equipment failures. There had been a related violation two years before that.
In January 1998 the NRC added Clinton to its Watch List of plants warranting increased regulatory attention. In June 1998 it issued an order confirming corrective actions on fire barriers. Through all of it the agency was running a restart readiness review, which would eventually cover April 1997 through January 1999.
A plant with a payroll and a fuel bill and no product, and a regulator that had stopped taking its word for anything.
Andrew was engaged by the chief executive and worked as advisor to him, which is the role now called Fractional COO. The assignment was the two things the regulator kept returning to: the corrective action program, and the restart readiness plan and the assessment behind it. The corrective action work reported to the Chief Nuclear Officer.
What we did
When the NRC published its readiness review findings in April 1999, the three recurring concerns it named were operator performance, implementation of the corrective action program, and resolution of engineering design issues. Two of those three were the assignment, and they had been the assignment from the start.
- Gave the corrective action program somewhere to put a management cause. The program the plant was running could classify a failure as an equipment problem or as a human performance problem. It had no executive management level and no organizational and programmatic level. Those two categories were simply absent.
- That is a structural defect and it is close to invisible from inside, because the program keeps working. Every event gets investigated. Every investigation reaches a cause. The cause is always a component that failed or a person who erred, because those are the only two answers the classification allows, and the corrective action is therefore always a repair or a retraining. A plant can run that program faithfully for years and never once record that a management decision produced the event, or that the program itself did.
- Both levels were established and put into use. Adding them changes what an investigation is permitted to conclude, which changes what gets trended, which changes what gets fixed.
- Trained the people who run it on the four things the program lives or dies on. Investigation, monitoring, trending and preventive action. Those four are a sequence and most programs break at the third. Investigation quality sets the ceiling on everything downstream. Monitoring is what keeps an open item open. Trending is what turns a pile of individually closed events into a visible pattern, and it is the step that a plant under pressure quietly drops, because closing items feels like progress and trending them feels like paperwork. Preventive action is the only part of the whole apparatus that gets ahead of anything.
- Facilitated the readiness plan and the assessment, then led the assessment and the submittal to the NRC. Both halves, not one. A restart readiness plan is what the plant tells its regulator it will have fixed, proven and demonstrated before it asks to come back up. The assessment is the evidence that it did. The plan here was built by the plant's own leadership working jointly, with Pilot facilitating, because a plan the leadership team did not build is a plan it cannot defend in the room. The assessment and the submittal were led by Pilot, because grading yourself in front of a regulator that has already served you a penalty for corrective actions it judged inadequate takes someone with no career inside the building.
The mechanism
Why it worked
A plant in this condition has a regulator problem that everyone inside mistakes for a technical problem. The equipment issues are real and they are also the easy part. What keeps a plant down is that the regulator no longer believes the organization can find its own problems, and no amount of fixing individual findings restores that belief.
Look at what the missing failure-mode levels were doing to that belief, and note that the regulator had already described the problem without using those words. Its stated reason for refusing corrective action credit in 1997 was that the plant's fixes addressed the specific breakers rather than the broader problem of repetitive equipment failures. That is the defect exactly. A program that can only classify a cause as a component or a person can only produce a fix aimed at that component or that person, so it will keep producing narrow fixes to a repeating problem no matter how diligently it is run.
A regulator reading a year of those findings draws one of two conclusions. Either the organization cannot see its own management contribution, or it can and will not write it down. Neither one gets a plant restarted, and no volume of closed corrective action items argues against either, because the closed items are the evidence.
So the fix was not to work the findings harder. It was to build a program capable of producing a different kind of finding, and then to let the regulator watch it produce one. A corrective action program that can name an executive or programmatic cause, staffed by people trained to investigate and trend rather than to close, starts surfacing problems the regulator has not found yet. That is the only thing that rebuilds the belief, and it is behavioral rather than technical, which is why it could not be handed to the engineering department. The behavior that had to change belonged to people who were graded on not having problems.
The readiness assessment is the second instrument and it proves the matching point. A plant that can grade itself accurately, in writing, before its regulator does has demonstrated the one capability the Watch List exists to question.
The same mechanism runs a manufacturing business with a customer in the regulator's chair. A plant whose incident reports all end at operator error has a corrective action program that structurally cannot find a management cause, and its customer eventually works that out. A plant that reports its own misses before the customer finds them keeps the account. A plant that waits to be caught loses it, and loses it over a smaller problem than the one it was covering.
The result
#1
Fastest NRC restart
100+
Violations closed
1,300
Employees
On April 27, 1999 the NRC staff found the improvements at Clinton sufficient for resumption of operation. At the senior management meeting held the week before, on April 20 and 21, the agency moved the plant off the Watch List and into regional focus.
Thirty-one months from shutdown to that finding, for a plant that spent the middle of it on the Watch List and under a penalty the regulator had imposed specifically because it did not believe the plant's corrective actions reached the real problem. It was the fastest return to service in U.S. nuclear power history.
What they owned afterward
The leadership team kept a corrective action program that could name a management cause, people trained to trend rather than to close, and a self-assessment practice that graded the plant before the regulator did.
That last one is the asset. Restart is an event. An organization that can accurately assess its own readiness, and put its name on that assessment in front of the body that can shut it down, does not need an outsider the next time it is questioned.