9.  The unacceptable practice continues of consigning ILW to the wet silo where it is accumulated in an irretrievable form.

  10.  Active handling facilities (D1217, D2001, D2670) no longer needed for their original purpose are being used to accumulate and "store" large quantities of waste including much fuel; uses for which they were never designed for. All still require POCO, as do the many redundant flasks associated with their operations. D1217 is being used as a fully operational fuel "store" but it is under a care and maintenance regime. Some of the waste has been transferred to "paint cans" but much has either been accumulated into piles or simply left where it was found. The waste accumulation is an ever-growing problem because there has been a two year old problem associated with the satisfactory refurbishment of one of the two 6021 flasks that services the waste posting cell.

  11.  The waste management problem is now compounded by the fact that the waste posting cell, which is pivotal to the success of waste management operations, is itself currently unserviceable. It is not just the problem of the failed waste counter itself, there is also the fact that the cell is literally overfilled with waste arisings to the extent that it cannot even be used for its intended purpose without first having an extensive clear-out.

  12.  Even when the waste posting cell is back in service, it will be unable to cope with the changed needs of the site and FCA, and it will continue to represent a very vulnerable bottleneck to waste processing, particular when the silo "route" is finally closed. Some of the FCA plants are already awash with waste and more will be arriving as decommissioning proceeds. If the problem is not satisfactorily resolved now, in the light of an accurate waste inventory and associated decommissioning-and-waste management strategy, then that strategy will fail.

  13.  Waste management in plants such as D1203 is reaching crisis point with more C-bins in the building than it can reasonably cope with. The overflow of these into ISOs can only be viewed as a temporary stop-gap. The use of ISOs raises questions on a number of matters including compliance with licence conditions 16 and 32, SAMs and emergency arrangements.

  14.  Given the situation regarding POG's waste management, it is difficult to see any influence of an effective, long term strategy that has been formulated taking into account the problems posed by the very nature of the POG plants. Their age, physical condition, interrelationships and the apparent conflict between, on the one hand, a desire for continued operations and on the other, the clear need for POCO and decommissioning, do not appear to have been effectively addressed in any clear and structured strategy for the future.

POCO OUTSTANDING FOR A NUMBER OF FACILITIES, INCLUDING SOME ALREADY IN "CARE AND MAINTENANCE".

  15. A number of active handling facilities continue to hold the materials that were being worked on when the reactor programme was cancelled (D1200, D1217, D2001, D2670). The staff who operated the facilities are reportedly no longer employed and so the operators today have a less than full knowledge of what they are being asked to deal with. Some facilities have been "downgraded" to a care and maintenance regime when they are clearly required to be maintained in a fully operational mode (eg D1200, D1217) and where this is the case there is a need to review the situation.

the case there is a need to review the situation.LAB 33: SIMPLY UNACCEPTABLE

  16.  No notes are necessary to clarify the issues of concern.

OPERATING PLANT IN "CARE AND MAINTENANCE"

  17.  This relates to the D1217 situation and those facilities in D1200 where POCO has not occurred.

SAFETY CASES

  18.  This category of observations is fundamental to the way forward, not just for new safety cases but perhaps more importantly for the programme of review/revision and update of existing ones. Notwithstanding the fact that NII may have played some part in safety cases in the past, there is an urgent need to return to the basics of just what a safety case is for, what it should contain and how its various aspects should be addressed. In returning to basics before moving forward again, the following should be included in the matters to be addressed:

—  plant design and engineering condition, both in the light of modern standards

—  Many of the plants are very old and their condition sometimes uncertain and unpredictable (eg D1206). In some instances, having inspected a plant, it is extremely difficult to then identify that plant's true condition from the description that appears in its safety case. Comparisons of plant condition with modern standards are consequently unfounded and complacent. Reliance is placed solely on arguments of reasonable practicability irrespective of the sheer size of the gap that exists in some cases between the existing condition and modern expectations (eg lab 33, D1204, D1206, D1208, D1200 etc.).

—  operating directives, operating rules, maintenance schedules (EMITS), safety mechanisms (Key Safety Related Equipment?)

All these should be derived and then justified from within the written safety case itself so that each is seen to be addressed in the proper context to produce a self contained and complete case. However, in practice:

—  The operating directives are significantly influenced by the "advice" proffered by the SWP, which adopts a quasi-executive role.


—  Traditionally, operating rules are kept to a minimum to "raise the level of their importance".


—  EMIT schedules are constructed by the ATO-holder in conjunction with the soon-to-be-divested ESG.


—  Plants are operated according to their operating directives rather than their safety cases.


—  Safety mechanisms are not an established concept.


—  As a consequence of the above, the plant operational safety justification becomes a blend of inputs, some of which are historical, which serve to cloud the issues of justification and the responsibility of the Head of POG.

It is the safety case itself—the written justification of continued safe operation, where the technical arguments for all of the above should be found. It should include the identification/derivation/justification of all the above, to demonstrate their adequacy, suitability and sufficiency. Licence condition 23 includes an absolute requirement for such a case and adequate arrangements made under licence conditions including 14, 15, 19-22 and 35 should then enable its maintenance as a "living" document.

—  nuclear safety assessments (criticality assessments), conditions and limits

—  Nuclear safety assessments (criticality assessments) should all be an integral part of the plant's safety case so that it is complete in all its aspects, thereby ensuring the assessments are all subject to the same careful control as is the safety case itself.


—  The SAM system and the system for nuclear safety (criticality control) appear to be working as two parallel, separate systems where it comes to both so-called "minor assessments" and modifications to plants that already hold a criticality clearance certificate. It is also not being applied correctly to new plants where the operational dose is less than 5 mSv, even though the plant's operations involve fissile material, eg D1231 store, which was categorised as a SAM D: no effect on safety.


—  The criteria for "minor assessments" are less than comprehensive and are open to beneficial interpretation for the sake of operational convenience.


—  The UKAEA at Dounreay is now very close to losing its expertise in nuclear safety assessments, having chosen to include this function in the divestment of AEAT. The site still possesses a UKAEA post of Criticality Safety Officer (CSO) but this is seen as being, at best, a tenuous claim to its maintaining control of work with fissile material. Major peer review is undertaken by AEAT at Risley and, with the exception of the contribution of the CSO, the SWP criticality sub group's subject-specific expertise resides almost wholly with AEAT staff. The role of the CSO post does not include any critical scrutiny or monitoring of the activities of the divested AEAT criticality section. Under the above circumstances it is difficult to see, with regard to criticality assessments, how the UKAEA is still meeting its licensee's duty of maintaining control.

—  SWP involvement

—  The SWP should really provide advice to the Head of POG to assist him in his executive decisions relating to POG's plants. However, where operating rules and operating directives are concerned, the SWP appears to act with quasi-executive authority itself, thereby clouding the issue of responsibility. It has no clear terms of reference relative to POG operations, the head of POG or indeed, the DNSC itself. Also, the SWP has a very large membership which raises questions about both membership criteria and its ability to effectively and efficiently discharge its duties.

 PROJECT CATEGORISATION AND SUB-DIVISION

  19.  Projects are being under-categorised, eg remediation of temporary D1208 ventilation system, D1206 effluent monitoring system replacement, turnstile replacement in D1209, D1231 store, C-bin storage in D1203 intended office space, D1206 RRP ventilation system, D2670 AgII rig, D1211, etc replacement.

  20.  Projects are being sub-divided into a number of components that will each then be considered as a project in its own right, thereby attracting lower SAM categories than the project as a whole rightfully deserves, eg the temporary D1208 ventilation system, D1211, etc replacement, the replacement D1208 ventilation system.

  21.  The hazard of criticality is not being afforded the respect it deserves and projects associated with fissile material that do not breach a 5 mSv operational limit are being categorised as a SAM D: no effect on safety, eg D1231 store.

  22.  So-called "minor assessments" for nuclear safety (criticality) have few guidelines or control and seem to be outside the SAM system completely.

  23.  There are examples of "liberal" interpretation of minor assessments to suit operational convenience, eg the storage of arrays of sample bottles on the floor in several areas of D1203 because storage racks are full.

MAINTENANCE PROCEDURES AND EQUIPMENT LISTS

  24.  Plant maintenance procedures (planned maintenance instructions) still do not exist for many of the items on MITS and PIMS A; equipment lists are likewise incomplete. The need for their completion does not appear to have been a consideration in the ESG divestment proposals.

SQEPS, DAPS AND TRAINING

  25.  This category of observations includes several observations that do not easily fit into any of the other categories but taken together, they raise concern regarding fundamental aspects of the management of safety. The observations relate to:

—  "reading across" a criticality clearance/letter of comfort from one particular situation to another (D1203)

—  in a supervisors instruction: the absence of any means of complying with a recently changed operating rule (D1208)

—  out of date training records (D1206)

—  poorly defined training requirements/standards, as exemplified by:

—  the currency of a plant or maintenance supervisor's knowledge in relation to their particular duty is not routinely revalidated as it would be if they were duly authorised.


—  a supervisor's need for assistance in his efforts to demonstrate compliance with an operating rule.


—  a supervisor's incomplete training and consequent inability to recount the plant operating rules or to describe what an operating directive is (both subjects are mandatory training requirements for supervisors).


—  a supervisor's inability to explain the contents of a "routines" sheet.


—  recently introduced standing instructions that conflicted with the plant instructions, thereby causing some confusion on the part of the supervisor.

ATOS, ATO-HOLDERS, BUREAUCRACY AND SWPS

  26.  Above the ATO-holders, there is a vacuum instead of a shared responsibility for safety. The vacuum is filled only when the post of Site Director is reached. In between the two, nobody shares the burden of the ATO-holder and the Site Director is too remote to do so himself. The head of POG and the POG Departmental Heads all have responsibilities that are declared in the POG organisational chart to be solely associated with commercial and production considerations. Thus the plant managers, as ATO-holders, appear to be required to shoulder a burden of safety responsibility that they cannot reasonably be expected to discharge, given their position in the organisation and its corresponding command of capital, resources, priorities and attention. Some have multi-plant responsibilities which merely serve to compound their particular problems.

  27.  The ATO-holders appear to be particularly pressed for time, given the expansion of their duties and responsibilities, and the reduction in support staff that is reported to have taken place in the last few years. This reduction has been taken to the point where the expertise to both operate and support the plant is no longer available in-house, eg contractors have had to be brought in to remedy the widespread and significant deficiencies in D1203 operating instructions and bring them all up to date. As noted above, some ATO-holders have multi-plant responsibilities which seem excessive given their position in the organisation. The situation of undermanning is not just restricted to operations however and plant maintenance instructions for safety related equipment on MITS and PIMS A remain incomplete, as do equipment lists.

  28.  The CSIs address the safety responsibilities of the ATO-holder but the ATO itself does not mention the word "safety" once in its requirements. Its renewal is a bureaucratic process that is founded on the SWP sitting in judgement of the plant's recent operational history. The decision itself should not rest with the SWP but with the Head of POG, after taking the advice of the SWP about the adequacy of the safety case to support a plant's continued operation into the future, following a review of the case in the light of recent operational experience.

NUCLEAR SITE LICENCE CONDITIONS AND CSIS

  29.  Licence condition arrangement requirements are embodied in the CSIs but these are written more to hold together a collection of separate business centres spread across a number of sites than to accurately reflect the needs of Dounreay's particular operations and problems. Rather than being a set of policies and general principles written for local interpretation and implementation, that could then be tailored to best suit the needs of a particular site, their detail and requirements are such that any scope for interpretation is limited. While the approach may have been appropriate in the past, it no longer represents the situation at Dounreay where a site director is in overall charge of a unitary DMT.

  30.  Because the CSIs are detailed documents that are centrally driven, it is not possible for the Dounreay Director to quickly or easily change arrangements to suit the particular needs of what is now "his" site, if the post is to have any real meaning. The recent "disappearance" from the CSIs of the post of Criticality Safety Officer is a very good example: the continued existence of the post is essential to the case for UKAEA at Dounreay remaining an "intelligent customer", and yet it is no longer seen as being a formal requirement by the corporate centre. Also, there are a number of licence condition issues at Dounreay that cannot be resolved by the site itself, even though their early resolution there would be of benefit to its drive to improve the management of safety (eg DAPs, safety cases, maintenance service support by contractors).

  31.  The way in which the CSIs are constructed veils the licence conditions and their requirements from the view of most managers. Their understanding of both is consequently less than might reasonably be expected from a licensee.

CONFLICT BETWEEN POG OPERATIONS AND DMT/LOSS OF CONTROL/TIMESCALES: "US AND THEM" ATTITUDES AND INTERFACE MANAGEMENT

  32.  The introduction of contractors to support the management of the site has been done in such a way that UKAEA staff in POG feel alienated towards DMT. This has led to a number of "us and them" issues developing where the staff of POG, who are all UKAEA employees, have seen their control diminished in relation to the safety-related projects, priorities and timescales associated with their plants. Certainly, they do not see themselves as being an integral part of DMT and they report that DMT sets priorities, even though POG is meant to be part of that organisation. A strong management control of such interfaces is vital both to the continued well-being of the plants affected by them and to help engender a stronger feeling that everyone is working for the same organisation: UKAEA itself.

CONCLUSIONS

  33.  It is important to bear in mind that the deficiencies reported here arise as a result of the legacy to the site from both its past and recent histories. Each of these histories is very different but nevertheless, each has played its particular part in the legacy: very old plants, intended initially for demonstration and support purposes only, and which had been left behind by the march of modern standards, were overnight turned into production plants and fuel or waste stores. The shielded, active handling facilities that once supported the fast reactor programme were no longer needed, as indeed were the staff who operated them. Consequently many of those facilities are still awaiting POCO today. Staff numbers in the mean time have been replenished by both managing, and decommissioning, contractors. In its quest to satisfy government's requirements then, the overall effect of such significant changes, in the absence of an adequate strategy for the management of change, has been for the corporate UKAEA to lose sight of its duties as a licensee at Dounreay.

  34.  The attached observations clearly contain some matters that will require urgent, short term action by UKAEA and others that will demand a sustained effort over a longer period. It also remains for UKAEA to take the necessary steps to satisfy itself that others of a similar nature do not remain hidden from consideration elsewhere. Over and above the remedying of the identified matters however, is the need for UKAEA to address the issue at Dounreay of its ability to discharge its duties as a licensee. This is not to say that NII, as UKAEA's regulator, is wholly free of some of the burden of responsibility.

June 1997