Sellafield - Inspection ID: 53369 | Office for Nuclear Regulation

Executive summary

Date(s) of inspection:

July 2025

Aim of inspection

The purpose of this intervention was to seek assurance that there is a justified baseline covering both the emergency preparedness function and emergency response activities with sufficient resources available to respond to a prolonged event, and/or one with very severe consequences caused by a beyond design basis event , or by multiple factors that materialise in parallel. The intervention also sought assurance regarding adequate succession planning for key roles to ensure continuity of capability and capacity for emergency response (under the control of Security & Resilience).

Subject(s) of inspection

LC11 - Emergency arrangements - Rating: Amber
LC36 - Organisational capability - Rating: Amber

Key findings, inspector's opinions and reasons for judgement made

I, the Site Inspector for the Site Management at the Sellafield Site in Cumbria, supported by a Leadership and Management for Safety specialist inspector undertook a licence condition inspection with a focus on the organisational resilience of Security & Resilience (Operations). The inspection covered Licence Condition 11 (LC 11) and Licence Condition 36 (LC 36). The purpose of LC 11 is to ensure that the licensee implements adequate arrangements for dealing with any accident or emergency arising on the site and their effects. The purpose of LC 36 is to ensure that the licensee provides and maintains adequate financial and human resources to ensure the safe operation of the licensed site.

The purpose of the intervention was to seek assurance that there was a justified Nuclear Baseline (NB) covering both the emergency preparedness function and emergency response activities with sufficient resources available to respond to any accident or emergency arising on the site. The intervention targeted Security & Resilience (Operations) as they predominantly provide the site-wide emergency response capability and are responsible for key roles and responsibilities associated with the Sellafield Site Emergency Arrangements Operator Emergency Plan (OEP).

I found that there was sufficient resources available within the responsibility and management of Security & Resilience to respond to any accident or emergency, as per the OEP, arising on the site.

Sellafield Limited has established arrangements for determining minimum safe staffing levels (MSSL) to ensure suitable and sufficient personnel are available to respond to emergency events, in alignment with the requirements of licence condition 11 - emergency arrangements. However, Sellafield Limited have self-identified systemic inefficiencies and inconsistencies in how these arrangements are defined, applied and maintained.

The current arrangements place a disproportionate administrative and bureaucratic burden on the licensee and its resource. This creates inefficiencies, increases workload, and generates uncertainty in operational decision-making regarding safe plant and manning status. Therefore, I have concluded that the Sellafield Limited has deficient LC 11 arrangements for compliance with legal requirements and I rate LC 11 as Amber (Seek Improvement).

A nuclear baseline exists for emergency arrangements, and key roles from the Operator Emergency Plan are captured within it. However, the baseline and its underpinning rationale, is not documented. This limits the licensee's ability to justify the current baseline and increases the risk of capability loss during organisational change. Whilst work is ongoing to rationalise the Operator Emergency Plan and review the S&R Operations structure, improvements are required to ensure the baseline is fully understood, justified and resilient to change. Therefore, I have concluded that the Sellafield Limited has deficient LC 36 arrangements for compliance with legal requirements and I rate LC 36 as Amber (Seek Improvement).

Conclusion

The Sellafield Limited actions from the ODM provide evidence that:

The determination of MSSL is in several cases underpinned by conservative safety case assumptions that do not reflect the actual hazard. While there will be instances where this is reasonable - due to ongoing reliance on certain control measures - the administrative burden of amending safety cases has likely led to the prolonged retention of outdated hazard scenarios and cases. It is likely that has resulted in an unnecessary resource demand within the MSSL.
In many instances the MSSL is defined based on specific roles rather than functional capability, meaning that the absence of an individual post-holder is sometimes treated as a fundamental gap in emergency response, even where sufficient defence-in-depth exists to fulfil the function. This approach can overstate the significance of certain absences and lead to avoidable operational restrictions.
The arrangements are applied at the individual plant level, requiring aggregation to assess site-wide emergency response capability. This introduces additional workload and complexity, particularly as there is inconsistency in how ‘mitigated’ and ‘unmitigated’ events are interpreted. In some cases an ‘unmitigated’ event is assumed to leave the site vulnerable from an emergency arrangements perspective, even when other protective measures remain available.

The current arrangements place a disproportionate administrative and bureaucratic burden on the licensee and its resource. This creates inefficiencies, increases workload, and generates uncertainty in operational decision-making regarding safe plant and manning status. This processes could be improved by aligning MSSL determination to functional capability rather than named roles, incorporating hazard reduction achievements into the underpinning safety cases in a timely manner, and standardising the key terms such as ‘mitigated’ and ‘unmitigated’.

Based on discussions and evidence gathered during the inspection, I am satisfied that the recent MSSL events have not resulted in an increased risk to workers or the public. There remains adequate defence-in-depth, within the S&R Ops are of responsibility, including the EDT, to respond to emergency events, including prolonged scenarios. Accordingly, these events do not represent a material increase in risk to the site at this time.

However, the current MSSL process is imprecise and inefficient, reducing the licensee's ability to accurately identify genuine risk gaps arising from absences or vacancies. This creates a persistent need to justify operational decisions, which may detract from identifying and addressing issues that could challenge the licensee in more complex multi-plant emergency scenarios, including loss of of site power or significant natural external hazards such as seismic events or extreme weather. While the EDT demonstrates sufficient resilience, improvements to the MSSL process are required to ensure clarity, efficiency and accurate risk understanding.

The current MSSL process is predominantly applied at the individual plant level, which provides a narrow view of emergency response capability. I am not aware of any robust arrangements to routinely assess the aggregated, site-wide impact of staffing shortfalls or absences. As a result, situational awareness of the overall defence-in-depth across the site is limited. This gap could impair the licensee's ability to make informed decisions on operational readiness, particularly in complex scenarios requiring coordination of multiple plant responses during events that affect multiple areas simultaneously. Strengthening site-wide oversight of manning levels would improve the situational awareness and support more resilient and efficient emergency arrangements.

Therefore, I rate licence condition 11 compliance as AMBER - seek improvement.

A nuclear baseline exists for emergency arrangements, and key roles from the Operator Emergency Plan are captured within it. However, the baseline and its underpinning rationale, is not documented separately in accordance with the Safety Directors' Forum good practice guide. This limits the licensee's ability to understand and justify the current baseline and increases the risk of capability loss during organisational change. Whilst work is ongoing to rationalise the Operator Emergency Plan and review the S&R Operations structure, improvements are required to ensure the baseline is fully understood, justified and resilient to change.

Therefore, I rate licence condition 36 compliance as AMBER - seek improvement.

The findings from this intervention and the follow-on regulatory actions will be considered an in separate enforcement decision record.