Dissent About Nuclear Safety

Alison Turner is concerned about the safety assumptions being made in her work place. This is an important question, but it takes on even more significance in Alison's work place--a nuclear power plant. This case revolves around two important ethical issues: (1) How can a group make the best decision about safety?; and (2) What is an ethical employee's responsibility in terms of expressing his or her opinion?

In terms of its safety decisions, it seems that the company who runs this nuclear power plant has asked the committee Alison is part of (the PNSRC--Plant Nuclear Safety Review Committee) to wear two different and potentially conflicting hats. In a famous example from the discussion that occurred before the Challenger explosion several years ago, a manager at Morton Thiokol asked an engineer who had opposed the launch to "take off his engineering hat" and put on his "management hat." When he responded to the question as a manager, he recommended launching the space shuttle under the conditions specified. This example illustrates that the decision recommended by an engineer may not be the same as the decision recommended by a manager. Asking people on one committee to play both roles may lead to disastrous results.

One reason for the potential danger in this situation is a phenomenon called "groupthink," discussed by Irving Janis in his book, Groupthink (Houghton Mifflin, 1982). In situations of groupthink, members of a group don't want to "rock the boat." They agree to a consensus to support the group even though individuals may disagree with the decision. Rich Robinson, the chair of the committee, has made it clear that it is important to act quickly to avoid a costly shutdown. He has set the tone for the meeting and set the stage for groupthink. It seems as if he has a decision made before the group even discusses anything. When someone suggests that additional calculations could easily be made, one person reminds another not to rock the boat by saying, "Our track record is excellent, and the system is optional. It's not as though we're taking any extraordinary risks." The group never has a chance to critically examine the situation.

When the vote is being cast, Alison must decide her responsibility to express her doubts about the decision. According to Albert Hirschman in the book, Exit, Voice and Loyalty (Harvard University Press, 1970), employees have three options in situations such as this one: exit, voice, or loyalty. In other words, they may decide that the problem is significant enough that they are forced to quit their jobs and leave the corporation (exit). They may speak to their supervisors or anyone else who might be involved and try to convince them of their concerns (voice). Or they may remain loyal to the company and do nothing believing that the company knows best and the problem will be solved in due time. If Alison decided to use the voice option in this situation, she would cast a negative vote. In this way, she would be communicating her dissatisfaction with the committee's decision. Of course, she could abstain (in essence, the exit option) or vote for the decision (loyalty). Each decision is significant and each carries its own risks. If she casts a negative vote, she remain true to her doubts but has the potential not to be seen as a team player. Her future promotions could be affected. If she abstains, she walks a middle ground--she expresses some dissatisfaction, but may still be seen as a reluctant member of the team. If she casts a positive vote, she goes along with the group, remains part of the team, but her voice has been lost.

To avoid putting any individual in this difficult position, this group could have used a more systematic method of assessing the risk involved in the important decisions they are asked to make. For example, in their book, Acceptable Risk (Cambridge University Press, 1981), Fischhoff and his colleagues present seven objectives that they believe a method for assessing risk should meet: comprehensive, logically sound, practical, open to evaluation, politically acceptable, compatible with institutions, and conducive to learning. They note that not all methods meet these criteria, but any method can be examined in light of the criteria. The PNSRC might have avoided groupthink if they had made an attempt to examine their decision-making procedure more systematically. Of course, these criteria do not assure that any decision is sound, but they are one more way of checking to make sure that all areas have been explored before a group chooses a solution to an important problem.

Decision making about risk is a difficult thing to do. It is even more difficult when it is done by a committee that has to consider the implications of the decision for a number of different constituencies. Nevertheless, this area of decision making is extremely important. The committee must be structured so that each employee has a voice and can act as ethically as possible within the parameters of the decision to be made.

I

Whether Alison Turner should express her reservations depends upon several factors. Some of the issues are technical. Some involve the importance of particular safety regulations. Also involved is the power structure of the company and perhaps her judgment of the motives and scruples of higher management.

Apparently she is uncomfortable with the assumption that the heat exchangers have 95% of capacity. How implausible does she think this estimate is and how far off? If she believes that this is probably an unrealistic estimate, made in good faith but probably an overestimation, does she have any good grounds for challenging its accuracy? And what would be the result if it were revised? If she believes that it is a deliberately false estimate, made to get approval of continued operation, she is up against a potentially more difficult situation. Whichever it is, there is also the question of the danger in case of an accident resulting in the loss of one heat exchanger. Alison thinks that this should be considered in the report. In such an event, would the result probably be catastrophic, or merely require quicker action to shut down operations?

Sometimes regulations are excessive. Does she believe that the regulations are excessively cautious or does she think that they are appropriate? If Alison personally believes that they are excessive, does that make a difference? If Alison thinks that there is a real danger, she has more obligation to express her reservations than if she thinks that the Single Failure Criteria are excessive, doesn't she? Or is her personal judgment irrelevant? Think about it from another point of view. Would you want the members of the Plant Nuclear Safety Review Committee using their personal judgment about the importance of the safety regulations in situations like this, or should they conform to the letter of the regulations?

In this case, the requirement that the plant anticipate loss of one heat exchanger in the event of a possible accident is being overlooked, rather than being violated, in the JCO. Is it up to the NRC to notice that? Or is it the responsibility of the plant to meet the requirement? If I am applying for a job and I leave blank some of the questions when answers would call attention to my weaknesses, isn't it up to the employer to decide whether to ask for further information? Is there any analogy between these two situations?

Alison is the least senior member of the committee, but she is still a member. If she is unable or unwilling to voice her opinion, she might as well not be there. Voicing a reservation is doing no more than expressing a professional judgment. But it is at the same time challenging the work of those who prepared the JCO and challenging the judgment of her superiors who see nothing wrong with it. That may take courage.

What if Allison thinks that the 95% capacity is a deliberately false assumption, made up to have a satisfactory JCO and avoid shutdown? Does that make any difference? In that case she would seem to have an additional responsibility to speak up, since in that case her superiors do think that there is something wrong with the JCO and are not saying so. But that may take even more courage, since she is not just raising a technical question but, at least in her own mind, questioning their integrity.

If the problem is sand blockage on the lake water side, is that something that will be remedied while the plant is operating, and will it be remedied if the JCO is approved? Or is the sand blockage something that is going to get worse and make the heat exchangers less effective as time goes by? If so, will the plant become progressively unsafe, or will the problem eventually require shutdown to remedy it? If so, wouldn't it be better to do it sooner, rather than later?

II

Not much has changed as a result of the discussion after Alison expressed her reservations. One member of the committee supported her concern and pointed out that it would take only three hours to carry out the calculations. That this trouble wasn't taken might make her even more suspicious that there is a deliberate effort to submit a misleading JCO. If so, she would have even stronger reason to cast a dissenting vote, for she would feel that there was more than just a matter of technical differences of opinion. On the other hand, she may have been persuaded by the argument that other plants are operating without containment spray systems; therefore it is an unnecessary extra precaution. She could even believe both--that there is only a very remote risk of its ever being needed and of its being unnecessary if it is, but also that management is deliberately ignoring the problem.

III

She might have been right to have expressed and voted her reservations, even if they turned out to have been unwarranted. She showed honesty and integrity. But she may have also adversely affected her career. Not to have unanimity on approval of a JCO is probably not appreciated by the company. It does not look good. To challenge the judgment of her superiors may not make her a welcome member of the team, and the fact that her concerns were unwarranted could be used against her. Is that something that she should have worried about when voting?

On the other hand, expressing and voting her honest opinion may be regarded as a virtue by her superiors. Which do you think is more likely? If you were the superior, which kind of subordinate would you want? If you were an owner of a company or the public affected by decisions, which kind of superior would you want?

In all of this, does it make any difference that Judy is female? Is it more difficult for her to express her judgment because of her gender?

I

Alison is the junior member of the PNSCR, which has the responsibility of making a recommendation concerning continuing operation of a heat exchanger which is not functioning to standards. Nuclear Safety and Licensing has submitted an analysis justifying continued operation (JCO), but Alison has reservations about an assumption made by NSL; if the assumption is wrong, problems could occur, and NSL has not discussed that contingency. Should Alison express her reservations? The other members of PNSCR want to approve the JCO, and there is pressure that the recommendation be unanimous.

Alison should keep firmly in mind that as a professional engineer, her job is to provide her best professional judgment when called on to do so; she is not on the payroll in order to endorse decisions made by others. She finds herself in a tense political situation, where management looks for the 'correct' recommendation. But if she feels she has valid reservations about the JCO, which she can't express for political reasons, she would be subverting her function on the PNSRC. In effect, it is being suggested to Alison that her professional judgment isn't needed in this situation, which ought to raise the question in everybody's mind, why is she there? If she's not free to speak as her judgment dictates, she has no role on the PNSCR and ought to ask to be replaced on it.

Chair Robinson's comments about the cost to the company of not approving the JCO are entirely inappropriate and put the PNSCR under pressure. Perhaps the parameters of the PNSCR's mandate are not clear; are they supposed to make engineering judgments, or management judgments? It is up to management, it would seem, to consider the costs of delay in deciding whether to accept or reject PNSRC recommendations. Evidently the PNSRC in this company functions in part to cover management's decisions; by providing input management wants to hear, they relieve management of the necessity of making business decisions balancing cost versus safety. This attitude is reflected in the comment of Chair Robinson.

II

Alison expresses her reservations, and there is discussion. However her recommendation for further study is steamrolled by the committee. Should she vote against the approval, since the calculations she requested haven't been made? It is unclear what the hurry is here; if a committee member has reservations which could be clarified by a three hour study, why not make the study? Evidently most of the other committee members think Alison's reservations simply aren't important enough to bother with, which is certainly their prerogative. On the other hand, she has a different opinion, and as a competent professional she is entitled to hear some reason why the study is a waste of time. Evidently Mark Reynolds sees the point of Alison's concern, but his support is brushed aside, leaving the impression that the committee does not really like to hear disagreement among its members. The case does not present any serious discussion on the PNSCR about the contingency which worries Alison; her concern is brushed off with vague invocations of the company's excellent safety record (which this discussion on the PNSRC may be putting in jeopardy!).

Of course Alison could be wrong; perhaps she is inexperienced, and just doesn't realize that what she's worried about is the remote possibility of the failure of a redundant system ("lots of plants don't even have containment spray systems"), which shouldn't be taken seriously. Maybe she's a bit over her head on this committee! If so, she might be wise to listen and learn until she gets more experience. On the other hand, it is also possible that she lends a critical point of view which the committee evidently lacks. Her attitude of refusal to go along with the rest could save the committee from embarrassment some day. There is an air of self-confidence about the other members which could prove dangerous. Given that her recommendation has been rejected without serious discussion, she ought to vote No. Perhaps she's not entitled that the study be done, but she is entitled to a reasoned discussion and plausible arguments why the study shouldn't be made.

It is not stated why it is important that PNSRC decisions be unanimous. Perhaps the vaunted unanimity of past decisions is a consequence of political pressure and not engineering consensus? If previous unanimous recommendations have been the legitimate result of engineering judgments, then no precedent is created, because such unanimity does not exist in the current situation. On the other hand, if previous unanimity has been produced by pressure such as is being exerted on Alison, then the tradition of unanimity is hollow and ought not to be taken as a precedent. What is being decided by the PNSRC is how far one has to go in the interests of safety. This is a matter of judgment. In general, reasonable people can disagree about this question. In this case, the system is optional, failure is evidently considered remote (only a "possibility," a word which in context implies, "very unlikely") and there are said to be no "extraordinary" risks involved even if the exchanger does fail. Nonetheless it is surprising that all PNSRC decisions have been unanimous. If I were management, I would suspect a unanimous PNSRC as too good to be true; such unanimity would strike me as more than a little bit 'concocted'. However management isn't interested in such suspicions because unanimity makes management's job easier.

III

Therefore, I conclude that no matter what the ultimate outcome, Alison would be more at fault for taking the easy way out and going along with the majority, than for voting No. In any case, however, she ought to have a chat with other members of the committee and express disappointment that her judgment was not respectfully considered, and point out that the tendency of the chair to pressure engineering judgments is not in anybody's best interest. Unless she exerts herself and defends her professional competence and prerogatives, she is going to find herself more and more ignored and will come to be regarded as a fifth wheel on the wagon.

It would seem that Alison Turner and her fellow committee members on the PNSRC do not yet have all of the information available to enable them to make a carefully considered judgement. But even before considering analysis of a single heat exchanger failure, as in part II, she has some professional obligations to consider. If Alison does not express her reservations in part I of this case, it is likely that the Justification for Continued Operation (JCO) will be forwarded onto the Nuclear Regularly Commission (NRC) for approval with no mention of the contingency check on the loss of one of the two heat exchangers under the required Single Failure Criteria.

It is not unreasonable to expect that the people who serve on the NRC have sufficient experience and expertise to turn down the JCO from the PNSRC just on the basis of the omission of this Single Failure Criteria assessment of the effect of losing one heat exchanger. Alison can make this point following the moment of silence on the initial vote in part I. She can try to convince her fellow PNSRC members that it is in their and their company's best interest to maintain the confidence of the NRC.

Most important she can try to convince her fellow PNSRC members about their responsibility to check all contingencies in order to hold paramount public safety according to all professional society codes of ethics. This is particularly sensitive given the nature of what is potentially at risk in this case.

In part II of the case it emerges that the Nuclear Safety and Licensing Department would only require 3 hours to perform the necessary calculations for the Single Failure Criteria issue of the effects of a possible loss of one heat exchanger. At this point in the discussion it appears that Mark Reynolds on the PNSRC is leaning towards supporting Alison's concerns. The fact that the containment spray heat exchanger is optional and the company track record is excellent, as Joe Carpello points out, is really not relevant to the question at hand, namely the responsibility of the PSNRC to consider all possible consequences of their actions. The fact that this is an accident mitigation system and there never has been an accident in the plant, as pointed out by Brad Louks, is also not relevant to the basic responsibilities the PNSRC faces.

Joe Carpello's statement that nothing is ever totally risk free is exactly right. But his point that their company has always been a leader in safety, so "...Let's not get carried away with 'possibilities'" seems precisely wrong just because nothing is ever totally risk free. It is exactly by letting oneself get deeply immersed in all failure mode possibilities that one maintains a position of leadership in safety.

Given that it is only 1:30 p.m. in the afternoon when this discussion takes place, and that the calculations for the missing Single Failure Criteria assessment would only take another 3 hours, it would seem that Alison and Mark could reasonably call for a tabling of the PNSRC vote until 4:30 that afternoon.

In part III of the case, it is hypothesized that subsequent calculations have shown that Alison's concerns were unfounded. Does that make it wrong for her to have requested a delay on the PNSRC vote? Just the fact that the substantiating subsequent analysis can now be included in the JCO to be forwarded to the NRC would seem to justify the delay.

The issue of setting a precedent of proceeding without unanimity on the PNSRC does not really seem to be an issue. Undoubtedly, once the Single Failure Criterion analysis is available, Alison will for sure be willing to join the majority to make the final recorded vote unanimous. But even without such a vote change, in something as critical as reviews like this one coming before the NRC, non-unanimity of a PNSRC vote may achieve the important function of requiring the NRC to look at any situation more carefully than it might otherwise have done.

The early days of the NRC actions are replete with some misguided risk assessment analyses that did not properly alert us to the kind of problems that arose at Three Mile Island. The interested reader is referred to the literature regarding the famous Report to the NRC headed by Professor Rasmussen of MIT (the so called WASH-1400 Report). There are also a number of informative reports and TV tapes on Three Mile Island that are relevant to some of the issues in this case.

I

Alison should express her reservations. If Single Failure Criteria require that one assume the loss of one heat exchanger, and if the Criteria themselves are required--that is, if one is required to make sure that they are satisfied--then the failure to determine what would happen if there were only one heat exchanger means that the plant has failed to do what it is required to do. It makes a difference, or course, who is requiring that the Single Failure Criteria be satisfied. If it is the NRC, and it is reasonable to assume that it is, then the Plant Nuclear Safety Review Committee is failing to fulfill one of its obligations in submitting its Justification for Continued Operation to NRC.

Perhaps NRC will see the failure and send the JCO back for the additional information that NRC requires. But there is no guarantee of that. In a complex document, it is easy enough to miss something, even if required. So Alison cannot assume that NRC will catch the Committee's not determining what will happen if one heat exchanger fails.

Even if she could assume that, she has an obligation as a member of the Committee to make sure that the Committee's reports reflect whatever is required. By not expressing her reservations when, by the nature of Rich's comments, it looks as though a vote will be called, she is effectively agreeing to sign off on what she takes to be a flawed document. She has a professional obligation not to do that.

That, as it appears, others may not agree with her is not relevant. An analogy may make this point clearer. The Supreme Court consists of nine justices. It hears cases, and the justices meet together to determine what the Court ought to decide. It is rare that the justices all agree. Unanimity is the exception, not the norm. The justice chosen to write the opinion for the majority is required to circulate his or her draft opinion to all members of the Court, and justices send back comments, suggesting changes, including additional arguments, problems with existing arguments or positions, and so on. The vote, in short, initiates a dialogue among the justices. Sometimes that dialogue changes the votes of some of the justices. As they see a decision argued out, they may become convinced that their original judgment was mistaken. It is the job of each person to give their views as strongly and clearly as possible. Only in that way, it is assumed, can the best decision be reached--the one most likely to withstand further criticism.

The Plant Nuclear Safety Review Committee and, indeed, any official committee of professionals ought to work in the same way. Such a procedure presumes, as a working hypothesis, the respect of each member of the committee for the others, but that respect is both created and maintained by the quality of judgment of the person being respected--a quality of judgment measured by how good the reasons are a person gives, how nuanced to the evidence, how carefully considered in light of objections, and so on.

So if Alison now expresses her reservations, she is immediately calling upon the presumptions about how such a committee ought to operate that make such expressions reasonable and accepted. She is calling upon the other members of the committee to explain why they think such a contingency as the loss of one heat exchanger need not be examined, and she is herself required to explain why it is that she thinks it ought to be examined.

Lying behind such presumptions about how such a committee ought to operate is the further, and deeper, presumption that it is only in such a committee, operating with such respect of the members, one for another, that one can be more sure of coming to a conclusion that will withstand objections than not. There is no guarantee that the conclusion reached will not be mistaken: it is possible that all the members be wrong in one respect or another. But if each member feels entitled and, better, obligated to raise what objections seems appropriate, and if the committee as a whole is obligated to come to grips with the objections, treat them with respect, and respond to them in a reasonable way, then the end result will be better decisions--one more likely to withstand objection.

Alison thus has an obligation to express her reservations, and it is a complex obligation--to the nature of the decision-making process and to her fellow committee members. She is, after all, obligated by a commitment to the decision-making process not to allow her fellow committee members to embarrass themselves by making a bad decision.

II

Alison should vote not to approve the JCO without the Nuclear Safety and Licensing Department making the further calculation, and she should make it clear the reasons she is voting not to approve the JCO--that the Criteria require such a calculation, that it is inappropriate to send the JCO onto the NRC without satisfying the Criteria it requires, and that it will take little work, and waste virtually no time, to do what is required.

She may get a bit of flack for voting that way, but not much, and that is not to the point in any case. If her case is reasonable, then the other members of the committee can hardly complain at her unwillingness to do what she thinks is a mistake.

Of course, one of the problems with what she has done is that she has failed to give arguments for her position given what has been said. On the one hand, she needs to second the observation Mark Reynolds makes. Joe objects, "What's the point?," and the proper response is that the point is that the Criteria require that the contingency be considered and that, to push Mark's point home, the necessary information can be gained quickly and without a great deal of trouble. So, Alison can and should say, she is not asking for much and is asking only for what is required.

But, on the other hand, she needs to respond to the points Louks and Carpello bring up. If having heat exchangers is not itself required, then why is it necessary to test to see what happens if one is lost? It is not to the point to argue, as they do, that so far the plant has been accident-free. One may cross the street all one's life without being run over and without looking both ways, but one's luck does not mean that it is right or all right not to look both ways. Requirements are there to make sure that one do what needs to be done to prevent accidents. It does not follow that if one has not had any accidents, that one need not do what is required. One may not have had any accidents because one has done what is required. But the thrust of the objection Louks and Carpello make is that since the heat exchangers are an extra safety device in any event, not required, it makes no sense to follow the Criteria and see what happens if one of them fails. Many plants have neither, and they have had no problems.

To make her point, Alison needs to argue something like this: heat exchangers are not required, but when they do exist, then the Criteria require that one determine what happens when one fails. It is not unusual to have a situation where one has something extra and then is required, because one has something extra, to make sure it works properly. If car seats for babies were not required by law, but one had one, it would not be inappropriate for a legislature to require that one check to be sure that it works properly. The baby might be no worse off in a car seat that did not stay in place in an accident than if he or she were in an accident without a car seat at all, but since the parent has provided one, the legislature may require that it work properly. Reduced insurance premiums might depend upon the seat working properly, or the legislature might want to be sure that the person who bought it has peace of mind appropriately, and not because of the mistaken assumption that the car seat will protect the child. Just so, NRC may not require heat exchangers, but may require, if a plant has them, that they do the job even if one is down. Nothing in the case tells us anything about that one way or the other, but that is a failure on the part of Alison. She has failed to pursue the dialogue, failed to provide the reasons she needs to provide, to make her position sustainable--and help her colleagues keep from making a mistake.

III

If subsequent calculations show that a single heat exchanger would be adequate, that would not make it wrong for Alison to have cast a negative vote. She is not doing that to prevent the report from going on to NRC, but to make sure that the committee do what is required--assuming that the Criteria are themselves required by NRC--and that the committee work in the appropriate way in coming to its decisions. That is, she has an obligation to present her views, however different they may be from the views of other members of the committee, and an obligation to make sure that the views of others are appropriately reasoned. She is casting a negative vote in part, presumably, because she does not think the position of the committee that the contingency in question need not be examined is a viable position. That she turns out to be wrong does not mean that the committee's position is right. After all, they could not have known when they voted that one heat exchanger would be enough. And, more important, that she turns out to be wrong does not mean that the committee's deliberations were appropriate: the committee failed to come to grips with her objection that the Criteria require determining what happens in such a contingency (assuming that is the thrust of her argument or, what is the same, that she has an acceptable response to the objection of Louks and Carpello).

She may well set a precedent for proceeding without unanimity, but the hope must be that she will begin to initiate the sort of dialogue that ought to mark such deliberative bodies.