Dissent About Nuclear Safety

Alison Turner is concerned about the safety assumptions being made in her work place. This is an important question, but it takes on even more significance in Alison's work place--a nuclear power plant. This case revolves around two important ethical issues: (1) How can a group make the best decision about safety?; and (2) What is an ethical employee's responsibility in terms of expressing his or her opinion?

In terms of its safety decisions, it seems that the company who runs this nuclear power plant has asked the committee Alison is part of (the PNSRC--Plant Nuclear Safety Review Committee) to wear two different and potentially conflicting hats. In a famous example from the discussion that occurred before the Challenger explosion several years ago, a manager at Morton Thiokol asked an engineer who had opposed the launch to "take off his engineering hat" and put on his "management hat." When he responded to the question as a manager, he recommended launching the space shuttle under the conditions specified. This example illustrates that the decision recommended by an engineer may not be the same as the decision recommended by a manager. Asking people on one committee to play both roles may lead to disastrous results.

One reason for the potential danger in this situation is a phenomenon called "groupthink," discussed by Irving Janis in his book, Groupthink (Houghton Mifflin, 1982). In situations of groupthink, members of a group don't want to "rock the boat." They agree to a consensus to support the group even though individuals may disagree with the decision. Rich Robinson, the chair of the committee, has made it clear that it is important to act quickly to avoid a costly shutdown. He has set the tone for the meeting and set the stage for groupthink. It seems as if he has a decision made before the group even discusses anything. When someone suggests that additional calculations could easily be made, one person reminds another not to rock the boat by saying, "Our track record is excellent, and the system is optional. It's not as though we're taking any extraordinary risks." The group never has a chance to critically examine the situation.

When the vote is being cast, Alison must decide her responsibility to express her doubts about the decision. According to Albert Hirschman in the book, Exit, Voice and Loyalty (Harvard University Press, 1970), employees have three options in situations such as this one: exit, voice, or loyalty. In other words, they may decide that the problem is significant enough that they are forced to quit their jobs and leave the corporation (exit). They may speak to their supervisors or anyone else who might be involved and try to convince them of their concerns (voice). Or they may remain loyal to the company and do nothing believing that the company knows best and the problem will be solved in due time. If Alison decided to use the voice option in this situation, she would cast a negative vote. In this way, she would be communicating her dissatisfaction with the committee's decision. Of course, she could abstain (in essence, the exit option) or vote for the decision (loyalty). Each decision is significant and each carries its own risks. If she casts a negative vote, she remain true to her doubts but has the potential not to be seen as a team player. Her future promotions could be affected. If she abstains, she walks a middle ground--she expresses some dissatisfaction, but may still be seen as a reluctant member of the team. If she casts a positive vote, she goes along with the group, remains part of the team, but her voice has been lost.

To avoid putting any individual in this difficult position, this group could have used a more systematic method of assessing the risk involved in the important decisions they are asked to make. For example, in their book, Acceptable Risk (Cambridge University Press, 1981), Fischhoff and his colleagues present seven objectives that they believe a method for assessing risk should meet: comprehensive, logically sound, practical, open to evaluation, politically acceptable, compatible with institutions, and conducive to learning. They note that not all methods meet these criteria, but any method can be examined in light of the criteria. The PNSRC might have avoided groupthink if they had made an attempt to examine their decision-making procedure more systematically. Of course, these criteria do not assure that any decision is sound, but they are one more way of checking to make sure that all areas have been explored before a group chooses a solution to an important problem.

Decision making about risk is a difficult thing to do. It is even more difficult when it is done by a committee that has to consider the implications of the decision for a number of different constituencies. Nevertheless, this area of decision making is extremely important. The committee must be structured so that each employee has a voice and can act as ethically as possible within the parameters of the decision to be made.

I

Whether Alison Turner should express her reservations depends upon several factors. Some of the issues are technical. Some involve the importance of particular safety regulations. Also involved is the power structure of the company and perhaps her judgment of the motives and scruples of higher management.

Apparently she is uncomfortable with the assumption that the heat exchangers have 95% of capacity. How implausible does she think this estimate is and how far off? If she believes that this is probably an unrealistic estimate, made in good faith but probably an overestimation, does she have any good grounds for challenging its accuracy? And what would be the result if it were revised? If she believes that it is a deliberately false estimate, made to get approval of continued operation, she is up against a potentially more difficult situation. Whichever it is, there is also the question of the danger in case of an accident resulting in the loss of one heat exchanger. Alison thinks that this should be considered in the report. In such an event, would the result probably be catastrophic, or merely require quicker action to shut down operations?

Sometimes regulations are excessive. Does she believe that the regulations are excessively cautious or does she think that they are appropriate? If Alison personally believes that they are excessive, does that make a difference? If Alison thinks that there is a real danger, she has more obligation to express her reservations than if she thinks that the Single Failure Criteria are excessive, doesn't she? Or is her personal judgment irrelevant? Think about it from another point of view. Would you want the members of the Plant Nuclear Safety Review Committee using their personal judgment about the importance of the safety regulations in situations like this, or should they conform to the letter of the regulations?

In this case, the requirement that the plant anticipate loss of one heat exchanger in the event of a possible accident is being overlooked, rather than being violated, in the JCO. Is it up to the NRC to notice that? Or is it the responsibility of the plant to meet the requirement? If I am applying for a job and I leave blank some of the questions when answers would call attention to my weaknesses, isn't it up to the employer to decide whether to ask for further information? Is there any analogy between these two situations?

Alison is the least senior member of the committee, but she is still a member. If she is unable or unwilling to voice her opinion, she might as well not be there. Voicing a reservation is doing no more than expressing a professional judgment. But it is at the same time challenging the work of those who prepared the JCO and challenging the judgment of her superiors who see nothing wrong with it. That may take courage.

What if Allison thinks that the 95% capacity is a deliberately false assumption, made up to have a satisfactory JCO and avoid shutdown? Does that make any difference? In that case she would seem to have an additional responsibility to speak up, since in that case her superiors do think that there is something wrong with the JCO and are not saying so. But that may take even more courage, since she is not just raising a technical question but, at least in her own mind, questioning their integrity.

If the problem is sand blockage on the lake water side, is that something that will be remedied while the plant is operating, and will it be remedied if the JCO is approved? Or is the sand blockage something that is going to get worse and make the heat exchangers less effective as time goes by? If so, will the plant become progressively unsafe, or will the problem eventually require shutdown to remedy it? If so, wouldn't it be better to do it sooner, rather than later?

II

Not much has changed as a result of the discussion after Alison expressed her reservations. One member of the committee supported her concern and pointed out that it would take only three hours to carry out the calculations. That this trouble wasn't taken might make her even more suspicious that there is a deliberate effort to submit a misleading JCO. If so, she would have even stronger reason to cast a dissenting vote, for she would feel that there was more than just a matter of technical differences of opinion. On the other hand, she may have been persuaded by the argument that other plants are operating without containment spray systems; therefore it is an unnecessary extra precaution. She could even believe both--that there is only a very remote risk of its ever being needed and of its being unnecessary if it is, but also that management is deliberately ignoring the problem.

III

She might have been right to have expressed and voted her reservations, even if they turned out to have been unwarranted. She showed honesty and integrity. But she may have also adversely affected her career. Not to have unanimity on approval of a JCO is probably not appreciated by the company. It does not look good. To challenge the judgment of her superiors may not make her a welcome member of the team, and the fact that her concerns were unwarranted could be used against her. Is that something that she should have worried about when voting?

On the other hand, expressing and voting her honest opinion may be regarded as a virtue by her superiors. Which do you think is more likely? If you were the superior, which kind of subordinate would you want? If you were an owner of a company or the public affected by decisions, which kind of superior would you want?

In all of this, does it make any difference that Judy is female? Is it more difficult for her to express her judgment because of her gender?

It would seem that Alison Turner and her fellow committee members on the PNSRC do not yet have all of the information available to enable them to make a carefully considered judgement. But even before considering analysis of a single heat exchanger failure, as in part II, she has some professional obligations to consider. If Alison does not express her reservations in part I of this case, it is likely that the Justification for Continued Operation (JCO) will be forwarded onto the Nuclear Regularly Commission (NRC) for approval with no mention of the contingency check on the loss of one of the two heat exchangers under the required Single Failure Criteria.

It is not unreasonable to expect that the people who serve on the NRC have sufficient experience and expertise to turn down the JCO from the PNSRC just on the basis of the omission of this Single Failure Criteria assessment of the effect of losing one heat exchanger. Alison can make this point following the moment of silence on the initial vote in part I. She can try to convince her fellow PNSRC members that it is in their and their company's best interest to maintain the confidence of the NRC.

Most important she can try to convince her fellow PNSRC members about their responsibility to check all contingencies in order to hold paramount public safety according to all professional society codes of ethics. This is particularly sensitive given the nature of what is potentially at risk in this case.

In part II of the case it emerges that the Nuclear Safety and Licensing Department would only require 3 hours to perform the necessary calculations for the Single Failure Criteria issue of the effects of a possible loss of one heat exchanger. At this point in the discussion it appears that Mark Reynolds on the PNSRC is leaning towards supporting Alison's concerns. The fact that the containment spray heat exchanger is optional and the company track record is excellent, as Joe Carpello points out, is really not relevant to the question at hand, namely the responsibility of the PSNRC to consider all possible consequences of their actions. The fact that this is an accident mitigation system and there never has been an accident in the plant, as pointed out by Brad Louks, is also not relevant to the basic responsibilities the PNSRC faces.

Joe Carpello's statement that nothing is ever totally risk free is exactly right. But his point that their company has always been a leader in safety, so "...Let's not get carried away with 'possibilities'" seems precisely wrong just because nothing is ever totally risk free. It is exactly by letting oneself get deeply immersed in all failure mode possibilities that one maintains a position of leadership in safety.

Given that it is only 1:30 p.m. in the afternoon when this discussion takes place, and that the calculations for the missing Single Failure Criteria assessment would only take another 3 hours, it would seem that Alison and Mark could reasonably call for a tabling of the PNSRC vote until 4:30 that afternoon.

In part III of the case, it is hypothesized that subsequent calculations have shown that Alison's concerns were unfounded. Does that make it wrong for her to have requested a delay on the PNSRC vote? Just the fact that the substantiating subsequent analysis can now be included in the JCO to be forwarded to the NRC would seem to justify the delay.

The issue of setting a precedent of proceeding without unanimity on the PNSRC does not really seem to be an issue. Undoubtedly, once the Single Failure Criterion analysis is available, Alison will for sure be willing to join the majority to make the final recorded vote unanimous. But even without such a vote change, in something as critical as reviews like this one coming before the NRC, non-unanimity of a PNSRC vote may achieve the important function of requiring the NRC to look at any situation more carefully than it might otherwise have done.

The early days of the NRC actions are replete with some misguided risk assessment analyses that did not properly alert us to the kind of problems that arose at Three Mile Island. The interested reader is referred to the literature regarding the famous Report to the NRC headed by Professor Rasmussen of MIT (the so called WASH-1400 Report). There are also a number of informative reports and TV tapes on Three Mile Island that are relevant to some of the issues in this case.

I

Alison should express her reservations. If Single Failure Criteria require that one assume the loss of one heat exchanger, and if the Criteria themselves are required--that is, if one is required to make sure that they are satisfied--then the failure to determine what would happen if there were only one heat exchanger means that the plant has failed to do what it is required to do. It makes a difference, or course, who is requiring that the Single Failure Criteria be satisfied. If it is the NRC, and it is reasonable to assume that it is, then the Plant Nuclear Safety Review Committee is failing to fulfill one of its obligations in submitting its Justification for Continued Operation to NRC.

Perhaps NRC will see the failure and send the JCO back for the additional information that NRC requires. But there is no guarantee of that. In a complex document, it is easy enough to miss something, even if required. So Alison cannot assume that NRC will catch the Committee's not determining what will happen if one heat exchanger fails.

Even if she could assume that, she has an obligation as a member of the Committee to make sure that the Committee's reports reflect whatever is required. By not expressing her reservations when, by the nature of Rich's comments, it looks as though a vote will be called, she is effectively agreeing to sign off on what she takes to be a flawed document. She has a professional obligation not to do that.

That, as it appears, others may not agree with her is not relevant. An analogy may make this point clearer. The Supreme Court consists of nine justices. It hears cases, and the justices meet together to determine what the Court ought to decide. It is rare that the justices all agree. Unanimity is the exception, not the norm. The justice chosen to write the opinion for the majority is required to circulate his or her draft opinion to all members of the Court, and justices send back comments, suggesting changes, including additional arguments, problems with existing arguments or positions, and so on. The vote, in short, initiates a dialogue among the justices. Sometimes that dialogue changes the votes of some of the justices. As they see a decision argued out, they may become convinced that their original judgment was mistaken. It is the job of each person to give their views as strongly and clearly as possible. Only in that way, it is assumed, can the best decision be reached--the one most likely to withstand further criticism.

The Plant Nuclear Safety Review Committee and, indeed, any official committee of professionals ought to work in the same way. Such a procedure presumes, as a working hypothesis, the respect of each member of the committee for the others, but that respect is both created and maintained by the quality of judgment of the person being respected--a quality of judgment measured by how good the reasons are a person gives, how nuanced to the evidence, how carefully considered in light of objections, and so on.

So if Alison now expresses her reservations, she is immediately calling upon the presumptions about how such a committee ought to operate that make such expressions reasonable and accepted. She is calling upon the other members of the committee to explain why they think such a contingency as the loss of one heat exchanger need not be examined, and she is herself required to explain why it is that she thinks it ought to be examined.

Lying behind such presumptions about how such a committee ought to operate is the further, and deeper, presumption that it is only in such a committee, operating with such respect of the members, one for another, that one can be more sure of coming to a conclusion that will withstand objections than not. There is no guarantee that the conclusion reached will not be mistaken: it is possible that all the members be wrong in one respect or another. But if each member feels entitled and, better, obligated to raise what objections seems appropriate, and if the committee as a whole is obligated to come to grips with the objections, treat them with respect, and respond to them in a reasonable way, then the end result will be better decisions--one more likely to withstand objection.

Alison thus has an obligation to express her reservations, and it is a complex obligation--to the nature of the decision-making process and to her fellow committee members. She is, after all, obligated by a commitment to the decision-making process not to allow her fellow committee members to embarrass themselves by making a bad decision.

II

Alison should vote not to approve the JCO without the Nuclear Safety and Licensing Department making the further calculation, and she should make it clear the reasons she is voting not to approve the JCO--that the Criteria require such a calculation, that it is inappropriate to send the JCO onto the NRC without satisfying the Criteria it requires, and that it will take little work, and waste virtually no time, to do what is required.

She may get a bit of flack for voting that way, but not much, and that is not to the point in any case. If her case is reasonable, then the other members of the committee can hardly complain at her unwillingness to do what she thinks is a mistake.

Of course, one of the problems with what she has done is that she has failed to give arguments for her position given what has been said. On the one hand, she needs to second the observation Mark Reynolds makes. Joe objects, "What's the point?," and the proper response is that the point is that the Criteria require that the contingency be considered and that, to push Mark's point home, the necessary information can be gained quickly and without a great deal of trouble. So, Alison can and should say, she is not asking for much and is asking only for what is required.

But, on the other hand, she needs to respond to the points Louks and Carpello bring up. If having heat exchangers is not itself required, then why is it necessary to test to see what happens if one is lost? It is not to the point to argue, as they do, that so far the plant has been accident-free. One may cross the street all one's life without being run over and without looking both ways, but one's luck does not mean that it is right or all right not to look both ways. Requirements are there to make sure that one do what needs to be done to prevent accidents. It does not follow that if one has not had any accidents, that one need not do what is required. One may not have had any accidents because one has done what is required. But the thrust of the objection Louks and Carpello make is that since the heat exchangers are an extra safety device in any event, not required, it makes no sense to follow the Criteria and see what happens if one of them fails. Many plants have neither, and they have had no problems.

To make her point, Alison needs to argue something like this: heat exchangers are not required, but when they do exist, then the Criteria require that one determine what happens when one fails. It is not unusual to have a situation where one has something extra and then is required, because one has something extra, to make sure it works properly. If car seats for babies were not required by law, but one had one, it would not be inappropriate for a legislature to require that one check to be sure that it works properly. The baby might be no worse off in a car seat that did not stay in place in an accident than if he or she were in an accident without a car seat at all, but since the parent has provided one, the legislature may require that it work properly. Reduced insurance premiums might depend upon the seat working properly, or the legislature might want to be sure that the person who bought it has peace of mind appropriately, and not because of the mistaken assumption that the car seat will protect the child. Just so, NRC may not require heat exchangers, but may require, if a plant has them, that they do the job even if one is down. Nothing in the case tells us anything about that one way or the other, but that is a failure on the part of Alison. She has failed to pursue the dialogue, failed to provide the reasons she needs to provide, to make her position sustainable--and help her colleagues keep from making a mistake.

III

If subsequent calculations show that a single heat exchanger would be adequate, that would not make it wrong for Alison to have cast a negative vote. She is not doing that to prevent the report from going on to NRC, but to make sure that the committee do what is required--assuming that the Criteria are themselves required by NRC--and that the committee work in the appropriate way in coming to its decisions. That is, she has an obligation to present her views, however different they may be from the views of other members of the committee, and an obligation to make sure that the views of others are appropriately reasoned. She is casting a negative vote in part, presumably, because she does not think the position of the committee that the contingency in question need not be examined is a viable position. That she turns out to be wrong does not mean that the committee's position is right. After all, they could not have known when they voted that one heat exchanger would be enough. And, more important, that she turns out to be wrong does not mean that the committee's deliberations were appropriate: the committee failed to come to grips with her objection that the Criteria require determining what happens in such a contingency (assuming that is the thrust of her argument or, what is the same, that she has an acceptable response to the objection of Louks and Carpello).

She may well set a precedent for proceeding without unanimity, but the hope must be that she will begin to initiate the sort of dialogue that ought to mark such deliberative bodies.

Cases such as this resist a simple answer because those involved (in the present case, Alison) must deal with several fundamentally different kinds of considerations in making their judgement. It is useful to explicitly distinguish these, because the resolution of each requires different kinds of reasoning. However, once distinguished, each is much easier to discuss and resolve than was the original problem. Here are the kinds of considerations:

1. (Facts) What are the relevant facts of the situation? Even here there is room for judgment and argument, as to which facts are or are not relevant or problematic with respect to safety.
2. (Regulations) Given 1., what government regulations apply to the situation? This also may require judgment, since for example 'borderline' data may require an expert decision on whether or not a regulation is significantly infringed by the facts.
3. (Duties) The PNSRC safety committee: what is its structure and organization, and what regulations must it itself conform to? Consequently, what are the duties of individual committee members such as Alison?
4. (Pressures) What political pressures are operative on the committee members? Do they both individually and collectively have the courage, authority and power to ignore these pressures and do the right thing anyway?

Let's start with the easiest part, the Duties. Who would disagree that the committee and its members have a duty to raise and satisfactorily resolve any and all safety issues that come up? What is more, all members of the committee, no matter how junior, have a duty to raise any safety issues they personally are aware of, and a duty to ensure that the committee resolves those issues. Failing this, they have a duty to record a dissenting opinion or vote if the matter has not (in their view) been properly resolved by the committee.

Surely none of this is controversial at all, since this is precisely what safety committees and the experts who sit on them are supposed to do. Hence if we have any doubt about whether Alison should express her reservations or cast a negative vote, it must be for other reasons. (One might quibble about whether Alison should raise further specific objections at the meeting before committing herself to a negative vote, but that is a mere tactical consideration having no implications for her duties.)

Now to the Pressures. Alison might well feel 'pressured' to keep quiet and not officially record her dissent, given the blatantly political and self-serving comments of others on the committee. She could also fear being a lone dissenter, or fear that her career may be compromised if she is perceived as a 'troublemaker' or an obstructionist. But here again, who would deny that she ought to resist such pressures? This, and any other kind of political pressure, clearly ought to be fought in every way possible by the committee and its members.

Since neither Duties nor Pressures provide any reasons for Alison to hold back her concerns, we are left with broadly scientific and factual issues (the Facts and Regulations mentioned under 1. and 2. above) as the arena for any remaining concerns about what she should do. From the facts presented, and regulations outlined or which can be assumed, an unexpected picture emerges.

Though Alison's concerns seem legitimate, from the initial information we are given it seems there are much more pressing reasons for safety concerns. A heat exchanger shows degraded coolant flow and high differential pressure even after two months of repairs, and tests show the other exchanger in the same generating unit has the same problems. Not only that, but the other generating unit also has problems with its heat exchangers. It seems quite likely that we have the makings of a disaster here, whether or not a generating unit could normally function with the loss of one heat exchanger (the specific point of Alison's concern). All of these facts should be reported to the NRC.

We are also told that the cooling water flow is slightly below the minimum requirement for the whole plant. Quite simply, this means that the NRC must be informed that the plant is in violation of this basic requirement, and NRC's duty is to immediately shut down the plant. A minimum standard is just that, i.e., a minimum level below which performance is absolutely unacceptable. (Even performance above but near to the minimum would be reason for serious safety investigations.) Why did no one on the committee raise this issue?

This case indirectly provides a good illustration of why the U.S nuclear power industry is held in such low esteem by its public. Sadly, engineers and scientists have failed to expeditiously seek out and correct many fundamental safety problems connected with nuclear power, and NRC regulation has been lax or non-existent. With engineers being more concerned with 'not rocking the boat' than with being activists for safer plants, regulatory committees have become largely 'rubber-stamps' for company policy. The comments of committee members as reported in this case, along with Alison's doubts as to whether she should do what it is plainly her duty to do, well illustrate these problems.