Dissent About Nuclear Safety

Alison Turner is concerned about the safety assumptions being made in her work place. This is an important question, but it takes on even more significance in Alison's work place--a nuclear power plant. This case revolves around two important ethical issues: (1) How can a group make the best decision about safety?; and (2) What is an ethical employee's responsibility in terms of expressing his or her opinion?

In terms of its safety decisions, it seems that the company who runs this nuclear power plant has asked the committee Alison is part of (the PNSRC--Plant Nuclear Safety Review Committee) to wear two different and potentially conflicting hats. In a famous example from the discussion that occurred before the Challenger explosion several years ago, a manager at Morton Thiokol asked an engineer who had opposed the launch to "take off his engineering hat" and put on his "management hat." When he responded to the question as a manager, he recommended launching the space shuttle under the conditions specified. This example illustrates that the decision recommended by an engineer may not be the same as the decision recommended by a manager. Asking people on one committee to play both roles may lead to disastrous results.

One reason for the potential danger in this situation is a phenomenon called "groupthink," discussed by Irving Janis in his book, Groupthink (Houghton Mifflin, 1982). In situations of groupthink, members of a group don't want to "rock the boat." They agree to a consensus to support the group even though individuals may disagree with the decision. Rich Robinson, the chair of the committee, has made it clear that it is important to act quickly to avoid a costly shutdown. He has set the tone for the meeting and set the stage for groupthink. It seems as if he has a decision made before the group even discusses anything. When someone suggests that additional calculations could easily be made, one person reminds another not to rock the boat by saying, "Our track record is excellent, and the system is optional. It's not as though we're taking any extraordinary risks." The group never has a chance to critically examine the situation.

When the vote is being cast, Alison must decide her responsibility to express her doubts about the decision. According to Albert Hirschman in the book, Exit, Voice and Loyalty (Harvard University Press, 1970), employees have three options in situations such as this one: exit, voice, or loyalty. In other words, they may decide that the problem is significant enough that they are forced to quit their jobs and leave the corporation (exit). They may speak to their supervisors or anyone else who might be involved and try to convince them of their concerns (voice). Or they may remain loyal to the company and do nothing believing that the company knows best and the problem will be solved in due time. If Alison decided to use the voice option in this situation, she would cast a negative vote. In this way, she would be communicating her dissatisfaction with the committee's decision. Of course, she could abstain (in essence, the exit option) or vote for the decision (loyalty). Each decision is significant and each carries its own risks. If she casts a negative vote, she remain true to her doubts but has the potential not to be seen as a team player. Her future promotions could be affected. If she abstains, she walks a middle ground--she expresses some dissatisfaction, but may still be seen as a reluctant member of the team. If she casts a positive vote, she goes along with the group, remains part of the team, but her voice has been lost.

To avoid putting any individual in this difficult position, this group could have used a more systematic method of assessing the risk involved in the important decisions they are asked to make. For example, in their book, Acceptable Risk (Cambridge University Press, 1981), Fischhoff and his colleagues present seven objectives that they believe a method for assessing risk should meet: comprehensive, logically sound, practical, open to evaluation, politically acceptable, compatible with institutions, and conducive to learning. They note that not all methods meet these criteria, but any method can be examined in light of the criteria. The PNSRC might have avoided groupthink if they had made an attempt to examine their decision-making procedure more systematically. Of course, these criteria do not assure that any decision is sound, but they are one more way of checking to make sure that all areas have been explored before a group chooses a solution to an important problem.

Decision making about risk is a difficult thing to do. It is even more difficult when it is done by a committee that has to consider the implications of the decision for a number of different constituencies. Nevertheless, this area of decision making is extremely important. The committee must be structured so that each employee has a voice and can act as ethically as possible within the parameters of the decision to be made.

I

Whether Alison Turner should express her reservations depends upon several factors. Some of the issues are technical. Some involve the importance of particular safety regulations. Also involved is the power structure of the company and perhaps her judgment of the motives and scruples of higher management.

Apparently she is uncomfortable with the assumption that the heat exchangers have 95% of capacity. How implausible does she think this estimate is and how far off? If she believes that this is probably an unrealistic estimate, made in good faith but probably an overestimation, does she have any good grounds for challenging its accuracy? And what would be the result if it were revised? If she believes that it is a deliberately false estimate, made to get approval of continued operation, she is up against a potentially more difficult situation. Whichever it is, there is also the question of the danger in case of an accident resulting in the loss of one heat exchanger. Alison thinks that this should be considered in the report. In such an event, would the result probably be catastrophic, or merely require quicker action to shut down operations?

Sometimes regulations are excessive. Does she believe that the regulations are excessively cautious or does she think that they are appropriate? If Alison personally believes that they are excessive, does that make a difference? If Alison thinks that there is a real danger, she has more obligation to express her reservations than if she thinks that the Single Failure Criteria are excessive, doesn't she? Or is her personal judgment irrelevant? Think about it from another point of view. Would you want the members of the Plant Nuclear Safety Review Committee using their personal judgment about the importance of the safety regulations in situations like this, or should they conform to the letter of the regulations?

In this case, the requirement that the plant anticipate loss of one heat exchanger in the event of a possible accident is being overlooked, rather than being violated, in the JCO. Is it up to the NRC to notice that? Or is it the responsibility of the plant to meet the requirement? If I am applying for a job and I leave blank some of the questions when answers would call attention to my weaknesses, isn't it up to the employer to decide whether to ask for further information? Is there any analogy between these two situations?

Alison is the least senior member of the committee, but she is still a member. If she is unable or unwilling to voice her opinion, she might as well not be there. Voicing a reservation is doing no more than expressing a professional judgment. But it is at the same time challenging the work of those who prepared the JCO and challenging the judgment of her superiors who see nothing wrong with it. That may take courage.

What if Allison thinks that the 95% capacity is a deliberately false assumption, made up to have a satisfactory JCO and avoid shutdown? Does that make any difference? In that case she would seem to have an additional responsibility to speak up, since in that case her superiors do think that there is something wrong with the JCO and are not saying so. But that may take even more courage, since she is not just raising a technical question but, at least in her own mind, questioning their integrity.

If the problem is sand blockage on the lake water side, is that something that will be remedied while the plant is operating, and will it be remedied if the JCO is approved? Or is the sand blockage something that is going to get worse and make the heat exchangers less effective as time goes by? If so, will the plant become progressively unsafe, or will the problem eventually require shutdown to remedy it? If so, wouldn't it be better to do it sooner, rather than later?

II

Not much has changed as a result of the discussion after Alison expressed her reservations. One member of the committee supported her concern and pointed out that it would take only three hours to carry out the calculations. That this trouble wasn't taken might make her even more suspicious that there is a deliberate effort to submit a misleading JCO. If so, she would have even stronger reason to cast a dissenting vote, for she would feel that there was more than just a matter of technical differences of opinion. On the other hand, she may have been persuaded by the argument that other plants are operating without containment spray systems; therefore it is an unnecessary extra precaution. She could even believe both--that there is only a very remote risk of its ever being needed and of its being unnecessary if it is, but also that management is deliberately ignoring the problem.

III

She might have been right to have expressed and voted her reservations, even if they turned out to have been unwarranted. She showed honesty and integrity. But she may have also adversely affected her career. Not to have unanimity on approval of a JCO is probably not appreciated by the company. It does not look good. To challenge the judgment of her superiors may not make her a welcome member of the team, and the fact that her concerns were unwarranted could be used against her. Is that something that she should have worried about when voting?

On the other hand, expressing and voting her honest opinion may be regarded as a virtue by her superiors. Which do you think is more likely? If you were the superior, which kind of subordinate would you want? If you were an owner of a company or the public affected by decisions, which kind of superior would you want?

In all of this, does it make any difference that Judy is female? Is it more difficult for her to express her judgment because of her gender?

Cases such as this resist a simple answer because those involved (in the present case, Alison) must deal with several fundamentally different kinds of considerations in making their judgement. It is useful to explicitly distinguish these, because the resolution of each requires different kinds of reasoning. However, once distinguished, each is much easier to discuss and resolve than was the original problem. Here are the kinds of considerations:

1. (Facts) What are the relevant facts of the situation? Even here there is room for judgment and argument, as to which facts are or are not relevant or problematic with respect to safety.
2. (Regulations) Given 1., what government regulations apply to the situation? This also may require judgment, since for example 'borderline' data may require an expert decision on whether or not a regulation is significantly infringed by the facts.
3. (Duties) The PNSRC safety committee: what is its structure and organization, and what regulations must it itself conform to? Consequently, what are the duties of individual committee members such as Alison?
4. (Pressures) What political pressures are operative on the committee members? Do they both individually and collectively have the courage, authority and power to ignore these pressures and do the right thing anyway?

Let's start with the easiest part, the Duties. Who would disagree that the committee and its members have a duty to raise and satisfactorily resolve any and all safety issues that come up? What is more, all members of the committee, no matter how junior, have a duty to raise any safety issues they personally are aware of, and a duty to ensure that the committee resolves those issues. Failing this, they have a duty to record a dissenting opinion or vote if the matter has not (in their view) been properly resolved by the committee.

Surely none of this is controversial at all, since this is precisely what safety committees and the experts who sit on them are supposed to do. Hence if we have any doubt about whether Alison should express her reservations or cast a negative vote, it must be for other reasons. (One might quibble about whether Alison should raise further specific objections at the meeting before committing herself to a negative vote, but that is a mere tactical consideration having no implications for her duties.)

Now to the Pressures. Alison might well feel 'pressured' to keep quiet and not officially record her dissent, given the blatantly political and self-serving comments of others on the committee. She could also fear being a lone dissenter, or fear that her career may be compromised if she is perceived as a 'troublemaker' or an obstructionist. But here again, who would deny that she ought to resist such pressures? This, and any other kind of political pressure, clearly ought to be fought in every way possible by the committee and its members.

Since neither Duties nor Pressures provide any reasons for Alison to hold back her concerns, we are left with broadly scientific and factual issues (the Facts and Regulations mentioned under 1. and 2. above) as the arena for any remaining concerns about what she should do. From the facts presented, and regulations outlined or which can be assumed, an unexpected picture emerges.

Though Alison's concerns seem legitimate, from the initial information we are given it seems there are much more pressing reasons for safety concerns. A heat exchanger shows degraded coolant flow and high differential pressure even after two months of repairs, and tests show the other exchanger in the same generating unit has the same problems. Not only that, but the other generating unit also has problems with its heat exchangers. It seems quite likely that we have the makings of a disaster here, whether or not a generating unit could normally function with the loss of one heat exchanger (the specific point of Alison's concern). All of these facts should be reported to the NRC.

We are also told that the cooling water flow is slightly below the minimum requirement for the whole plant. Quite simply, this means that the NRC must be informed that the plant is in violation of this basic requirement, and NRC's duty is to immediately shut down the plant. A minimum standard is just that, i.e., a minimum level below which performance is absolutely unacceptable. (Even performance above but near to the minimum would be reason for serious safety investigations.) Why did no one on the committee raise this issue?

This case indirectly provides a good illustration of why the U.S nuclear power industry is held in such low esteem by its public. Sadly, engineers and scientists have failed to expeditiously seek out and correct many fundamental safety problems connected with nuclear power, and NRC regulation has been lax or non-existent. With engineers being more concerned with 'not rocking the boat' than with being activists for safer plants, regulatory committees have become largely 'rubber-stamps' for company policy. The comments of committee members as reported in this case, along with Alison's doubts as to whether she should do what it is plainly her duty to do, well illustrate these problems.

I

Alison is the junior member of the PNSCR, which has the responsibility of making a recommendation concerning continuing operation of a heat exchanger which is not functioning to standards. Nuclear Safety and Licensing has submitted an analysis justifying continued operation (JCO), but Alison has reservations about an assumption made by NSL; if the assumption is wrong, problems could occur, and NSL has not discussed that contingency. Should Alison express her reservations? The other members of PNSCR want to approve the JCO, and there is pressure that the recommendation be unanimous.

Alison should keep firmly in mind that as a professional engineer, her job is to provide her best professional judgment when called on to do so; she is not on the payroll in order to endorse decisions made by others. She finds herself in a tense political situation, where management looks for the 'correct' recommendation. But if she feels she has valid reservations about the JCO, which she can't express for political reasons, she would be subverting her function on the PNSRC. In effect, it is being suggested to Alison that her professional judgment isn't needed in this situation, which ought to raise the question in everybody's mind, why is she there? If she's not free to speak as her judgment dictates, she has no role on the PNSCR and ought to ask to be replaced on it.

Chair Robinson's comments about the cost to the company of not approving the JCO are entirely inappropriate and put the PNSCR under pressure. Perhaps the parameters of the PNSCR's mandate are not clear; are they supposed to make engineering judgments, or management judgments? It is up to management, it would seem, to consider the costs of delay in deciding whether to accept or reject PNSRC recommendations. Evidently the PNSRC in this company functions in part to cover management's decisions; by providing input management wants to hear, they relieve management of the necessity of making business decisions balancing cost versus safety. This attitude is reflected in the comment of Chair Robinson.

II

Alison expresses her reservations, and there is discussion. However her recommendation for further study is steamrolled by the committee. Should she vote against the approval, since the calculations she requested haven't been made? It is unclear what the hurry is here; if a committee member has reservations which could be clarified by a three hour study, why not make the study? Evidently most of the other committee members think Alison's reservations simply aren't important enough to bother with, which is certainly their prerogative. On the other hand, she has a different opinion, and as a competent professional she is entitled to hear some reason why the study is a waste of time. Evidently Mark Reynolds sees the point of Alison's concern, but his support is brushed aside, leaving the impression that the committee does not really like to hear disagreement among its members. The case does not present any serious discussion on the PNSCR about the contingency which worries Alison; her concern is brushed off with vague invocations of the company's excellent safety record (which this discussion on the PNSRC may be putting in jeopardy!).

Of course Alison could be wrong; perhaps she is inexperienced, and just doesn't realize that what she's worried about is the remote possibility of the failure of a redundant system ("lots of plants don't even have containment spray systems"), which shouldn't be taken seriously. Maybe she's a bit over her head on this committee! If so, she might be wise to listen and learn until she gets more experience. On the other hand, it is also possible that she lends a critical point of view which the committee evidently lacks. Her attitude of refusal to go along with the rest could save the committee from embarrassment some day. There is an air of self-confidence about the other members which could prove dangerous. Given that her recommendation has been rejected without serious discussion, she ought to vote No. Perhaps she's not entitled that the study be done, but she is entitled to a reasoned discussion and plausible arguments why the study shouldn't be made.

It is not stated why it is important that PNSRC decisions be unanimous. Perhaps the vaunted unanimity of past decisions is a consequence of political pressure and not engineering consensus? If previous unanimous recommendations have been the legitimate result of engineering judgments, then no precedent is created, because such unanimity does not exist in the current situation. On the other hand, if previous unanimity has been produced by pressure such as is being exerted on Alison, then the tradition of unanimity is hollow and ought not to be taken as a precedent. What is being decided by the PNSRC is how far one has to go in the interests of safety. This is a matter of judgment. In general, reasonable people can disagree about this question. In this case, the system is optional, failure is evidently considered remote (only a "possibility," a word which in context implies, "very unlikely") and there are said to be no "extraordinary" risks involved even if the exchanger does fail. Nonetheless it is surprising that all PNSRC decisions have been unanimous. If I were management, I would suspect a unanimous PNSRC as too good to be true; such unanimity would strike me as more than a little bit 'concocted'. However management isn't interested in such suspicions because unanimity makes management's job easier.

III

Therefore, I conclude that no matter what the ultimate outcome, Alison would be more at fault for taking the easy way out and going along with the majority, than for voting No. In any case, however, she ought to have a chat with other members of the committee and express disappointment that her judgment was not respectfully considered, and point out that the tendency of the chair to pressure engineering judgments is not in anybody's best interest. Unless she exerts herself and defends her professional competence and prerogatives, she is going to find herself more and more ignored and will come to be regarded as a fifth wheel on the wagon.

It would seem that Alison Turner and her fellow committee members on the PNSRC do not yet have all of the information available to enable them to make a carefully considered judgement. But even before considering analysis of a single heat exchanger failure, as in part II, she has some professional obligations to consider. If Alison does not express her reservations in part I of this case, it is likely that the Justification for Continued Operation (JCO) will be forwarded onto the Nuclear Regularly Commission (NRC) for approval with no mention of the contingency check on the loss of one of the two heat exchangers under the required Single Failure Criteria.

It is not unreasonable to expect that the people who serve on the NRC have sufficient experience and expertise to turn down the JCO from the PNSRC just on the basis of the omission of this Single Failure Criteria assessment of the effect of losing one heat exchanger. Alison can make this point following the moment of silence on the initial vote in part I. She can try to convince her fellow PNSRC members that it is in their and their company's best interest to maintain the confidence of the NRC.

Most important she can try to convince her fellow PNSRC members about their responsibility to check all contingencies in order to hold paramount public safety according to all professional society codes of ethics. This is particularly sensitive given the nature of what is potentially at risk in this case.

In part II of the case it emerges that the Nuclear Safety and Licensing Department would only require 3 hours to perform the necessary calculations for the Single Failure Criteria issue of the effects of a possible loss of one heat exchanger. At this point in the discussion it appears that Mark Reynolds on the PNSRC is leaning towards supporting Alison's concerns. The fact that the containment spray heat exchanger is optional and the company track record is excellent, as Joe Carpello points out, is really not relevant to the question at hand, namely the responsibility of the PSNRC to consider all possible consequences of their actions. The fact that this is an accident mitigation system and there never has been an accident in the plant, as pointed out by Brad Louks, is also not relevant to the basic responsibilities the PNSRC faces.

Joe Carpello's statement that nothing is ever totally risk free is exactly right. But his point that their company has always been a leader in safety, so "...Let's not get carried away with 'possibilities'" seems precisely wrong just because nothing is ever totally risk free. It is exactly by letting oneself get deeply immersed in all failure mode possibilities that one maintains a position of leadership in safety.

Given that it is only 1:30 p.m. in the afternoon when this discussion takes place, and that the calculations for the missing Single Failure Criteria assessment would only take another 3 hours, it would seem that Alison and Mark could reasonably call for a tabling of the PNSRC vote until 4:30 that afternoon.

In part III of the case, it is hypothesized that subsequent calculations have shown that Alison's concerns were unfounded. Does that make it wrong for her to have requested a delay on the PNSRC vote? Just the fact that the substantiating subsequent analysis can now be included in the JCO to be forwarded to the NRC would seem to justify the delay.

The issue of setting a precedent of proceeding without unanimity on the PNSRC does not really seem to be an issue. Undoubtedly, once the Single Failure Criterion analysis is available, Alison will for sure be willing to join the majority to make the final recorded vote unanimous. But even without such a vote change, in something as critical as reviews like this one coming before the NRC, non-unanimity of a PNSRC vote may achieve the important function of requiring the NRC to look at any situation more carefully than it might otherwise have done.

The early days of the NRC actions are replete with some misguided risk assessment analyses that did not properly alert us to the kind of problems that arose at Three Mile Island. The interested reader is referred to the literature regarding the famous Report to the NRC headed by Professor Rasmussen of MIT (the so called WASH-1400 Report). There are also a number of informative reports and TV tapes on Three Mile Island that are relevant to some of the issues in this case.