Today Alison finds herself in a difficult situation. PNSRC is meeting to decide what to do about a heat exchanger problem. Alison is a single voice in a company meeting held to finalize an important decision. Should she speak up?
originally titled: To Dissent or not to Dissent
This case is one of thirty-two cases which address a wide range of ethical issues that can arise in engineering practice provided by the Center For the Study of Ethics in Society, Western Michigan University.
edited by Michael Pritchard
Alison Turner is a department manager at a large commercial nuclear generating plant. She is also a member of the Plant Nuclear Safety Review Committee (PNSRC). The committee's responsibilities include reviewing and approving design changes, procedural changes, and submittals to the Nuclear Regulatory Commission (NRC). Today Alison finds herself in a difficult situation. PNSRC is meeting to decide what to do about a heat exchanger problem. Routine testing on the previous morning revealed degraded cooling water flow and high differential pressure in one of the containment spray heat exchangers of one of the two generating units. This unit has just returned to service after two months of repairs. Test results on the second heat exchanger were similar.
Although the other generating unit has been in continuous service, testing reveals that its two heat exchangers are operating at less than full capacity. The most likely cause of the problem is sand blockage on the lake water side of the four heat exchangers. After extensive analysis by engineers in the Mechanical Engineering and Nuclear Safety & Licensing Departments, it has been concluded that the cooling water flow falls slightly below the minimum requirement set by the technical specifications under which the plant is licensed. Nevertheless, based on Mechanical Engineering's analysis, Nuclear Safety & Licensing has prepared a Justification for Continued Operation (JCO) for submission to NRC. PNSRC is now meeting to decide whether to approve the JCO and forward it to NRC.
As Alison reviews the JCO she is uncomfortable with one assumption made in the analysis. The analysis assumes that the heat exchangers still have 95% of their original heat transfer capability. It is concluded that this would be satisfactory. However, in anticipating possible accidents, Single Failure Criteria require the plant to assume the loss of one heat exchanger. Alison wonders if, under those conditions, the heat transfer problem would be manageable. The JCO does not discuss what might happen under that contingency. Seven members of PNSRC are present, enough for a quorum. Alison is the least senior member present. From the outset of the meeting, committee chair Rich Robinson has made it clear that it is important to act quickly, since any shutdown will cost the company, and ultimately the rate payers, a lot of money in additional fuel costs. "Repairs," he says, "might take a couple of weeks. If we don't approve this, we may be facing a multi-million dollar proposition. Fortunately, the JCO seems fine. What do you think?" Brad Louks and Joe Carpello immediately concur. Rich then says, "Well, if no one sees any problems here, let's go with it." There is a moment of silence. Should Alison express her reservations?
Alison Turner expresses her reservations. Brad Louks replies, "We're talking about containment heat exchangers. It's an Accident Mitigation System, and it's never had to be used here--or at any other commercial nuclear plant that we know of, for that matter. In fact, lots of plants don't even have containment spray systems." "Right," adds Joe Carpello, "we're ahead of the game on this one. I don't see any problem here. Nothing's totally risk free, but we've always been leaders in safety. Let's not get carried away with 'possibilities'." "I don't think Alison meant to have us get carried away with anything," Mark Reynolds interjects. "She's just wondering if the JCO should address the question of how things would look if we lost one of the heat exchangers. How much time would it take the Nuclear Safety and Licensing Department to make a calculation for us--another 3 hours? It's only 1:30pm, you know." "What's the point, Mark?" asks Joe. "Our track record is excellent, and the system is optional. It's not as though we're taking any extraordinary risks."
Nothing further is said, and Rich Robinson calls for the vote. Though not a committee requirement, PNSRC has always acted unanimously. It often rejects, sometimes approves, but always unanimously. As the call goes around the room, each member approves. The last member called on to vote is Alison. She still has serious reservations about approving the JCO without the Nuclear Safety and Licensing Department making further calculations. How should she vote?
Suppose Alison casts a negative vote and subsequent calculations show that her worries were unfounded -- in the event of an accident, a single heat exchanger would be adequate to manage any likely heat transfer problems. Would it follow that it was wrong for her to cast a dissenting vote? [Recall that a single dissenting vote would not defeat approval. It would only set a precedent of proceeding without unanimity.]
Return to Teaching Engineering Ethics: A Case Study Approach
Posted 12 years and 5 months ago
Whether Alison Turner should express her reservations depends upon several factors. Some of the issues are technical. Some involve the importance of particular safety regulations. Also involved is the power structure of the company and perhaps her judgment of the motives and scruples of higher management.
Apparently she is uncomfortable with the assumption that the heat exchangers have 95% of capacity. How implausible does she think this estimate is and how far off? If she believes that this is probably an unrealistic estimate, made in good faith but probably an overestimation, does she have any good grounds for challenging its accuracy? And what would be the result if it were revised? If she believes that it is a deliberately false estimate, made to get approval of continued operation, she is up against a potentially more difficult situation. Whichever it is, there is also the question of the danger in case of an accident resulting in the loss of one heat exchanger. Alison thinks that this should be considered in the report. In such an event, would the result probably be catastrophic, or merely require quicker action to shut down operations?
Sometimes regulations are excessive. Does she believe that the regulations are excessively cautious or does she think that they are appropriate? If Alison personally believes that they are excessive, does that make a difference? If Alison thinks that there is a real danger, she has more obligation to express her reservations than if she thinks that the Single Failure Criteria are excessive, doesn't she? Or is her personal judgment irrelevant? Think about it from another point of view. Would you want the members of the Plant Nuclear Safety Review Committee using their personal judgment about the importance of the safety regulations in situations like this, or should they conform to the letter of the regulations?
In this case, the requirement that the plant anticipate loss of one heat exchanger in the event of a possible accident is being overlooked, rather than being violated, in the JCO. Is it up to the NRC to notice that? Or is it the responsibility of the plant to meet the requirement? If I am applying for a job and I leave blank some of the questions when answers would call attention to my weaknesses, isn't it up to the employer to decide whether to ask for further information? Is there any analogy between these two situations?
Alison is the least senior member of the committee, but she is still a member. If she is unable or unwilling to voice her opinion, she might as well not be there. Voicing a reservation is doing no more than expressing a professional judgment. But it is at the same time challenging the work of those who prepared the JCO and challenging the judgment of her superiors who see nothing wrong with it. That may take courage.
What if Allison thinks that the 95% capacity is a deliberately false assumption, made up to have a satisfactory JCO and avoid shutdown? Does that make any difference? In that case she would seem to have an additional responsibility to speak up, since in that case her superiors do think that there is something wrong with the JCO and are not saying so. But that may take even more courage, since she is not just raising a technical question but, at least in her own mind, questioning their integrity.
If the problem is sand blockage on the lake water side, is that something that will be remedied while the plant is operating, and will it be remedied if the JCO is approved? Or is the sand blockage something that is going to get worse and make the heat exchangers less effective as time goes by? If so, will the plant become progressively unsafe, or will the problem eventually require shutdown to remedy it? If so, wouldn't it be better to do it sooner, rather than later?
Not much has changed as a result of the discussion after Alison expressed her reservations. One member of the committee supported her concern and pointed out that it would take only three hours to carry out the calculations. That this trouble wasn't taken might make her even more suspicious that there is a deliberate effort to submit a misleading JCO. If so, she would have even stronger reason to cast a dissenting vote, for she would feel that there was more than just a matter of technical differences of opinion. On the other hand, she may have been persuaded by the argument that other plants are operating without containment spray systems; therefore it is an unnecessary extra precaution. She could even believe both--that there is only a very remote risk of its ever being needed and of its being unnecessary if it is, but also that management is deliberately ignoring the problem.
She might have been right to have expressed and voted her reservations, even if they turned out to have been unwarranted. She showed honesty and integrity. But she may have also adversely affected her career. Not to have unanimity on approval of a JCO is probably not appreciated by the company. It does not look good. To challenge the judgment of her superiors may not make her a welcome member of the team, and the fact that her concerns were unwarranted could be used against her. Is that something that she should have worried about when voting?
On the other hand, expressing and voting her honest opinion may be regarded as a virtue by her superiors. Which do you think is more likely? If you were the superior, which kind of subordinate would you want? If you were an owner of a company or the public affected by decisions, which kind of superior would you want?
In all of this, does it make any difference that Judy is female? Is it more difficult for her to express her judgment because of her gender?
Alison Turner is concerned about the safety assumptions being made in her work place. This is an important question, but it takes on even more significance in Alison's work place--a nuclear power plant. This case revolves around two important ethical issues: (1) How can a group make the best decision about safety?; and (2) What is an ethical employee's responsibility in terms of expressing his or her opinion?
In terms of its safety decisions, it seems that the company who runs this nuclear power plant has asked the committee Alison is part of (the PNSRC--Plant Nuclear Safety Review Committee) to wear two different and potentially conflicting hats. In a famous example from the discussion that occurred before the Challenger explosion several years ago, a manager at Morton Thiokol asked an engineer who had opposed the launch to "take off his engineering hat" and put on his "management hat." When he responded to the question as a manager, he recommended launching the space shuttle under the conditions specified. This example illustrates that the decision recommended by an engineer may not be the same as the decision recommended by a manager. Asking people on one committee to play both roles may lead to disastrous results.
One reason for the potential danger in this situation is a phenomenon called "groupthink," discussed by Irving Janis in his book, Groupthink (Houghton Mifflin, 1982). In situations of groupthink, members of a group don't want to "rock the boat." They agree to a consensus to support the group even though individuals may disagree with the decision. Rich Robinson, the chair of the committee, has made it clear that it is important to act quickly to avoid a costly shutdown. He has set the tone for the meeting and set the stage for groupthink. It seems as if he has a decision made before the group even discusses anything. When someone suggests that additional calculations could easily be made, one person reminds another not to rock the boat by saying, "Our track record is excellent, and the system is optional. It's not as though we're taking any extraordinary risks." The group never has a chance to critically examine the situation.
When the vote is being cast, Alison must decide her responsibility to express her doubts about the decision. According to Albert Hirschman in the book, Exit, Voice and Loyalty (Harvard University Press, 1970), employees have three options in situations such as this one: exit, voice, or loyalty. In other words, they may decide that the problem is significant enough that they are forced to quit their jobs and leave the corporation (exit). They may speak to their supervisors or anyone else who might be involved and try to convince them of their concerns (voice). Or they may remain loyal to the company and do nothing believing that the company knows best and the problem will be solved in due time. If Alison decided to use the voice option in this situation, she would cast a negative vote. In this way, she would be communicating her dissatisfaction with the committee's decision. Of course, she could abstain (in essence, the exit option) or vote for the decision (loyalty). Each decision is significant and each carries its own risks. If she casts a negative vote, she remain true to her doubts but has the potential not to be seen as a team player. Her future promotions could be affected. If she abstains, she walks a middle ground--she expresses some dissatisfaction, but may still be seen as a reluctant member of the team. If she casts a positive vote, she goes along with the group, remains part of the team, but her voice has been lost.
To avoid putting any individual in this difficult position, this group could have used a more systematic method of assessing the risk involved in the important decisions they are asked to make. For example, in their book, Acceptable Risk (Cambridge University Press, 1981), Fischhoff and his colleagues present seven objectives that they believe a method for assessing risk should meet: comprehensive, logically sound, practical, open to evaluation, politically acceptable, compatible with institutions, and conducive to learning. They note that not all methods meet these criteria, but any method can be examined in light of the criteria. The PNSRC might have avoided groupthink if they had made an attempt to examine their decision-making procedure more systematically. Of course, these criteria do not assure that any decision is sound, but they are one more way of checking to make sure that all areas have been explored before a group chooses a solution to an important problem.
Decision making about risk is a difficult thing to do. It is even more difficult when it is done by a committee that has to consider the implications of the decision for a number of different constituencies. Nevertheless, this area of decision making is extremely important. The committee must be structured so that each employee has a voice and can act as ethically as possible within the parameters of the decision to be made.
Alison should express her reservations. If Single Failure Criteria require that one assume the loss of one heat exchanger, and if the Criteria themselves are required--that is, if one is required to make sure that they are satisfied--then the failure to determine what would happen if there were only one heat exchanger means that the plant has failed to do what it is required to do. It makes a difference, or course, who is requiring that the Single Failure Criteria be satisfied. If it is the NRC, and it is reasonable to assume that it is, then the Plant Nuclear Safety Review Committee is failing to fulfil one of its obligations in submitting its Justification for Continued Operation to NRC.
Perhaps NRC will see the failure and send the JCO back for the additional information that NRC requires. But there is no guarantee of that. In a complex document, it is easy enough to miss something, even if required. So Alison cannot assume that NRC will catch the Committee's not determining what will happen if one heat exchanger fails.
Even if she could assume that, she has an obligation as a member of the Committee to make sure that the Committee's reports reflect whatever is required. By not expressing her reservations when, by the nature of Rich's comments, it looks as though a vote will be called, she is effectively agreeing to sign off on what she takes to be a flawed document. She has a professional obligation not to do that.
That, as it appears, others may not agree with her is not relevant. An analogy may make this point clearer. The Supreme Court consists of nine justices. It hears cases, and the justices meet together to determine what the Court ought to decide. It is rare that the justices all agree. Unanimity is the exception, not the norm. The justice chosen to write the opinion for the majority is required to circulate his or her draft opinion to all members of the Court, and justices send back comments, suggesting changes, including additional arguments, problems with existing arguments or positions, and so on. The vote, in short, initiates a dialogue among the justices. Sometimes that dialogue changes the votes of some of the justices. As they see a decision argued out, they may become convinced that their original judgment was mistaken. It is the job of each person to give their views as strongly and clearly as possible. Only in that way, it is assumed, can the best decision be reached--the one most likely to withstand further criticism.
The Plant Nuclear Safety Review Committee and, indeed, any official committee of professionals ought to work in the same way. Such a procedure presumes, as a working hypothesis, the respect of each member of the committee for the others, but that respect is both created and maintained by the quality of judgment of the person being respected--a quality of judgment measured by how good the reasons are a person gives, how nuanced to the evidence, how carefully considered in light of objections, and so on.
So if Alison now expresses her reservations, she is immediately calling upon the presumptions about how such a committee ought to operate that make such expressions reasonable and accepted. She is calling upon the other members of the committee to explain why they think such a contingency as the loss of one heat exchanger need not be examined, and she is herself required to explain why it is that she thinks it ought to be examined.
Lying behind such presumptions about how such a committee ought to operate is the further, and deeper, presumption that it is only in such a committee, operating with such respect of the members, one for another, that one can be more sure of coming to a conclusion that will withstand objections than not. There is no guarantee that the conclusion reached will not be mistaken: it is possible that all the members be wrong in one respect or another. But if each member feels entitled and, better, obligated to raise what objections seems appropriate, and if the committee as a whole is obligated to come to grips with the objections, treat them with respect, and respond to them in a reasonable way, then the end result will be better decisions--one more likely to withstand objection.
Alison thus has an obligation to express her reservations, and it is a complex obligation--to the nature of the decision-making process and to her fellow committee members. She is, after all, obligated by a commitment to the decision-making process not to allow her fellow committee members to embarrass themselves by making a bad decision.
Alison should vote not to approve the JCO without the Nuclear Safety and Licensing Department making the further calculation, and she should make it clear the reasons she is voting not to approve the JCO--that the Criteria require such a calculation, that it is inappropriate to send the JCO onto the NRC without satisfying the Criteria it requires, and that it will take little work, and waste virtually no time, to do what is required.
She may get a bit of flack for voting that way, but not much, and that is not to the point in any case. If her case is reasonable, then the other members of the committee can hardly complain at her unwillingness to do what she thinks is a mistake.
Of course, one of the problems with what she has done is that she has failed to give arguments for her position given what has been said. On the one hand, she needs to second the observation Mark Reynolds makes. Joe objects, "What's the point?," and the proper response is that the point is that the Criteria require that the contingency be considered and that, to push Mark's point home, the necessary information can be gained quickly and without a great deal of trouble. So, Alison can and should say, she is not asking for much and is asking only for what is required.
But, on the other hand, she needs to respond to the points Louks and Carpello bring up. If having heat exchangers is not itself required, then why is it necessary to test to see what happens if one is lost? It is not to the point to argue, as they do, that so far the plant has been accident-free. One may cross the street all one's life without being run over and without looking both ways, but one's luck does not mean that it is right or all right not to look both ways. Requirements are there to make sure that one do what needs to be done to prevent accidents. It does not follow that if one has not had any accidents, that one need not do what is required. One may not have had any accidents because one has done what is required. But the thrust of the objection Louks and Carpello make is that since the heat exchangers are an extra safety device in any event, not required, it makes no sense to follow the Criteria and see what happens if one of them fails. Many plants have neither, and they have had no problems.
To make her point, Alison needs to argue something like this: heat exchangers are not required, but when they do exist, then the Criteria require that one determine what happens when one fails. It is not unusual to have a situation where one has something extra and then is required, because one has something extra, to make sure it works properly. If car seats for babies were not required by law, but one had one, it would not be inappropriate for a legislature to require that one check to be sure that it works properly. The baby might be no worse off in a car seat that did not stay in place in an accident than if he or she were in an accident without a car seat at all, but since the parent has provided one, the legislature may require that it work properly. Reduced insurance premiums might depend upon the seat working properly, or the legislature might want to be sure that the person who bought it has peace of mind appropriately, and not because of the mistaken assumption that the car seat will protect the child. Just so, NRC may not require heat exchangers, but may require, if a plant has them, that they do the job even if one is down. Nothing in the case tells us anything about that one way or the other, but that is a failure on the part of Alison. She has failed to pursue the dialogue, failed to provide the reasons she needs to provide, to make her position sustainable--and help her colleagues keep from making a mistake.
If subsequent calculations show that a single heat exchanger would be adequate, that would not make it wrong for Alison to have cast a negative vote. She is not doing that to prevent the report from going on to NRC, but to make sure that the committee do what is required--assuming that the Criteria are themselves required by NRC--and that the committee work in the appropriate way in coming to its decisions. That is, she has an obligation to present her views, however different they may be from the views of other members of the committee, and an obligation to make sure that the views of others are appropriately reasoned. She is casting a negative vote in part, presumably, because she does not think the position of the committee that the contingency in question need not be examined is a viable position. That she turns out to be wrong does not mean that the committee's position is right. After all, they could not have known when they voted that one heat exchanger would be enough. And, more important, that she turns out to be wrong does not mean that the committee's deliberations were appropriate: the committee failed to come to grips with her objection that the Criteria require determining what happens in such a contingency (assuming that is the thrust of her argument or, what is the same, that she has an acceptable response to the objection of Louks and Carpello).
She may well set a precedent for proceeding without unanimity, but the hope must be that she will begin to initiate the sort of dialogue that ought to mark such deliberative bodies.
It would seem that Alison Turner and her fellow committee members on the PNSRC do not yet have all of the information available to enable them to make a carefully considered judgement. But even before considering analysis of a single heat exchanger failure, as in part II, she has some professional obligations to consider. If Alison does not express her reservations in part I of this case, it is likely that the Justification for Continued Operation (JCO) will be forwarded onto the Nuclear Regularly Commission (NRC) for approval with no mention of the contingency check on the loss of one of the two heat exchangers under the required Single Failure Criteria.
It is not unreasonable to expect that the people who serve on the NRC have sufficient experience and expertise to turn down the JCO from the PNSRC just on the basis of the omission of this Single Failure Criteria assessment of the effect of losing one heat exchanger. Alison can make this point following the moment of silence on the initial vote in part I. She can try to convince her fellow PNSRC members that it is in their and their company's best interest to maintain the confidence of the NRC.
Most important she can try to convince her fellow PNSRC members about their responsibility to check all contingencies in order to hold paramount public safety according to all professional society codes of ethics. This is particularly sensitive given the nature of what is potentially at risk in this case.
In part II of the case it emerges that the Nuclear Safety and Licensing Department would only require 3 hours to perform the necessary calculations for the Single Failure Criteria issue of the effects of a possible loss of one heat exchanger. At this point in the discussion it appears that Mark Reynolds on the PNSRC is leaning towards supporting Alison's concerns. The fact that the containment spray heat exchanger is optional and the company track record is excellent, as Joe Carpello points out, is really not relevant to the question at hand, namely the responsibility of the PSNRC to consider all possible consequences of their actions. The fact that this is an accident mitigation system and there never has been an accident in the plant, as pointed out by Brad Louks, is also not relevant to the basic responsibilities the PNSRC faces.
Joe Carpello's statement that nothing is ever totally risk free is exactly right. But his point that their company has always been a leader in safety, so "...Let's not get carried away with 'possibilities'" seems precisely wrong just because nothing is ever totally risk free. It is exactly by letting oneself get deeply immersed in all failure mode possibilities that one maintains a position of leadership in safety.
Given that it is only 1:30 p.m. in the afternoon when this discussion takes place, and that the calculations for the missing Single Failure Criteria assessment would only take another 3 hours, it would seem that Alison and Mark could reasonably call for a tabling of the PNSRC vote until 4:30 that afternoon.
In part III of the case, it is hypothesized that subsequent calculations have shown that Alison's concerns were unfounded. Does that make it wrong for her to have requested a delay on the PNSRC vote? Just the fact that the substantiating subsequent analysis can now be included in the JCO to be forwarded to the NRC would seem to justify the delay.
The issue of setting a precedent of proceeding without unanimity on the PNSRC does not really seem to be an issue. Undoubtedly, once the Single Failure Criterion analysis is available, Alison will for sure be willing to join the majority to make the final recorded vote unanimous. But even without such a vote change, in something as critical as reviews like this one coming before the NRC, non-unanimity of a PNSRC vote may achieve the important function of requiring the NRC to look at any situation more carefully than it might otherwise have done.
The early days of the NRC actions are replete with some misguided risk assessment analyses that did not properly alert us to the kind of problems that arose at Three Mile Island. The interested reader is referred to the literature regarding the famous Report to the NRC headed by Professor Rasmussen of MIT (the so called WASH-1400 Report). There are also a number of informative reports and TV tapes on Three Mile Island that are relevant to some of the issues in this case.
Alison is the junior member of the PNSCR, which has the responsibility of making a recommendation concerning continuing operation of a heat exchanger which is not functioning to standards. Nuclear Safety and Licensing has submitted an analysis justifying continued operation (JCO), but Alison has reservations about an assumption made by NSL; if the assumption is wrong, problems could occur, and NSL has not discussed that contingency. Should Alison express her reservations? The other members of PNSCR want to approve the JCO, and there is pressure that the recommendation be unanimous.
Alison should keep firmly in mind that as a professional engineer, her job is to provide her best professional judgment when called on to do so; she is not on the payroll in order to endorse decisions made by others. She finds herself in a tense political situation, where management looks for the 'correct' recommendation. But if she feels she has valid reservations about the JCO, which she can't express for political reasons, she would be subverting her function on the PNSRC. In effect, it is being suggested to Alison that her professional judgment isn't needed in this situation, which ought to raise the question in everybody's mind, why is she there? If she's not free to speak as her judgment dictates, she has no role on the PNSCR and ought to ask to be replaced on it.
Chair Robinson's comments about the cost to the company of not approving the JCO are entirely inappropriate and put the PNSCR under pressure. Perhaps the parameters of the PNSCR's mandate are not clear; are they supposed to make engineering judgments, or management judgments? It is up to management, it would seem, to consider the costs of delay in deciding whether to accept or reject PNSRC recommendations. Evidently the PNSRC in this company functions in part to cover management's decisions; by providing input management wants to hear, they relieve management of the necessity of making business decisions balancing cost versus safety. This attitude is reflected in the comment of Chair Robinson.
Alison expresses her reservations, and there is discussion. However her recommendation for further study is steamrolled by the committee. Should she vote against the approval, since the calculations she requested haven't been made? It is unclear what the hurry is here; if a committee member has reservations which could be clarified by a three hour study, why not make the study? Evidently most of the other committee members think Alison's reservations simply aren't important enough to bother with, which is certainly their prerogative. On the other hand, she has a different opinion, and as a competent professional she is entitled to hear some reason why the study is a waste of time. Evidently Mark Reynolds sees the point of Alison's concern, but his support is brushed aside, leaving the impression that the committee does not really like to hear disagreement among its members. The case does not present any serious discussion on the PNSCR about the contingency which worries Alison; her concern is brushed off with vague invocations of the company's excellent safety record (which this discussion on the PNSRC may be putting in jeopardy!).
Of course Alison could be wrong; perhaps she is inexperienced, and just doesn't realize that what she's worried about is the remote possibility of the failure of a redundant system ("lots of plants don't even have containment spray systems"), which shouldn't be taken seriously. Maybe she's a bit over her head on this committee! If so, she might be wise to listen and learn until she gets more experience. On the other hand, it is also possible that she lends a critical point of view which the committee evidently lacks. Her attitude of refusal to go along with the rest could save the committee from embarrassment some day. There is an air of self-confidence about the other members which could prove dangerous. Given that her recommendation has been rejected without serious discussion, she ought to vote No. Perhaps she's not entitled that the study be done, but she is entitled to a reasoned discussion and plausible arguments why the study shouldn't be made.
It is not stated why it is important that PNSRC decisions be unanimous. Perhaps the vaunted unanimity of past decisions is a consequence of political pressure and not engineering consensus? If previous unanimous recommendations have been the legitimate result of engineering judgments, then no precedent is created, because such unanimity does not exist in the current situation. On the other hand, if previous unanimity has been produced by pressure such as is being exerted on Alison, then the tradition of unanimity is hollow and ought not to be taken as a precedent. What is being decided by the PNSRC is how far one has to go in the interests of safety. This is a matter of judgment. In general, reasonable people can disagree about this question. In this case, the system is optional, failure is evidently considered remote (only a "possibility," a word which in context implies, "very unlikely") and there are said to be no "extraordinary" risks involved even if the exchanger does fail. Nonetheless it is surprising that all PNSRC decisions have been unanimous. If I were management, I would suspect a unanimous PNSRC as too good to be true; such unanimity would strike me as more than a little bit 'concocted'. However management isn't interested in such suspicions because unanimity makes management's job easier.
Therefore, I conclude that no matter what the ultimate outcome, Alison would be more at fault for taking the easy way out and going along with the majority, than for voting No. In any case, however, she ought to have a chat with other members of the committee and express disappointment that her judgment was not respectfully considered, and point out that the tendency of the chair to pressure engineering judgments is not in anybody's best interest. Unless she exerts herself and defends her professional competence and prerogatives, she is going to find herself more and more ignored and will come to be regarded as a fifth wheel on the wagon.
Cases such as this resist a simple answer because those involved (in the present case, Alison) must deal with several fundamentally different kinds of considerations in making their judgement. It is useful to explicitly distinguish these, because the resolution of each requires different kinds of reasoning. However, once distinguished, each is much easier to discuss and resolve than was the original problem. Here are the kinds of considerations:
Let's start with the easiest part, the Duties. Who would disagree that the committee and its members have a duty to raise and satisfactorily resolve any and all safety issues that come up? What is more, all members of the committee, no matter how junior, have a duty to raise any safety issues they personally are aware of, and a duty to ensure that the committee resolves those issues. Failing this, they have a duty to record a dissenting opinion or vote if the matter has not (in their view) been properly resolved by the committee.
Surely none of this is controversial at all, since this is precisely what safety committees and the experts who sit on them are supposed to do. Hence if we have any doubt about whether Alison should express her reservations or cast a negative vote, it must be for other reasons. (One might quibble about whether Alison should raise further specific objections at the meeting before committing herself to a negative vote, but that is a mere tactical consideration having no implications for her duties.)
Now to the Pressures. Alison might well feel 'pressured' to keep quiet and not officially record her dissent, given the blatantly political and self-serving comments of others on the committee. She could also fear being a lone dissenter, or fear that her career may be compromised if she is perceived as a 'troublemaker' or an obstructionist. But here again, who would deny that she ought to resist such pressures? This, and any other kind of political pressure, clearly ought to be fought in every way possible by the committee and its members.
Since neither Duties nor Pressures provide any reasons for Alison to hold back her concerns, we areleft with broadly scientific and factual issues (the Facts and Regulations mentioned under 1. and 2. above) as the arena for any remaining concerns about what she should do. From the facts presented, and regulations outlined or which can be assumed, an unexpected picture emerges.
Though Alison's concerns seem legitimate, from the initial information we are given it seems there are much more pressing reasons for safety concerns. A heat exchanger shows degraded coolant flow and high differential pressure even after two months of repairs, and tests show the other exchanger in the same generating unit has the same problems. Not only that, but the other generating unit also has problems with its heat exchangers. It seems quite likely that we have the makings of a disaster here, whether or not a generating unit could normally function with the loss of one heat exchanger (the specific point of Alison's concern). All of these facts should be reported to the NRC.
We are also told that the cooling water flow is slightly below the minimum requirement for the whole plant. Quite simply, this means that the NRC must be informed that the plant is in violation of this basic requirement, and NRC's duty is to immediately shut down the plant. A minimum standard is just that, i.e., a minimum level below which performance is absolutely unacceptable. (Even performance above but near to the minimum would be reason for serious safety investigations.) Why did no one on the committee raise this issue?
This case indirectly provides a good illustration of why the U.S nuclear power industry is held in such low esteem by its public. Sadly, engineers and scientists have failed to expeditiously seek out and correct many fundamental safety problems connected with nuclear power, and NRC regulation has been lax or non-existent. With engineers being more concerned with 'not rocking the boat' than with being activists for safer plants, regulatory committees have become largely 'rubber-stamps' for company policy. The comments of committee members as reported in this case, along with Alison's doubts as to whether she should do what it is plainly her duty to do, well illustrate these problems.
Alison Turner is experiencing a moral crisis partly because of an unhealthy group leadership situation. In order for group problem solving to be successful, a style of discussion leadership must be developed to maximize the group's assets and minimize its liabilities (Ritchie and Thompson 1980).
The Plant Nuclear Safety Review Committee includes more than one individual because a group has access to more knowledge and experience than an individual has. Also, a group can generate more alternatives to solving a problem, and can explore a problem from a greater number of perspectives than an individual can. Such assets are particularly valuable when the group is charged with safety oversight responsibilities for critical facilities. These aspects of group problem solving can only be realized, however, when the group leader understands and facilitates effective group dynamics. Each individual must be encouraged to voice concerns, including contingencies that have not been considered by other group members. Each individual must feel valued by the group. This is the goal of leadership ethics (Maier 1980).
Rich Robinson, chair of the committee, is not exercising effective leadership. He is dominating the discussion, and with the help of two other strong personalities, Brad Louks and Joe Carpello, he is quickly leading the group toward a preconceived decision. Alison Turner, along with others, is hesitant to accept this decision, but no one speaks. Alison is especially uncomfortable because she is the least senior member present at the meeting.
Group decisions, especially unanimous group decisions, are generally given more weight than decisions made by individuals. However, this case illustrates that group decisions may, in fact, represent the viewpoint of a single member of the group or the judgment of a minority of dominant individuals.
Unless all individuals in the group are comfortable in contributing to a consensus, the value of the group is questionable. The decisions may as well be made by an individual, or by a computer using expert systems technology. People, not computers, have been trusted with the oversight assignment in this case, and the reason is that experience-based judgments are needed.
The experience brought to a problem by senior members of a group is valuable. However, sometimes seniority works to disadvantage. The less-senior members may feel uncomfortable challenging their superiors. But the less-senior members are often able to bring fresh insights and new experiences to the problem. Senior members may be inclined toward misguided loyalties and may become complacent and defensive. These attributes can be seen in some of the comments by Brad Louks and Joe Carpello: "...we've always been leaders in safety," and, "Our track record is excellent..." When contingencies are being ignored, these attitudes need to be challenged. The less-senior members of the group can be very effective in energizing a complacent group if the leadership is healthy.
This committee has a precedence of always arriving at a unanimous decision. The account given here causes one to question the wisdom of honoring such a tradition. If a unanimous decision represents a consensus agreed to willingly by all members of the group, then the unanimity may be an indication of the quality of the decision. However, in this case, it appears that a unanimous decision may be the result of social pressure. Social pressure within a group can stifle disagreement. Uncomfortable parties remain silent and conform to the wishes of dominant individuals (Maier 1980).
Alison and at least one other member, Mark Reynolds, are not comfortable with the direction the group is taking. Public welfare may be at stake, and one hopes that these individuals will decide to place the public interest above their own personal comfort. This is the hallmark of professionalism. Sometimes things do go wrong in spite of low probability, and concern for this contingency is what separates the true professional from the "uninvolved" technician. The engineering Code of Ethics requires members of the profession to "...hold paramount the health, safety and welfare of the public" (Pletta 1987, Rubin and Banick 1987).
Since Alison still has reservations, she should not vote to approve the Justification for Continued Operation. The committee will be forced to either address her concerns, or to depart from the precedence of unanimity. It should be noted that there is some merit to abandoning the practice of forced unanimity. Dissenting viewpoints based on rational arguments are useful, especially when something goes wrong. The dissenting comments assist in the re-evaluation of decision processes. Even the Supreme Court does not insist on unanimous decisions; a lack of complete consensus is a valid reflection of the uncertainties present in judgment decisions.
The safety of the Nuclear Power industry relies on the diligence of many professionals who worry about contingencies. Redundancy of critical components and systems is a key factor in ensuring public safety. The "Single Failure Criteria" that Alison is exploring is fundamental to the concept of Redundancy. She is not "...getting (unnecessarily) carried away with possibilities," as Joe Carpello suggests. She is exercising her professional responsibilities as a trusted member of an oversight group. She is merely concerned that all reasonably foreseeable contingencies be investigated.
When things go wrong, there is always a technical explanation for the failure. But there is also inevitably a procedural problem, involving human deficiencies (Carper 1989). Often the procedural problem relates to a flawed decision process and complacency regarding contingency plans. Mark Reynold's suggestion that the concerns expressed by Alison be referred back to the Mechanical Engineering group makes a lot of sense. This act would not entail a great time delay. It will impress the Mechanical Engineering group with the need to investigate all contingencies when future problems arise. And, even if the problem turns out to be less critical than it now appears to Alison, the committee decision will truly be a willing consensus. The more comprehensive review will be viewed favorably by the Nuclear Regulatory Commission, and the NRC will likely place more credibility in future recommendations from the committee.
One final concern deserves comment. The current report implies that the cooling system is operating at or below the limit of acceptable standards. The problem appears to be sand blockage involving all four heat exchangers. If nothing is done to remedy the situation, is it not likely to deteriorate further? Yet, the dominant individuals in this group are committed to getting on with business as usual. Robinson says, "If we don't approve this, we may be facing a multi-million dollar proposition."
Obviously, the time will come when a sizable expenditure will be required, unless further compromises to public safety are entertained. If Alison retains her commitment to professionalism, and we hope she does, it will be even more difficult to speak up next time. In the future, she may find it necessary to take her concerns outside the company. At present, however, the best option is to insist on voicing her convictions within the organization (Martin and Schinzinger 1989). There may be others, like Mark Reynolds, who will follow her example and improve the quality of interaction in this committee.