History As Cause:
Columbia and Challenger

The Board began its investigation with two central ques- engineersʼ decision-making, the three worked together. Each
tions about NASA decisions. Why did NASA continue to fly is a critical link in the causal chain.
with known foam debris problems in the years preceding the
Columbia launch, and why did NASA managers conclude This chapter shows that both accidents were “failures of
that the foam debris strike 81.9 seconds into Columbiaʼs foresight” in which history played a prominent role.1 First,
flight was not a threat to the safety of the mission, despite the history of engineering decisions on foam and O-ring
the concerns of their engineers? incidents had identical trajectories that “normalized” these
anomalies, so that flying with these flaws became routine
8.1 ECHOES OF CHALLENGER and acceptable. Second, NASA history had an effect. In re-
sponse to White House and Congressional mandates, NASA
As the investigation progressed, Board member Dr. Sally leaders took actions that created systemic organizational
Ride, who also served on the Rogers Commission, observed flaws at the time of Challenger that were also present for
that there were “echoes” of Challenger in Columbia. Ironi- Columbia. The final section compares the two critical deci-
cally, the Rogers Commission investigation into Challenger sion sequences immediately before the loss of both Orbit-
started with two remarkably similar central questions: Why ers – the pre-launch teleconference for Challenger and the
did NASA continue to fly with known O-ring erosion prob- post-launch foam strike discussions for Columbia. It shows
lems in the years before the Challenger launch, and why, on history again at work: how past definitions of risk combined
the eve of the Challenger launch, did NASA managers decide with systemic problems in the NASA organization caused
that launching the mission in such cold temperatures was an both accidents.
acceptable risk, despite the concerns of their engineers?
Connecting the parts of NASAʼs organizational system and
The echoes did not stop there. The foam debris hit was not drawing the parallels with Challenger demonstrate three
the single cause of the Columbia accident, just as the failure things. First, despite all the post-Challenger changes at
of the joint seal that permitted O-ring erosion was not the NASA and the agencyʼs notable achievements since, the
single cause of Challenger. Both Columbia and Challenger causes of the institutional failure responsible for Challenger
were lost also because of the failure of NASAʼs organiza- have not been fixed. Second, the Board strongly believes
tional system. Part Two of this report cites failures of the that if these persistent, systemic flaws are not resolved,
three parts of NASAʼs organizational system. This chapter the scene is set for another accident. Therefore, the recom-
shows how previous political, budgetary, and policy deci- mendations for change are not only for fixing the Shuttleʼs
sions by leaders at the White House, Congress, and NASA technical system, but also for fixing each part of the orga-
(Chapter 5) impacted the Space Shuttle Programʼs structure, nizational system that produced Columbiaʼs failure. Third,
culture, and safety system (Chapter 7), and how these in turn the Boardʼs focus on the context in which decision making
resulted in flawed decision-making (Chapter 6) for both ac- occurred does not mean that individuals are not responsible
cidents. The explanation is about system effects: how actions and accountable. To the contrary, individuals always must
taken in one layer of NASAʼs organizational system impact assume responsibility for their actions. What it does mean
other layers. History is not just a backdrop or a scene-setter. is that NASAʼs problems cannot be solved simply by retire-
History is cause. History set the Columbia and Challenger ments, resignations, or transferring personnel.2
accidents in motion. Although Part Two is separated into
chapters and sections to make clear what happened in the The constraints under which the agency has operated
political environment, the organization, and managersʼ and throughout the Shuttle Program have contributed to both

Report Volume I August 2003 195

Shuttle accidents. Although NASA leaders have played risks” in Flight Readiness Reviews. NASA managers also
an important role, these constraints were not entirely of assigned each bipod foam event In-Flight Anomaly status,
NASAʼs own making. The White House and Congress must and then removed the designation as corrective actions
recognize the role of their decisions in this accident and take were implemented. But when major bipod foam-shedding
responsibility for safety in the future. occurred on STS-112 in October 2002, Program manage-
ment did not assign an In-Flight Anomaly. Instead, it down-
8.2 FAILURES OF FORESIGHT : TWO DECISION graded the problem to the lower status of an “action” item.
HISTORIES AND THE NORMALIZATION OF Before Challenger, the problematic Solid Rocket Booster
DEVIANCE joint had been elevated to a Criticality 1 item on NASAʼs
Critical Items List, which ranked Shuttle components by
Foam loss may have occurred on all missions, and left bipod failure consequences and noted why each was an accept-
ramp foam loss occurred on 10 percent of the flights for able risk. The joint was later demoted to a Criticality 1-R
which visible evidence exists. The Board had a hard time (redundant), and then in the month before Challengerʼs
understanding how, after the bitter lessons of Challenger, launch was “closed out” of the problem-reporting system.
NASA could have failed to identify a similar trend. Rather Prior to both accidents, this demotion from high-risk item
than view the foam decision only in hindsight, the Board to low-risk item was very similar, but with some important
tried to see the foam incidents as NASA engineers and man- differences. Damaging the Orbiterʼs Thermal Protection
agers saw them as they made their decisions. This section System, especially its fragile tiles, was normalized even be-
gives an insider perspective: how NASA defined risk and fore Shuttle launches began: it was expected due to forces
how those definitions changed over time for both foam debris at launch, orbit, and re-entry.6 So normal was replacement
hits and O-ring erosion. In both cases, engineers and manag- of Thermal Protection System materials that NASA manag-
ers conducting risk assessments continually normalized the ers budgeted for tile cost and turnaround maintenance time
technical deviations they found.3 In all official engineering from the start.
analyses and launch recommendations prior to the accidents,
evidence that the design was not performing as expected was It was a small and logical next step for the discovery of foam
reinterpreted as acceptable and non-deviant, which dimin- debris damage to the tiles to be viewed by NASA as part of an
ished perceptions of risk throughout the agency. already existing maintenance problem, an assessment based
on experience, not on a thorough hazard analysis. Foam de-
The initial Shuttle design predicted neither foam debris bris anomalies came to be categorized by the reassuring
problems nor poor sealing action of the Solid Rocket Boost- term “in-family,” a formal classification indicating that new
er joints. To experience either on a mission was a violation occurrences of an anomaly were within the engineering ex-
of design specifications. These anomalies were signals of perience base. “In-family” was a strange term indeed for a
potential danger, not something to be tolerated, but in both violation of system requirements. Although “in-family” was
cases after the first incident the engineering analysis con- a designation introduced post-Challenger to separate prob-
cluded that the design could tolerate the damage. These en- lems by seriousness so that “out-of-family” problems got
gineers decided to implement a temporary fix and/or accept more attention, by definition the problems that were shifted
the risk, and fly. For both O-rings and foam, that first deci- into the lesser “in-family” category got less attention. The
sion was a turning point. It established a precedent for ac- Boardʼs investigation uncovered no paper trail showing es-
cepting, rather than eliminating, these technical deviations. calating concern about the foam problem like the one that
As a result of this new classification, subsequent incidents of Solid Rocket Booster engineers left prior to Challenger.7
O-ring erosion or foam debris strikes were not defined as So ingrained was the agencyʼs belief that foam debris was
signals of danger, but as evidence that the design was now not a threat to flight safety that in press briefings after the
acting as predicted. Engineers and managers incorporated Columbia accident, the Space Shuttle Program Manager
worsening anomalies into the engineering experience base, still discounted the foam as a probable cause, saying that
which functioned as an elastic waistband, expanding to hold Shuttle managers were “comfortable” with their previous
larger deviations from the original design. Anomalies that risk assessments.
did not lead to catastrophic failure were treated as a source
of valid engineering data that justified further flights. These From the beginning, NASAʼs belief about both these prob-
anomalies were translated into a safety margin that was ex- lems was affected by the fact that engineers were evaluat-
tremely influential, allowing engineers and managers to add ing them in a work environment where technical problems
incrementally to the amount and seriousness of damage that were normal. Although management treated the Shuttle
was acceptable. Both O-ring erosion and foam debris events as operational, it was in reality an experimental vehicle.
were repeatedly “addressed” in NASAʼs Flight Readiness Many anomalies were expected on each mission. Against
Reviews but never fully resolved. In both cases, the engi- this backdrop, an anomaly was not in itself a warning sign
neering analysis was incomplete and inadequate. Engineers of impending catastrophe. Another contributing factor was
understood what was happening, but they never understood that both foam debris strikes and O-ring erosion events were
why. NASA continued to implement a series of small correc- examined separately, one at a time. Individual incidents
tive actions, living with the problems until it was too late.4 were not read by engineers as strong signals of danger.
What NASA engineers and managers saw were pieces of ill-
NASA documents show how official classifications of risk structured problems.8 An incident of O-ring erosion or foam
were downgraded over time.5 Program managers designated bipod debris would be followed by several launches where
both the foam problems and O-ring erosion as “acceptable the machine behaved properly, so that signals of danger

196 Report Volume I August 2003

were followed by all-clear signals – in other words, NASA foam shedding and potential damage to the Orbiter before
managers and engineers were receiving mixed signals.9 Columbia. Furthermore, NASA performed no tests on what
Some signals defined as weak at the time were, in retrospect, would happen if a wing leading edge were struck by bipod
warnings of danger. Foam debris damaged tile was assumed foam, even though foam had repeatedly separated from the
(erroneously) not to pose a danger to the wing. If a primary External Tank.
O-ring failed, the secondary was assumed (erroneously)
to provide a backup. Finally, because foam debris strikes During the Challenger investigation, Rogers Commis-
were occurring frequently, like O-ring erosion in the years sion member Dr. Richard Feynman famously compared
before Challenger, foam anomalies became routine signals launching Shuttles with known problems to playing Russian
– a normal part of Shuttle operations, not signals of danger. roulette.12 But that characterization is only possible in hind-
Other anomalies gave signals that were strong, like wiring sight. It is not how NASA personnel perceived the risks as
malfunctions or the cracked balls in Ball Strut Tie Rod As- they were being assessed, one launch at a time. Playing Rus-
semblies, which had a clear relationship to a “loss of mis- sian roulette implies that the pistol-holder realizes that death
sion.” On those occasions, NASA stood down from launch, might be imminent and still takes the risk. For both foam
sometimes for months, while the problems were corrected. debris and O-ring erosion, fixes were in the works at the time
In contrast, foam debris and eroding O-rings were defined of the accidents, but there was no rush to complete them be-
as nagging issues of seemingly little consequence. Their cause neither problem was defined as a show-stopper. Each
significance became clear only in retrospect, after lives had time an incident occurred, the Flight Readiness process
been lost. declared it safe to continue flying. Taken one at a time, each
decision seemed correct. The agency allocated attention and
History became cause as the repeating pattern of anomalies resources to these two problems accordingly. The conse-
was ratified as safe in Flight Readiness Reviews. The official quences of living with both of these anomalies were, in its
definitions of risk assigned to each anomaly in Flight Readi- view, minor. Not all engineers agreed in the months immedi-
ness Reviews limited the actions taken and the resources ately preceding Challenger, but the dominant view at NASA
spent on these problems. Two examples of the road not taken – the managerial view – was, as one manager put it, “we
and the devastating implications for the future occurred close were just eroding rubber O-rings,” which was a low-cost
in time to both accidents. On the October 2002 launch of problem.13 The financial consequences of foam debris also
STS-112, a large piece of bipod ramp foam hit and dam- were relatively low: replacing tiles extended the turnaround
aged the External Tank Attachment ring on the Solid Rocket time between launches. In both cases, NASA was comfort-
Booster skirt, a strong signal of danger 10 years after the last able with its analyses. Prior to each accident, the agency saw
known bipod ramp foam event. Prior to Challenger, there no greater consequences on the horizon.
was a comparable surprise. After a January 1985 launch, for
which the Shuttle sat on the launch pad for three consecutive 8.3 SYSTEM EFFECTS: THE IMPACT OF HISTORY
nights of unprecedented cold temperatures, engineers discov- AND POLITICS ON RISKY WORK
ered upon the Orbiterʼs return that hot gases had eroded the
primary and reached the secondary O-ring, blackening the The series of engineering decisions that normalized technical
putty in between – an indication that the joint nearly failed. deviations shows one way that history became cause in both
accidents. But NASAʼs own history encouraged this pattern
But accidents are not always preceded by a wake-up call.10 of flying with known flaws. Seventeen years separated the
In 1985, engineers realized they needed data on the rela- two accidents. NASA Administrators, Congresses, and po-
tionship between cold temperatures and O-ring erosion. litical administrations changed. However, NASAʼs political
However, the task of getting better temperature data stayed and budgetary situation remained the same in principle as it
on the back burner because of the definition of risk: the had been since the inception of the Shuttle Program. NASA
primary erosion was within the experience base; the sec- remained a politicized and vulnerable agency, dependent on
ondary O-ring (thought to be redundant) was not damaged key political players who accepted NASAʼs ambitious pro-
and, significantly, there was a low probability that such cold posals and then imposed strict budget limits. Post-Challeng-
Florida temperatures would recur.11 The scorched putty, ini- er policy decisions made by the White House, Congress, and
tially a strong signal, was redefined after analysis as weak. NASA leadership resulted in the agency reproducing many
On the eve of the Challenger launch, when cold temperature of the failings identified by the Rogers Commission. Policy
became a concern, engineers had no test data on the effect constraints affected the Shuttle Programʼs organization cul-
of cold temperatures on O-ring erosion. Before Columbia, ture, its structure, and the structure of the safety system. The
engineers concluded that the damage from the STS-112 three combined to keep NASA on its slippery slope toward
foam hit in October 2002 was not a threat to flight safety. Challenger and Columbia. NASA culture allowed flying
The logic was that, yes, the foam piece was large and there with flaws when problems were defined as normal and rou-
was damage, but no serious consequences followed. Further, tine; the structure of NASAʼs Shuttle Program blocked the
a hit this size, like cold temperature, was a low-probability flow of critical information up the hierarchy, so definitions
event. After analysis, the biggest foam hit to date was re- of risk continued unaltered. Finally, a perennially weakened
defined as a weak signal. Similar self-defeating actions and safety system, unable to critically analyze and intervene, had
inactions followed. Engineers were again dealing with the no choice but to ratify the existing risk assessments on these
poor quality of tracking camera images of strikes during two problems. The following comparison shows that these
ascent. Yet NASA took no steps to improve imagery and system effects persisted through time, and affected engineer-
took no immediate action to reduce the risk of bipod ramp ing decisions in the years leading up to both accidents.

Report Volume I August 2003 197

The Board found that dangerous aspects of NASAʼs 1986 Prior to Challenger, Shuttle Program structure had hindered
culture, identified by the Rogers Commission, remained information flows, leading the Rogers Commission to con-
unchanged. The Space Shuttle Program had been built on clude that critical information about technical problems was
compromises hammered out by the White House and NASA not conveyed effectively through the hierarchy.20 The Space
headquarters.14 As a result, NASA was transformed from a Shuttle Program had altered its structure by outsourcing
research and development agency to more of a business, to contractors, which added to communication problems.
with schedules, production pressures, deadlines, and cost The Commission recommended many changes to remedy
efficiency goals elevated to the level of technical innovation these problems, and NASA made many of them. However,
and safety goals.15 The Rogers Commission dedicated an the Board found that those post-Challenger changes were
entire chapter of its report to production pressures.16 More- undone over time by management actions.21 NASA ad-
over, the Rogers Commission, as well as the 1990 Augus- ministrators, reacting to government pressures, transferred
tine Committee and the 1999 Shuttle Independent Assess- more functions and responsibilities to the private sector.
ment Team, criticized NASA for treating the Shuttle as if it The change was cost-efficient, but personnel cuts reduced
were an operational vehicle. Launching on a tight schedule, oversight of contractors at the same time that the agencyʼs
which the agency had pursued as part of its initial bargain dependence upon contractor engineering judgment in-
with the White House, was not the way to operate what creased. When high-risk technology is the product and lives
was in fact an experimental vehicle. The Board found that are at stake, safety, oversight, and communication flows are
prior to Columbia, a budget-limited Space Shuttle Program, critical. The Board found that the Shuttle Programʼs normal
forced again and again to refashion itself into an efficiency chain of command and matrix system did not perform a
model because of repeated government cutbacks, was beset check-and-balance function on either foam or O-rings.
by these same ills. The harmful effects of schedule pressure
identified in previous reports had returned. The Flight Readiness Review process might have reversed
the disastrous trend of normalizing O-ring erosion and foam
Prior to both accidents, NASA was scrambling to keep up. debris hits, but it didnʼt. In fact, the Rogers Commission
Not only were schedule pressures impacting the people found that the Flight Readiness process only affirmed the
who worked most closely with the technology – techni- pre-Challenger engineering risk assessments.22 Equally
cians, mission operators, flight crews, and vehicle proces- troubling, the Board found that the Flight Readiness pro-
sors – engineering decisions also were affected.17 For foam cess, which is built on consensus verified by signatures of
debris and O-ring erosion, the definition of risk established all responsible parties, in effect renders no one accountable.
during the Flight Readiness process determined actions Although the process was altered after Challenger, these
taken and not taken, but the schedule and shoestring bud- changes did not erase the basic problems that were built into
get were equally influential. NASA was cutting corners. the structure of the Flight Readiness Review.23 Managers at
Launches proceeded with incomplete engineering work on the top were dependent on engineers at the bottom for their
these flaws. Challenger-era engineers were working on a engineering analysis and risk assessments. Information was
permanent fix for the booster joints while launches contin- lost as engineering risk analyses moved through the process.
ued.18 After the major foam bipod hit on STS-112, manage- At succeeding stages, management awareness of anomalies,
ment made the deadline for corrective action on the foam and therefore risks, was reduced either because of the need
problem after the next launch, STS-113, and then slipped it to be increasingly brief and concise as all the parts of the
again until after the flight of STS-107. Delays for flowliner system came together, or because of the need to produce
and Ball Strut Tie Rod Assembly problems left no margin in consensus decisions at each level. The Flight Readiness
the schedule between February 2003 and the management- process was designed to assess hardware and take corrective
imposed February 2004 launch date for the International actions that would transform known problems into accept-
Space Station Node 2. Available resources – including time able flight risks, and that is precisely what it did. The 1986
out of the schedule for research and hardware modifications House Committee on Science and Technology concluded
– went to the problems that were designated as serious – during its investigation into Challenger that Flight Readi-
those most likely to bring down a Shuttle. The NASA ness Reviews had performed exactly as they were designed,
culture encouraged flying with flaws because the schedule but that they could not be expected to replace engineering
could not be held up for routine problems that were not de- analysis, and therefore they “cannot be expected to prevent
fined as a threat to mission safety.19 a flight because of a design flaw that Project management
had already determined an acceptable risk.”24 Those words,
The question the Board had to answer was why, since the true for the history of O-ring erosion, also hold true for the
foam debris anomalies went on for so long, had no one rec- history of foam debris.
ognized the trend and intervened? The O-ring history prior
to Challenger had followed the same pattern. This question The last line of defense against errors is usually a safety
pointed the Boardʼs attention toward the NASA organiza- system. But the previous policy decisions by leaders de-
tion structure and the structure of its safety system. Safety- scribed in Chapter 5 also impacted the safety structure
oriented organizations often build in checks and balances and contributed to both accidents. Neither in the O-ring
to identify and monitor signals of potential danger. If these erosion nor the foam debris problems did NASAʼs safety
checks and balances were in place in the Shuttle Program, system attempt to reverse the course of events. In 1986,
they werenʼt working. Again, past policy decisions pro- the Rogers Commission called it “The Silent Safety Sys-
duced system effects with implications for both Challenger tem.”25 Pre-Challenger budget shortages resulted in safety
and Columbia. personnel cutbacks. Without clout or independence, the

198 Report Volume I August 2003

safety personnel who remained were ineffective. In the treating it as if it were.29 The Board found that even after the
case of Columbia, the Board found the same problems loss of Challenger, NASA was guilty of treating an experi-
were reproduced and for an identical reason: when pressed mental vehicle as if it were operational and of not listening
for cost reduction, NASA attacked its own safety system. to outside experts. In a repeat of the pre-Challenger warn-
The faulty assumption that supported this strategy prior to ing, the 1999 Shuttle Independent Assessment Team report
Columbia was that a reduction in safety staff would not reiterated that “the Shuttle was not an ʻoperationalʼ vehicle
result in a reduction of safety, because contractors would in the usual meaning of the term.”30 Engineers and program
assume greater safety responsibility. The effectiveness planners were also affected by “Can-Do,” which, when
of those remaining staff safety engineers was blocked by taken too far, can create a reluctance to say that something
their dependence on the very Program they were charged cannot be done.
to supervise. Also, the Board found many safety units with
unclear roles and responsibilities that left crucial gaps. How could the lessons of Challenger have been forgotten
Post-Challenger NASA still had no systematic procedure so quickly? Again, history was a factor. First, if success
for identifying and monitoring trends. The Board was sur- is measured by launches and landings,31 the machine ap-
prised at how long it took NASA to put together trend data peared to be working successfully prior to both accidents.
in response to Board requests for information. Problem Challenger was the 25th launch. Seventeen years and 87
reporting and tracking systems were still overloaded or missions passed without major incident. Second, previous
underused, which undermined their very purpose. Mul- policy decisions again had an impact. NASAʼs Apollo-era
tiple job titles disguised the true extent of safety personnel research and development culture and its prized deference
shortages. The Board found cases in which the same person to the technical expertise of its working engineers was
was occupying more than one safety position – and in one overridden in the Space Shuttle era by “bureaucratic ac-
instance at least three positions – which compromised any countability” – an allegiance to hierarchy, procedure, and
possibility of safety organization independence because the following the chain of command.32 Prior to Challenger, the
jobs were established with built-in conflicts of interest. can-do culture was a result not just of years of apparently
successful launches, but of the cultural belief that the Shut-
8.4 ORGANIZATION, CULTURE, AND tle Programʼs many structures, rigorous procedures, and
UNINTENDED CONSEQUENCES detailed system of rules were responsible for those success-
es.33 The Board noted that the pre-Challenger layers of pro-
A number of changes to the Space Shuttle Program structure cesses, boards, and panels that had produced a false sense of
made in response to policy decisions had the unintended confidence in the system and its level of safety returned in
effect of perpetuating dangerous aspects of pre-Challenger full force prior to Columbia. NASA made many changes to
culture and continued the pattern of normalizing things that the Space Shuttle Program structure after Challenger. The
were not supposed to happen. At the same time that NASA fact that many changes had been made supported a belief in
leaders were emphasizing the importance of safety, their the safety of the system, the invincibility of organizational
personnel cutbacks sent other signals. Streamlining and and technical systems, and ultimately, a sense that the foam
downsizing, which scarcely go unnoticed by employees, problem was understood.
convey a message that efficiency is an important goal.
The Shuttle/Space Station partnership affected both pro- 8.5 HISTORY AS CAUSE: TWO ACCIDENTS
grams. Working evenings and weekends just to meet the
International Space Station Node 2 deadline sent a signal Risk, uncertainty, and history came together when unprec-
to employees that schedule is important. When paired with edented circumstances arose prior to both accidents. For
the “faster, better, cheaper” NASA motto of the 1990s and Challenger, the weather prediction for launch time the next
cuts that dramatically decreased safety personnel, efficiency day was for cold temperatures that were out of the engineer-
becomes a strong signal and safety a weak one. This kind of ing experience base. For Columbia, a large foam hit – also
doublespeak by top administrators affects peopleʼs decisions outside the experience base – was discovered after launch.
and actions without them even realizing it.26 For the first case, all the discussion was pre-launch; for
the second, it was post-launch. This initial difference de-
Changes in Space Shuttle Program structure contributed to termined the shape these two decision sequences took, the
the accident in a second important way. Despite the con- number of people who had information about the problem,
straints that the agency was under, prior to both accidents and the locations of the involved parties.
NASA appeared to be immersed in a culture of invincibility,
in stark contradiction to post-accident reality. The Rogers For Challenger, engineers at Morton-Thiokol,34 the Solid
Commission found a NASA blinded by its “Can-Do” atti- Rocket Motor contractor in Utah, were concerned about
tude,27 a cultural artifact of the Apollo era that was inappro- the effect of the unprecedented cold temperatures on the
priate in a Space Shuttle Program so strapped by schedule rubber O-rings.35 Because launch was scheduled for the
pressures and shortages that spare parts had to be cannibal- next morning, the new condition required a reassessment of
ized from one vehicle to launch another.28 This can-do atti- the engineering analysis presented at the Flight Readiness
tude bolstered administratorsʼ belief in an achievable launch Review two weeks prior. A teleconference began at 8:45
rate, the belief that they had an operational system, and an p.m. Eastern Standard Time (EST) that included 34 people
unwillingness to listen to outside experts. The Aerospace in three locations: Morton-Thiokol in Utah, Marshall, and
Safety and Advisory Panel in a 1985 report told NASA Kennedy. Thiokol engineers were recommending a launch
that the vehicle was not operational and NASA should stop delay. A reconsideration of a Flight Readiness Review risk

Report Volume I August 2003 199

assessment the night before a launch was as unprecedented In both situations, upper-level managers and engineering
as the predicted cold temperatures. With no ground rules or teams working the O-ring and foam strike problems held
procedures to guide their discussion, the participants auto- opposing definitions of risk. This was demonstrated imme-
matically reverted to the centralized, hierarchical, tightly diately, as engineers reacted with urgency to the immediate
structured, and procedure-bound model used in Flight Read- safety implications: Thiokol engineers scrambled to put
iness Reviews. The entire discussion and decision to launch together an engineering assessment for the teleconference,
began and ended with this group of 34 engineers. The phone Langley Research Center engineers initiated simulations
conference linking them together concluded at 11:15 p.m. of landings that were run after hours at Ames Research
EST after a decision to accept the risk and fly. Center, and Boeing analysts worked through the weekend
on the debris impact analysis. But key managers were re-
For Columbia, information about the foam debris hit was sponding to additional demands of cost and schedule, which
widely distributed the day after launch. Time allowed for competed with their safety concerns. NASAʼs conflicting
videos of the strike, initial assessments of the size and speed goals put engineers at a disadvantage before these new situ-
of the foam, and the approximate location of the impact to ations even arose. In neither case did they have good data
be dispersed throughout the agency. This was the first de- as a basis for decision-making. Because both problems had
bris impact of this magnitude. Engineers at the Marshall, been previously normalized, resources sufficient for testing
Johnson, Kennedy, and Langley centers showed initiative or hardware were not dedicated. The Space Shuttle Program
and jumped on the problem without direction from above. had not produced good data on the correlation between cold
Working groups and e-mail groups formed spontaneously. temperature and O-ring resilience or good data on the poten-
The size of Johnsonʼs Debris Assessment Team alone neared tial effect of bipod ramp foam debris hits.37
and in some instances exceeded the total number of partici-
pants in the 1986 Challenger teleconference. Rather than a Cultural beliefs about the low risk O-rings and foam debris
tightly constructed exchange of information completed in a posed, backed by years of Flight Readiness Review deci-
few hours, time allowed for the development of ideas and sions and successful missions, provided a frame of refer-
free-wheeling discussion among the engineering ranks. The ence against which the engineering analyses were judged.
early post-launch discussion among engineers and all later When confronted with the engineering risk assessments, top
decision-making at management levels were decentralized, Shuttle Program managers held to the previous Flight Readi-
loosely organized, and with little form. While the spontane- ness Review assessments. In the Challenger teleconference,
ous and decentralized exchanging of information was evi- where engineers were recommending that NASA delay the
dence that NASAʼs original technical culture was alive and launch, the Marshall Solid Rocket Booster Project manager,
well, the diffuse form and lack of structure in the rest of the Lawrence Mulloy, repeatedly challenged the contractorʼs
proceedings would have several negative consequences. risk assessment and restated Thiokolʼs engineering ratio-
nale for previous flights.38 STS-107 Mission Management
In both situations, all new information was weighed and Team Chair Linda Ham made many statements in meetings
interpreted against past experience. Formal categories and reiterating her understanding that foam was a maintenance
cultural beliefs provide a consistent frame of reference in problem and a turnaround issue, not a safety-of-flight issue.
which people view and interpret information and experi-
ences.36 Pre-existing definitions of risk shaped the actions The effects of working as a manager in a culture with a cost/
taken and not taken. Worried engineers in 1986 and again efficiency/safety conflict showed in managerial responses. In
in 2003 found it impossible to reverse the Flight Readiness both cases, managersʼ techniques focused on the information
Review risk assessments that foam and O-rings did not pose that tended to support the expected or desired result at that
safety-of-flight concerns. These engineers could not prove time. In both cases, believing the safety of the mission was
that foam strikes and cold temperatures were unsafe, even not at risk, managers drew conclusions that minimized the
though the previous analyses that declared them safe had risk of delay.39 At one point, Marshallʼs Mulloy, believing
been incomplete and were based on insufficient data and in the previous Flight Readiness Review assessments, un-
testing. Engineersʼ failed attempts were not just a matter convinced by the engineering analysis, and concerned about
of psychological frames and interpretations. The obstacles the schedule implications of the 53-degree temperature limit
these engineers faced were political and organizational. on launch the engineers proposed, said, “My God, Thiokol,
They were rooted in NASA history and the decisions of when do you want me to launch, next April?”40 Reflecting the
leaders that had altered NASA culture, structure, and the overall goal of keeping to the Node 2 launch schedule, Hamʼs
structure of the safety system and affected the social con- priority was to avoid the delay of STS–114, the next mis-
text of decision-making for both accidents. In the following sion after STS-107. Ham was slated as Manager of Launch
comparison of these critical decision scenarios for Columbia Integration for STS-114 – a dual role promoting a conflict of
and Challenger, the systemic problems in the NASA orga- interest and a single-point failure, a situation that should be
nization are in italics, with the system effects on decision- avoided in all organizational as well as technical systems.
making following.
NASAʼs culture of bureaucratic accountability emphasized
NASA had conflicting goals of cost, schedule, and safety. chain of command, procedure, following the rules, and go-
Safety lost out as the mandates of an “operational system” ing by the book. While rules and procedures were essential
increased the schedule pressure. Scarce resources went to for coordination, they had an unintended but negative effect.
problems that were defined as more serious, rather than to Allegiance to hierarchy and procedure had replaced defer-
foam strikes or O-ring erosion. ence to NASA engineersʼ technical expertise.

200 Report Volume I August 2003

In both cases, engineers initially presented concerns as well define themselves as qualified because of their position: they
as possible solutions – a request for images, a recommenda- were not in an appropriate specialization, had not recently
tion to place temperature constraints on launch. Manage- worked the O-ring problem, or did not have access to the
ment did not listen to what their engineers were telling them. “good data” that they assumed others more involved in key
Instead, rules and procedures took priority. For Columbia, discussions would have.42 Geographic locations also re-
program managers turned off the Kennedy engineersʼ initial sulted in missing signals. At one point, in light of Marshallʼs
request for Department of Defense imagery, with apologies objections, Thiokol managers in Utah requested an “off-line
to Defense Department representatives for not having fol- caucus” to discuss their data. No consensus was reached,
lowed “proper channels.” In addition, NASA administrators so a “management risk decision” was made. Managers
asked for and promised corrective action to prevent such voted and engineers did not. Thiokol managers came back
a violation of protocol from recurring. Debris Assessment on line, saying they had reversed their earlier NO-GO rec-
Team analysts at Johnson were asked by managers to dem- ommendation, decided to accept risk, and would send new
onstrate a “mandatory need” for their imagery request, but engineering charts to back their reversal. When a Marshall
were not told how to do that. Both Challenger and Columbia administrator asked, “Does anyone have anything to add to
engineering teams were held to the usual quantitative stan- this?,” no one spoke. Engineers at Thiokol who still objected
dard of proof. But it was a reverse of the usual circumstance: to the decision later testified that they were intimidated by
instead of having to prove it was safe to fly, they were asked management authority, were accustomed to turning their
to prove that it was unsafe to fly. analysis over to managers and letting them decide, and did
not have the quantitative data that would empower them to
In the Challenger teleconference, a key engineering chart object further.43
presented a qualitative argument about the relationship be-
tween cold temperatures and O-ring erosion that engineers In the more decentralized decision process prior to
were asked to prove. Thiokolʼs Roger Boisjoly said, “I had Columbiaʼs re-entry, structure and hierarchy again were re-
no data to quantify it. But I did say I knew it was away from sponsible for an absence of signals. The initial request for
goodness in the current data base.”41 Similarly, the Debris imagery came from the “low status” Kennedy Space Center,
Assessment Team was asked to prove that the foam hit was bypassed the Mission Management Team, and went directly
a threat to flight safety, a determination that only the imag- to the Department of Defense separate from the all-power-
ery they were requesting could help them make. Ignored by ful Shuttle Program. By using the Engineering Directorate
management was the qualitative data that the engineering avenue to request imagery, the Debris Assessment Team was
teams did have: both instances were outside the experience working at the margins of the hierarchy. But some signals
base. In stark contrast to the requirement that engineers ad- were missing even when engineers traversed the appropriate
here to protocol and hierarchy was managementʼs failure to channels. The Mission Management Team Chairʼs position in
apply this criterion to their own activities. The Mission Man- the hierarchy governed what information she would or would
agement Team did not meet on a regular schedule during the not receive. Information was lost as it traveled up the hierar-
mission, proceeded in a loose format that allowed informal chy. A demoralized Debris Assessment Team did not include
influence and status differences to shape their decisions, and a slide about the need for better imagery in their presentation
allowed unchallenged opinions and assumptions to prevail, to the Mission Evaluation Room. Their presentation included
all the while holding the engineers who were making risk the Crater analysis, which they reported as incomplete and
assessments to higher standards. In highly uncertain circum- uncertain. However, the Mission Evaluation Room manager
stances, when lives were immediately at risk, management perceived the Boeing analysis as rigorous and quantitative.
failed to defer to its engineers and failed to recognize that The choice of headings, arrangement of information, and size
different data standards – qualitative, subjective, and intui- of bullets on the key chart served to highlight what manage-
tive – and different processes – democratic rather than proto- ment already believed. The uncertainties and assumptions
col and chain of command – were more appropriate. that signaled danger dropped out of the information chain
when the Mission Evaluation Room manager condensed the
The organizational structure and hierarchy blocked effective Debris Assessment Teamʼs formal presentation to an infor-
communication of technical problems. Signals were over- mal verbal brief at the Mission Management Team meeting.
looked, people were silenced, and useful information and
dissenting views on technical issues did not surface at higher As what the Board calls an “informal chain of command”
levels. What was communicated to parts of the organization began to shape STS-107ʼs outcome, location in the struc-
was that O-ring erosion and foam debris were not problems. ture empowered some to speak and silenced others. For
example, a Thermal Protection System tile expert, who was
Structure and hierarchy represent power and status. For both a member of the Debris Assessment Team but had an office
Challenger and Columbia, employeesʼ positions in the orga- in the more prestigious Shuttle Program, used his personal
nization determined the weight given to their information, network to shape the Mission Management Team view and
by their own judgment and in the eyes of others. As a result, snuff out dissent. The informal hierarchy among and within
many signals of danger were missed. Relevant information Centers was also influential. Early identifications of prob-
that could have altered the course of events was available lems by Marshall and Kennedy may have contributed to the
but was not presented. Johnson-based Mission Management Teamʼs indifference to
concerns about the foam strike. The engineers and managers
Early in the Challenger teleconference, some engineers who circulating e-mails at Langley were peripheral to the Shuttle
had important information did not speak up. They did not Program, not structurally connected to the proceedings, and

Report Volume I August 2003 201

therefore of lower status. When asked in a post-accident by NASAʼs dependence on the contractor. Unfamiliar with
press conference why they didnʼt voice their concerns to Crater, NASA engineers and managers had to rely on Boeing
Shuttle Program management, the Langley engineers said for interpretation and analysis, and did not have the train-
that people “need to stick to their expertise.”44 Status mat- ing necessary to evaluate the results. They accepted Boeing
tered. In its absence, numbers were the great equalizer. engineersʼ use of Crater to model a debris impact 400 times
One striking exception: the Debris Assessment Team tile outside validated limits.
expert was so influential that his word was taken as gospel,
though he lacked the requisite expertise, data, or analysis NASAʼs safety system lacked the resources, independence,
to evaluate damage to RCC. For those with lesser standing, personnel, and authority to successfully apply alternate per-
the requirement for data was stringent and inhibiting, which spectives to developing problems. Overlapping roles and re-
resulted in information that warned of danger not being sponsibilities across multiple safety offices also undermined
passed up the chain. As in the teleconference, Debris As- the possibility of a reliable system of checks and balances.
sessment Team engineers did not speak up when the Mission
Management Team Chair asked if anyone else had anything NASAʼs “Silent Safety System” did nothing to alter the deci-
to say. Not only did they not have the numbers, they also sion-making that immediately preceded both accidents. No
were intimidated by the Mission Management Team Chairʼs safety representatives were present during the Challenger
position in the hierarchy and the conclusions she had already teleconference – no one even thought to call them.46 In the
made. Debris Assessment Team members signed off on the case of Columbia, safety representatives were present at
Crater analysis, even though they had trouble understanding Mission Evaluation Room, Mission Management Team, and
it. They still wanted images of Columbiaʼs left wing. Debris Assessment Team meetings. However, rather than
critically question or actively participate in the analysis, the
In neither impending crisis did management recognize how safety representatives simply listened and concurred.
structure and hierarchy can silence employees and follow
through by polling participants, soliciting dissenting opin- 8.6 CHANGING NASAʼS ORGANIZATIONAL
ions, or bringing in outsiders who might have a different SYSTEM
perspective or useful information. In perhaps the ultimate
example of engineering concerns not making their way The echoes of Challenger in Columbia identified in this
upstream, Challenger astronauts were told that the cold tem- chapter have serious implications. These repeating patterns
perature was not a problem, and Columbia astronauts were mean that flawed practices embedded in NASAʼs organiza-
told that the foam strike was not a problem. tional system continued for 20 years and made substantial
contributions to both accidents. The Columbia Accident
NASA structure changed as roles and responsibilities were Investigation Board noted the same problems as the Rog-
transferred to contractors, which increased the dependence ers Commission. An organization system failure calls for
on the private sector for safety functions and risk assess- corrective measures that address all relevant levels of the
ment while simultaneously reducing the in-house capability organization, but the Boardʼs investigation shows that for all
to spot safety issues. its cutting-edge technologies, “diving-catch” rescues, and
imaginative plans for the technology and the future of space
A critical turning point in both decisions hung on the discus- exploration, NASA has shown very little understanding of
sion of contractor risk assessments. Although both Thiokol the inner workings of its own organization.
and Boeing engineering assessments were replete with
uncertainties, NASA ultimately accepted each. Thiokolʼs NASA managers believed that the agency had a strong
initial recommendation against the launch of Challenger safety culture, but the Board found that the agency had
was at first criticized by Marshall as flawed and unaccept- the same conflicting goals that it did before Challenger,
able. Thiokol was recommending an unheard-of delay on when schedule concerns, production pressure, cost-cut-
the eve of a launch, with schedule ramifications and NASA- ting and a drive for ever-greater efficiency – all the signs
contractor relationship repercussions. In the Thiokol off-line of an “operational” enterprise – had eroded NASAʼs abil-
caucus, a senior vice president who seldom participated in ity to assure mission safety. The belief in a safety culture
these engineering discussions championed the Marshall has even less credibility in light of repeated cuts of safety
engineering rationale for flight. When he told the managers personnel and budgets – also conditions that existed before
present to “Take off your engineering hat and put on your Challenger. NASA managers stated confidently that every-
management hat,” they reversed the position their own one was encouraged to speak up about safety issues and that
engineers had taken.45 Marshall engineers then accepted the agency was responsive to those concerns, but the Board
this assessment, deferring to the expertise of the contractor. found evidence to the contrary in the responses to the Debris
NASA was dependent on Thiokol for the risk assessment, Assessment Teamʼs request for imagery, to the initiation of
but the decision process was affected by the contractorʼs the imagery request from Kennedy Space Center, and to the
dependence on NASA. Not willing to be responsible for a “we were just ʻwhat-iffingʼ” e-mail concerns that did not
delay, and swayed by the strength of Marshallʼs argument, reach the Mission Management Team. NASAʼs bureaucratic
the contractor did not act in the best interests of safety. structure kept important information from reaching engi-
Boeingʼs Crater analysis was performed in the context of neers and managers alike. The same NASA whose engineers
the Debris Assessment Team, which was a collaborative showed initiative and a solid working knowledge of how
effort that included Johnson, United Space Alliance, and to get things done fast had a managerial culture with an al-
Boeing. In this case, the decision process was also affected legiance to bureaucracy and cost-efficiency that squelched

202 Report Volume I August 2003

the engineersʼ efforts. When it came to managersʼ own ac- dent, robust capability to protect the systemʼs fundamental
tions, however, a different set of rules prevailed. The Board requirements and specifications inevitably compromised
found that Mission Management Team decision-making those requirements, and therefore increased risk. The
operated outside the rules even as it held its engineers to Shuttle Programʼs structure created power distributions that
a stifling protocol. Management was not able to recognize need new structuring, rules, and management training to
that in unprecedented conditions, when lives are on the line, restore deference to technical experts, empower engineers
flexibility and democratic process should take priority over to get resources they need, and allow safety concerns to be
bureaucratic response.47 freely aired.

During the Columbia investigation, the Board consistently Strategies must increase the clarity, strength, and presence
searched for causal principles that would explain both the of signals that challenge assumptions about risk. Twice in
technical and organizational system failures. These prin- NASA history, the agency embarked on a slippery slope that
ciples were needed to explain Columbia and its echoes of resulted in catastrophe. Each decision, taken by itself, seemed
Challenger. They were also necessary to provide guidance correct, routine, and indeed, insignificant and unremarkable.
for NASA. The Boardʼs analysis of organizational causes in Yet in retrospect, the cumulative effect was stunning. In
Chapters 5, 6, and 7 supports the following principles that both pre-accident periods, events unfolded over a long time
should govern the changes in the agencyʼs organizational and in small increments rather than in sudden and dramatic
system. The Boardʼs specific recommendations, based on occurrences. NASAʼs challenge is to design systems that
these principles, are presented in Part Three. maximize the clarity of signals, amplify weak signals so they
can be tracked, and account for missing signals. For both ac-
Leaders create culture. It is their responsibility to change cidents there were moments when management definitions
it. Top administrators must take responsibility for risk, of risk might have been reversed were it not for the many
failure, and safety by remaining alert to the effects their missing signals – an absence of trend analysis, imagery data
decisions have on the system. Leaders are responsible for not obtained, concerns not voiced, information overlooked
establishing the conditions that lead to their subordinatesʼ or dropped from briefings. A safety team must have equal
successes or failures. The past decisions of national lead- and independent representation so that managers are not
ers – the White House, Congress, and NASA Headquarters again lulled into complacency by shifting definitions of risk.
– set the Columbia accident in motion by creating resource It is obvious but worth acknowledging that people who are
and schedule strains that compromised the principles of a marginal and powerless in organizations may have useful
high-risk technology organization. The measure of NASAʼs information or opinions that they donʼt express. Even when
success became how much costs were reduced and how ef- these people are encouraged to speak, they find it intimidat-
ficiently the schedule was met. But the Space Shuttle is not ing to contradict a leaderʼs strategy or a group consensus.
now, nor has it ever been, an operational vehicle. We cannot Extra effort must be made to contribute all relevant informa-
explore space on a fixed-cost basis. Nevertheless, due to tion to discussions of risk. These strategies are important for
International Space Station needs and scientific experiments all safety aspects, but especially necessary for ill-structured
that require particular timing and orbits, the Space Shuttle problems like O-rings and foam debris. Because ill-structured
Program seems likely to continue to be schedule-driven. problems are less visible and therefore invite the normaliza-
National leadership needs to recognize that NASA must fly tion of deviance, they may be the most risky of all.
only when it is ready. As the White House, Congress, and
NASA Headquarters plan the future of human space flight,
the goals and the resources required to achieve them safely
must be aligned.

Changes in organizational structure should be made only
with careful consideration of their effect on the system and
their possible unintended consequences. Changes that make
the organization more complex may create new ways that it
can fail.48 When changes are put in place, the risk of error
initially increases, as old ways of doing things compete with
new. Institutional memory is lost as personnel and records
are moved and replaced. Changing the structure of organi-
zations is complicated by external political and budgetary
constraints, the inability of leaders to conceive of the full
ramifications of their actions, the vested interests of insiders,
and the failure to learn from the past.49

Nonetheless, changes must be made. The Shuttle Programʼs
structure is a source of problems, not just because of the
way it impedes the flow of information, but because it
has had effects on the culture that contradict safety goals.
Challenger launches on the ill-fated STS-33/51-L mission on Janu-
NASAʼs blind spot is it believes it has a strong safety cul-
ary 28, 1986. The Orbiter would be destroyed 73 seconds later.
ture. Program history shows that the loss of a truly indepen-

Report Volume I August 2003 203

The citations that contain a reference to “CAIB document” with CAB or 27
Report of the Presidential Commission, Vol. I, pp. 171-173.
CTF followed by seven to eleven digits, such as CAB001-0010, refer to a 28
document in the Columbia Accident Investigation Board database maintained Report of the Presidential Commission, Vol. I, pp. 173-174.
by the Department of Justice and archived at the National Archives. 29
National Aeronautics and Space Administration, Aerospace Safety
Advisory Panel, “National Aeronautics and Space Administration Annual
Report: Covering Calendar Year 1984,” (Washington: Government
Turner studied 85 different accidents and disasters, noting a common Printing Office, 1985).
pattern: each had a long incubation period in which hazards and 30
warning signs prior to the accident were either ignored or misinterpreted. Harry McDonald, Report of the Shuttle Independent Assessment Team.
He called these “failures of foresight.” Barry Turner, Man-made Disasters, 31
Richard J. Feynman, “Personal Observations on Reliability of the
(London: Wykeham, 1978); Barry Turner and Nick Pidgeon, Man-made Shuttle,” Report of the Presidential Commission, Appendix F:1.
Disasters, 2nd ed. (Oxford: Butterworth Heinneman,1997). 32
Howard E. McCurdy, “The Decay of NASAʼs Technical Culture,” Space
Changing personnel is a typical response after an organization has Policy (November 1989), pp. 301-10; See also Howard E. McCurdy,
some kind of harmful outcome. It has great symbolic value. A change in Inside NASA (Baltimore: Johns Hopkins University Press, 1993).
personnel points to individuals as the cause and removing them gives the 33
Diane Vaughan, “The Trickle-Down Effect: Policy Decisions, Risky Work,
false impression that the problems have been solved, leaving unresolved
and the Challenger Tragedy,” California Management Review, 39, 2,
organizational system problems. See Scott Sagan, The Limits of Safety.
Winter 1997.
Princeton: Princeton University Press, 1993.
3 Morton subsequently sold its propulsion division of Alcoa, and the
Diane Vaughan, The Challenger Launch Decision: Risky Technology,
company is now known as ATK Thiokol Propulsion.
Culture, and Deviance at NASA (Chicago: University of Chicago Press.
1996). Report of the Presidential Commission, pp. 82-118.
4 36
William H. Starbuck and Frances J. Milliken, “Challenger: Fine-tuning For discussions of how frames and cultural beliefs shape perceptions, see,
the Odds until Something Breaks.” Journal of Management Studies 23 e.g., Lee Clarke, “The Disqualification Heuristic: When Do Organizations
(1988), pp. 319-40. Misperceive Risk?” in Social Problems and Public Policy, vol. 5, ed. R. Ted
5 Youn and William F. Freudenberg, (Greenwich, CT: JAI, 1993); William
Report of the Presidential Commission on the Space Shuttle Challenger
Starbuck and Frances Milliken, “Executive Perceptual Filters – What They
Accident, (Washington: Government Printing Office, 1986), Vol. II,
Notice and How They Make Sense,” in The Executive Effect, Donald C.
Appendix H.
Hambrick, ed. (Greenwich, CT: JAI Press, 1988); Daniel Kahneman,
Alex Roland, “The Shuttle: Triumph or Turkey?” Discover, November Paul Slovic, and Amos Tversky, eds. Judgment Under Uncertainty:
1985: pp. 29-49. Heuristics and Biases (Cambridge: Cambridge University Press, 1982);
Report of the Presidential Commission, Vol. I, Ch. 6. Carol A. Heimer, “Social Structure, Psychology, and the Estimation of
Risk.” Annual Review of Sociology 14 (1988): 491-519; Stephen J. Pfohl,
Turner, Man-made Disasters. Predicting Dangerousness (Lexington, MA: Lexington Books, 1978).
Vaughan, The Challenger Launch Decision, pp. 243-49, 253-57, 262-64, 37
Report of the Presidential Commission, Vol. IV: 791; Vaughan, The
350-52, 356-72. Challenger Launch Decision, p. 178.
Turner, Man-made Disasters. 38
Report of the Presidential Commission, Vol. I, pp. 91-92; Vol. IV, p. 612.
U.S. Congress, House, Investigation of the Challenger Accident, 39
Report of the Presidential Commission, Vol. I, pp. 164-177; Chapter 6,
(Washington: Government Printing Office, 1986), pp. 149. this Report.
Report of the Presidential Commission, Vol. I, p. 148; Vol. IV, p. 1446. 40
Report of the Presidential Commission, Vol. I, p. 90.
Vaughan, The Challenger Launch Decision, p. 235. 41
Report of the Presidential Commission, Vol. IV, pp. 791. For details of
Report of the Presidential Commission, Vol. I, pp. 1-3. teleconference and engineering analysis, see Roger M. Boisjoly, “Ethical
15 Decisions: Morton Thiokol and the Space Shuttle Challenger Disaster,”
Howard E. McCurdy, “The Decay of NASAʼs Technical Culture,” Space American Society of Mechanical Engineers, (Boston: 1987), pp. 1-13.
Policy (November 1989), pp. 301-10. 42
16 Vaughan, The Challenger Launch Decision, pp. 358-361.
Report of the Presidential Commission, Vol. I, pp. 164-177. 43
17 Report of the Presidential Commission, Vol. I, pp. 88-89, 93.
Report of the Presidential Commission, Vol. I, Ch. VII and VIII. 44
18 Edward Wong, “E-Mail Writer Says He was Hypothesizing, Not
Report of the Presidential Commission, Vol. I, pp. 140. Predicting Disaster,” New York Times, 11 March 2003, Sec. A-20, Col. 1
19 (excerpts from press conference, Col. 3).
For background on culture in general and engineering culture in
particular, see Peter Whalley and Stephen R. Barley, “Technical Work 45
Report of the Presidential Commission, Vol. I, pp. 92-95.
in the Division of Labor: Stalking the Wily Anomaly,” in Stephen R. 46
Barley and Julian Orr (eds.) Between Craft and Science, (Ithaca: Cornell Report of the Presidential Commission, Vol. I, p. 152.
University Press, 1997) pp. 23-53; Gideon Kunda, Engineering Culture: 47
Weick argues that in a risky situation, people need to learn how to “drop
Control and Commitment in a High-Tech Corporation, (Philadelphia: their tools:” learn to recognize when they are in unprecedented situations
Temple University Press, 1992); Peter Meiksins and James M. Watson, in which following the rules can be disastrous. See Karl E. Weick, “The
“Professional Autonomy and Organizational Constraint: The Case of Collapse of Sensemaking in Organizations: The Mann Gulch Disaster.”
Engineers,” Sociological Quarterly 30 (1989), pp. 561-85; Henry Administrative Science Quarterly 38, 1993, pp. 628-652.
Petroski, To Engineer is Human: The Role of Failure in Successful Design 48
(New York: St. Martinʼs, 1985); Edgar Schein. Organization Culture and Lee Clarke, Mission Improbable: Using Fantasy Documents to Tame
Leadership, (San Francisco: Jossey-Bass, 1985); John Van Maanen and Disaster, (Chicago: University of Chicago Press, 1999); Charles Perrow,
Stephen R. Barley, “Cultural Organization,” in Peter J. Frost, Larry F. Normal Accidents, op. cit.; Scott Sagan, The Limits of Safety, op. cit.;
Moore, Meryl Ries Louise, Craig C. Lundberg, and Joanne Martin (eds.) Diane Vaughan, “The Dark Side of Organizations,” Annual Review of
Organization Culture, (Beverly Hills: Sage, 1985). Sociology, Vol. 25, 1999, pp. 271-305.
Report of the Presidential Commission, Vol. I, pp. 82-111. Typically, after a public failure, the responsible organization makes
safety the priority. They sink resources into discovering what went wrong
Harry McDonald, Report of the Shuttle Independent Assessment Team. and lessons learned are on everyoneʼs minds. A boost in resources goes
Report of the Presidential Commission, Vol. I, pp. 145-148. to safety to build on those lessons in order to prevent another failure.
23 But concentrating on rebuilding, repair, and safety takes energy and
Vaughan, The Challenger Launch Decision, pp. 257-264. resources from other goals. As the crisis ebbs and normal functioning
24 returns, institutional memory grows short. The tendency is then to
U. S. Congress, House, Investigation of the Challenger Accident,
(Washington: Government Printing Office, 1986), pp. 70-71. backslide, as external pressures force a return to operating goals.
25 William R. Freudenberg, “Nothing Recedes Like Success? Risk Analysis
Report of the Presidential Commission, Vol. I, Ch.VII.
and the Organizational Amplification of Risks,” Risk: Issues in Health and
Mary Douglas, How Institutions Think (London: Routledge and Kegan Safety 3, 1: 1992, pp. 1-35; Richard H. Hall, Organizations: Structures,
Paul, 1987); Michael Burawoy, Manufacturing Consent (Chicago: Processes, and Outcomes, (Prentice-Hall. 1998), pp. 184-204; James G.
University of Chicago Press, 1979). March, Lee S. Sproull, and Michal Tamuz, “Learning from Samples of
One or Fewer,” Organization Science, 2, 1: February 1991, pp. 1-13.

204 Report Volume I August 2003

Master your semester with Scribd & The New York Times

Special offer for students: Only $4.99/month.

Master your semester with Scribd & The New York Times

Cancel anytime.