Space Shuttle Challenger Case(From The Knowing Organization, Chapter 5)
Morton-Thiokol Inc. had engineered the space shuttle's solid rocket booster (SRB) based on the Air Force's Titan III design because of its reliability. The SRB's steel case was divided into segments that were joined and sealed by rubber O-rings. Although the Titan's O-rings had occasionally been eroded by hot gases, the erosion was not regarded as significant. A second, redundant O-ring was added to each joint to act as back-up should the primary O-ring failed.
As early as 1977, a test of the SRB case showed an unexpected rotation of the joints which decompressed the O-rings making it more difficult for them to seal the joints. In 1980, a review committee concluded that safety was not jeopardized and the joints were classified as Criticality 1R, denoting that joint failure could cause loss of life or shuttle (the 1 in the rating); and that secondary O-rings provided redundancy (the R in the rating). During 1983, the SRBs were modified to use thinner walls, narrower nozzles, and more powerful fuel, which worsened the joint rotation. Tests showed that the rotation could be so large that a secondary O-ring could not seal a joint and provide redundancy. The R rating was consequently removed from the joints' Criticality classification. Nevertheless, many NASA and Thiokol documents produced over the next three years continued to list the Criticality as 1R, and seemed to suggest that neither management thought that a secondary O-ring could really fail to seal a joint.
In a flight readiness review of March 1984, NASA's top managers discussed and accepted the idea that some O-ring erosion was 'acceptable' because the rings embodied a safety factor. The incidence of heat damage at the SRB joints was growing -- three of the five 1984 flights showed heat damage, eight of the nine 1985 flights, and the flight on January 12, 1986, just two weeks before Challenger. In spite of these signals, the management of the SRB project at Marshall Space Flight Centre and at Thiokol remained confident that the erosion was 'allowable' and an 'acceptable risk.' The April 1985 flight showed significant damage at one primary O-ring, with a substantial amount of hot gas blowing by this ring, which in turn eroded the secondary O-ring (Bell and Esch 1987). This led Lawrence Mulloy, SRB project manager at Marshall, to place a 'launch constraint' on all subsequent flights, acknowledging that a problem of Criticality 1, 1R, 2, or 2R might occur. However, Mulloy 'waived' the launch constraint for all subsequent flights up to the last one.
In early December 1985, Thiokol was told to 'close out' long outstanding problems, including O-ring erosion problems, and the relevant problem reports were subsequently marked as 'contractor closure received.' O-rings were no longer listed as a launch constraint for the flight readiness review of January 15, 1986, and O-rings were not mentioned in the Flight Readiness Review documentation of the Challenger.
On the afternoon of January 27, 1986, the eve of the launch, the weather forecast predicted unusually cold weather for Florida, with temperatures at low 20s in the early hours of January 28. Thiokol engineers expressed concern that at such cold temperatures, the O-rings would harden and not seal the joints against the hot ignition gases.
Two telephone conferences were held at three sites (Thiokol, Marshall SFC, and Kennedy Space Center) on the evening of January 27 to discuss whether the launch should be delayed. Thirty four engineers and managers participated in the second conference, where Thiokol engineers warned that at the forecast temperatures, the O-rings would seal more slowly than on the coldest launch to date, a January 1985 mission when the temperature was 53 deg. F, at which a primary O-ring was eroded so that it failed to seal, allowing hot gases to 'blow by' to the secondary ring. Although the secondary ring did seal the joint then, the engineers argued that a more extensive blow-by could damage the secondary ring so that it does not seal. Someone then pointed out that one of the Thiokol data points showed blow-by at 75 deg. F, suggesting that temperature was not the only factor.
Roger Boisjoly, a Thiokol staff engineer was asked what evidence existed to show that O-ring damage was the result of cold temperatures. Boisjoly replied that he could not quantify his concerns, that he had no data to quantify it, but that he knew "it was away from goodness in the current database." Lawrence Mulloy, Manager SRB Project at Marshall, asked Thiokol management for a recommendation. Thiokol's Joseph Kilminster, Vice President Space Booster Programs, replied that he could not recommend a launch at any temperature below 53 deg. F. Mulloy said that since booster joint temperatures had never been set as launch criteria, Thiokol was effectively trying to create new Launch Commit Criteria on the eve of the launch. He then exclaimed, "My God, Thiokol, when do you want me to launch, next April?"
George Hardy, Marshall's Deputy Director of Science and Engineering, added that he was "appalled" at the Thiokol recommendation, that the data presented did not conclusively support a correlation between temperature and O-ring erosion, but that he will not agree to a launch against Thiokol's recommendation. The challenges from both Mulloy and Hardy, worded in strong language, put pressure on the Thiokol engineers. Kilminster then asked for permission for Thiokol engineers and managers to go off-line for a few minutes. All participants who were asked why the caucus was called thought that it was because Thiokol's engineering analysis was weak.
During the off-line caucus, which lasted for about half an hour, Thiokol's Senior Vice President Jerry Mason stated that the possibility of blow-by and erosion had always been present in the earlier flights, and had been considered as acceptable risks. They should therefore consider the temperature issue separately on its own. Mason reaffirmed the belief in redundancy, that the primary O-ring would perform properly, but if it sealed slowly and blow-by occured, then the secondary O-ring would be in position and would seal. Boisjoly and another engineer (Arnold Thompson) defended the engineering position that based on the data they had, they did not know what the secondary O-ring would do in these cold temperatures.
After several minutes of discussion Mason noted that they were starting to go over the same ground over and over again and said that "Well, it's time to make a management decision." Mason, Kilminster, Wiggins (VP & GM Space Division), and Lund (VP Engineering) then conferred among themselves, effectively excluding the engineers from the decision making. Mason, Kilminster, Wiggins supported a launch recommendation, but Lund hesitated. Mason said to Lund, "It's time to take off your engineering hat and put on your management hat." Lund then voted with the rest. When they were later asked why they had reversed their initial recommendation and changed their minds about the danger of a low-temperature launch, "all said that they were influenced by facts not taken into account before their initial recommendation. These facts supported redundancy: thus, they believed that the secondary would seal the joint."
When the teleconference resumed, Kilminster summarized Thiokol's position. Although temperature effects were a concern, the data predicting blow-by were inconclusive. Erosion tests had indicated that the primary O-ring could sustain three times more erosion than that experienced in the previous worst case. Furthermore, even if the primary failed, the secondary as back-up would still seal the joint.
Stanley Reinartz, Manager Shuttle Projects Office at Marshall, then asked all participants of the teleconference whether there were disagreements or comments about Thiokol's recommendation. No one said anything. As part of normal NASA procedures, Mulloy asked Kilminster to fax a copy of the flight-readiness rationale and recommendation to Marshall and Kennedy. The teleconference ended. At 11.38 am the following morning the Challenger was launched. The ambient temperature was 36 deg. F. Seconds later, the shuttle exploded, killing all on board.
In the end, the Challenger disaster was the result of an organizational and social process that had its origins in "routine and taken-for-granted aspects of organizational life that created a way of seeing that was simultaneously a way of not seeing." In this process, information initially viewed as indicating potentially dangerous deviance is reinterpreted as being within the norms of acceptable joint performance, and therefore officially within the limits of acceptable risk. According to Diane Vaughan, this normalization of deviance was the outcome of three social forces:
In the production of culture, the SRB work group repeatedly used a decision-making sequence to develop norms, values and procedures that supported their central belief about redundancy and which allowed them to reinterpet deviant information. The decision sequence consisted of five steps:
- the production of culture in the SRB work group,
- the culture of production, and
- structural secrecy.
On January 27, 1986, the five-step decision sequence was enacted once again. The predicted cold weather was a signal of potential danger, creating uncertainty about the relationship between O-ring resiliency and redundancy. Arranging the teleconference was an official act of acknowledging escalated risk. There followed a review of the evidence, culminating in an official act indicating the normalization of deviance: accept risk. The decision was followed by the destruction of STS 51-L [Challenger's official designation] ...
- Signals of potential danger;
- Official act acknowledging escalated risk;
- Review of evidence;
- Official act indicating the normalization of deviance: accepting the risk; and
- Shuttle launch.
The work group beliefs and norms were reinforced by a culture of production which consisted of the institutionalized belief systems of the engineering profession, NASA, and the Marshall Space Flight Center, and which was dominated by three cultural imperatives: the original technical culture, bureaucratic accountability, and political accountability.
The third organizational factor that resulted in the normalization of deviance was the hiding of information about the seriousness of the O-ring problem through structural secrecy, "the way that patterns of information, organizational structure, processes, and transactions, and the structure of regulatory relations systematically undermine the attempt to know and interpret situations in all organizations."
In Vaughan's analysis, the three forces of the production of culture, the culture of production, and structural secrecy work together to explain the history of meaning and choice making that led to the decision to launch the Challenger.
The production of culture, through repeated decision routines that normalized deviant information, developed and maintained the group's belief in redundancy -- that the secondary O-ring will back up the primary. This belief in redundancy provided the frame of reference for processing information.
The culture of production, expressed in the norms of the engineering profession and the culture of NASA organizations, legitimized the decision process as conforming to acceptable practices of engineers and managers who have to exercise interpretive flexibility, develop ad hoc rules, and follow bureaucratic procedures in dealing with complex, innovative, risky technical systems.
Structural secrecy blocked information flow and attenuated signals about the O-ring problem, hiding and diluting the information so that the signals of potential danger lost their ability to overturn the dominant belief about redundancy.
The three forces converged on the eve of the launch in a final denouement of the history and style of decision making that has characterized the space shuttle program:
It can truly be said that the Challenger launch decision was a rule-based decision. But the cultural understandings, rules, procedures, and norms that always had worked in the past did not work this time. It was not amorally calculating managers violating rules that were responsible for the tragedy. It was conformity.
(Vaughan 1996, p. 386)
1. How were decision routines used to reduce complexity and uncertainty?
2. How was information seeking and information use influenced by organizational roles, rules and routines?
3. Did organizational politics play a part in the decision making process?4. In what way was the case a failure of organizational sensemaking?
5. In what way was the case a failure of organizational knowledge creating and use?