Autonomy, interdependence, and social control: NASA and the space shuttle Challenger

Administrative Science Quarterly, June, 1990 by Diane Vaughan

Autonomy, Interdependence, and Social Control: NASA and the Space Shuttle Challenger The tragic loss of the space shuttle Challenger on January 28, 1986 sent the nation into mourning and forced a citizenry ordinarily preoccupied with other matters to confront again the risks of living in a technologically sophisticated age. Preceded by the incidents at Three Mile Island and Union Carbide in Bhopal and soon followed by Chernobyl, the Challenger accident left in its aftermath a deeply troubling question: Has our ability to create highly developed technological systems exceeded our ability to control and master them in practice? Perrow (1984) addressed this question, arguing that technological complexity has a tendency to result in "normal accidents," accidents that are inevitable for certain technical systems. These accidents initially are caused by technical component failures but become accidents rather than incidents because of the nature of the system. The failure of one component interacts with others, triggering a complex set of interactions that can precipitate a technical system accident of catastrophic potential.

Technology is not the only culprit, however. The organizations that run these risky enterprises often contribute to their own technological failures. Turner (1976, 1978) has investigated accidents and social disasters, seeking any systematic organizational patterns that might have preceded these events. He found that disasters had long incubation periods characterized by a number of discrepant events signaling danger. These events were overlooked or misinterpreted, accumulating unnoticed. Among the organizational patterns contributing to these "failures of foresight" (Turner, 1978: 51) were norms and culturally accepted beliefs about hazards, poor communication, inadequate information handling in complex situations, and failure to comply with existing regulations instituted to assure safety (Turner, 1976: 391).

Paradoxically, a long incubation period is advantageous. Hypothetically, regulatory agents could intervene, possibly averting a technical system accident. True, some are unavoidable, because they involve multiple errors of design, equipment failure, and systems operation. But for those technical system accidents that are potentially avoidable and whose impending occurrence is obscured by organizational patterns such as those Turner noted, effective regulation may reduce the probability that a technical failure will occur. Unfortunately, regulatory agents are organizations subject to their own failures of foresight.

When regulatory failure occurs in the monitoring of an organization that deals in high-risk technology, the resulting accident may be thought of as an organizational-technical system accident: a potentially avoidable technical system accident resulting from the failure of the technical components of the product, the organization responsible for its production and use, and the regulatory organizations designed to oversee the entire operation. The failures of the producer and regulatory organizations are failures of foresight, arising from organizational patterns that block problem identification and correction in the pre-accident incubation period. Such an accident cannot be explained by the failure of the technical system alone. The organization malfunctions, failing to correct a correctable technical problem. The regulatory organization charged with surveillance of the technical product and the organization's performance fails to resolve the problems in both. The result is an organizational-technical system accident, perhaps of catastrophic proportion.

The Challenger disaster was an organizational-technical system accident. The immediate cause was technical failure. The O-rings--two 0.280-inch diameter rings of synthetic rubber designed to seal a gap in the aft field joint of the solid rocket booster--did not do their job. The Presidential Commission (1986, 1: 72) investigating the incident stated that design failure interacted with "the effects of temperature, physical dimensions, the character of the materials, the effects of re-usability, processing, and the reaction of the joint to dynamic loading." The result of these interactive factors was, indeed, a technical system accident similar to those Perrow identified. But there was more. The post-accident investigations of both the Commission (1986, 1: 82-150) and the U.S. House Committee on Science and Technology (1986a: 138-178) indicated that the NASA organization contributed to the technical failure. As Turner might have predicted, the technical failure had a long incubation period. Problems with the O-rings were first noted in 1977 (Presidential Commission, 1986, 1: 122). Thus, NASA might have acted to avert the tragedy. But the organizational response to the technical problem was characterized by poor communication, inadequate information handling, faulty technical decision making, and failure to comply with regulations instituted to assure safety (Presidential Commission, 1986, 1: 82-150; U.S. House Committee on Science and Technology, 1986a: 138-178). Moreover, the regulatory system designed to oversee the safety of the shuttle program failed to identify and correct program management and design problems related to the O-rings. NASA insiders referred to these omissions as "quality escapes": failures of the program to preclude an avoidable problem (Presidential Commission, 1986, 1: 156, 159). NASA's safety system failed at monitoring shuttle operations to such an extent that the Presidential Commission's report referred to it as "The Silent Safety Program" (1986, 1: 152).