♪♪
-T-minus 10, 9, 8, 7, 6...
We have main engine start.
4, 3, 2... -All right.
-And liftoff!
Liftoff of the 25th space shuttle mission,
and it has cleared the tower.
-Whoa! -Wow!
[ Radio chatter ]
-Roger, roll, Challenger.
-Oh, wow.
-Good roll program confirmed.
Challenger now heading downrange.
-Wow! -Oh, wow.
-Ohh!
-Engines beginning throttling down now, at 94%.
Velocity, 2,257 feet per second.
Altitude, 4.3 nautical miles.
Downrange distance, 3 nautical miles.
-Challenger, go at throttle up.
-Roger. Go at throttle up.
[ Chatter ]
-Flight controllers here looking very carefully
at the situation.
Obviously a major malfunction.
-A major malfunction?
-We have no downlink.
Reports from the flight dynamics officer
indicate that the vehicle apparently exploded.
-What?! What?! -The vehicle has exploded!
-We are looking at checking with the recovery forces
to see what can be done at this point.
-What? -The vehicle had exploded!
-Oh, please, don't say that.
[ Indistinct conversations ]
♪♪
-Up until the Challenger accident,
NASA was a very untypical government agency.
We were inventing as we went along,
so you had a lot of freedom.
-It was viewed internationally as a fantastic place.
The Apollo missions gave it an aura of invincibility.
-4 minutes and 27 seconds to go
before the start of this historic mission.
-The year was 1981,
and NASA was about to amaze the world with Columbia,
a new spacecraft that pushed the limits of imagination.
-They never before have sent a spacecraft into orbit
that is going to come down as a plane.
-Instead of using a single rocket, like Apollo,
the shuttle was attached to an external fuel tank
and two solid rocket boosters.
Each of the boosters was constructed
of joined metal tubes,
and the field joints were sealed
with two rubber gaskets called O-rings.
-Look at those huge engines getting ready
to catapult this strange assemblage off the earth.
-But all this technology wasn't cheap,
and NASA had to come up with a new funding model.
So Congress and NASA decided the shuttle program
could pay its way by carrying payloads into orbit.
-The Department of Defense, private contractors
that wanted experiments done in space
would pay them to take them up on the shuttle.
-And unlike Apollo, the shuttle system
was going to be almost entirely reusable.
-They had to return this hardware back into space
as rapidly as they could.
It wasn't long into the program they realized that that process
was far more difficult than they ever anticipated.
-They were under constant pressure to launch.
-T-minus 10, 9, 8...
-I'm getting a few butterflies myself right now.
-We've gone for main engine start.
We have main engine start.
♪♪
[ Indistinct shouting ]
-Go! -Fly like an eagle.
♪♪
-Columbia was a fantastic success,
but NASA had to figure out how to make these
technological feats routine.
-They predicted, in the beginning,
that they would be able to launch 60 shuttles a year,
that NASA would, in fact, become self-paying or self-funded.
-We had two pads up and running,
so you'd have two vehicles out on the pad,
and they were going to launch, like, three days apart.
-But that really never happened.
It was an experimental technology,
and they just couldn't manage that many,
so they continually fell behind.
-The shuttle program never had more than nine launches
in a single year.
-We have a beautiful picture now. It's coming through.
-And to help meet their ambitious schedules,
NASA worked with private contractors
to build many of the shuttle's systems,
while NASA engineers analyzed data
to see how well everything performed.
-NASA kept very good records of anomalies.
The problem is, is that they ran into a lot of these.
-One thing engineers saw
was the O-rings that sealed the booster joints
weren't behaving according to design.
On several flights, especially those at cold temperatures,
rocket propellant had blown by the primary O-ring.
-The first time it happened, they accepted it.
They tested it.
They thought they knew what had happened.
And then, the next launch, everything worked,
and then a few more launches, and it happened again.
-But each time, the secondary O-ring
prevented gases from escaping the side of the booster.
So rather than stalling the program to redesign the joint,
NASA waived the requirements governing O-rings,
which effectively made it acceptable
to fly with minimal erosion.
-Even with the worst O-ring erosion they'd ever had,
it hadn't failed, so they started to work on it,
but they really weren't rushing.
It didn't seem so terrible,
but they continually expanded the bounds of acceptable risk.
-And then came the 10th Challenger launch
and a mission unlike any NASA had attempted before.
-They decided to make that the first flight
that a ordinary citizen could fly,
and that drew a tremendous interest from the public,
plus the school systems
were going to show this live on television.
-At this time, I'd like to introduce you
to perhaps the person you came to see,
and that's Christa McAuliffe,
our payload specialist, teacher in space.
-My job at the time of the Challenger was the director
of the space shuttle solid-rocket motor project
for my company, Morton Thiokol.
-Morton Thiokol was an engineering firm
out of Brigham City, Utah,
and had the NASA contract to build the shuttle boosters.
-Well, I am so excited to be here,
and I just hope everybody tunes in on day four, now,
to watch the teacher teaching from space.
-On the day before Challenger,
there was an overnight low that was record-breaking.
-Got a telephone call from one of the program managers
back in Utah that worked for me.
And he said, "Al," he says,
"We just heard that it might get down
to as low as 18 degrees by tomorrow morning."
"Good grief," I said.
"I'm really worried about these O-ring seals
being able to operate properly at those kind of temperatures."
-The mission had already been rescheduled
after routine delays, so now Morton Thiokol and NASA
scheduled an emergency teleconference
the night before the launch.
-The engineers at Thiokol were very concerned,
so they began scrambling
to put together an analysis of temperature data.
-Larry Mulloy was NASA's project manager
for the solid-rocket boosters.
-Then we went out to the teleconference,
and Roger Boisjoly,
who was kind of the O-ring czar at Morton Thiokol,
did most of the talking.
The recommendation was that we wait
until it's 54 degrees before we launch.
So I said something like, "54 degrees where?"
-They had never drawn a temperature line before,
and it meant a tremendous change to the shuttle's schedule.
-It isn't what they wanted to hear.
In fact, Larry made a comment,
"Thiokol, when the hell do you want me to launch, next April?"
-Thiokol's engineers in Utah were caught off guard
by NASA's strong reaction to their recommendation,
so they asked if they could have some time off the teleconference
to review the data in private.
-After they went offline, Al McDonald was visibly upset,
and he said, "I wouldn't want to be the guy that had to appear
at a board of inquiry if this thing blows."
And I said, "I understand that, Al.
And you won't have to. That'll be me."
♪♪
-At Thiokol, the vice president was asking those engineers
to stand up for what they said.
Roger Boisjoly took the lead in the objections.
He said, "I can't prove it to you.
All I know is that
it's away from goodness in our experience base."
But the engineers at Thiokol didn't have the data,
so the vice president
took the decision-making away from the engineers
and asked the managers to decide.
-And they did.
More than 30 minutes after the engineers had gone offline,
Thiokol managers voted to reverse the recommendation
and to launch the Challenger as planned.
The teleconference became a focal point
for the White House-appointed Rogers Commission
that investigated NASA after the disaster.
-There was not one positive statement for launch
ever made in that room.
-What was driving you here?
What was to be achieved that caused you to go?
♪♪
-NASA pressured the folks at Thiokol to change their mind,
and it was clear to me that we finally came back
and gave them what they wanted to hear.
-You know, we'd been rationalizing
this erosion since the second flight.
-None of the information the NASA managers were getting
was new.
This was not individuals getting used to something.
This was organizationally supported.
-That's where...
the accident was inevitable.
-Once Thiokol reversed their initial recommendation,
someone needed to sign off on the launch rationale.
-I did the smartest thing I ever did in my lifetime.
I refused to sign it.
I just felt it was too much risk to take.
-So just before midnight, McDonald's boss,
Joe Kilminster, signed off instead.
After the disaster,
the commission concluded cold and joint design
were major factors in Challenger's O-ring failure.
It also squarely pointed a finger
at NASA managers like Mulloy.
-The commission did recognize
that there was pressure to launch,
but they saw it as enacted by amorally calculating managers
who were in positions of responsibility.
I found something completely different.
-So Vaughan began her own investigation.
-No one wanted this to happen, but intuition, you know,
"I don't feel good about this," should have been okay,
and they applied all the usual rules
in a situation where the usual rules didn't apply.
-4, 3, 2, 1.
♪♪
-We made a grievous error.
♪♪
-So the real crux of the matter is,
how do you get people to recognize
when you need to do something different
than what you've been trained to do?
-After Challenger, the Rogers Commission
prompted many changes at NASA,
including an increase in the program's budget,
adding a third O-ring to the booster joints,
and moving some managers, including Mulloy,
out of the shuttle program.
-But there was nothing really about
how to change the organization
that came out of the commission report.
-And then in 2003,
after NASA had completed 15 years of successful missions,
came the 28th launch of the Space Shuttle Columbia.
-It seemed like any other launch, but, on the second day,
someone called me on the phone and said,
"You've heard about the large piece of debris or foam
that came off the tank and hit the left wing,
caused a cloud, a poof?"
I said, "No, I didn't."
-Columbia made it into orbit safely,
but the concern was that if debris
had caused damage to the left wing,
it could be vulnerable on re-entry,
so just days after the launch,
NASA formed a special team to assess the damage.
-The decision to ask for more data,
the need for it, was unanimous.
-But management was worried about
unnecessarily diverting Columbia from its mission.
Since foam damage had been generally considered
to be nonthreatening,
NASA manager Linda Ham denied three requests
to get pictures of the shuttle's underside
from a nearby satellite.
-And they were all put down for different reasons.
The similarity between Challenger and Columbia
was the falling back on routine under uncertain circumstances.
-In the end, NASA sent just one communication
to the astronauts about the debris strike,
and on February 1, 2003,
the crew began their return to Earth.
-Yeah. [ Laughs ]
-Part of our engineering culture
is that you should work to your chain of command.
I will regret, always,
why I didn't break the door down by myself.
-And we're ready, Willie, no deltas.
-Everything look good to you?
-I don't see anything out of the ordinary.
-This is amazing.
It's really getting fairly bright out there.
-They had just started the de-orbit burn.
They were coming down, and we started seeing temperatures
change higher on the left side versus the right.
-FYI, I've just lost
four separate temperature transducers
on the left side of the vehicle.
-The anomalous data confirmed my worst fear.
[ Radio static ]
-Columbia, Houston. UHF comm check.
Columbia, Houston, UHF comm check.
-I looked up, and I saw one of our chief engineers in tears.
"We can't get the crew," she said.
"They've been incommunicado."
♪♪
"It happened. It happened."
♪♪
-Columbia was destroyed on re-entry.
♪♪
After the disaster, Vaughan worked closely
with the Columbia Accident Investigation Board,
which concluded that NASA had ineffective leadership
and a flawed safety culture.
-We are quite convinced that these organizational matters
are just as important as the foam.
-Ham soon left the shuttle program,
and NASA restructured its management team.
-This happens in many different kinds of organizations.
I don't think that the general public
got the position
of either Larry Mulloy or Linda Ham
and that their behavior was, to a great deal,
determined by working in a very rule-oriented organization.
[ Bell clanging ]
-Using her insights from NASA,
Vaughan developed a theory that went beyond the space agency,
calling it "normalization of deviance."
She says it helps explain how, over time,
organizations come to accept risky practices as normal.
-It's widespread...
with Katrina, where the engineers were saying,
"These structures are not going to hold.
We need to do something more here,"
with British Petroleum, early warning signs ignored.
-The cement used in the Gulf oil rig was flawed.
[ Indistinct shouting ]
-The 2008 financial failure.
-The federal commission concluded
it could have been avoided.
-You had a lot of the heavy technology
derivatives and formulas,
and there is a fine line between what is devious
and what's a good business decision.
-And in 2017...
-Two deadly accidents involving U.S. Navy ships.
-...the U.S. Navy cited Vaughan's theory
to help explain accidents that killed 17 sailors.
-We accepted this, what was termed,
the normalization of deviance.
In other words, we allowed our standards to drop,
thinking we were still okay.
♪♪
-We can never resolve the problem of complexity,
but you have to be sensitive to your organization
and how it works.
While a lot of us work in complex organizations,
we don't really realize the way the organizations
that we inhabit completely inhabit us.
♪♪