WEBVTT
1
00:00:00.540 --> 00:00:03.700
Welcome everybody to Failure Mode. When systems collapse, don't forget
2
00:00:03.720 --> 00:00:06.400
to share and subscribe. Today we're looking at the Challenger.
3
00:00:07.219 --> 00:00:12.060
On the evening of January 27, 1986, engineers at Morton-Thicol
4
00:00:12.099 --> 00:00:14.869
were worried about the temperature. The space shuttle Challenger was
5
00:00:14.900 --> 00:00:18.230
scheduled to launch the next morning from Kennedy Space Center.
6
00:00:18.429 --> 00:00:22.250
Florida was experiencing unusually cold weather. Engineers were concerned about
7
00:00:22.289 --> 00:00:26.109
rubber seals, O-rings, inside the shuttle's solid rocket booster joints.
8
00:00:26.769 --> 00:00:30.600
Their recommendation was straightforward, don't launch under these conditions. Less
9
00:00:30.620 --> 00:00:34.880
than 12 hours later, Challenger lifted off. 73 seconds after launch,
10
00:00:34.899 --> 00:00:39.909
the vehicle broke apart. Tragically, seven astronauts were killed. The
11
00:00:39.920 --> 00:00:42.969
question behind Challenger isn't simply why an O-ring failed. It's
12
00:00:42.990 --> 00:00:45.409
how his system received a warning and still moved forward.
13
00:00:46.530 --> 00:00:50.929
What did happen on January 28, 1986? Challenger launched on
14
00:00:50.969 --> 00:00:56.390
mission STS-51L. Each solid rocker booster consisted of cylindrical sections
15
00:00:56.469 --> 00:01:00.340
joined together. These O-rings inside those joints were designed to
16
00:01:00.380 --> 00:01:05.420
prevent extremely hot combustion gases from escaping. But colder rubber
17
00:01:05.519 --> 00:01:08.959
becomes less resilient and responds more slowly. The morning of
18
00:01:09.000 --> 00:01:11.799
the launch was colder than any previous shuttle launch. The
19
00:01:11.840 --> 00:01:14.560
Rogers Commission later determined that a joint in the right
20
00:01:15.159 --> 00:01:19.609
solid rocket booster failed to seal properly. Hot gases escaped,
21
00:01:19.840 --> 00:01:22.969
eventually contributing to the structural breakup of the external tank
22
00:01:23.010 --> 00:01:27.540
and destruction of Challenger. But the disaster began long before ignition.
23
00:01:27.859 --> 00:01:31.969
O-ring erosion and evidence of hot gas blow-by had appeared
24
00:01:32.030 --> 00:01:35.349
on previous shuttle missions. Instead of automatically grounding the system,
25
00:01:35.390 --> 00:01:39.230
engineers and managers repeatedly analyzed these anomalies and developed rationales
26
00:01:39.269 --> 00:01:43.769
for continuing operation. Then came the weather forecast for Challenger.
27
00:01:44.109 --> 00:01:48.930
During a January 27 teleconference, Morton Thiokol engineers presented data
28
00:01:48.969 --> 00:01:53.269
showing concerns about O-ring performance in cold conditions. The cold
29
00:01:53.349 --> 00:01:57.400
as previous shuttle launch involving the relevant experience had an
30
00:01:57.480 --> 00:02:01.890
estimated O-ring temperature of 50 to 3 degrees Fahrenheit. FICO
31
00:02:01.909 --> 00:02:05.790
initially recommended the Challenger not launch unless the O-rings reached
32
00:02:05.849 --> 00:02:09.849
at least 50 to 3 degrees. NASA personnel challenged the
33
00:02:09.889 --> 00:02:14.349
recommendation and questioned whether the available data justified establishing 53
34
00:02:14.349 --> 00:02:20.469
degrees as a launch limit. FICO management caucused privately when
35
00:02:20.509 --> 00:02:23.919
the company returned to the conference as position changed. and
36
00:02:23.939 --> 00:02:28.009
then they recommended the launch. Some of their engineers remained opposed.
37
00:02:29.069 --> 00:02:31.889
This is where Challenger became more than an engineering failure.
38
00:02:32.229 --> 00:02:35.389
Sociologists later used Challenger to develop one of the most
39
00:02:35.449 --> 00:02:41.270
influential ideas in organizational safety, normalization of deviance. The system
40
00:02:41.330 --> 00:02:46.139
experienced something that technically should not happen. Nothing catastrophic follows,
41
00:02:46.180 --> 00:02:50.599
so the abnormal condition gradually becomes interpreted as tolerable. Zero-ring
42
00:02:50.699 --> 00:02:55.710
technology erosion had occurred before without destroying a shuttle. Each
43
00:02:55.729 --> 00:02:59.129
successful mission could therefore reinforce confidence that the anomaly was
44
00:02:59.210 --> 00:03:02.310
manageable rather than evidence that the system was approaching its limits.
45
00:03:03.210 --> 00:03:06.409
Vaughn described this as a gradual process in which technical
46
00:03:06.449 --> 00:03:10.849
warning signals became normalized to organizational decision-making. This is what
47
00:03:10.889 --> 00:03:16.219
makes normalization of deviance dangerous. Success can sometimes teach the
48
00:03:16.240 --> 00:03:20.729
wrong lesson. The warning signs the zero ring problem wasn't
49
00:03:20.770 --> 00:03:24.509
discovered the night before Challenger. NASA and its contractors had
50
00:03:24.550 --> 00:03:30.090
accumulated evidence of erosion and blow-by from previous missions. The
51
00:03:30.150 --> 00:03:33.509
Rogers Commission later concluded that senior launch decision makers did
52
00:03:33.550 --> 00:03:36.650
not receive the complete history of the problem and know
53
00:03:36.689 --> 00:03:40.620
that FICO had initially recommended against launching below 53 degrees.
54
00:03:41.460 --> 00:03:44.180
The system contained the information, but the information did not
55
00:03:44.219 --> 00:03:46.900
reach everyone who needed it in a form that communicated
56
00:03:46.919 --> 00:03:51.150
its significance. The critical organizational moment came during the January
57
00:03:51.150 --> 00:03:55.759
27 teleconference. FICO's original engineering recommendation was not to launch
58
00:03:55.919 --> 00:04:00.180
under the predicted conditions. After discussion in an internal management caucus,
59
00:04:00.199 --> 00:04:04.680
the recommendation changed. The Rogers Commission concluded that the launch
60
00:04:04.699 --> 00:04:07.219
decision was flawed. It found deficiencies not only in the
61
00:04:07.259 --> 00:04:11.340
booster joint but in the decision-making process. The commission specifically
62
00:04:11.379 --> 00:04:14.979
criticized the failure to communicate crucial information upward and concluded
63
00:04:15.000 --> 00:04:18.459
that FICO management reversed its position contrary to engineer views.
64
00:04:19.589 --> 00:04:22.910
Challenger therefore cannot be adequately explained as one defective piece
65
00:04:22.949 --> 00:04:25.470
of rubber. It was a technical failure embedded inside an
66
00:04:25.529 --> 00:04:30.689
organizational failure. Repeated success does not prove that a dangerous
67
00:04:30.730 --> 00:04:34.980
condition is safe. Sometimes it merely means catastrophe hasn't happened yet.
68
00:04:35.839 --> 00:04:40.009
Safety systems must preserve. dissent. When engineers closest to a
69
00:04:40.069 --> 00:04:42.689
technical risk are worried, their concerns need a direct route
70
00:04:42.709 --> 00:04:46.850
to the people making the final decision. And finally, organizations
71
00:04:46.949 --> 00:04:50.550
should be especially suspicious when uncertainty gradually becomes interpreted as
72
00:04:50.629 --> 00:04:55.709
evidence of safety. Challenger's deepest lesson isn't simply that engineers
73
00:04:55.750 --> 00:04:59.389
warn NASA. It's that organizations can slowly redefine what they
74
00:04:59.439 --> 00:05:04.189
consider acceptable until yesterday's warning becomes today's normal operating condition.
75
00:05:04.560 --> 00:05:10.009
And that is the central principle of failure mode. Catastrophes
76
00:05:10.089 --> 00:05:13.569
rarely require one enormous mistake. Sometimes they only require enough
77
00:05:13.629 --> 00:05:15.709
small failures to align.
1
00:00:00.540 --> 00:00:03.700
Welcome everybody to Failure Mode. When systems collapse, don't forget
2
00:00:03.720 --> 00:00:06.400
to share and subscribe. Today we're looking at the Challenger.
3
00:00:07.219 --> 00:00:12.060
On the evening of January 27, 1986, engineers at Morton-Thicol
4
00:00:12.099 --> 00:00:14.869
were worried about the temperature. The space shuttle Challenger was
5
00:00:14.900 --> 00:00:18.230
scheduled to launch the next morning from Kennedy Space Center.
6
00:00:18.429 --> 00:00:22.250
Florida was experiencing unusually cold weather. Engineers were concerned about
7
00:00:22.289 --> 00:00:26.109
rubber seals, O-rings, inside the shuttle's solid rocket booster joints.
8
00:00:26.769 --> 00:00:30.600
Their recommendation was straightforward, don't launch under these conditions. Less
9
00:00:30.620 --> 00:00:34.880
than 12 hours later, Challenger lifted off. 73 seconds after launch,
10
00:00:34.899 --> 00:00:39.909
the vehicle broke apart. Tragically, seven astronauts were killed. The
11
00:00:39.920 --> 00:00:42.969
question behind Challenger isn't simply why an O-ring failed. It's
12
00:00:42.990 --> 00:00:45.409
how his system received a warning and still moved forward.
13
00:00:46.530 --> 00:00:50.929
What did happen on January 28, 1986? Challenger launched on
14
00:00:50.969 --> 00:00:56.390
mission STS-51L. Each solid rocker booster consisted of cylindrical sections
15
00:00:56.469 --> 00:01:00.340
joined together. These O-rings inside those joints were designed to
16
00:01:00.380 --> 00:01:05.420
prevent extremely hot combustion gases from escaping. But colder rubber
17
00:01:05.519 --> 00:01:08.959
becomes less resilient and responds more slowly. The morning of
18
00:01:09.000 --> 00:01:11.799
the launch was colder than any previous shuttle launch. The
19
00:01:11.840 --> 00:01:14.560
Rogers Commission later determined that a joint in the right
20
00:01:15.159 --> 00:01:19.609
solid rocket booster failed to seal properly. Hot gases escaped,
21
00:01:19.840 --> 00:01:22.969
eventually contributing to the structural breakup of the external tank
22
00:01:23.010 --> 00:01:27.540
and destruction of Challenger. But the disaster began long before ignition.
23
00:01:27.859 --> 00:01:31.969
O-ring erosion and evidence of hot gas blow-by had appeared
24
00:01:32.030 --> 00:01:35.349
on previous shuttle missions. Instead of automatically grounding the system,
25
00:01:35.390 --> 00:01:39.230
engineers and managers repeatedly analyzed these anomalies and developed rationales
26
00:01:39.269 --> 00:01:43.769
for continuing operation. Then came the weather forecast for Challenger.
27
00:01:44.109 --> 00:01:48.930
During a January 27 teleconference, Morton Thiokol engineers presented data
28
00:01:48.969 --> 00:01:53.269
showing concerns about O-ring performance in cold conditions. The cold
29
00:01:53.349 --> 00:01:57.400
as previous shuttle launch involving the relevant experience had an
30
00:01:57.480 --> 00:02:01.890
estimated O-ring temperature of 50 to 3 degrees Fahrenheit. FICO
31
00:02:01.909 --> 00:02:05.790
initially recommended the Challenger not launch unless the O-rings reached
32
00:02:05.849 --> 00:02:09.849
at least 50 to 3 degrees. NASA personnel challenged the
33
00:02:09.889 --> 00:02:14.349
recommendation and questioned whether the available data justified establishing 53
34
00:02:14.349 --> 00:02:20.469
degrees as a launch limit. FICO management caucused privately when
35
00:02:20.509 --> 00:02:23.919
the company returned to the conference as position changed. and
36
00:02:23.939 --> 00:02:28.009
then they recommended the launch. Some of their engineers remained opposed.
37
00:02:29.069 --> 00:02:31.889
This is where Challenger became more than an engineering failure.
38
00:02:32.229 --> 00:02:35.389
Sociologists later used Challenger to develop one of the most
39
00:02:35.449 --> 00:02:41.270
influential ideas in organizational safety, normalization of deviance. The system
40
00:02:41.330 --> 00:02:46.139
experienced something that technically should not happen. Nothing catastrophic follows,
41
00:02:46.180 --> 00:02:50.599
so the abnormal condition gradually becomes interpreted as tolerable. Zero-ring
42
00:02:50.699 --> 00:02:55.710
technology erosion had occurred before without destroying a shuttle. Each
43
00:02:55.729 --> 00:02:59.129
successful mission could therefore reinforce confidence that the anomaly was
44
00:02:59.210 --> 00:03:02.310
manageable rather than evidence that the system was approaching its limits.
45
00:03:03.210 --> 00:03:06.409
Vaughn described this as a gradual process in which technical
46
00:03:06.449 --> 00:03:10.849
warning signals became normalized to organizational decision-making. This is what
47
00:03:10.889 --> 00:03:16.219
makes normalization of deviance dangerous. Success can sometimes teach the
48
00:03:16.240 --> 00:03:20.729
wrong lesson. The warning signs the zero ring problem wasn't
49
00:03:20.770 --> 00:03:24.509
discovered the night before Challenger. NASA and its contractors had
50
00:03:24.550 --> 00:03:30.090
accumulated evidence of erosion and blow-by from previous missions. The
51
00:03:30.150 --> 00:03:33.509
Rogers Commission later concluded that senior launch decision makers did
52
00:03:33.550 --> 00:03:36.650
not receive the complete history of the problem and know
53
00:03:36.689 --> 00:03:40.620
that FICO had initially recommended against launching below 53 degrees.
54
00:03:41.460 --> 00:03:44.180
The system contained the information, but the information did not
55
00:03:44.219 --> 00:03:46.900
reach everyone who needed it in a form that communicated
56
00:03:46.919 --> 00:03:51.150
its significance. The critical organizational moment came during the January
57
00:03:51.150 --> 00:03:55.759
27 teleconference. FICO's original engineering recommendation was not to launch
58
00:03:55.919 --> 00:04:00.180
under the predicted conditions. After discussion in an internal management caucus,
59
00:04:00.199 --> 00:04:04.680
the recommendation changed. The Rogers Commission concluded that the launch
60
00:04:04.699 --> 00:04:07.219
decision was flawed. It found deficiencies not only in the
61
00:04:07.259 --> 00:04:11.340
booster joint but in the decision-making process. The commission specifically
62
00:04:11.379 --> 00:04:14.979
criticized the failure to communicate crucial information upward and concluded
63
00:04:15.000 --> 00:04:18.459
that FICO management reversed its position contrary to engineer views.
64
00:04:19.589 --> 00:04:22.910
Challenger therefore cannot be adequately explained as one defective piece
65
00:04:22.949 --> 00:04:25.470
of rubber. It was a technical failure embedded inside an
66
00:04:25.529 --> 00:04:30.689
organizational failure. Repeated success does not prove that a dangerous
67
00:04:30.730 --> 00:04:34.980
condition is safe. Sometimes it merely means catastrophe hasn't happened yet.
68
00:04:35.839 --> 00:04:40.009
Safety systems must preserve. dissent. When engineers closest to a
69
00:04:40.069 --> 00:04:42.689
technical risk are worried, their concerns need a direct route
70
00:04:42.709 --> 00:04:46.850
to the people making the final decision. And finally, organizations
71
00:04:46.949 --> 00:04:50.550
should be especially suspicious when uncertainty gradually becomes interpreted as
72
00:04:50.629 --> 00:04:55.709
evidence of safety. Challenger's deepest lesson isn't simply that engineers
73
00:04:55.750 --> 00:04:59.389
warn NASA. It's that organizations can slowly redefine what they
74
00:04:59.439 --> 00:05:04.189
consider acceptable until yesterday's warning becomes today's normal operating condition.
75
00:05:04.560 --> 00:05:10.009
And that is the central principle of failure mode. Catastrophes
76
00:05:10.089 --> 00:05:13.569
rarely require one enormous mistake. Sometimes they only require enough
77
00:05:13.629 --> 00:05:15.709
small failures to align.
