THEORY-140: The Columbia Accident Investigation Board found that the institutional causes of the Challenger accident had not been fixed and recurred in Columbia's: in both, evidence that the design was not performing as expected was repeatedly reinterpreted as acceptable, each decision seeming correct in itself and each survived anomaly justifying the next flight, while budget and schedule pressure, consensus sign-off, a hierarchy that kept dissent from rising and a safety organization dependent on the program it oversaw sustained the pattern for twenty years and undid post-Challenger reforms

Source

Columbia Accident Investigation Board (2003), chapter 8, LIT-734, read in NOTE-578. Vaughan’s book, LIT-715, on which the chapter draws for its central claim, is unread.

What was actually shown

The Board (LIT-734) compares two decision histories.

• The same trajectory. For O-ring erosion before Challenger and foam shedding before Columbia, the first decision accepted the deviation rather than eliminating it. Later anomalies that did not cause disaster were treated as data justifying further flights, the experience base expanding “as an elastic waistband”, and were classed “in-family”.
• Seen from inside. “Taken one at a time, each decision seemed correct.” The Board rejects the reading that NASA knowingly gambled as one “only possible in hindsight”.
• What sustained it. Strict budgets imposed by political sponsors; a shift toward a business with schedule and cost goals raised to the level of safety; consensus sign-off that “renders no one accountable”; a reversed burden of proof, under which engineers had to show a flight was unsafe; dissent that did not surface; and safety staff dependent on the program they supervised.
• Why “history is cause”. Post-Challenger reforms were undone by management over time, and the institutional causes of Challenger “have not been fixed”.

The case could have come out otherwise: Columbia’s foam decisions might have followed a different path from Challenger’s O-ring decisions, or the post-Challenger reforms might have held. The Board found neither.

What this does not say

• Not that individuals are excused. The Board says individuals “always must assume responsibility for their actions”, and that replacing personnel would not fix the problem.
• Not that NASA chose to gamble. The deviation was normal from inside.
• Not that all constraints were NASA’s own. They “were not entirely of NASA’s own making”.
• Not one unchanged mechanism. The Board finds that Challenger’s institutional causes were not fixed and that related failure mechanisms recurred, not that one cause sat unaltered between the accidents (CASE-138).
• Not a general theory. It is two cases in one agency; the general account is Vaughan’s, and the record has not read it. Whether it is one is QUESTION-334.

Connections

• Drift to the boundary (THEORY-144). Rasmussen’s activity migrates toward the safety boundary under cost and effort gradients, and eroded defences go unseen because a single breach has no visible effect. The Board’s case fits that picture, and adds the mechanism by which the breach is seen and reclassified as normal. No relation is declared; the record has not checked whether either text cites the other.
• Defensive routines (THEORY-145). Argyris’s routines make an inconsistency undiscussable. The Board describes engineers who did not speak up and a hierarchy that blocked information, but attributes it to structure and to signals from leaders, not to individual theories-in-use. Related results, different mechanisms.
• Exploration and exploitation (THEORY-142). March’s competency trap and the Board’s normalization both turn past success into evidence for continuing. The Board does not use March’s framework.
• The owner’s essay. §5.4: a regime in which each surviving anomaly justifies the next flight reproduces the conditions that justify it. §8.4: the Board’s remedy is externalized governance, a safety organization independent of the program.