Normalization Of Deviance

An astronaut's tale of readiness

By Mike Mullane

On the morning of August 30, 1984, I was scared. Terrified, really. I was strapped into the cockpit of the space shuttle Discovery, minutes from my first flight into space. Most of the public would have been surprised to hear of my fear. For the past two years, since the fourth shuttle mission had landed, NASA Headquarters had been telling the media that the shuttle was no longer “experimental” but rather “operational,” a title that implied the machine was nothing more than a very high flying 747.

Photo Courtesy of NASA

The public had been lulled into believing the great risks of spaceflight were a thing of the past. Fear in the cockpit? They wouldn't have believed it. But I was a former Air Force flyer with 1,500 hours in the back seat of the F-4 Phantom. In my ten-year flying career, I had read the accident reports of countless military jet crashes and had buried a number of friends who had died in some of those crashes. If we couldn't build flawless jets, I reasoned, how much more difficult must it be to build a flawless spacecraft of the complexity of a space shuttle? In spite of NASA Headquarters pronouncements about the shuttle being “operational,” I was scared.

At T-6 seconds, the three space shuttle main engines (SSMEs) were commanded on by computers. The cockpit shuddered violently. Nearly 1.5 million pounds of thrust were tethered to earth by explosive bolts. Only if the ship's computers determined the engines were operating nominally would those bolts be blown and the command issued to ignite the twin solid-fueled rocket boosters (SRBs).

Lift off
Three...two...one...The SSME health check was nominal. A new violence of noise and vibration swept over us as the SRBs fired and Discovery leaped from the earth on 7.5 million pounds of thrust.

I watched shadows move across the cockpit as Discovery pirouetted in a “roll program” and began a slow pitch-over toward the risen sun. A minute into flight, the cockpit was rattled with a new wave of brutal vibrations, this time from the sonic waves being generated by flight through the sound barrier.

At about 25 miles altitude, there was a loud “bang” in the cockpit and a whip of fire across the windows as the expended SRBs were jettisoned. They would parachute into the Atlantic and be retrieved by tug boats to be used again.

Now, only the liquid-fueled SSMEs were running. They had to perform perfectly for the next 61_2 minutes to get us to our final orbit altitude of about 250 miles and a speed approaching 5 miles per second. I prayed they would do so. It was these engines that astronauts most feared. Each consumed 500 pounds of propellant per second. The turbo-pumps that rammed this fuel into the combustion chambers ran at hellish pressures, temperatures and RPMs. Continuous helium purges were needed to keep dangerous gases from mixing and causing an explosion. Countless welds in a maze of tubing had to withstand temperatures that varied from cryogenic cold to thousands of degrees hot. It was easy to imagine a catastrophic failure in any number of the components that made up an SSME. It wasn't a hypothetical worry. Astronauts had been briefed on many SSME test stand failures and explosions. Of course, for the first two minutes of ascent our lives had been attached to the two booster rockets, but we hadn't given them a second thought. No engineer had ever come to an astronaut meeting to explain away an SRB failure. The boosters were the essence of simplicity—just big steel tubes filled with solid propellant. They always worked.

Dodging a Bullet
None of us aboard Discovery would know it until after the Challenger disaster, but one of our boosters had betrayed us. At some point in its burn, one of the flexible O-rings that sealed the segmented joints of the SRB had failed to make that seal. For the briefest of moments, probably just a fraction of a second, 5,000ß F gas, at a pressure of nearly 1,000 psi, had wiggled past a primary O-ring and been stopped by the backup O-ring. We had experienced what engineers would ultimately call the first case of “blow by.” We had narrowly missed the same death that would claim Challenger and her crew in 1986. As it turned out, we weren't the only crew to have dodged the O-ring bullet.

After the boosters were recovered from STS-2 (the second space shuttle mission), engineers had seen significant damage to one of the booster O-rings. Because the SRBs are so large (150 feet long, 12 feet in diameter and 1.2 million pounds), they cannot be transported as a single piece. They have to be constructed in four propellant-filled segments that are transported separately to Kennedy Space Center, where they are stacked and bolted together. Redundant O-rings seal each segment joint. Since the O-rings had previously been given a “Criticality One” rating, the observed damage from STS-2 was cause for grounding the shuttle program. (A Criticality One rating was attached to shuttle components, the failure of which would cause vehicle loss and crew death. O-ring failure would result in the leak of 5,000ß F gas and vehicle destruction.)

However, the NASA team was under tremendous schedule pressure. The shuttle had been sold to Congress as a means of getting into space at a fraction of the cost of other launchers, and the key to that efficiency was a rapid turnaround of the vehicles, on the order of just two weeks. The four-shuttle fleet was to fly 20-plus missions a year. Under pressure to not only maintain the launch schedule but rapidly expand it, the shuttle team looked for a way to continue flight operations even with a Criticality One design violation. When a laboratory test of an O-ring that was intentionally damaged (to a degree greater than the STS-2 O-ring) revealed that it could maintain three times the expected flight pressure, NASA decided it would be okay to continue flight operations. Post-Challenger investigators would later show that this was the first step in a four-year process known as “normalization of deviance.”

Normalization of Deviance
When the next several flights flew without O-ring anomalies, the correctness of the decision to continue operations was reinforced. Over the following several years, more cases of O-ring sealing problems were observed in the returned SRBs, but it became harder and harder for the team to accept what they were seeing as a grounding anomaly. The team had “gotten away with it” so many times, the O-ring deviance had been normalized into its decision-making process. This, in spite of the fact that some SRB engineers were predicting disaster, as in these words written by a contractor engineer six months prior to the Challenger tragedy: “It is my honest and very real fear that if we do not take immediate action to solve the problem with the field joint (the O-ring) having the number one priority, then we stand in jeopardy of losing a flight along with all the launch pad facilities.”

Even warnings such as these could not reverse the normalization of deviance that was occurring. On January 28, 1986, both the primary and backup O-rings on the bottom segment joint of the right side SRB failed during the launch of Challenger. Seventy-three seconds into flight, the vehicle was destroyed and the seven member crew was killed. While many people refer to Challenger as an accident, it was not. Challenger was a “predictable surprise” precipitated by a multi-year normalization of deviance.

Every team and every team member is vulnerable to a normalization of deviance in their operations. When was the last time you took a break to see if you are infected? Are pressures (schedule, budget, family distractions, etc.) causing you or people within your organization to cut corners in safety or other areas? Are they oblivious to the deviance of their actions because they have gotten away with it so many times in the past? It's time for a “normalization of deviance” check.