Observations on the Columbia Accident

First, some background so you can evaluate and put my remarks in context. In the past 23 years, I have been involved with safety-critical projects in just about every industry.1 For example, I helped Ontario Hydro in Canada get the first nuclear power plant digital shutdown system certified and have similarly worked with the NRC in the U.S. and the IAEA (International Atomic Energy Agency) to establish standards for certifying nuclear power plants. I have been involved in some way on almost every attempted air traffic control system upgrade in the U.S. since the mid-1980s. I have been involved in various ways on all types of NASA and DoD (Navy, Air Force, and Army) projects. I even consult with Disney on amusement park ride safety. I have been teaching safety engineering in universities and in industry for two decades. I have been recognized for my activities both by the academic research community and by working engineers. While these remarks are obviously only my own opinions and observations, they are grounded in extensive experience. With that introduction, let me start by saying that over the years I have never seen anything but the highest commitment to safety at all levels in NASA. The cultural problems at NASA do not include a disregard for safety or the type of complacency that can be described as the “Ford Pinto” attitude that cost-benefit analysis is a reasonable way to decide safety questions, i.e., that deaths are acceptable if the cost of preventing them exceeds the cost of dealing with the consequences. NASA engineers and management are almost obsessive about safety. They are, in addition, among the most dedicated to and excited about their jobs in the world, and I am honored to have the opportunity to interact with them. But as we learned from the ICBM systems in the 1950s (where system safety first arose as an engineering discipline), a commitment to safety is not enough: Achieving high levels of safety requires a planned, disciplined, and systematic approach to identifying, analyzing, and controlling hazards by building safety into the design from the very beginning and continuing to control hazards throughout the entire life cycle of the system. The complexity of the manned space program and other NASA missions is overwhelming and management of safety is critical. A second observation that I have involves outside “experts” who are not engineers and have never worked on a safety-critical engineering project claiming after a widely publicized accident that certain things that preceded it—particularly heated discussions about the safety of particular aspects of the system—are somehow precursors of accidents in general and reflect negatively on the safety culture of the organization. This is what Dave Woods calls hindsight bias and others have referred to as 20/20 hindsight. It is always easy after the fact to see the full ramifications of a problem or to ascribe special characteristics to what is in reality standard behavior. In virtually all of the safety-critical projects over the last 23 years in which I have been involved, there was continual discussion and disagreement about the safety of many specific aspects of the project. In just the past few months, I have been copied on emails every week (and sometimes every day) between NASA engineers on (unmanned) spacecraft projects strongly arguing detailed engineering decisions about which they feel passionately. Usually they only want my moral support and a