- The U.S. Navy has been criticized after a series of tragic accidents at sea.

Ships from the US Seventh Fleet were involved in four collisions in one year.

The incidents which included colliding with a cargo ship and an oil tanker caused the deaths of 17 sailors.

- The Navy found that the accidents resulted from overconfidence, complacency, and an accumulation of small errors over time.

And they cited a theory that sheds light on how these kinds of disasters can happen.

It's called the Normalization of Deviance.

And it's an understanding that came from one of this country's most tragic accidents; the explosion of the Space Shuttle Challenger.

(static voice on radio) - [Ground Control] T minus ten, nine, eight, seven, six, we have main engine start (engine roars) four, three, alright, and lift off!

Lift off of the twenty-fifth space shuttle mission and it has cleared the tower!

(crowd exclaims) (static voice on radio) - Roger roll, Challenger.

Roll program confirmed.

Challenger now heading down range.

(crowd exclaims) Engines begin throttling down now at 94%.

Velocity 2257 feet per second.

Altitude 4.3 nautical miles, downrange distance 3 nautical miles.

- Challenger, go a throttle up.

- Roger, go to throttle up.

(explosion) (crowd exclaiming in Spanish) - Flight controllers, here looking very carefully at the situation.

Obviously a major malfunction.

- [Man In Crowd] Major malfunction.

- We have no down Lee.

The boys from the Flight Dynamics Office indicate that the vehicle apparently exploded.

- [Woman In Crowd] What?

- [Man In Crowd] The vehicle has exploded!

- We're looking at, uh, checking into recovery forces to see, uh, what can be done at this point.

- [Woman In Crowd] What?

- [Man In Crowd] The vehicle has exploded.

- [Woman In Crowd] Oh, please.

Don't say that.

(people exclaiming in various foreign languages) - [Larry] Up until the Challenger accident NASA was a very untypical government agency.

We were inventing as we went along, so you had a lot of freedom.

- It was viewed internationally as a fantastic place.

The Apollo missions gave it an aura of invincibility.

- [Reporter] Four minutes and twenty seven seconds to go before the start of this historic mission.

- [Narrator] The year was 1981 and NASA was about to amaze the world with Columbia, a new spacecraft that pushed the limits of imagination.

- [Reporter] They never before have sent a spacecraft into orbit that is going to come down as a plane.

- [Narrator] Instead of using a single rocket like Apollo, the shuttle was attached to an external fuel tank and two solid rocket boosters.

Each of the boosters was constructed of joined metal tubes and the fuel joints were sealed with two rubber gaskets called O-rings.

- [Reporter] Look at those huge engines getting ready to catapult this strange assemblage off the earth.

- [Narrator] But all this technology wasn't cheap and NASA had to come up with a new funding model.

So, Congress and NASA decided the Shuttle Program could pay its way by carrying payloads into orbit.

- The Department of Defense, private contractors that wanted experiments done in space would pay them to take them up on the shuttle.

- [Narrator] And unlike Apollo, the shuttle system was going to be almost entirely reusable.

- They had to return this hardware back into space as rapidly as they could.

It wasn't long into the program they realized that that process was far more difficult than they ever anticipated.

- They were under constant pressure to launch.

- T minus ten, nine, eight... - [Reporter] I'm getting a few butterflies myself right now.

- [Man] We got the main entrance done.

We have- (static) (viewers screaming) - [Narrator] Colombia was a fantastic success, but NASA had to figure out how to make these technological feats from team.

- They predicted in the beginning that they would be able to launch 60 shuttles a year.

That NASA would in fact become self paying, or self funded.

- We had two pads up and running, so you have two vehicles out on the pad, and they were going to launch like 3 days apart.

- But that really never happened.

It was an experimental technology, and they just couldn't manage that many, so they continually fell behind.

- [Narrator] The shuttle program never had more than 9 launches in a single year.

- [Man] We have a beautiful picture now coming through.

- [Narrator] And to help meet their ambitious schedules, NASA worked with private contractors to build many of the shuttle systems.

While NASA engineers analyzed data to see how well everything performed.

- NASA kept very good records of anomalies.

The problem is that they ran into a lot of these.

- [Narrator] One thing engineers saw was the O-Rings that sealed the booster joints weren't behaving according to design.

On several flights, especially those at cold temperatures, rocket propellant had blown by the primary O-Ring.

- The first time it happened, they accepted it.

They tested it, they thought they knew what had happened, and then the next launch everything worked, and then a few more launches and it happened again.

- [Narrator] But each time, the Secondary O-Ring prevented gases from escaping the side of the booster.

So rather than stalling the program to redesign the joint, NASA waived the requirements governing O-Rings which effectively made it acceptable to fly with minimal erosion.

- Even with the worst O-Ring erosion they'd ever have, it hadn't failed.

So, they started to work on it, but they really weren't rushing.

It didn't seem so terrible that they continually expanded the balance of acceptable risk.

- [Narrator] And then came the tenth Challenger launch, and a mission unlike any NASA had attempted before.

- They decided to make that the first flight that an ordinary citizen could fly, and that drew a tremendous interest from the public, plus the school systems were open to show this live on television.

- At this time I'd like to introduce you to perhaps the person you came to see, and that's Christa McAuliffe, Payload Specialist Teacher in Space.

- My job at the time of the Challenger was the director of the Space Shuttle Solid Rocket Motor Project from my company Mortin Thiokol.

- [Narrator] Mortin Thiokol was an engineering firm at a Brigham City, Utah, and had the NASA a contract to build the shuttle boosters.

- Well I am so excited to be here, and I just hope everybody tunes in on Day Four now to watch the Teachers Teaching in Space.

- [Diane] On the day before Challenger, there was an overnight load that was record breaking.

- Got a telephone call from one of the program managers back in Utah that worked for me, they said, "Al, we just heard that it might get down to as low as 18 degrees by tomorrow morning."

Good grief, I said, I'm really worried about these O-Rings seals being able to operate properly at those kind of temperatures.

- [Narrator] The mission had already been rescheduled after routine delays, so now Mortin Thiokol and NASA scheduled an emergency teleconference the night before the launch.

- [Diane] The engineers at Thiokol were very concerned, so they began scrambling to put together an analysis of temperature data.

- [Narrator] Larry Mulloy was NASA's project manager for the Solid Rocket Boosters.

- Then we went out to the teleconference, and Roger Beaujolais who was kind of the O-Rings R at Morton Thiokol did most of the talking.

The recommendation was that we wait until it's 54 degrees before we launch.

So I said something like, 54 degrees where?

- They had never drawn a temperature line before, and it meant a tremendous change into the shuttle's schedule.

- It isn't what they wanted to hear, in fact Larry made a comment, Thiokol when the hell do you want me to launch, next April?

- [Narrator] Thiokol's engineers at Utah were caught off guard by NASA's strong reaction to their recommendation, so they asked if they could have some time off the teleconference to review the data in private.

- After they went offline, Al McDonald was visibly upset, and he said, I wouldn't want to be the guy that had to appear at a board of inquiry if this thing blows, and I said, I understand that Al, and you won't have to.

It'll be me.

(sorrowful music) - At Thiokol, the vice president was asking those engineers to stand up for what they said.

Roger Beaujolais took the lead and the objections.

He said, "I can't prove it to you.

All I know is that it's away from goodness in our experience space."

But the engineers at Thiokol didn't have the data, so the Vice President took the decision making away from the engineers and asked the managers to decide.

- [Narrator] And they did.

More than 30 minutes after the engineers had gone offline, Thiokol managers voted to reverse the recommendation, and to launch the Challenger as planned.

The teleconference became a focal point for the White House appointed Roger's Commission, that investigated NASA after the disaster.

- There was not one positive statement for a launch ever made in that room.

- What was drivin' here?

What was to be achieved that caused you to go?

- NASA pressured the folks at Thiokol to change their mind, and it was clear to me that we finally came back and gave them what they wanted to hear.

- Yeah, we'd be rationalizing this erosion since the second flight.

- None of the information that NASA managers were getting was new, this was not individuals getting used to something.

This was organizationally supported.

- That's where the accident was inevitable.

- [Narrator] Once Thiokol reversed their initial recommendation, someone needed to sign off on the launch rational.

- I get the smartest thing I ever did in my lifetime, I refused to sign.

I just felt it was too much risk to take.

- [Narrator] So just before midnight, McDonald's boss, Joe Kilmister signed off instead.

After the disaster, the commission concluded cold and joint design were major factors in Challenger's O-Ring failure.

It also squarely pointed a finger at NASA manager's like Mulloy.

- [Diane] The commission did recognize that there was pressure to launch.

That they saw as enacted by amorally calculating managers who were in positions of responsibility.

I found something completely different.

- So Vaughan began her own investigation.

- No one wanted this to happen, but intuition, you know, I don't feel good about this, should've been okay.

And they applied all the usual rules in a situation where they usual rules didn't apply.

- [Man] Four, three, two one.

(somber music) - We made a grievous error.

(somber music) - So the real crucks of the matter is how do you get people to recognize when you need to do something different than what you've been trained to do?

- [Narrator] After Challenger, the Roger's Commission prompted many changes at NASA, including an increase in the programs budget, adding a third O-Ring to the booster joints, and moving some managers, including Mulloy, out of the Shuttle Program.

- But there was nothing really about how to change the organization that came out of the commission report.

- [Narrator] And then in 2003, after NASA had completed 15-years of successful missions, came the 28th launch of the Space Shuttle Colombia.

- It seemed like any other launch, but on the second day, someone called me on the phone and said, "You've heard about the large piece of debris or foam that came off the tank and hit the left wing, caused a cloud, poof!"

I said, no I didn't.

- [Narrator] Colombia made it to orbit safely, but the concern was that if debris had caused damage to the left wing, it could be vulnerable on reentry.

So just days after the launch, NASA formed a special team to assess the damage.

- The decision to ask for more days that they'd need for it was unanimous.

- [Narrator] But management was worried about unnecessarily diverting Colombia from it's mission since foam damage had been generally considered to be nonthreatening, NASA manager Linda Ham denied pre requests to get pictures of the shuttle's underside from a nearby satellite.

- And they were all put down for different reasons.

The similarity between Challenger and Colombia with the falling back on routine under uncertain circumstances.

- [Narrator] In the end, NASA sent just one communication to the astronauts about the debris strike, and on February 1, 2003, the crew began their return to Earth.

(jingle music) (laughter) - Part of our engineering culture is that you should work to your chain of command.

I will regret always why I didn't break the door down by myself.

- [Man] And we're ready Willie, no deltas.

- [Man 2] Everything look good to you?

- [Man] I don't see anything out of the ordinary.

(static) - [Man 2] It's really bright out there.

- They had just started the de orbit burn.

They're coming down, and we started seeing temperatures changed higher on the left side versus the right.

- [Man] FYI, I just lost four separate temperature transducers on the left side of the vehicle.

- [Rodney] The anomalous data confirmed my worst fear.

(static) - [Man] Colombia to Houston, (inaudible) - [Rodney] I looked up and I saw one of our chief engineers in tears, we can't get the crew is what she said.

They'd been incommunicado.

(somber music) - It happened.

It happened.

(sorrowful music) - [Narrator] Colombia was destroyed on reentry.

After the disaster, Vaughan worked closely to the Colombia accident investigation board which concluded that NASA had ineffective leadership, and a flawed safety culture.

- We are quite convinced that these organizational matters are just as important as the foam.

- [Narrator] Ham's left the shuttle program, and NASA restructured it's management team.

- This happens in many different kinds of organizations.

I don't think that the general public got the position of, either Larry Mulloy or Linda Ham, and that their behavior was too great deal determine by working in a varied rule oriented organization.

(chimes) - [Narrator] Using our insight from NASA, Vaughan developed a theory that went beyond the space agency calling it Normalization of Deviance.

She says it helps explain how over time, organizations come to accept risky practices as normal.

- [Diane] It's widespread.

With Katrina, where the engineers were saying these structures are not going to hold, we need to do something more here, with British Pertroleum, early warning signs ignored.

- The senate used in the Gulf oil rig was flawed.

- [Diane] The 2008 financial failure.

- The Federal Commission concluded it could've been avoided.

- [Diane] You have a lot of heavy technology derivatives, and formulas, and there is a fine line between what is devious and what's a good business decision.

- [Narrator] And in 2017: - Two deadly accidents involving U.S. Navy ships.

- [Narrator] The U.S Navy sighted Vaughn's theory to help explain accidents that killed 17 sailors.

- We accepted this, what was termed Normalization of Deviance.

In other words, we allowed our standards to drop thinking we were still okay.

- We can never resolve the problem of complexity, but we have to be sensitive to your organization and how it works.

While a lot of us work in complex organizations, we don't really realize the way the organizations that we inhabit completely inhabit us.

(sorrowful music)