Disasters in the Making

Sherwood “Woody” Spring and Robert L. Tremaine

After almost every accident or disaster, the postmortem analysis invariably uncovers telling signs along a consequential chain-of-events leading up to the catastrophe itself. At a key point, there was a high probability that someone could have helped change the future. In two well-known cases, people spoke up but were overruled by senior management professionals exercising something far worse—their reluctance to think more critically, thereby falling victim to the likely catastrophic consequences. What if they had dug a little deeper and exercised more divergent thinking? What else did they fail to consider? This article addresses those “whys, “hows” and “whats.”

Learning Through the Forensics

When a major system has an accident or near accident, an investigation board convenes. Replete with subject-matter experts, this multi-discipline team hunts for the root cause and contributing factors.

After combing through what they have at their disposal (e.g., material, processes and interviews with personnel involved with both) they pursue multiple related questions in their inquiry: Why did the space shuttle explode? Why did the plane crash? Why did the nuclear power plant leak radiation? Why did the oil rig release hundreds of thousands gallons into the ocean? If the evidence points to a manufacturing pedigree issue, why did the part fail? Was it poorly designed? Were the design tolerances exceeded and why? Was there a manufacturing abnormality? Did counterfeit parts/material sneak into the assembly line? Did an unknown design defect finally materialize? On the other hand, if the basic cause was operator error, why did that error occur? Was it due to inadequate training, lack of currency, poor judgment, poor instrumentation or simply work overload? Did the previously unknown problem that materialized pose an immediate safety concern that was prematurely dismissed or discounted? Did the affected personnel understand the severity of the situation but have little time to fully assimilate the “fix” in a way that could overcome any impending danger? Was the operator impaired due to some sort of psychological trauma or physical illness?

Only after the possible root causes and contributing factors are fully understood along the chain-of-events can corrective measures be established to significantly reduce the risk of future recurrences. And more important, what was missing to promote deeper thinking to prevent the catastrophe in the first place? Who did what or why not?

The Missing Variables

Those of us in the acquisition profession who find ourselves on the training side of the equation have discovered what sometimes gets overlooked, or too hastily minimized all too often—the importance of critical thinking, and its inextricable link to ethical persistence. Aside from nurturing functional expertise, the need to reinforce both of these qualities couldn’t be more vital. In their absence, how can the professional Defense Acquisition Workforce who oversee the development, production and sustainment of weapons possibly ensure that they are lethal, safe and give our war­fighters the competitive advantage they deserve in the battle sphere? Our experiences as practitioners alone constitute a rather convincing argument as far as an ideal training principle goes to meet that end. As simple as it sounds, it’s all about conditioning our students to ask the “whys” and “hows” back in their respective workplaces, and thereby more fully prepare them for unattended consequences. Rarely will you find a course or workshop at the Defense Acquisition University (DAU) without some combination of both. Critical thinking and ethical considerations are carefully woven into many of these learning opportunities along with the necessary functional focus. More and more though, DAU is driving its students to think more about their own thinking (AKA metacognition), by asking a lot of “whys” well before they ever get to the “hows” and “whats.”

As simple as it sounds, it’s all about conditioning our students to ask the “whys” and “hows” back in their respective workplaces, and thereby more fully prepare them for unattended consequences.

Striking the Learning Chords in Class

In a DAU classroom, the colorful NASA videos and slides of nominal mission profiles and life on orbit demonstrate the marvel of space travel, notwithstanding the inherent risks. However, using the NASA Space Shuttle Challenger and Columbia accidents as the medium for a facilitated discussion quickly magnifies the potential perils. Traveling at speeds fast approaching 25 times the speed of sound is clearly a wonder albeit a treacherous one. For Challenger, 73 seconds after it launched on its 10th voyage in January 1986, an O-ring failed causing one of two Solid Rocket Booster struts to pivot, rupturing the external fuel tank. Tens of thousands of gallons of fuel cascaded into a white-hot exhaust. Challenger was gone.

During Columbia’s Feb. 1, 2003, liftoff, a briefcase-sized piece of foam insulation peeled away from the external fuel tank. At about MACH 2.5, that fragment struck and shattered the carbon epoxy leading edge of Columbia’s left wing. Days later, upon re-entry, part of the thermal protection on the leading edge of the left wing vanished, enabling a jet of hot plasma gas that literally melted the critical wing structure and its embedded sensors. Columbia was gone.

At NASA, the risks were well known. Theoretically, what could go wrong is considered in every case. Backed by empirical evidence afterward, a finding of what actually goes wrong, what could have been done and what should have been done generally leads to something more obvious as seen in both tragedies. The forensics for these disasters provide a well-documented account of the more dominating leadership decisions at all levels. Did NASA’s leadership back on Earth that these two crews trusted discount the telling signs of a potential disaster? Whatever environmental and cultural pressures reduced their natural propensity to think more critically in the context of ethical persistence helped shepherd a more heartbreaking destiny along the causal chain of events.

During class discussions (with 20/20 hindsight), most students fervently agree that neither accident should have occurred. Students start asking, “What were they thinking? How could they ignore the clues? Why didn’t they take any action?” No one intentionally ignored the signs. However, both accidents appeared to simply represent leadership imprudence and reluctance to challenge their own beliefs or accept the recommendations from others. A shortage of critical thinking and ethical persistence sprinkled with group think, cognitive bias, conation and maybe a bit of hubris allowed these two accidents to occur. There are many ways to depict it. Figure 1 illustrates one particular way that highlights the susceptibility of our declarative knowledge in addressing “why” individuals decide to act (or not) and where ethical persistence should enter the decision loop but may not do so.

One technique that NASA and the testing community frequently employs is the 60-Minutes Challenge by assuming the worst consequence (e.g., destruction, severe injury or death) relating to the situation or problem under consideration. Imagine a “60 Minutes” reporter with a microphone rushing toward you, demanding: What did you know, when did you know it, and what did you do about it? It’s time to defend your action or absence thereof. The 60-Minutes Challenge promotes more critical thinking, ethical persistence, and the likelihood of any accompanying regrets.

Two Hypothetical Situations to Consider

Nothing stirs curiosity and challenges our own behavior more like these cataclysmic disasters when it comes to influencing the action we would take next, especially when we think about our role and action in the chain-of-events. The test community is no stranger to these scenarios. They face them with regular frequency when a system finds itself at the outer edges of its operating envelope. Although the following two scenarios are fictitious, they serve to test our own resolve along these salient lines:

• What will I do if or when I am placed in a similar situation?
• Will I take the time to think more deeply, and act accordingly to break the chain of events and prevent something like this from happening on my watch, and how far will I go?
• Is ethical persistence part of my decision equation?

Scenario 1

You are the Test Lead on a Foreign Military Sale (FMS) for a Fourth Generation Fighter involved in the development testing for a modification at the customer’s request. As a part of the sale, the customer wants the Fighter certified for operations at Mach 3. The aircraft can do Mach 3, but is not designed for sustained operations there. You already know that an aircraft traveling at these kind of speeds generates excessive temperatures. Its kinetic energy converts to tremendous heat through compression and friction. After the flight test, you notice that the air inlet became deformed and the canopy was still too hot to touch after the flight. Both developments raise safety concerns. In your view, the system failed the test, luckily without a catastrophic result. When test results are sent to the program office, the staff there let you know that they don’t plan to share the results since they firmly believe that the FMS customer would never fly at Mach 3. You wonder why and ask. Your program office counterpart said that he will document what you sent and that “should be good enough.” But that’s not good enough for you. You contact your 0-6 and explain your concerns. She says that she’ll follow up, and take it from here. A couple of months go by, and you later find out that the sale went through. Your curiosity compels you ask your O-6 if the FMS customer was notified of the limitations. She said they have what they need to know, and you decide that’s good enough. What do you do?

• Stop testing because the data are good and you trust the team?
• Keep testing because the program manager needs the data and hope nothing bad happens?
• Raise your concerns to the program manager and the base safety officer to get another look at the test cases with aviation safety in mind?

Scenario 2

You start noticing signs that your chief test pilot might have a drinking problem. Occasionally, he shows up at work late smelling of spirits and seems a little unsteady. You’re concerned about his safety and that of others around him whenever he’s in the air. Until now, you’ve modeled your behavior after him. He is a highly decorated veteran of two wars and has logged more than 10,000 flight hours and 200 combat sorties. He is a legend within the fighter community and one of the humblest officers you have ever encountered. If you speak up, you might ruin his career and maybe call to attention to your own if you’re wrong. What if it’s not alcohol you smell? You are in charge and responsible for your team. You decide to speak to your supervisor, and he says he’ll check it out. A month goes by, and you haven’t seen a change. The smell of spirits is still prevalent. Your orders come through for your next assignment to the Pentagon. What do you do? Some choices:

• Ignore the situation, keep flying and hope nothing goes wrong.
• Hold off doing anything because he is an experienced test pilot and you don’t want to jeopardize his career.
• Confront him as the concerned test lead and own the problem. Challenge his behavior and your concerns, and take any appropriate action.

The day before you depart, the chief test pilot has a Class A mishap. His aircraft is totaled, and he is killed. There is talk that he failed to eject. In both cases, what did you know, when did you know it, and what did you do about it? If you did nothing, or decided to transfer “ownership responsibility” to someone else or someone more senior, yet you believe they did not act as you would have, what inhibited further action on your part? Was it a lack of consideration for more critical thinking, and its inextricable link to ethical persistence when it mattered the most? When fully invigorated, these are powerful combinations to meet the challenges required by more rapid acquisition pursuits riddled with risk as well as time-urgent operational demands saturated with danger.

Summary

If we relentlessly employ more critical thinking along with the tenacity of ethical persistence, the decisions that warrant both will go well beyond acting on declarative knowledge alone. Without experiencing these challenges and failures through hands-on learning simulations in class, the acquisition workforce is more likely to experience them for the first time, which might be too late. NASA had no shortage of technical experts. Seemingly, they may have run short of ethical persistence. Both failures didn’t live in the technical world. They lived outside it. More recently, Boeing Aircraft Corporation faced a test of its own. When Boeing could have taken “reasonable precautionary measures” to immediately ground the 737 MAX 8 aircraft after the second crash, it chose not to. If two relatively new airplanes of the same model crash shortly after each other under what appears to be under similar circumstances, why did regulators need to wait until they knew for sure what caused the crashes before they took action? As a regulator, what would you have done to be more critical and ethically persistent? More important, what will you do next time as an acquisition professional in your role along the causal chain of events, especially when the life of others could be placed at risk?

Read the full issue of
Defense Acquisition magazine

SPRING, a graduate of West Point and former test pilot and NASA astronaut, and program manager, is a professor of Engineering, Test and Evaluation, plus Science and Technology Management at the Defense Acquisition University (DAU) West Region in San Diego, California. He is also a chief learning officer for all Western Ranges and a regional executive coach.

TREMAINE is the Associate Dean for Outreach and Mission Assistance where he is responsible for providing a wide variety of time-urgent workplace solutions for defense acquisition customers in the West Region of DAU. He holds DAWIA Level III certifications in Program Management and in Systems Planning, Research, Development and Engineering (SPRDE) functional areas, and is an instructor, course manager, mentor and leader in various capacities. He holds a Bachelor of Science degree from the United States Air Force Academy, and a master’s in Research and Development from the Air Force Institute of Technology (AFIT).

The authors can be contacted at [email protected] and [email protected].

The views expressed in this article are those of the author alone and not the Department of Defense. Reproduction or reposting of articles from Defense Acquisition magazine should credit the authors and the magazine.