Shifting Baselines: The Story of STS-27 and Its Effect on NASA’s Safety Culture
How the near-loss of a Space Shuttle caused an organizational decay within NASA, and directly led to one of the largest disasters in space history.
Picture this — you’re behind the wheel of a car for the first time. You’d probably drive very cautiously at first, fastidiously obeying all the road laws and speed limits as you went. But as you get more confident, you might start to speed a little here and there, maybe start merging without your blinkers, and before you know it, those road laws are less “hard-and-fast rules” and more “suggestions.”
I’m sure this story is relatable to anyone who has learned how to drive. But what if, instead of driving a car, you were responsible for a multi-billion dollar spacecraft — and more importantly, the lives of the astronauts on board? Surely you would take things more seriously, right?
Unfortunately, things don’t always work out so nicely. Sometimes, even the best and most professional organizations can fall victim to this mentality — and suffer the consequences of it.
“Once lucky, twice confident, and thrice dead.”
~Terry Goodkind
To tell that tale, we must start on December 2, 1988. At Kennedy Space Center in Cape Canaveral, Florida, the Space Shuttle Atlantis sat on the pad, ready to depart. This launch, STS-27, would be Atlantis’s third flight, and the twenty-seventh Space Shuttle flight overall. Onboard were five astronauts, commanded by Robert L. “Hoot” Gibson. Their mission was to deploy a classified payload (later revealed to be a Lacrosse-1 reconnaissance satellite) on behalf of the United States Department of Defense.
At 9:30 AM, with a furious roar, Atlantis leapt off of the pad for her eight-and-a-half minute ride to orbit. As the Shuttle thundered skywards, everything seemed normal. However, Atlantis and her crew were about to fall victim to a flaw inherent to the Space Shuttle’s unique design.
Unlike prior spacecraft, which were just a capsule on top of a larger rocket, the Space Shuttle stack was made up of three main components. The large orange external tank (ET), which held fuel for the Shuttle’s three main engines; attached to either side of the tank were the two solid rocket boosters (SRBs); the orbiter, which housed the crew and payload, was then bolted onto the front of the ET.
This arrangement was unlike any previous rocket, and created a new danger: debris strikes. The orbiter’s position relative to the ET and SRBs meant that it was possible for a chunk of debris to fall off of the other parts of the stack and strike the Shuttle itself. This phenomenon had been observed on the very first Shuttle launch, and again on almost every launch since, but had never been seen as a safety risk; it was only ever seen as an issue for post-flight maintenance, as the orbiter would need to be inspected for damage.
And now, it was about to happen to Atlantis.
At around T+85 seconds, a piece of insulating material from the right-hand SRB’s nosecone broke off and struck Atlantis’s right wing. While it didn’t appear to cause any issues with the flight, and the launch was otherwise perfectly normal, NASA decided to err on the side of caution. Once Atlantis reached orbit, the astronauts would use the camera on the end of the Shuttle’s robotic arm to inspect Atlantis’s belly and ensure that there was no damage.
And what the astronauts saw astounded them.
Atlantis’s Thermal Protection System (TPS) — a series of over twenty thousand heat-resistant tiles on the underside of the Shuttle — had been mauled by the debris strike, with many tiles chipped or broken by the impact. This posed a serious danger to the crew; if the TPS was sufficiently damaged, Atlantis would disintegrate as it re-entered Earth’s atmosphere.
However, Mission Control in Houston, Texas, disagreed. Due to the classified nature of the mission, the astronauts were forced to use an encrypted form of data transmission to send the images of Atlantis down to Earth. This greatly reduced the resolution of the pictures, causing NASA to believe that the tile damage was an optical illusion or “just lights and shadows.” Besides, this had happened on almost every previous Shuttle launch, so there was nothing to worry about.
The astronauts were greatly angered by NASA’s apparent indifference, with many of the crew believing that they were going to die during re-entry. Nevertheless, they went about their duties, and after four days in space, the time came for Atlantis to return home.
As Atlantis descended towards Earth, still travelling at orbital velocities, it created a massive amount of friction with the air in the upper atmosphere. This friction, in turn, generated a huge amount of heat, which formed a sheath of plasma around the orbiter that reached temperatures of over 3,000 degrees Fahrenheit. The astronauts could do nothing but wait and see if the TPS would hold against the assault. One astronaut saw what he believed was molten aluminum streaking over Atlantis’s nose, while Commander Gibson prepared to “tell Mission Control what he thought” of their earlier assessment should his instruments indicate that the Shuttle was disintegrating.
However, to everyone’s relief, Atlantis held together, and half an hour after re-entering the atmosphere, the Shuttle landed at Edwards Air Force Base in California.
When NASA finally got the chance to inspect Atlantis, they were utterly shocked. Their assessment that the TPS damage was merely a trick of lighting had been completely incorrect. Over seven hundred tiles had been damaged by the debris strike, and one tile was missing entirely. The only thing that had prevented a catastrophic failure of the Shuttle’s structure had been the fact that the missing tile had been directly over a mounting plate for a navigation antenna; the plate had taken the brunt of the damage, sparing the more vulnerable structural components underneath. Atlantis was, by a considerable margin, the most damaged spacecraft to ever enter Earth’s atmosphere safely, and her crew had emerged unharmed by a whisker.
But NASA seemed rather unconcerned. The commission appointed to investigate the near-disaster concluded that, while the damage to Atlantis was unusually severe, it wasn’t a major issue. After all, debris strikes had occurred on nearly every Space Shuttle launch, and Atlantis made it back even when she had been damaged beyond anyone’s expectations. It was therefore concluded that there was no flight safety risk to the Shuttle from debris strikes, and that, at worst, it would lead to a few additional weeks of fixing tiles after the mission concluded.
While this conclusion may be true on the surface, it goes without saying that it was dangerously incomplete. NASA appeared to be so caught up on the fact that Atlantis had returned safely despite the damage — no doubt a testament to the robustness of the Shuttle’s design — that they missed the more important point: Debris strikes could jeopardize the orbiter’s ability to re-enter Earth’s atmosphere safely.
As a result of this overconfidence, no changes were made to either the design of the Shuttle stack or the launch procedures. For another fifteen years, the Shuttle flew without further incident, although the debris strikes continued with alarming regularity. However, NASA’s luck would eventually run out in the worst way possible.
On January 16, 2003, Space Shuttle Columbia launched with seven crew members aboard to conduct scientific experiments in orbit. At first, the mission, STS-107, proceeded as normal. However, at T+81.7 seconds, a piece of foam from the ET broke off and struck the leading edge of Columbia’s left wing.
NASA was, once again, unconcerned. After all, this had happened so many times before, and the Shuttle had returned safely every time. There was no way that anything could possibly go wrong, right?
Unfortunately, things went very wrong. After two weeks in space, as she re-entered Earth’s atmosphere on February 1, 2003, Columbia broke apart, killing all seven astronauts on board. The debris strike on launch had punched a hole through one of the TPS tiles on the leading edge of the orbiter’s left wing. This left a massive hole for super-heated gas and plasma to enter Columbia’s internals.
And unlike on STS-27, there was no mounting plate underneath the failed tile to take the heat off of Columbia’s structural components. The Shuttle’s wing eventually failed under the strain, causing the orbiter to tumble out of control before disintegrating.
The resulting investigation concluded that, while the proximate cause of the Columbia disaster was the debris strike and resulting wing damage, it was brought about by the slow decay of NASA’s safety culture and attitude towards debris strikes.
Debris strikes had occurred with such regularity that NASA had come to see them as a regular part of Shuttle launches, a hassle that they would have to deal with later — an attitude that was reinforced by Atlantis’s safe return on STS-27. This caused them to discount the possibility that these strikes could compromise the Shuttle’s ability to re-enter the atmosphere safely; NASA believed that since it had happened before without any consequences, there would never be any adverse effects.
This was a prime example of what sociologists term the “normalization of deviance.” Whenever out-of-the-ordinary, or downright unsafe practices do not immediately result in catastrophic failure, these practices come to be seen as a “new normal.” However, as NASA learned the hard way, just because nothing happened the first, second, or even the seventy-ninth time, it does not mean that the procedures in place are safe; you could just be getting lucky.
Over time, this can create a culture of turning a blind eye towards possible issues — an attitude which slowly erodes at an organization’s ability to operate safely. By the time of the Columbia disaster, the baseline of safety within NASA had shifted to the point that they were willing to overlook a major safety risk just because it had happened before without issues, resulting in an oversight that would have fatal consequences.
Ultimately, this tragedy spurred NASA to take some long-overdue action. The design of the ET and SRBs was revised to minimize the risk of debris strikes, and procedures were put in place to ensure that damage to the TPS could be detected early in the mission, and a rescue plan could be mounted should the damage be dangerous. The Space Shuttle continued to fly until 2011, when Atlantis touched down at Kennedy Space Center for the final time. Additionally, NASA created new reporting procedures at every step of the launch process to ensure that any safety concern — no matter how small it may seem at first — could be addressed before it became normalized.
This saga of organizational decay holds a valuable lesson for anyone who works with any level of risk — that no deviation from standard operating procedures is ever acceptable, regardless of how inconsequential it may seem. Whether we work on a factory floor or on a space station, we must all be vigilant to the insidiousness of the “normalization of deviance” and take proactive steps to combat it — for there is no such thing as “going too far” in the pursuit of safety.
