Contents
About 82 seconds after liftoff, a piece of foam broke off the external tank of the space shuttle Columbia and struck the leading edge of the left wing. That was on January 16, 2003. Sixteen days later, the shuttle broke apart on reentry, killing all seven crew members. In between lay just over two weeks in which people at NASA sensed that something was wrong – and in which that doubt never reached the place where decisions were made. An example of the Team Principle of Safety.
A Familiar Kind of Strike
Situation
Columbia lifted off on mission STS-107 at 10:39 a.m. local time. The foam strike was not noticed until the second day of the flight, when the launch footage was reviewed. On January 21, a debris assessment team convened, with engineers from NASA, Boeing and United Space Alliance. It was co-chaired by Pam Madera and NASA engineer Rodney Rocha. Foam shedding had occurred on earlier flights, too. It had come to seem routine.
Connection to the team principle
This is the first trap. A fault that has often done no harm eventually comes to be seen as normal. Anyone who still calls it a danger is then contradicting not just one assessment but the experience of the entire organization. That makes doubt costly before anyone has even voiced it.
Three Attempts to Get a Picture
Situation
The engineers wanted images of the wing from military reconnaissance assets. There were three attempts: on January 17, on January 21, and on the same day in an email from Rocha to his superior. Rocha wrote, in essence, that without better images the problem could not even be narrowed down. On January 22, Linda Ham, chair of the Mission Management Team, learned of the requests. She checked who had a formal requirement for the images, found none and had the Defense Department’s preparations halted after about 90 minutes. No one consulted the debris assessment team.
Connection to the team principle
No one forbade the engineers to speak. But their doubt did not fit any official form. It had no formal sender, so it was treated as if it did not exist. That is how an organization can dismiss concerns without anyone ever having rejected them. The investigation board explicitly blamed culture and structure for this, not individuals.
The Email That Was Never Sent
Situation
Rocha drafted another email. In it, he described the decision to forgo images as bordering on irresponsible. He showed the draft to colleagues but never sent it – he did not want to go around the chain of command.
Connection to the team principle
This unsent message is the image that captures the whole principle. The knowledge was there. The concern was there. Even the words had already been written. What was missing was the safety to send them up the line. In a 2006 study of 23 neonatal intensive care units, Ingrid M. Nembhard and Amy C. Edmondson showed that people of higher professional status feel psychologically safer than others – and that inclusive leadership can even out this gap. The board’s report itself does not use the term “psychological safety”; that interpretation came later. But it describes exactly the gap between drafting a message and sending it.
Reassurance Instead of Scrutiny
Situation
On January 23, flight director Steve Stich told the crew by email that there was no reason for concern; foam strikes had happened before. On January 24, the Mission Management Team heard a summary: no burn-through was expected, only extra maintenance work. At the last meeting, on January 31, the strike barely came up. On February 1, 2003, radio contact was lost at 8:59 a.m. Rick Husband, William McCool, Michael Anderson, Kalpana Chawla, David Brown, Laurel Clark and Ilan Ramon were killed.
Connection to the team principle
The higher the information traveled, the calmer it became. “We can’t assess it” turned into “no reason for concern.” Where doubts may not be voiced, they do not shrink – they simply disappear from the minutes.
Who Has to Prove What?
Situation
On August 26, 2003, the investigation board led by Admiral Harold W. Gehman presented its report with 29 recommendations. Alongside the technical cause, it identified organizational causes and compared NASA’s culture with the culture before the 1986 Challenger disaster. It counted at least eight missed opportunities to detect the damage. Its central finding: the engineers had to prove that the situation was unsafe – a reversal of the usual obligation to demonstrate safety.
Connection to the team principle
This is the sharpest lesson. In a safe team, a well-founded doubt is enough to trigger a review. In an unsafe one, the doubter must first supply the proof – for which they would need precisely the means they are being denied. Whether images would have saved the crew is an open question; rescue and repair scenarios were never more than hypothetical. Only one thing is certain: the organization did not learn until the disaster struck.
Key takeaways
Key Lessons
- Reverse the burden of proof. It is not the person raising the alarm who must prove there is danger – it is whoever wants to carry on who must show it is safe.
- Talk to the experts yourself before you stop one of their requests. Just because a request didn’t go through official channels doesn’t mean there is no real concern behind it.
- Create a channel through which a doubt can bypass levels of the hierarchy without being seen as disloyalty.
- Beware of habituation. Whenever someone says “We’ve seen this before,” ask: Do we know it’s harmless, or have we just been lucky so far?
- In meetings, ask explicitly about unsent emails: What did you think and not say?
Summary
On the Columbia mission, the team knew about the danger. But rank, the chain of command and habituation made it hard to pass the doubt on: the request for images failed, and a warning email remained a draft. The board blamed culture and structure, not individuals. The disaster shows the Team Principle of Safety from the opposite side: a team only learns when no one has to fear speaking up about a mistake or a doubt.