Autonomy, Interdependence, and Social Control: NASA and the Space Shuttle Challenger
Author(s): Diane Vaughan
Source: Administrative Science Quarterly, Vol. 35, No. 2 (Jun., 1990), pp. 225-257
Published by: Johnson Graduate School of Management, Cornell University
Stable URL: http://www.jstor.org/stable/2393390 .
Accessed: 01/03/2011 05:19
Your use of the JSTOR archive indicates your acceptance of JSTOR's Terms and Conditions of Use, available at .
http://www.jstor.org/page/info/about/policies/terms.jsp. JSTOR's Terms and Conditions of Use provides, in part, that unless
you have obtained prior permission, you may not download an entire issue of a journal or multiple copies of articles, and you
may use content in the JSTOR archive only for your personal, non-commercial use.
Please contact the publisher regarding any further use of this work. Publisher contact information may be obtained at .
http://www.jstor.org/action/showPublisher?publisherCode=cjohn. .
Each copy of any part of a JSTOR transmission must contain the same copyright notice that appears on the screen or printed
page of such transmission.
JSTOR is a not-for-profit service that helps scholars, researchers, and students discover, use, and build upon a wide range of
content in a trusted digital archive. We use information technology and tools to increase productivity and facilitate new forms
of scholarship. For more information about JSTOR, please contact [email protected].
Johnson Graduate School of Management, Cornell University is collaborating with JSTOR to digitize, preserve
and extend access to Administrative Science Quarterly.
http://www.jstor.org
Autonomy, Interdependence, and Social
Control:NASAand
the Space
Shuttle Challenger
Diane Vaughan
Boston College
This paper shows that the organizations responsible for
regulating safety at the National Aeronautics and Space
Administration (NASA) failed to identify flaws in management procedures and technical design that, if corrected,
might have prevented the Challenger tragedy. Analysis of
the processes of discovery, monitoring, investigation, and
sanctioning in the Space Shuttle Program indicates that
regulatory effectiveness was inhibited by the autonomy
and interdependence of NASA and its regulators. This
discovery suggests that autonomy and interdependence,
concepts developed from research on the external control
of organizations, are applicable to the study of intraorganizational regulatory relationships. Moreover, by articulating the organizational contribution to technical failure,
this research challenges existing assumptions about the
social control of risky technologies.'
The tragicloss of the space shuttle Challengeron January28,
1986 sent the nationinto mourningand forced a citizenryordinarilypreoccupiedwith other mattersto confrontagainthe
risks of livingin a technologicallysophisticatedage. Preceded
by the incidentsat Three Mile Islandand UnionCarbidein
Bhopaland soon followed by Chernobyl,the Challengeraccident left in its aftermatha deeply troublingquestion: Has our
abilityto create highlydeveloped technologicalsystems exceeded our abilityto controland master them in practice?
Perrow(1984) addressed this question, arguingthat technologicalcomplexityhas a tendency to result in "normalaccidents," accidents that are inevitablefor certaintechnical
systems. These accidents initiallyare caused by technical
component failuresbut become accidents ratherthan incidents because of the natureof the system. The failureof one
component interactswith others, triggeringa complex set of
interactionsthat can precipitatea technical system accident
of catastrophicpotential.
?
1990 by CornellUniversity.
0001-8392/90/3502-0225/$1.00.
My thanksto John Braithwaite,Patricia
Ewick,Susan P. Shapiro,and three anonymous reviewersfor useful comments on
this paper.Earlierversionswere presented at the EuropeanConferenceof
CriticalLegalStudies,Centrede Recherche Interdisciplinaire
de Vaucresson,
Vaucresson,France(April1987) and the
Lawand SocietyAssociationAnnual
Meeting,Vail,Colorado,June 1988. This
researchwas made possible, in part,by
supportfromthe Centrefor Socio-Legal
Studies,WolfsonCollege,Universityof
Oxford(1986-1987) and the AmericanBar
Foundation,Chicago(1988-1989).
Technologyis not the only culprit,however. The organizations
that runthese riskyenterprises often contributeto their own
technologicalfailures.Turner(1976, 1978) has investigated
accidents and social disasters, seeking any systematic organizationalpatternsthat might have preceded these events.
He found that disasters had long incubationperiods characterized by a numberof discrepantevents signalingdanger.
These events were overlookedor misinterpreted,accumulatingunnoticed.Among the organizationalpatternscontributingto these "failuresof foresight" (Turner,1978: 51) were
norms and culturallyaccepted beliefs about hazards,poor
communication,inadequateinformationhandlingin complex
situations,and failureto complywith existing regulationsinstituted to assure safety (Turner,1976: 391).
a long incubationperiodis advantageous.HyParadoxically,
pothetically,regulatoryagents could intervene,possibly
avertinga technicalsystem accident. True,some are unavoidable,because they involvemultipleerrorsof design,
equipmentfailure,and systems operation.But for those technicalsystem accidents that are potentiallyavoidableand
whose impendingoccurrence is obscured by organizational
225/AdministrativeScience Quarterly,35 (1990): 225- 257
patternssuch as those Turnernoted, effective regulationmay
reduce the probabilitythat a technicalfailurewill occur. Unfortunately,regulatoryagents are organizationssubject to
their own failuresof foresight.
When regulatoryfailureoccurs in the monitoringof an organizationthat deals in high-risktechnology, the resultingaccident
system accimay be thought of as an organizational-technical
dent: a potentiallyavoidabletechnicalsystem accident resultingfrom the failureof the technicalcomponents of the
product,the organizationresponsiblefor its productionand
use, and the regulatoryorganizationsdesigned to oversee the
entire operation.The failuresof the producerand regulatory
organizationsare failuresof foresight, arisingfrom organizationalpatternsthat blockproblemidentificationand correction
in the pre-accidentincubationperiod.Such an accident cannot
be explainedby the failureof the technicalsystem alone. The
organizationmalfunctions,failingto correcta correctable
technical problem.The regulatoryorganizationchargedwith
surveillanceof the technical productand the organization's
performancefails to resolve the problemsin both. The result
is an organizational-technical
system accident, perhapsof catastrophicproportion.
The Challengerdisaster was an organizational-technical
system accident. The immediatecause was technicalfailure.
The O-rings-two 0.280-inchdiameterrings of synthetic
rubberdesigned to seal a gap in the aft field jointof the-solid
rocket booster-did not do theirjob. The PresidentialCommission (1986, 1: 72) investigatingthe incidentstated that
design failureinteractedwith "the effects of temperature,
physicaldimensions, the characterof the materials,the effects of re-usability,processing, and the reactionof the joint
to dynamicloading."The result of these interactivefactors
was, indeed, a technicalsystem accident similarto those
Perrowidentified.But there was more. The post-accidentinvestigations of both the Commission(1986, 1: 82-150) and
the U.S. House Committee on Science and Technology
(1986a: 138-178) indicatedthat the NASAorganizationcontributedto the technicalfailure.As Turnermight have predicted, the technicalfailurehad a long incubationperiod.
Problemswith the O-ringswere first noted in 1977 (Presidential Commission, 1986, 1: 122). Thus, NASAmight have
acted to avert the tragedy. But the organizationalresponse to
the technicalproblemwas characterizedby poor communication, inadequateinformationhandling,faultytechnicaldecision
making,and failureto complywith regulationsinstitutedto assure safety (PresidentialCommission, 1986, 1: 82-150; U.S.
House Committee on Science and Technology,1986a:
138-178). Moreover,the regulatorysystem designed to
oversee the safety of the shuttle programfailed to identify
and correct programmanagement and design problemsrelated to the O-rings.NASAinsiders referredto these omissions as "qualityescapes": failuresof the programto
precludean avoidableproblem(PresidentialCommission,
1986, 1: 156, 159). NASA'ssafety system failedat monitoring
shuttle operationsto such an extent that the Presidential
Commission's reportreferredto it as "The Silent Safety Program" (1986, 1: 152).
226/ASQ, June
1990
NASA and the Challenger
My purpose in this paper is to analyze NASA'ssafety regulatory system and specify the organizationalbases of its ineffectiveness. NASA,like all organizations,is subject to
restraintand controlthat occur as a consequence of interaction with other organizationsin its environmentacting as consumers, suppliers, competitors, and controllers(Pfefferand
Salancik,1978: 40-54). Inthis analysis, I focus only on those
organizationswith (1) officiallydesignated social controlresponsibilities,(2) safety assurance as the sole function,and
(3) personnel with aerospace technicalexpertise. Although
the uniqueness of this case requiresthe usual disclaimers
about generalization,its uniqueness also allows analysis of a
complex technical case perhaps not possible otherwise. The
tragedygenerated an enormous amount of archivalinformation as well as much conflictingpublicdiscourse by people
more technicallycompetent than 1,leadingme to sources and
questions that might not have occurredto me.
Over 122,000 pages of documents gathered by the Presidential Commissionare cataloguedand availableat the National
Archives,Washington,D.C. I've drawnmy analysisfrom documents pertainingto safety that were generated by NASA,
contractors,and safety regulatorspriorto the disaster. I also
reliedon volumes 1, 2, 4, and 5 of the 1986 Reportof the
PresidentialCommissionon the Space Shuttle ChallengerAccident, volumes 4 and 5 of which contain2,800 pages of
hearingtranscriptsfrom both closed and open Commission
sessions; the 1986 Reportof the Committee on Science and
Technology, U.S. House of Representatives,which includes
two volumes of hearingtranscripts;and the publishedaccounts of journalists,historians,scientists, and others.
I also conducted interviews. Crucialto my methodologywas
the use of informationfrom both insiders and outsiders: insiders are participantsin the organizationsor event being
studied; outsiders are individualsinformedabout the subject
matterwho, because of positionwithin the organizations
being studied, membershipin other organizations,ideology,
occupation,or even variedproximityto the event or setting,
may hold differentperspectives on an event than insiders.
Outsiders produce additionalinsights that aid in discovering
biases inherentin primarydata sources. In this case, the insiders I interviewedwere people responsiblefor regulating
safety at NASAand contractorsites; outsiders were whistleblowers, journalistswho investigated NASA'ssafety system
followingthe disaster, and participantsin NASA'sregulatory
environmentwho were not directlyresponsiblefor regulating
safety but were knowledgeableabout it. I sent selected insiders and outsiders copies of the penultimatedraftof this
paper,and their comments were taken into account in the
finalversion. I also used transcriptsfrom 160 additionalinterviews conducted by 15 experienced government investigators
who supportedCommissionactivities,documentingthe factual backgroundof the incidentand safety activitiesat NASA
and its contractors(totalingapproximately9,000 pages stored
at the NationalArchives).Nearly60 percent of those interviewed by government investigatorsnever testified before
the PresidentialCommissionor the House Committee on
Science and Technology.
227/ASQ, June 1990
CONSTRAINTSON THESOCIALCONTROL
OF ORGANIZATIONS
Research on legallyempowered agents of social controlregulatingbusiness firms reveals how interorganizational
relations constrainsocial control.Both the autonomyand
interdependenceof regulatoryand regulatedorganizationsinhibitcontrolefforts (Vaughan,1983: 88-104). While autonomy and interdependenceaffect the full range of
regulatoryactivities-discovery, monitoring,investigation,
and sanctioning-they each appearto affect particularcontrol
activitiesdifferentially.Autonomy,or the fact that social control agents and business firms exist as separate, independent
entities, seems to be a criticalfactor in regulatoryefforts to
discover, monitor,and investigate organizationalbehavior.All
organizationsare, to varyingdegrees, self-boundedcommunities. Physicalstructure,reinforcedby norms and laws protecting privacy,insulates them from other organizationsin the
environment.The natureof transactionsfurtherprotects
them from outsiders by releasing only selected bits of information in complex and difficult-to-monitor
forms. Thus, although organizationsengage in exchange with others, they
retainelements of autonomythat mask organizationalbehavior.While an organization'sstructureand the natureof its
transactionsobscure activitiesfrom all other organizationsin
the environment,they pose particularproblemsfor agents of
social control.
Autonomousstructuresin theirown right,regulatorsare
mandatedto oversee the behaviorof other organizations.But
the autonomy of regulatedorganizationsobstructs the gathering and interpretationof informationnecessary for discovery, monitoring,and investigation.Regulatorsattempt to
penetrate organizationalboundaries
by periodicsite visits
and/orby requiringthe regulatedorganizationto furnishinformationto them. These strategies allow regulatorsto examine
only limitedaspects of organizationallife, however. Moreover,
even when regulatorshave access to organizationsin these
two ways, the size and complexityof the targeted organization, its numerous dailytransactions,specialization,and the
uniquelanguages that accompanyit can be difficultto master.
Technologyadds to the challenge. Regulators,always under
pressure to keep informedof developments in the industries
they regulate,find theirtasks complicatedby scientific advance and the burgeoninguse of computertechnology in
nearlyevery aspect of routinebusiness activity.
Attemptingto surmountthese obstacles, regulatorstend to
become dependent on the regulatedorganizationto aid them
in gatheringand interpretinginformation.While certainlythe
potentialexists for a productiverelationship,informationaldependencies also can underminesocial controlin subtle ways.
First,regulators'definitionsof what is a problemand the relative seriousness of problemsare shaped by their informants.
Second, informationaldependencies tend to generate continuingrelationshipsthat make regulatorsvulnerableto cooptation (Selznick,1966). Regulatorsmay take the point of view
of the regulatedbecause they develop sympathyand affinity
for them, compromisingthe abilityboth to identifyand report
violations.Finally,the situationis ripefor intentionaldistortion
2281ASQ,June 1990
NASA and the Challenger
and obfuscationby the regulated,for informationaldependencies prevent regulatorsfrom detecting falsification.
Paradoxically,regulatoryorganizationsand the organizations
they regulate have the capacityto be autonomous and interdependent simultaneously.Despite being physicallyseparate
independententities, regulatorand regulatedmay become
linkedsuch that outcomes for each are, in part,determined
by the activitiesof the other (Pfefferand Salancik,1978:
39-61; Vaughan,1983: 93-104). When organizationsare interdependent,the outcomes they reach are determinedby
the natureand distributionof resources between the two and
the way those resources are used. Althoughinterdependence
may affect the entire regulatoryprocess, its majorimpact is
on the abilityof regulatorsto threatenor impose meaningful
sanctions. Interdependencecan be of two types: competitive
or symbiotic (Pfefferand Salancik,1978: 41). Competitiveinterdependence exists when two organizationscompete for
the same scarce resources and when one succeeds, the
other, by definition,fails (Pfefferand Salancik,1978: 41).
Competitiveinterdependenceapplies to social controlagents
and the organizationsthey regulatein a slightlydifferent
sense. Because they are adversaries,the resources of each
can be used in ways that interferewith the goals of the other.
Regulatoryorganizationspossess resources (investigativeand
sanctioningpowers) that can impose costs and threatenthe
operationsof regulatedorganizations.At the same time, regulatedorganizationsmay possess resources (wealth, influence, information)that can interferewith the successful
enactment of tasks necessary to social control(Stone, 1975:
96; Cullen,Maakestad,and Cavender,1987). Consequently,
both regulatorand regulatedtend to avoid costly adversarial
strategies to impose and thwartpunitivesanctions; instead,
bargainingbecomes institutionalized,as negotiationdemands
fewer resources from both (Vaughan,1983: 88-104). Hence,
sanctions often are mitigatedas a result of the powermediatingefforts of both parties.
Symbioticinterdependencealso affects the sanctioningprocess. Symbioticinterdependenceexists when resource exchange occurs between social controlorganizationsand those
they regulate:differentresources are exchanged, one organization's output functioningas the inputof the other (Pfeffer
and Salancik,1978: 41). When harmor good fortune befalls
one, the well-beingof the other is similarlyaffected. Hence,
they rise and fall together. When the exchange is asymetrical,symbiotic interdependencemay either enhance or impede regulatoryefforts. On the one hand,when a firmis dependent on the governmentto supplya criticalresource, the
probabilitythat the regulatedorganizationwill complywith
government laws and regulationsis increased (Wileyand
Zald, 1968: 35-56). On the other hand,when the government is dependent on a firmto supply a criticalresource and
that firmviolates laws or rules, the probabilitythat a government regulatoryagency will invokestringentsanctions to
achieve compliance is decreased (Pfefferand Salancik,1978:
58-59).
Situationsof mutualdependence (whethersymbioticor competitive)are likelyto engender continualnegotiationand bargainingratherthan adversarialtactics, as each partytries to
229/ASQ, June 1990
controlthe other's use of resources and conserve its own
(Yuchtmanand Seashore, 1967). To interpretthe consequences of this negotiationand bargaining(e.g., the "slap-onthe-wrist"sanction or no sanction at all)as regulatory
"failure"is to miss the point. Compromiseis an enforcement
patternsystematicallygenerated by the structureof interorganizationalregulatoryrelations.
The concepts of autonomyand interdependenceare useful
analytictools for research on the social controlof organizations. But to restrictinquiryto privatesector organizationsand
legal actors is to make artificialdistinctionsthat impede
theorizing.Structuralsimilarities,groundedin the hierarchical
natureof organizationalforms, allow us to applyconcepts,
models, and theories in multiplecontexts (Vaughan,1990).
Because regulatorydifficultiesare systematicallygenerated
by the structureof relationsbetween organizations,we can
use autonomyand interdependenceheuristicallyto guide
analysis of officialregulatoryrelationsbetween diverse types
of organizations.Further,organizationsexist in a hierarchyof
organizationsand develop an internalhierarchyof their own.
Consequently,concepts developed to explainrelationsbetween an organizationand others in its environmentcan be
relations(Vaughan,1990:
used to examine intraorganizational
3-6). Manyorganizationsare self-regulating,initiatingspecial
subunits to discover, monitor,investigate,and sanction in
While
orderto controldeviantevents intraorganizationally.
empiricaland theoreticalwork on the externalcontrolof organizationsis extensive, we know much less about the organizationaldimensions of self-regulation(but see Katz,1977;
Sherman, 1978; Punch, 1985; Braithwaiteand Fisse, 1987).
By using autonomyand interdependenceto explore social
and by varying
controlrelationsintra-and interorganizationally
the types of organizationsstudied, we may (1) learnmore
about how the structuredrelationsof organizationsaffect social control,(2) specify these two concepts more fully,and (3)
move toward more broadlybased theory on the social control
of organizations.
I've used these two concepts to guide my analysis of safety
regulatoryenforcement at NASA.In contrast to the research
traditionof investigatingthe social controlof business firms
by legallyempowered agents of social control, I explore the
regulationof a governmentagency and one of its contractors.
Two internalsafety organizationsestablished by NASAand
one externalsafety regulatorcreated by Congress regulated
the shuttle program.Consequently,we have the rareopportunityof examininga self-regulatingsystem reinforcedby externalcontrol.While the strategy at NASAof combining
self-regulationwith externalreview would appearto be maximallyeffective (the advantages of one compensatingfor the
disadvantagesof the other), I hypothesize that regulatoryeffectiveness at NASAwas underminedby autonomyand interdependence, reducingthe probabilitythat safety hazards
would be identifiedand corrected.
Each regulatorystrategy has its own structurallyengendered
weaknesses. Createdto reapthe independentreview potential of an autonomous structure,NASA'sexternalregulator
would tend to experience difficultiesin getting access to and
230/ASQ, June 1990
NASA and the Challenger
interpretinginformation,perhapsdeveloping informationaldependencies that would undermineindependentreview. If
NASAand the externalregulatorare found to be interdependent, the applicationof sanctions would tend to be mitigated
by negotiationand compromise.We also would expect to find
autonomyand interdependenceat work intraorganizationally.
The advantageof internalregulatorybodies is access to the
organizationand knowledge of language, specialization,and
technology, which allows them a closer purviewthan external
regulators(Bardachand Kagan,1982: 219, 272). Yet, when
organizationsare large, internalstructure,specialization,and
numerous transactionscan confound insiders, preservingorganizationalautonomy. Despite havingbetter access to data,
an internalregulatorstill may encounter barriersto discovery,
monitoring,and investigation.Informational
dependencies,
previouslyidentifiedonly in interorganizational
controlrelations, are a likelyresult. Moreover,we would expect self-regulatingsystems to be plaguedcontinuouslyby symbiotic
interdependence.When regulatoryauthority,resources, and
time are controlledby the regulatedorganization,many
phases of the regulatoryprocess might be compromised,
from issuing warningsto imposingsanctions. Most certainly,
these dependencies would tend to subvert objective review.
Exploringthe structuralcontributionto regulatoryineffectiveness at NASAshifts the focus away from individualactors.
Undeniably,individualshad a hand in it: those administrators
who made criticaldecisions about regulatorystructureand
resource allocationto safety over the years, as well as the
actions of individualsafety personnel on the job. Neitherare
addressed here. The decisions of NASAadministratorsthat
affected the structureof regulationnecessarilyare recounted,
but the explanationbehindthose decisions requiresextensive
analysis of the NASAorganizationand its history.While all
three components of NASA'sorganizational-technical
system
are essential to understandingthe accident, such an examinationis beyond the scope of this paper.Clarifyingthe structuralbases of NASA'sregulatoryineffectiveness is significant
in its own right,however, havingimplicationsboth for theory
and policyconcerningthe social controlof organizations.
Organizationsno doubt have failuresof foresight more frequentlythan we realize.Onlywhen these failureslead to
harmfulconsequences that then become publicdo outsiders
have the opportunityto consider the cause. Because official
investigationsshape what outsiders perceive as cause, and
because documents from officialinvestigationsare used in
this research, considerationmust be given to the accounts
that result from such investigations.The PresidentialCommission and the House Commissionon Science and Technology also are partof NASA'ssafety regulatoryenvironment,
both havingofficiallydesignated social controlresponsibilities.
The extent to which autonomyand interdependencemay
have affected the documents they produceddeserves inquiry.
This phase of my research is still in progress. Whilethe conclusions drawn by these officialinvestigationsremainto be
assessed as a productof the politico-socio-historical
environment that producedthem, the descriptionsof NASA'sregulatory environmentin general and the three safety units in
particularhave been corroboratedfrom multiplesources, jus231/ASQ, June 1990
tifyingtheir use as an example of regulationin an organizational-technicalsystem accident.
STRUCTURE
ENVIRONMENT:
NASA'S REGULATORY
AND PROCESS
The foundationof NASA'sregulatorysystem was established
by the NationalAeronauticsand Space Act of 1958 (U.S.
Congress, 1959). This act allocatedbroadoversight responsibilitiesto two bodies, to the NationalAeronauticsand Space
Counciland to Congress, but the responsibilityfor close surveillancewas left to NASA.The space agency, from its inception, was to guide and implementits own regulation.
NASAwas given the authority"to make, promulgate,issue,
rescind, and amend rules and regulationsgoverningthe
mannerof its operationsand the exercise of the powers
vested in it by law" and "to appointsuch advisorycommittees as may be appropriatefor purposes of consultation
and advice to the Administratorin the performanceof its
functions"(U.S. Congress, 1959: sec. 203).
Self-regulationis a frequentsolutionto the classic dilemmaof
government: Who controls the controller?But, more significantly,the space agency's self-regulatoryresponsibilities
were designed to complement and assure NASA'scentral
goal: U.S. supremacy in the internationalcompetitionfor scientific advance and militarysupremacy(McDougall,1985). To
meet both scientificand defense goals, NASArequireda regulatorysystem that would closely monitortechnicaldevelopment and managementaspirationsto assure safety, reliability,
and qualityof equipmentdesign and performance.At the
same time, the space agency needed to encourage innovation. While safety and innovationare inherentlyconflicting
goals (the former requiringconstraint,the latterfreedom),
both were essential for competitive success. Hypothetically,
an independentexternalbody could effect the constraintnecessary to assure safety. But would an externalregulatorhave
the capabilityfor regularsurveillanceas well as the abilityto
assess NASA'scomplex technicalsystems and operations?
Moreover,an externalregulatormight impose constraintsthat
would interferewith innovationor, a relatedconcern, penetrate the secrecy necessary to Departmentof Defense
projects on which NASAcooperated.
What agency was better qualifiedin the technical expertise
necessary to ensure safety than NASA?What agency was
better able to encourage and foster innovativespace technology and at the same time keep the secrets necessary to
nationaldefense? In its self-regulatingefforts, NASAcreated
a regulatorystructureintendedto ensure both safety and innovationby separatingoversight responsibilitiesfor these two
goals. To encourage innovation,NASAcreated a system of
advisorycommittees staffed with respected leaders from the
aerospace industry,research institutes,and universities,who
would shape policyand technologicaldevelopments. To asregulatory
sure safety, NASAcreated two intraorganizational
units staffed by NASApersonnel: the Safety, Reliability,and
QualityAssurance Programand the Space Shuttle Crew
Safety Panel.The sole responsibilityof these units was to assure safety throughintensive scrutinyof both technicaldesign and programmanagement.These two internalsafety
2321ASQ,June 1990
NASA and the Challenger
units were created with the expectation that NASApersonnel, informedabout its technology, managementsystems,
personnel, and with access to day-to-dayactivities,were capable of the close monitoringessential to safety. Moreover,
these internalunits were physicallyseparate from the activities they were to regulate,so they were expected to bringto
theirtask the objectivitynecessary for independentreview
(U.S. House, 1967a, pt. 2: 41).
These safety units existed at the inceptionof the shuttle program, but there was one addition.Shortlyafter the 1967
Apollolaunch-padfire that killedthree astronauts,Congress
supplemented NASA'sown advisorycommittee structure
with an advisorycommittee solely responsiblefor safety surveillance: the Aerospace Safety AdvisoryPanel (Rumsfeld
and Kriegsman,1967; U.S. Congress, 1968). The creationof
this panel was an explicitattempt by Congress to balance
NASA'sinternalsafety system with an independentexternal
regulatorybody composed of aerospace experts (Presidential
Commission, 1986, 5: 1488-1489; Egan, 1988). Legislative
action was guided by the notionthat the combinationof internaland external regulatorybodies would providethe surveillance essential for preventingfutureaccidents (U.S.
House, 1967a, pt. 2: 229).
Legalagents of social controltend to regulatethroughone of
two generic strategies: deterrence or compliance(Reiss,
1984). Reiss (1984) noted that many, if not most, social controlsystems mix complianceand deterrence strategies of law
enforcement, but as idealtypes the two models behave quite
differently.Ina deterrence strategy, punishmentis invoked
after a violationhas occurred.Social controlis adversarial:
discover, investigate, prosecute, and punishviolators.While
the entire investigatoryprocess communicates the message
that violationswill be met with enforcement action, it is ultimately the punishmentitself that is believed to affect decision making.But empiricalquestions about the deterrent
effects of punishmentaside, some situationsexist for which
a deterrence strategy is out of the question. Some violations,
such as those resultingin accidents at nuclearpower plants,
have consequences so extreme that to allow the possibilityof
their occurrence is to take a sociallyunacceptablerisk.
For NASA,the potentialresult of technicaland procedural
violationswas losses too great to risk.Not only might lives
and an expensive vehicle be destroyed, but an in-flightfailure
could also jeopardizefundingfrom commercialand congressional sources. Moreover,post-accidentinterruptionto space
science and militaryventures linkedto the shuttle program
could threatenthe U.S. positionamong world powers. Insuch
situations,a compliancestrategy is more appropriate.Andthe
regulatoryprocess of all three NASAsafety units was thus
characterizedby a compliancestrategy. Preventionof social
harmwas the goal. A compliancestrategy has regulators
monitoring,negotiating,and interveningregularlywith target
organizationsin orderto gain compliancewith existing standards-thus attemptingto avoid violationsand the social
costs that would ensue (Reiss, 1984: 28). Whereas deterrence systems primarilymanipulatepunishments,compliance
systems principallymanipulaterewards.Negotiationgradually
begins to incorporateelements of punishmentas compliance
2331ASQ,June 1990
efforts run into trouble.Althougha compliancesystem also
has penalties available,they are used primarilyas a threat
ratherthan as a sanction to be carriedout. A sanction invoked
as a threatduringcompliancenegotiationsis intendedto stop
the inappropriatebehavior,the same as a sanction invokedas
punishmentto be carriedout after failed negotiations.When
complianceis achieved, typicallythe sanctions are suspended
or withdrawn.To carryout a punishmentis a sign that negotiation-the hallmarkof the system-has failed (Reiss, 1984:
25). The threat (sometimes to punishby withdrawinga reward)is partof an arrayof enforcement tactics that are all
characterizedby a continuingpersonalcontact between regulatorand regulatedin which social relationshipsare valued not
only as a means of easing the job, but also as a means of assisting in the futurediscovery of problems(Hawkins,1984).
NASA'sinternaland externalsafety regulatoryunits were intended to providethe balancedscrutinynecessary to safeguardthe shuttle program.Yet this safety system failed to
avert the Challengertragedy. Below, I describe the three
safety units, their compliancestrategies, inadequacies,and
the structuralconstraintson social control,to show how autonomy and interdependenceundercuteffective discovery,
monitoring,investigation,and sanctioningof safety hazardsin
the NASAsystem. Forthis account, I have relied heavilyon
documents in the NationalArchives,which are listed in the
references, as well as on the interviewdata I collected.
BARRIERS
TO DISCOVERY,
MONITORING,
AND INVESTIGATION
The Safety, Reliability,and Quality Assurance
Program (SR&QA)
Of the three safety units, SR&QAbore the majorresponsibilityfor safety oversight.This internalNASAsafety program
was headed by the chief engineer at NASAheadquartersin
Washington.In additionto the staff there, SR&QAhad subunits at Johnson, Kennedy,and Marshallspace centers (PresidentialCommission, 1986, 1: 153). Its responsibilities
extended to NASAcontractorsresponsiblefor shuttle components, which SR&QAmonitoredfrom offices located at
contractorfacilities.AlthoughSR&QAoffices were organized
differentlyat each center, theirfunctions and compliance
strategies were the same (Bunn,1986). The compliance
strategy of SR&QAincludedthe three monitoringresponsibilities indicatedby its name, all with directflight-safetyimplications. The safety functionwas carriedout by engineers who
preparedand executed plans for accident prevention,flight
systems safety, and industrialsafety requirements.Additionally, safety engineers identifiedin-flightand post-flight
problems, determinedand monitoredpotentialhazards,and
assessed risk.The reliabilityengineers' responsibilitywas to
determine that particularcomponents and systems arrivingat
the centers from contractorscould be reliedon to work as
planned.Qualityassurance engineers had the responsibility
for proceduralcontrols: assessing inspectionprogramsand
identifyingand reportingproblems (PresidentialCommission,
1986, 1: 152-153; NASA,1986).
234/ASQ, June 1990
NASA and the Challenger
Safety standardsfor these activitieswere publishedin a
wide-scoped, detailed document that was updatedannually
(NASA,1986). SR&QAstaff monitoredand implemented
these standardson a day-to-daybasis at all NASAlocations
and at contractorsites. Contractorswere requiredto create
their own internalsafety organizationand preparea safety
plancomplyingwith all requirementsin the document (NASA,
1986: 2-2). SR&QApersonnel situated in contractorfacilities
monitoredcompliancewith written proceduresand worked
closely with contractorsafety personnel. Inaddition,SR&QA
auditteams auditedcontractoractivitiesperiodically.Contractorssubmitted problemreportsand correctiveactions to
the center monitoringthem, which forwardedsummaryreports to Washington(Quong, 1986: 18-20, 30).
Because O-ringproblemswere first noted at NASAin 1977,
both the PresidentialCommissionand the House Committee
on Science and Technologywanted to know why NASAmanagers were not better informedabout the solid rocketbooster
jointdifficulties.NASAengineers at Marshallwere aware;
SR&QAstaff at both Marshalland MortonThiokol,Inc. of
Utah, the contractorresponsible for manufacturingthe solid
rocket boosters, were monitoringthe problem.Yet NASAadministratorsreportedthey did not consider the problemhazardous to mission safety. The officialChallengerincident
inquiriesfound majorfailuresin SR&QA'smonitoringand investigating responsibilities,supposedly the primaryadvantage
of internalcontrol.Three principalfailureswere discovered,
involvingsafety-criticalitems, trend data, and problem-reportingrequirements.(PresidentialCommission, 1986, 1:
153-156; U.S. House Committee on Science and Technology, 1986a: 69, 174-179). HadSR&QAhandledthese
three responsibilitieseffectively, the probabilitythat NASA
administratorswould have accuratelyassessed the O-ring
problemwould have been increased.
Safety-critical items. SR&QAassigns criticalitycategories
that identifyshuttle components by the seriousness of failure
consequences. The failureof a component designated Criticality 1 (C 1), for example, results in "loss of life or vehicle"
(PresidentialCommission, 1986, 1: 153). SR&QAproduces a
CriticalItems Listfor each component and is responsiblefor
monitoringthese items. The solid rocket booster (SRB)joint
was originallylisted as C 1-R, indicatingredundancy(i.e., a
back-upexisted to preventfailure).But in 1982, the criticality
category was changed to the more serious C 1 designation
(MarshallSpace FlightCenter, 1982: A-6A,6B). Afterthe accident, some internalNASAdocuments were discovered that
still listed the jointas C 1-Rafter the criticalitychange, which
apparentlyled some NASAmanagerswronglyto believe that
redundancyexisted, and SR&QAfailedto identifyand rectify
this confusion (PresidentialCommission, 1986, 1: 155-159).
Trend data. The development of trend data is a standard
functionof any reliabilityand qualityassurance program.Beginningwith the tenth mission of the shuttle in January1984
and concludingwith the twenty-fifth(the Challengerflight),
more than halfthe missions experienced O-ringproblems.
This trend was not identifiedand analyzedby SR&QA(PresidentialCommission, 1986, 1:155-156). HadSR&QAcompiled and circulatedtrend data on in-flight0-ring erosion,
235/ASQ, June 1990
NASAadministrators(andSR&QApersonnel)would have had
essential data on the historyand extent of the jointproblem.
Problem-reporting requirements. The PresidentialCommisrequirementfailures.First,
sion found three problem-reporting
SR&QAdid not establish and maintainclear and sufficient requirementsfor reportingshuttle problemsup the NASAhierarchy(PresidentialCommission, 1986, 1: 154). As shown in
Figure1, the shuttle programmanagement structureconsisted of four hierarchicallevels. Priorto 1983, Level Illwas
requiredto reportall problems,trends, and problemcloseout
actions to Level 11unless the problemwas associated with
hardwarethat was not "flight-critical"
(PresidentialCommission, 1986, 1: 154). In 1983, the directorof SR&QAat
Johnson reducedthe requirementsfor reportingproblems
(Johnson Space Center, 1983). The resultwas that less documentationand fewer reportingrequirementsreplacedprevious directivesthat all safety problemsbe reportedto upper
levels in NASA'shierarchy(PresidentialCommission,1986, 1:
154).
Second, SR&QAfailed to create a concise set of requirements for reportingin-flightanomalies (unexpected events or
unexplaineddeparturesfrom past mission experience).Those
rules that were in effect were scattered in individualdocuments and often contradictedeach other, causing confusion
about which document appliedand to which level of management a problemshould be conveyed (PresidentialCommission, 1986, 1: 154-155).
Finally,SR&QAfailedto detect violationsof problemreporting
requirements.NASA'sLevel Ill projectmanagerswere requiredto informLevel 11of launchconstraints(Presidential
Commission,1986, 1: 138, 159). A launchconstraintis issued
by Level Ill managers in response to a serious safety issue.
The constraintrequirescorrectiveaction be taken before the
shuttle can fly. Because of the extensiveness of O-ringerosion found after the shuttle launchof April1985, Level Ill
managers placed a launchconstraintagainst the next six
shuttle flights (PresidentialCommission, 1986, 1: 137). Each
time a launchapproached,Level Illsolid rocket booster
projectmanagerLawrenceMulloyformallywaived the constraint,allowingthe flightto proceed. Yet neitherLevel 11nor
Level I NASAadministratorswere informedof the constraints
or the subsequent waivers, in violationof the launchconstraintreportingrequirement,and SR&QAdid not discover
the reportingrequirementviolations(PresidentialCommission, 1986, 1: 138-139, 155, 159).
SR&QAwas not makingtrends, status, and problemsvisible
with sufficientaccuracyand emphasis. Inadditionto these
shortcomings,the Commissionnoted that SR&QAstaff were
absent from key Challengerpre-launchdecision making:the
controversialteleconference between MarshallSpace Flight
Centerand MortonThiokolpersonnel the nightbefore the
launch,when Thiokolengineers expressed concern about the
potentialfor O-ringerosion and objected to launchingin the
predictedcold weather (PresidentialCommission, 1986, 1:
152). Althoughsafety representativesare incorporatedinto
formalpre-flightdecision making,"no one thought to invitea
safety representativeor a reliabilityand qualityassurance en2361ASQ, June
1990
NASA and the Challenger
Figure 1. Shuttle program management structure.*
Level I
Johnson
Center
l
Marshall
Center
LevellI
LevelIll
LevelIll
LvlIV
LvlIV
*Source: PresidentialCommission (1986, 1: 102).
Institutionalchain
-
-
-
Programchain
Level I: The associate administratorfor space flight. Oversees budgets
for Johnson, Marshall,and Kennedy space centers.
Responsible for policy, budgetary, and top-level technical
matters for shuttle program.
Level II: Manager, National Space TransportationProgram. Responsible
for shuttle program baseline and requirements. Provides
technical oversight on behalf of Level I.
Level Ill: Program managers for orbiter, solid rocket booster, external
tank, and space shuttle main engine. Responsible for
development, testing, and delivery of hardwareto launch site.
Level IV: Contractorsfor shuttle elements. Responsible for design and
production of hardware.
gineer" to the hurriedlyconvened January27 teleconference,
which occurrednot only outside the mandatedformalreview
process, but began at 5:45 p.m. EST,after many people at
Kennedyhad gone for the day (PresidentialCommission,
1986, 1: 152). Furthermore,no safety representativewas on
the Mission ManagementTeam that made key decisions
concerningice and cold duringthe countdown (1986, 1: 152).
The absence of SR&QAstaff was another missed opportunityto identifyand communicatesafety concerns. Supposedly, SR&QAcreated and maintainedexacting and extensive
safety proceduresduringthe Apolloprogram(Presidential
Commission, 1986, 1: 152; WallStreet Journal,1986: A-2).
What happened is that both autonomyand interdependence
were underminingregulationintraorganizationally.
237/ASQ, June 1990
In the mid-sixties,a complex nexus of factors, both internationaland domestic, resulted in uncertaintyabout the future
directionof the space programand a consequent decline in
congressionalappropriationsfor NASA(McDougall,1985:
420-435). The shuttle programwas bornin the midst of this
decline, with fundingstruggles as its inalienablebirthright
(Roland,1985). Ratherthan the redundancythat typifiedthe
programduringApollo,safety surveillancefor the shuttle was
characterizedby scarcity.The Safety, Reliabilityand Quality
Assurance Programwas dependent on NASAdecisions that
allocated resources to it, and NASAhad cut those resources
(Diamond,1986; PresidentialCommission, 1986, 1: 159161; WallStreet Journal,1986). In 1982, the shuttle was officiallydeclared operational,signifyingthat the developmental
phase was over: after fourtest flights,the shuttle had proven
readyto fulfillthe tasks for which it had been designed (PresidentialCommission, 1986, 1: 161). At that time, NASAeither reorganizedSR&QAoffices or continuedthem with
reduced personnel. Between 1970 and the Challenger
tragedy, NASAtrimmed71 percent of its safety and quality
controlstaff (U.S. House Committee on Science and Technology, 1986a: 176-177; Magnuson,1986: 17). SR&QAstaff
at Marshall,which had NASAresponsibilityfor the solid
rocket booster project,had been cut from about 130 to 84.
(U.S. House Committee on Science and Technology,1986b,
1: 655; Quong, 1986: 27). At the time of the accident, total
SR&QApersonnel numberedabout 500; total NASAemployees were about twenty-two thousand (U.S. House Committee on Science and Technology,1986a: 176-177).
Even before staff reductions,we might expect SR&QAto be
handicappedby the autonomygenerated by the NASA/contractorsystem's size, complexity,and enormous amounts of
highlytechnicalpaperwork.But staff reductionsmade it all
but impossibleto monitoradequatelya system as complex as
NASA's(PresidentialCommission, 1986, 1: 153; U.S. House
Committee on Science and Technology,1986a: 177). One
example of an SR&QAfailurecited by the officialinvestigations was its confusion over the criticalityratingof the SRB
joint. In 1982 when the SRB joint's criticalitycategorywas
changed from C 1-R to C 1, only one reliabilityengineer was
monitoringpaperworkfor problemreportingand close-out at
NASAheadquarters(Quong, 1986: 17). SR&QAstaff
members themselves often mistakenlylabeled individual
problemreportson the SRB jointas C 1-R ratherthan C 1
(Bunn, 1986: 13). Apparently,the reliabilityengineer did not
catch the errors(Quong, 1986: 17). The summaries of
problemreportson the solid rocket motor,solid rocket
boosters, externaltank, and main engine were compiled into
books three inches thick.Althoughthe SR&QAdirectorand
deputy directorat NASAheadquartersreceived these summaries, they did not notice the SRBjointcriticalitychange
(Quong, 1986: 16). Not only did the amount of information
being conveyed obscure the discrepancies,but both the directorand the deputy directorhad other responsibilities,each
spending, respectively, 10 percent and 25 percent of their
time on the shuttle program,leavingmeager time for safety
concerns (Quong, 1986: 30-32). Giventhat overburdened
SR&QAdirectorsand staff members were not able to identify
and correcttheir own misunderstandingson the SRB joint
238/ASQ, June 1990
NASA and the Challenger
criticalityrating,it is not surprisingthat they were not able to
identifyand rectifythe confusionamong NASAadministrators.
Liketheir externalcounterparts,internalsocial controlagents
develop informationaldependencies that circumventthe
structuralbarriersto discovery, monitoring,and investigation.
Staff reductionsare likelyto increase relianceon formalized
dependency relations,however, as increasedworkloadsforce
regulatorsfrom proactiveto reactiveoversight.Although
there are no data on how these dependencies affected regulationoverall,one example shows how dependency relations
were pertinentto the O-ringproblem.Inthe SR&QAunit permanentlysituated at Thiokol,staff members monitored
problemreportssubmitted by the contractor,compliancewith
written procedures,and worked closely with contractorsafety
personnel. Althoughthey did pursue safety issues with some
of the Thiokolemployees, staff size underminedcomprehensive surveillance.Roger Boisjoly,the MortonThiokolengineer
in charge of the O-ringSeal Task Force who vigorouslyprotested launchingChallenger,reportedthat he never had a
safety person ask him about the workingsof the solid rocket
booster joint (Boisjoly,1986: 44). Althoughthis omission
cannot be linkedto any of the specific SR&QAfailurescited
by officialinvestigations,one must wonder about the effects
that informationdependencies had on what SR&QAstaff defined as problemsand the seriousness attributedto those
problems.
SR&QAwas dependent on NASAin another importantway
that could have had a telling impact,even when resources
were abundant.SR&QAoffices at Kennedyand Marshall
space centers were underthe supervisionof the partsof the
organizationand activitiesthey were to check (Presidential
Commission, 1986, 1: 160). Dependence on the management
structureto act on recommendationscompromisedSR&QA's
abilityto act in the interest of safety. Boisjolynoted, "SR&QA
was relegated to honorstatus only, as demonstratedby how
they reportedorganizationally"
(personalcommunication,19
September 1989). As the PresidentialCommission(1986, 1:
153) stated, "The clear implicationof such a management
structureis that it fails to providethe kindof independentrole
necessary for flightsafety."
The Space Shuttle Crew Safety Panel (SSCSP)
In additionto the Safety, Reliabilityand QualityAssurance
Program,NASAcreated a second internalunit in 1974 to be
responsiblesolely for crew safety (JohnsonSpace Center,
1974). The panel was composed of 20 people from Johnson,
Kennedy,and Marshallspace centers, Dryden(the NASAfacilityat EdwardsAirForce Base, California),
and the AirForce
(Hammack,1986: 2-3). Forestallingaccidents-the goal of a
compliance strategy-was to be achieved by (1) identifying
possible hazardsto shuttle crews, and (2) advisingshuttle
management about these hazardsand their resolution.To assure communicationand coordinationon all crew safety
issues, panel members were selected from throughoutthe
NASA/contractor
system, representingengineering,project
management, and the AstronautOffice, which trainsastronauts and providesflightcrews for space vehicles (Presidential Commission, 1986, 1: 161; 5: 1411). Theirresponsibilities
239/ASQ, June 1990
on this panel were additionsto the responsibilitiesnormally
associated with their positions. The panel was chairedby
Scott H. Simpkinson,managerfor flightsafety, an experienced NASA"troubleshooter"(Maley,1986: 1).
In meetings, the Space Shuttle Crew Safety Panel (SSCSP)
indentifiedpotentialproblemareas, developed solutions, and
reviewed schedules (Hammack,1986: 2-3). Often, the chair
assigned individualproblemsto members for detailed investigation, negotiation,and resolution.The panel reliedon its
own workinggroups when practicalbut established subpanels or employed subsystem managersand technicalspecialists to supplement panel expertise when necessary. The
panel prioritizedsafety issues for NASA'sattention,submitting a formalreportto the Space Shuttle Programmanager
after each meeting (Maley,1986). From1974 through1979,
the SSCSP met 26 times, addressingsuch issues as missionabortcontingencies, crew escape systems, and equipment
acceptability(Hammack,1986: 5; 9-19).
Althoughthe O-ringproblemwas first noted at NASAin 1977,
my review of SSCSP meeting summaries gives no indication
the O-ringproblemwas addressed by this panel (Hammack,
1986: 12-19). Was this omission a consequence of intraorganizationalautonomy?Availabledata do not allow us to explorethe precise effects of the NASAsystem's structure,
specialization,and transactionson the crew safety panel. On
the one hand,the strategy of drawingmembers from representative parts of the organizationwould tend to reduce
these problems. On the other hand,a twenty-memberpanel
could not cover all the bases in so vast a system, as evidenced by its dependence on other technicalexperts. As with
SR&QA,inadequatestaff numberstend to increase the
problemsassociated with discovery, monitoring,and investigation of safety issues in complex organizations.But this
panel had additionalhandicaps.Responsibilitiesfor theirown
jobs restrictedthe amount of work each person could do for
the panel, limitingthe numberof problems panel members
could investigate, as well as the depth of their investigations.
Thus, while the partsof the organizationthat panel members
represented may have received adequate attention,other
parts may have received inadequateattention,or none.
As expected in a self-regulatingsystem, symbiotic interdependence manifested itself in several forms that curtailedthe
effectiveness of the SSCSP. First,the crew safety panelwas
dependent on NASAmanagementfor resources essential to
its inquiries.Members had to provide"the necessary details,
analyses, manpower,and plans requiredto fulfilltask resolutions assigned by the panel chairmanand must be authorized
by their parentorganizationto commit necessary resources"
(JohnsonSpace Center, 1974: 2). Second, all panel recommendationsfor change were subject to management approvaland designationof necessary resources. Finally,the
panel was dependent on NASAfor its very existence. This
was true of SR&QA,too, of course, but the consequences for
the crew safety panel were more extreme.
The NASAdocument that created the panel stated that the
panel would functiononly "duringthe design development
and flighttest phases of the shuttle" (JohnsonSpace Center,
240/ASQ, June 1990
NASA and the Challenger
1974: 1). In 1981, as the shuttle began moving from its developmentalto its operationalstage, discussions were held
about whether the panel should or should not continue (Hammack, 1986: 6). A decision was made to combine it with another panel. The attempt was unsuccessful due to "lackof
programinterest, appropriatesubjects, programmaturity,lack
of SSCSP membershipsupportand differences in panel purposes" (Hammack,1986: 7). Significantto this denouement
was the retirementof Simpkinson,the troubleshootingflight
safety manager,who was not replaced.Withouta mandateto
continue in the operationalphase of the shuttle program,
SSCSPwent out of existence with Simpkinson'sretirementin
1981 (Maley, 1986: 2).
Withthe panel's demise went an importantformalmechanism for interjectinginformationabout dangerto crew and
the value of human life into the NASAdecision-makingstructure. The panel's eliminationdid not mean crew safety was
no longeron NASA'sagenda, however. The AstronautOffice
and the astronautsthemselves were vitallyconcerned with
crew safety, thus possibly compensating for the loss of the
SSCPS. The AstronautOffice, althoughnot an officiallydesignated safety regulator,might have preventedthe Challenger
tragedy by refusingto providea crew untilthe O-ringerosion
problemwas solved. But, like SR&QAand the crew safety
panel, the AstronautOffice's abilityto act on technical issues
was constrainedby NASA'sinternalstructureand specialization, which resulted in informationaldependencies. The AstronautOffice had many responsibilitiesdirectlyrelevantto
flightoperations(PresidentialCommission, 1986, 5:
1414-1415; U.S. House Committee on Science and Technology, 1986b, 1: 544-624). Because of preoccupationwith
flightoperationsgenerallyand the specifics of each flight,the
AstronautOffice (likethe flightcrew and the commanderresponsible for the final "go")was dependent on others to
supply informationabout design problems (PresidentialCommission, 1986, 5: 1420, 1423, 1424). The AstronautOffice
was not informedof earlysolid rocketbooster design and test
problems in any "formalorganizationalway" (Presidential
Commission, 1986, 5: 1416-1418). Nordid the AstronautOffice gain this criticalinformationinformallyas awareness and
concern about the O-ringsgrew among some personnel at
both NASAand MortonThiokol.
At the time of the Challengerlaunch,the AstronautOffice had
91 astronautswho participatedin many phases of the program. In additionto their own flighttraining,many astronauts
did more than one job (PresidentialCommission, 1986, 5:
1467-1470). Despite the contacts with variousparts of the
shuttle programthat the astronauts'multipleresponsibilities
incurred,informationabout the seriousness of the SRB joint
problemdid not reach the AstronautOffice throughastronauts' connections with other parts of the organization(U.S.
House Committee on Science and Technology,1986b, 1:
565). Not that the Office or the astronautswere uninformed
about technical matters. Rather,their abilityto assess flight
safety issues was impairedby their other responsibilitiesand
their position in NASA'sinformationstructure,both of which
assigned them to a reactive stance where design problems
were concerned (U.S. House Committeeon Science and
241/ASQ, June 1990
Technology, 1986a; 152-154). They were relianton others
both for problemidentificationand assessment (U.S. House
Committee on Science and Technology,1986b, 1: 557-563).
When questions about the O-ringsarose in other partsof the
organization,they were either resolved and not conveyed or
else were conveyed as nonserious problems (Presidential
Commission, 1986, 2: H 1-3). Neitherthe AstronautOffice
nor the astronautswere informedof the teleconference between MarshallSpace FlightCenterand Thiokolpersonnel
the night before the launch(PresidentialCommission, 1986,
5: 1415-1416; U.S. House Committee on Science and Technology, 1986b, 1: 557-563).
The Aerospace Safety Advisory Panel (ASAP)
The Aerospace Safety AdvisoryPanelwas created to supplement NASA'sinternalsafety system with an externalregulatory body capable of independentsurveillanceof safety
hazards.The dilemma Congress faced in constitutingit was
findingpeople with the technicaltrainingand experience necessary to do the job (U.S. House, 1967b: pt. 16: 21807).
Congress turnedto aerospace industryleaders (Presidential
Commission, 1986, 5: 1488). Panel membershipwas set by
statute at "no more than nine members, of whom up to four
may come from NASA"(U.S. Congress, 1968: sec. 6). Each
would serve a three-yearterm. The NASAparticipantswere
includedto circumventthe problemsof autonomyconfronted
by externalregulatorybodies. They were to act as liaisons
between the five aerospace experts and internalNASAoperations, informingthem about operations,design, and other
internalmatters. The panel members were joined by the
NASAchief engineer as an ex-officiomember and a small
staff of full-timeNASAemployees. The panel's duty, accordingto statutorydefinition,was to be responsive to the
NASAadministrator'sdefinitionof problems (U.S. Congress,
1968: sec. 6).
In keepingwith NASA'sown mandate (U.S. Congress, 1959:
sec. 303), the agency was activelyinvolvedin outliningthe
limitsof the Aerospace Safety AdvisoryPanel's domain. ImmediatelyfollowingASAP's creation,senior NASAofficials
set to work determiningthe panel's role (NASA,1967:
163-165). The NASAadministratorapprovedASAP's charter
and appointedits members and chair(NASA,1968:
147-148). As the shuttle programmatured,changes improved its abilityto discover, monitor,and investigate in the
evolving program.The domainof the panel was expanded to
includeassessment of the safety implicationsof programs
and their management, ratherthan being limitedto surveillance of technical risks (PresidentialCommission, 1986, 1:
160). The term of membershipwas increasedto six years to
take advantageof the expertise panel members developed.
The panel became increasinglyproactive,pursuingits own
leads based on its own judgments (AerospaceSafety Advisory Panel, 1973: 2).
Beginningin 1980, the originalrequirementthat four NASA
members serve on the panel was changed. Withthe exception of the ASAPstaff director,no NASArepresentativesparticipatedon the panel. Duringthe course of a six-yearterm,
panel members grew knowledgeableabout NASApersonnel
242/ASQ, June
1990
NASA and the Challenger
and activitiesand developed informalcontacts. Consequently,
NASApeople were no longer needed to provideinsights that
the aerospace experts didn'thave (Interview,staff director,
Aerospace Safety AdvisoryPanel, 2 March1988). Inaddition,
the panel's membershipexpanded.To cope with the panel's
increased responsibilities,the NASAadministratorappointed
five non-NASAmembers as consultants (propulsion,rocketry,
humanfactors, and nuclearspecialists). Sometimes consultants later moved into active panel membership;sometimes
formerpanel members became consultants after theirsixyear terms. The logic behindthese rotationswas acquired
expertise: once these specialists understoodNASAactivities,
the NASAadministratorand ASAPstaff directorwere reluctant to let them go. As a result, the entire panel consisted of
experts (most were retiredCEOsof aerospace firms)who
had become familiarwith NASAactivitiesand personnel.
These changes, along with ASAP'scompliancestrategy, created what was thoughtto be a qualifiedand influentialunitfor
protectingsafety in the program.
ASAP's compliancestrategy includedconductingfact-finding
sessions at NASAcenters and contractorsites to investigate
safety issues. These issues came to panel members' attention in variousways. The NASAadministratorrequested investigations. The ASAPstaff directorlearnedof safety
problemswhile attendingmeetings at centers and with contractors,referringthem to panel members to investigate in
on-site visits. Occasionally,congressionalcommittees requested specific informationfrom the panel. Sometimes
ASAP members discovered problemsat an investigativesite.
In 1985, the year precedingthe accident, the full panel conducted seven fact-findingsessions, and individualpanel
members conducted forty-seven, meeting at NASAheadquarters,seven NASAcenters, six contractorsites, Vandenberg AirForce Base, and three other locations (Aerospace
Safety AdvisoryPanel, 1986, 1: 25-28). Panel members attempted to negotiate safety issues at the lowest possible
level, then went to the top, as necessary: the contractorvice
presidentor chief engineer, then the NASAprogrammanager, associate administrator,or administrator.
ASAP members gave personalfeedback to the people with
whom they had contact. The panel sent formalstatements of
findingsand recommendationsto the centers and contractors,who responded in writingto each recommendation.
These statements were forwardedto NASAheadquarters.
ASAPannuallyconveyed findingsand recommendationsto
Congress and the NASAadministratororallyand in an annual
report(PresidentialCommission, 1986, 5: 1488). Createdby
Congress ratherthan NASA,ASAP reportedto Congress as
partof the annualcongressionalauthorizationof NASArequiredby the 1958 Space Act. The process of authorization
itself was a form of social control,frequentlyleadingto
hearingson controversialissues. NASA'sresponses to ASAP
recommendationswere conveyed to Congress in the following year's annualreport.
Althoughthe role of ASAPexpanded and changed over the
years, and its annualreports(1984, 1985, 1986) indicatean
active explorationof problemsand risks,the Presidential
Commissionfound no indicationthat the solid rocket booster
243/ASQ, June 1990
jointdesign or associated flightanomalieswere assessed by
ASAP (1986, 1: 161). The Commissionattributedthis failure
of foresight to the panel's "breadthof activities"(1986, 1:
161). This panel did have vast oversight responsibilities.The
limitationsof a nine-memberpanel (workingon average 30
days per year, aided by five consultants called in sporadically)
on discoveringall problems in the NASAenterpriseare obvious. To attributethe panel's failureto discover the problematic O-ringsto breadthof activitiesalone, however, suggests
time and system size were the only constraints.Such a conrelations
clusion overlooksthe effects of interorganizational
on social control.
Dependencies on NASAthat were incorporatedinto ASAP's
originaldesign compromised independentreview. ASAP's
status was strictlyadvisoryand underthe authorityof the
NASAadministrator(PresidentialCommission, 1986, 1: 161;
Egan, 1988). The administratorappointedpanel members,
suggested concerns and specific interests for panel inquiry,
and ultimatelymade decisions about panel recommendations.
Because the panel was primarilyguided by the concerns and
interests of the NASAadministrator,the staff director,and
Congress, the amount of time remainingfor originaldiscovery
could not have been much. Moreover,the panel experienced
the obstacles normallyencountered in externalcontrolof an
autonomous structure.Inthe beginning,ASAPmembers
were qualifiedin aerospace but were not experts on NASAor
the shuttle program.This obstacle apparentlywas overcome,
as evidenced by the eventual eliminationof NASAmembers
from the panel. But this alterationcoincidedwith panel
members' development of informalassociations that were
importantto penetratingthe maze of NASAlife. The development of informalconnections between the aerospace experts
on the panel and NASAand contractorpersonnel no doubt increased the panel's abilityto investigate and negotiate in a
manneressential to an effective compliancestrategy. Still,
ASAPmembers were not involvedin day-to-dayactivities,and
much of what went on eluded them. The resultwas that the
panel remaineddependent on NASAand contractorpersonnel
for information.
While informationaldependencies partiallyresolved the difficulties resultingfrom ASAP'sexternality,they curtailedthe
panel's fact-findingcapabilityin anotherway. What constituted a problemand the panel's definitionof the seriousness
of the problemwere shaped by the informationthat was
given to them and by the definitionsof seriousness held by
NASAand contractorpersonnel.With littleopportunityfor
proactiveinvestigationand not receivinga formalrequest
from NASAadministratorsto investigate the solid rocket
booster jointanomalies, ASAPwas dependent on Thiokoland
NASApersonnel to alertthem to the O-ringproblem.As the
ASAPstaff directorcommented on the Challengertragedy,
"Sometimes people don't tell the whole story. Morton
'Thiokoldidn'ttell us the whole story. MarshallSpace Flight
Center didn't.If people aren'tforthcoming,we are limited"
(Interview,2 March1988).
The extent and directionof the effects of interdependenceon
the monitoringand investigatingof the Aerospace Safety Advisory Panel are unknown,though the economic importance
244/ASQ, June 1990
NASA and the Challenger
of the space programmay have had an effect on safety regulation.Economists generallyagree that the space programis
vitalto the technologicalstandingof U.S. industry(Congressional Budget Office, 1988: 68-74). Panel members were
drawn primarilyfrom the aerospace industry,but, as noted,
interdependencebetween industryand government may either enhance or impede regulatoryefforts. Informalassociations with NASAand Thiokolpersonnel also may have
affected ASAP's safety surveillance.Likeinterdependenceat
the macro-level,informalorganizationeither may subvert or
advance the goals of an organization(Roethlisbergerand
Dickson, 1947). Whetherthese informalassociations coopted
or improvedASAP's monitoringand investigationremains
open to conjecture.What is certainis that ASAP,like the
other regulatoryunits, had littleauthorityto sanction when inappropriatebehaviorcontinued.
BARRIERSTO EFFECTIVE
SANCTIONING
Sanctionsare an importantresource, and, whether invokedor
not, they increase the power of regulatorsand thus the potentialto achieve compliance(Hawkins,1983: 68). Interdependence, however, bears importantlyon the abilityof
regulatorsto threaten or impose meaningfulsanctions. Although NASAadopted a compliancestrategy-negotiation
and regularmonitoringto secure conformity,ratherthan an
adversarialstance-the capacityto rewardand punish, necessary to a compliancesystem as a lever to persuade, was
not written into the chartersof the regulatoryunits. Instead,
all three were dependent on NASAto invokesanctions in
their behalf. Subordinatepositioningplus the absence of an
independentsanctioningcapabilitymeant that the setting of
prioritiesand the resolutionof safety issues were not likelyto
be joint, but a functionof hierarchy(Blau,1964; Wilson and
Rachal,1977).
The efficacy of a compliancestrategy in a self-regulating
system in which regulatoryunits are dependent on the regulated organizationfor formalsanctions (amongother resources) deserves inquiry.The goal of a compliancesystem is
to achieve complianceand avoid sanctioning;nonetheless,
the threat of sanction impositionis considered an important
enforcement tool. Althoughresearchers have explored how
the characteristicsof sanctions and variationin their use affect compliancewhen legallyempowered agents are in an
adversarialpositiontoward potentialviolators(Hawkins,1984;
Reiss, 1984; Manning,1989), we know littleabout the use
and efficacy of sanctions in compliancesystems in which
regulatorsare relianton the regulatedorganizationto enforce
in their behalf.
Withoutsanctions of their own, these safety units' abilityto
achieve compliancewould be affected by (1) NASAand contractorwillingness to comply voluntarilywith suggested
changes and (2) absent voluntarycompliance,the effectiveness of the sanctions to which they had access, however indirectly,to serve as a lever to persuade. No doubt NASAand
its contractorsvoluntarilycompliedon manyof the problems
that safety regulatorsrecommendedthey address. Symbioticallyinterdependent,NASA,contractors,and the safety regulatoryunits were linkedby a common goal: to prevent
245/ASQ, June 1990
accidents. NASAand its contractorswere joined in continuing
buyer-sellerarrangementsdue to NASA'sneed for shuttle
components and the contractors'relianceon NASAas a lucrativesource of income. NASAand shuttle contractorsdepended on the safety units for informationcriticalto accident
preventionand, thus, attainmentof the space shuttle's scientific and militarygoals. The regulatoryunits, NASA,and the
contractorsall stood to benefit from the shuttle's success by
prestige, increased resources, expanded domain,or simply
continuedfunctioning;in the case of failure,one or more
might suffer from fundingcutbacks or even programdemise.
Symbioticinterdependenceguaranteedcooperationin furtherance of shared interests. NASAand its contractorswould
strive for complianceon problemsthat both regulatorand
regulateddefined as serious safety issues. When disagreement occurredabout whether or not a problemshould receive attentionor about prioritizing
those problemsthat
should, however, NASAadministratorswould determinethe
outcome. One possible result might be concerted noncompliance: NASAadministratorsdisagree with the regulators
and so do not invoke sanctions to alter noncompliantbehavior.Should NASAadministratorsagree with regulatorsand
invokesanctions, however, then compliancewould turnupon
the effectiveness of NASA'ssanctions at convertingnoncompliance into compliance.To explore sanction effectiveness,
one must consider the deterrentpotentialof penalties invoked as threats in a compliancesystem. Deterrence research, which explores the relationshipbetween punishment
and individualbehavior,stresses the importanceof the perceived and actualcertaintyand severity of sanctions imposed
ratherthan their statutoryexistence (Williamsand Hawkins,
1986). The assumption is that behavioris guided by the probabilityof punishmentbeing meted out and the severity of that
punishment.The certaintyand severity of punishmentmeted
out is considered here: when NASAadministratorsinvoke
sanctions on behalf of regulatorsas a threatto achieve compliance,what is the likelihoodthat the threatwill be fulfilled,
and, if so, what is the natureof the punishment?
Compelling Compliance
Contractsare mechanisms for controlof both individualand
organizationalbehavior(Heimer,1985; Stinchcombe, 1985).
NASAexerts formalcontrolover both NASAemployees and
contractorsresponsiblefor shuttle components throughcontracts, and behavioris subject to periodicformalreview.
These evaluationsaffect financialremunerationas specified in
the contractas well as its continuation.When sanctions are
directed at the financialwell-beingof individualsand organizations in a symbiotic relationshipwith the sanctioningauthority,the harshness of sanctions tends to be mitigatedby
negotiationand compromise. NASAmanagement's use of
contracts on the safety regulators'behalf reveals the constraints of interdependenceon the regulators'abilityto control safety problems.
Sanctioning employees. Keyto understandingcontractsas
a mechanism for controlof employees is that promotion,
raises, and contractrenewal are status system rewards
(Stinchcombe,1985: 133-134). Status systems with these
246/ASQ, June 1990
NASA and the Challenger
incentives are intendedto encourage careers and, thus, commitment and discipline.Consistent with a premonitorycompliancestrategy, the employee contractoffers the possibility
of both positive and negative sanctions, contracttermination
being one option. NASA'suse of these sanctions for all employees is unknown,but other researchand NASA'spostaccident treatment of executives suggests the safety units'
regulatoryefforts would not have been well-served by them.
Katz(1977) argued that self-regulatingorganizationstend to
practice nonenforcementor to punish so discreetly that the
internalactions being sanctioned are condoned ratherthan
condemned. Organizationssolidifyinternalauthorityand deflect external regulatoryauthoritiesfrom interveningby covering up internaldeviance. Further,superordinatestend not to
respondto deviance officiallybecause of enforcement tradeoffs. Decisions not to enforce safety rules are commonly
tradedfor compliancewith productionstandards,for example
(Katz,1977: 10). Certainlythe tendency toward nonenforcement and discreet punishmentwill varywith the questionable
behavioras well as with an organization'sdependence on the
employee. Position,skills, experience, competence, integration, and replaceabilitywill bear upon the latter.NASA'spostaccident treatment of executives closely associated with the
controversialdecision to launchChallengerconfirms Katz's
argument:Some managerstook voluntaryretirement,some
received lateraltransfers, some remainedin their positions,
but none were terminatedor even publiclycastigated by
NASA.
Sanctioning contractors. NASAmonitoredcontractorsby
"incentive/awardfee contracts"(U.S. House Committee on
Science and Technology,1986a: 179). These contracts primarilymanipulatedrewards,althoughnegative sanctions in
the event of component failurewere also written into them.
The amount of the incentivefee was based on contractcosts
(lower costs yield a largerincentivefee), timely delivery,and
successful launchand recovery.The awardfee focused on
the safety recordof the contractor.Two facts lead to skepticism about NASA'sabilityto employ sanctions effectively
when necessary to secure contractorcomplianceon safety
issues.
First,NASA'sincentive/awardfee contractitself prioritized
cost saving and meeting deadlines over safety (U.S. House
Committee on Science'and Technology, 1986a: 179-180).
The incentivefee, rewardingcost savings and timely delivery,
could total as much as 14 percent of the value of the contract;the awardfee, rewardingthe contractor'ssafety record,
could total a maximumof 1 percent. No provisionsexisted for
performancepenalties or flight anomalypenalties. Absent a
majormission failure,which entaileda large penaltyafter the
fact, the fee system reinforcedspeed and economy rather
than caution (U.S. House Committee on Science and Technology, 1986a: 179). Althoughin traditionaldeterrence research the characteristicsof sanctions as defined by statute
are regardedas less significantthan perceptionsof their use,
the characteristicsof sanctions as defined in contractsappear
to have had significantimplicationsfor contractorsafety complianceat NASA.As the House Committee on Science and
247/ASQ, June 1990
Technology(1986a: 182) commented on the contracting-fee
system,
. . . so long as [contractor]managementis convincedthat a festering
problemlikethe [0-ring]seal problemis not likelyto cause mission
failure,there is littleincentivefor the companyto spend resources
to fix the problem.In fact, if the solution involves significantdelays
in delivery,there may be a strong financialdis-incentivefor the companyto pursue a short-termsolutionaggressively.
Even the possibilityof contractloss appearsto have reinforced productioninterests at Thiokol,not safety. Post-accident investigationssuggest that Thiokolmanagersapproved
the launchover engineeringobjections because launchdelay
mightjeopardizethe company's ongoing contractnegotiations
to continue producingthe solid rocket booster for NASA
(PresidentialCommission, 1986, 1: 104; McConnell,1987:
180-181).
Second, while NASA'suse of the contracting-feesystem with
all contractorsis unknown,no evidence exists that sanctions
were used to enhance safety complianceat MortonThiokol
priorto the Challengerlaunch.There had been more than
twenty-five occurrences of O-ringerosion and relatedSRB
anomaliesat the time of the accident. Thiokolhad never been
penalized,nor was there evidence that punishmenthad been
threatened (U.S. House Committee on Science and Technology, 1986a: 181). Rather,at the time of the Challengeraccident, Thiokolwas eligibleto receive a near-maximum
incentivefee of approximately$75 million.Furthermore,
safety and proceduralviolationsoccurredat Thiokol'sUtahfacilities over the years, several resultingin fires and/orexplosions. Again,the persistence of the problemindicatesthe
failureto achieve complianceeither throughnegotiationor
sanctions invokedas threat. Even after these violationsbecame public,Thiokolwas not penalized,as is customaryupon
negotiationfailurein compliancesystems (U.S. House Committee on Science and Technology, 1986a: 181). NASAcontracts presented two standardsthat sometimes could not be
met simultaneously:(1) cost savings and timely deliveryand
(2) safety. When rewardswere great for cost savings and
meeting deadlines and punishmentwas not forthcomingfor
safety infractions,contractorswould tend to alter their priorities accordingly.Thiokoldid comply, but with NASAproduction interests, not with safety standards.
NASA'sfailureto punish past safety violationsbears importantlyon any NASAattempts to negotiate contractors'compliancewith safety standards,for historicsanctioningpatterns
may affect contractors'willingness to comply duringa current
negotiation.If punishmenthas not been imposed in the past
in response to violationsthat resulted in harmthat became
publicknowledge, then why should contractorsbe quickto
respond to punishmentinvokedas threat in early phases of
negotiation?A resource dependence perspective would predict that, absent an equallyattractivealternativesupplier,
punishmentwould be mitigatedby NASA'sdependence on
the contractorfor the shuttle component. Symbioticallyinterdependent, both would be harmed.Inthe event that punishment had to be inflicted,NASAwould also experience
consequences if that punishmentinterferedwith the quality
of the productor the contractor'sabilityto produce it on
248/ASQ, June 1990
NASA and the Challenger
schedule. The harsherthe punishment,the greaterthe probabilitythat NASAwould also incurcosts. The tendency, then,
would be for NASAto mitigatethose costs by not punishing,
or, if punishmentwere inflicted,to minimizecosts if possible.
This hypothesis is confirmedby NASA'spost-accidenttreatment of Thiokol.TerminatingThiokol'scontractwas the
harshest sanction availableto NASA.But NASAdid not terminate the contract.To have done so would have resulted in
costs for NASA'sshuttle program.Johnsrud(1988) found that
many companies in the defense and aerospace industriesdevelop structuraland operationalcongruencies and complementaritieswith the federal government because government
(includingNASA)represents such a stable and often lucrative
marketfor products.Congruenciesare similaritiesin workgrouporganization,operatingprocedures,and communication
patternsthat aid in jointendeavors. Complementaritiesare
differences between these factors that facilitatethe achievement of shared interests. Congruenciesand complementarities affect the awardingof primeand subcontractsfor
productsand services, creatingcontinuingmutualinterdependencies for resource exchange (Johnsrud,1988: 5-6). TerminatingThiokol'scontractand beginningwith a new SRB
contractorwould have created shuttle programdelays and
perhaps new safety hazardswhile the kinksgot worked out
of the interfaceproblems between both organizationaland
technicalsystems.
Instead, NASAimposed the penaltyfor component failure
that was written into the contract.The designated penalty
was altered in subsequent negotiationsbetween NASAand
Thiokol,however. While certainlythe cost to Thiokolwas
great, it was not as great as it might have been. Accordingto
Thiokol'scontractwith NASA,a reductionof $10,000,000 in
incentivefee earned would ensue if failureof the solid rocket
motor/motorsresulted in loss of life and mission (U.S. House
Committee on Science and Technology,1986a: 181). Further,
any contractorresponsiblefor component failuremust sign a
document admittingresponsibilityfor the resultingaccident,
addingsocial stigma and legal liabilityto the financialloss.
Admissionof legal liabilitymight result in other financialrepercussions, such as limitinga contractor'sabilityto compete
successfully for futuregovernmentcontractsand vulnerability
to suit by privateparties.Thiokolwas unwillingto accept the
"fullcontractualpenalties" due the manufacturerof a failed
component (U.S. House Committee on Science and Technology, 1986a: 181). Thiokolwas willingto forfeitthe money
but unwillingto sign the document and was prepared,to litigate the issue. The willingness to take adversarialaction
raised the specter of additionalcosts for both: symbiotic interdependence would be joined by competitive interdependence if each began to use resources to thwartthe litigation
goals of the other.
Both organizationswere concerned with conserving resources and maintainingestablished routines.NASAand
MortonThiokolmade an agreement in orderto "avoidlitigation and keep priorityon returningthe shuttle to flight,and
bypasses [sic] the question of the company's liabilityfor the
accident" (AviationWeek and Space Technology,1987: 28).
Instead of the $10,000,000 contractpenaltyfor the failure,
249/ASQ, June 1990
NASAand MortonThiokolagreed that Thiokolwould "voluntarilyaccept" the $10,000,000 reductionin the incentivefee it
had earned underthe contractat the time of the accident
(1987: 28). By voluntarilyforfeiting$10,000,000 of its profits
in lieu of the contractpenalty,Thiokolavoided signing the
document admittinglegal liability.Thus, Thiokolremainedeligible to bid on futuregovernmentcontracts.Thiokoldid agree
to performat no profitapproximately$505 millionworth of
work requiredto redesign the field joint, reworkexisting
hardwareto includethe redesign, and replacethe reusable
hardwarelost in the Challengeraccident (MarshallSpace
FlightCenter, 1988).
With the bargainingand compromise characteristicof both
competitive and symbioticallyinterdependentregulatoryrelationships, the outcome was negotiated in the interest of each
organizationand shared programgoals. Bargainingis a consequence of interdependence,but it may have an independent
effect on sanctioningundercontractualagreements that requirecooperationin the doing of the contractedwork and/or
in the regulationof it. When bargainingbecomes institutionalized between parties,adversarialstrategies would violate the
norms of the relationshipand so would tend to be constrained. Inaddition,adversarialstrategies might alterthe future characterof the workingrelationship,thus posing
potentialadditionalcosts for one or both organizations.
Stinchcombe (1986: 234) noted that when an exchange relationshipis continuous,currentexchange is modifiedby the
expectation of future exchange. Because of institutionalized
bargainingas well as interdependence,then, the full contractual promise regardingharshness of penalties to be carried
out is not likelyto be fulfilled.
Alternative sources of sanctions. Availablealternativescan
alter power-dependence relations(Blau,1964). SR&QAand
the Space Shuttle Crew Safety Panel had no alternative
sources of officialsanctions besides those NASAmanagement controlled.The Aerospace Safety AdvisoryPanel did,
however. ASAP reportedits findingsannuallyto Congress.
Congressionalresponse to these findingsultimatelymanifested itself in budget appropriations.It was throughthe
budget that Congress could respondto ASAP's concerns by
sanctioningboth NASA'sinternalactivitiesand contractorrelations, but congressionalinvocationof sanctions on behalf of
ASAPwould be uncertain.
As an external regulatorsubject to the limitationsof autonomy, Congress would have difficultymakingjudgments
concerningtechnicalcontroversiesbetween NASAand ASAP
because its members lackaerospace engineeringtraining.
Historically,NASAhad authority,bestowed by Congress, over
ASAPrecommendations.Inaddition,on both organizational
and technical matters, NASAwas consulted by the agencies
regulatingcommercialspace ventures to such an extent that
it was NASA'sterms and conditionsthat shaped government
regulatorypolicies (Levine,1986). In a dispute between NASA
and ASAP,the tendency would be for the agency's expertise
and experience to carrythe day on a controversialissue. This
conclusion is supportedby my analysis of ASAPrecommendations for action on safety matters submitted to NASAand
250/ASQ,June 1990
NASA and the Challenger
Congress in annualreportsand NASA'sitem-by-itemresponses publishedin those reports.
If Congress did invoke sanctions, they would not be likelyto
threaten seriously the progress or survivalof the American
space program.NASAand Congress were symbioticallyinterdependent. Congress (as well as other branchesof government) was dependent on NASA'smonopolyin meeting U.S.
goals for space science and militarysupremacy; NASAwas
dependent on Congress as its primarysource of funding.As
previouslynoted, symbiotic interdependencecan enhance
social control,and the space agency's extreme vulnerability
to
budgetaryfluctuationswould suggest a readiness to comply
(PresidentialCommission, 1986, 1: 164-177; U.S. House
Committee on Science and Technology,1986a: 116-131).
Yet such readiness may not always result in compliance,for
a government agency can deny and avoidthe authorityof
government regulators.An agency's tasks are legislatively
mandated,and it can defend itself by mobilizingallies elsewhere in government who share a stake-material or ideological-in the agency's well-being(Wilsonand Rachal,1977).
But symbiotic interdependencealso can inhibitsocial control.
Regulatorsare often constrainedin penaltyuse because the
regulatedorganizationis thought to be acting in the interest
of the publicat large (Vaughan,1983: 47-50). When that organizationis the majoror only supplierof a service to a large
population,it is even less vulnerableto social control(Zald,
1978: 92). Yet this tendency may not be consistently realized,
for in the face of uncooperativebehavior,the regulatormust
resort to using sanctions, not only to assure compliancebut
also to protect its credibilityas a watchdog against symbolic
assaults on its authority(Hawkins,1983: 40).
The consequences of autonomyand symbiotic interdependence between NASAand Congress would be the mitigation
of ASAP's efforts to bringa recalcitrantNASAinto compliance. This conclusion,while speculative, can be reinforced
theoreticallyby shiftingthe analyticalfocus, in keeping with
the idea that the hierarchicalnatureof organizationalforms
allows us to applyconcepts, models, and theories in multiple
contexts (Vaughan,1990). If we consider the U.S. government as the organizationalunitof analysisand one of its goals
as U.S. militaryand space supremacy in the international
arena,Congress and NASAcan then be viewed as subunitsof
the largerorganization.Congress becomes an internalregulatorwith oversight responsibilitiesfor the space agency, itself an internalunit. Fromthis perspective, the U.S.
government is a self-regulatingorganization,and Katz's(1977)
insightapplies: Self-regulatingorganizationstend to practice
nonenforcementor to punishso discreetlythat those internal
activitiesthat are sanctioned are condoned ratherthan condemned. Despite the availabilityof an alternativesource of
sanctions that would appearto increase ASAP'spower over
NASA,interdependencebetween NASAand Congress would
tend to mitigate use of those sanctions. Resource exchange
affected the sanctioningcapabilitiesof all three safety units,
with the result that NASA,designed to be self-regulating,remained so.
251/ASQ, June 1990
AUTONOMY,INTERDEPENDENCE,
AND
SOCIALCONTROL
Accident preventionwas essential to NASA'scompetitive
success; consequently, multiplestrategies and systems were
employed to assure safety. The extensive programfor crew
training,the 122,000 pages of documents pertainingto safety
now stored at the NationalArchives,the four volumes of
items routinelychecked in each pre-launchcountdown, and
even the midnight-hourteleconference on the eve of Challenger's launchare a few of NASA'smany formaland informalprecautionarymeasures. NASA'ssafety regulatory
structurealso reflected the space agency's concern with
safety. It was designed to providethe balancedscrutinynecessary to safeguardthe shuttle program:internaland external
review units using a compliancestrategy. The internalunits,
staffed by NASApersonnel,would be capable of close monitoring.To assure objective review, they would be physically
separate from the programsthey were to regulate.The external unitwould, by definition,be separate. To providea
close monitoringcapability,it would be guided by NASApersonnel formallyappointedto the panel. While an analysis of
NASA'sentire safety system is beyond the scope of this research, my investigationof the three safety units indicates
that just as cautionwas designed into the NASAsystem, so
was failure.Autonomyand interdependenceinterferedwith
regulatoryabilityto discover, monitor,investigate,and sanction in the interest of safety, decreasing the probabilitythat
developingproblemswould be identifiedand corrected.
The NASA/contractor
system's autonomyobstructeddiscovery, monitoring,and investigationof safety hazards.Size,
structure,changingtechnology, specializedlanguage,and numerous transactionscreated barriersfor both internaland externalregulatoryunits. The externalregulator,the Aerospace
Safety AdvisoryPanel, did not discover the 0-ring problem.
Even when ASAP became sufficientlyattuned to NASAand
contractoractivities not to requireNASAmembers on its
staff, this change did not eliminatethe constraintsautonomy
placed on the panel. The panel's surveillancecapabilitywas
still limitedby its absence from dailyNASAactivities,so it remained dependent on informalrelationswith NASA-contractor
personnel for the informationnecessary to regulate.Despite
being located internally,SR&QAand the crew safety panel
also had problems in discovery, monitoring,and investigation,
due to the size, complexity,and burdensometechnicalpaperwork of the NASA/contractor
system. The crew safety panel
did not address the 0-ring problemin its meetings. SR&QA
identifiedthe problembut failed at other monitoringand investigative responsibilitiesthat led to insufficient,contradictory, and sometimes inaccurateinformationabout the 0-rings
being circulatedthroughoutthe NASAsystem. Informational
dependencies, previouslynoted only in researchon interorganizationalregulatoryrelations,existed in all three cases, although data are insufficientto understandtheireffects. Also,
the data do not allow us to investigatethe possibilityof cooptation, frequentlya consequence of continuingregulatoryrelations.
Regulatoryineffectiveness at NASAcannot be attributedonly
to problems associated with autonomy,however. Although
252/ASQ, June 1990
NASA and the Challenger
interdependence primarilyaffects regulators' ability to
threaten and impose meaningful sanctions, here it also affected surveillance. Symbiotically interdependent with NASA,
both internal regulators relied on the NASA organization for
resource allocation and legitimacy, which impaired their ability
to discover, monitor, and investigate hazards. NASA eliminated the crew safety panel five years before the Challenger
tragedy, and its budget cuts and personnel transfers depleted
the resources SR&QA required for effective surveillance. The
external regulator, ASAP, never became the independent
problem-defining entity Congress intended; its original mandate made it dependent on the direction of the NASA administrator, its staff director, and Congress. Moreover, all three
regulatory units reported to the parts of the NASA organization they were intended to regulate. Consequently, all three
were dependent on the NASA management structure for
transferring information and recommendations about safety
problems throughout the organization and for implementing
suggested changes. Thus, interdependence also reduced the
probabilitythat risky technical and managerial systems would
be identified and corrected.
The dependent condition of these units was reinforced not
only by the reporting system, but by the fact that none of the
units had sanctions of its own to impose. When threat of
sanctions or sanction imposition was necessary to compel
compliance, regulators were dependent on NASA to use contracts to achieve safety goals. Although we have little information on the effects of social control at NASA on its
employees, the effectiveness of the NASA/Thiokolcontract
as a lever to compel safety compliance was undermined not
only by symbiotic interdependence, but also by the incentives
NASA encoded in the contracts. In the Space Shuttle Program, the power advantage lay with the regulated, not the
regulators. Here we see not only the regulatory contribution
to this technical failure, but also NASA's. The space agency
created a regulatory structure and controlled its operation.
Over time, however, NASA administrators altered that structure. By so doing, they altered the information available to
them about hazards in the Space Shuttle Program, hence altering the bases on which still other critical decisions were
made. One of them was the decision to launch the Space
Shuttle Challenger.
In addition to clarifying the-organizational contribution to this
technical system accident, this analysis demonstrates the analytic utility of the concepts of autonomy and interdependence for both intra-and interorganizational regulatory
relations. Moreover, it raises the possibility that autonomy
and interdependence, formerly associated only with official
regulatory relations between legally empowered agents of
social control and business firms, may systematically inhibit
regulation, regardless of the nature of the regulated enterprise. Consequently, we might benefit from research using
these concepts in intra- and interorganizational settings that
diverge from the traditional legal actor/public enterprise
model, so that we may understand regulatory relations better.
From these data, we may begin to develop a general theory
of the social controlof organizations.
253/ASQ, June 1990
The uniqueness of the Challenger incident limits making
broad claims on the basis of this case study. In addition,
available data limit what can be concluded about this organizational-technical system accident. We can conclude that the
organizational patterns uncovered were correlated with the
accident, but no direct evidence exists that allows us to assert that these organizational patterns caused the accident.
Even the conclusions about correlation must be accompanied
by a caveat. Studying a specific technological failure obscures
those instances in which autonomy and interdependence of
regulators and regulated may have forestalled an accident.
How many times did the externality of ASAP result in discovery and investigation of a problem that insiders would
hesitate to reveal to NASA administration? How many times
did internal regulators identify and pursue a problem that only
NASA employees closely involved in daily activities could
identify? How often did contractual ties between organizations represented by ASAP members and NASA, or informal
ties between individuals in the two organizations, result in an
investigation that otherwise would not have occurred?
The precise trade-off between the negative and positive effects of autonomy and interdependence on safety regulation
at NASA are uncertain. The possible benefits suggested
above, however, are threatened by the comparative powerlessness that results when the regulators are dependent on
the regulated organization for information, financial resources,
personnel, communicating information about hazards, implementing suggested changes, or imposing sanctions. Quality
negotiation and investigation brought to bear on a particular
problem deserve less celebration if many other problems go
untended because of inadequate resources, if members of
the regulated organization don't receive warnings about
hazards, or if recommendations for change aren't heeded.
Regulation itself appears to be risky business, subject to uncertain trade-offs that result from autonomy and interdependence. Strategies of social control selected for their potential
to increase regulatory effectiveness are likely to be undermined in subtle, complex ways by the disadvantages. This is
not to argue that failure is inevitable. The probabilityof
failures of foresight clearly decreases as regulatory resources
increase. Personnel changes and/or increasing resources to
strengthen surveillance and sanctioning capabilities may result in efficiency and effectiveness in regulating a specific
problem. But the structure of regulatory relations will continue to generate patterned obstacles to social control. Autonomy and interdependence are fundamental to the
interaction of social control agents and regulated organizations, so they inhibit the social control of organizations regardless of available skills, resources, and commitment to
fulfill the regulatory mandate.
All of the above leads to the conclusion that if both negative
and positive consequences are systematically associated with
intra- and interorganizational regulatory relationships, then
regulators cannot be relied upon to prevent accidents. Clarke
(1988: 30) noted that "closer attention to interorganizational
relations should provide valuable insights into assessment,
distribution, mitigation, and acceptability of risk." In designing
254/ASQ, June 1990
NASA and the Challenger
strategies for the social control of -riskytechnology, intraorganizational relationships also need to be taken into account.
A logical assumption is that organizations producing high-risk
technological products will play an active role in their own
regulation, if for no other reason than because they have the
technical knowledge to do so. Self-regulating systems, however, are "fundamentally suspect" (Shapiro, 1987: 646). Any
organizational system that, like NASA, regulates resources
and their exchanges, in effect, concentrates influence over
those resources (Pfeffer and Salancik, 1978: 51). As a consequence, self-regulation of risky technical enterprise may, by
definition, be accompanied by dependencies that interfere
with regulatory effectiveness, despite what may be well-intentioned attempts to create a regulatory system with the capacity to regulate vigorously and effectively (Hall, 1982: 132).
Of particularconcern are high-risk technological products produced and regulated by government (Wilson and Rachal,
1977).
Many advocates of policy for regulating risk focus on technical failure. Morone and Woodhouse (1986) and Perrow
(1984), for example, first distinguish technical systems by
their potential for failure and catastrophe, assign them to categories according to risk potential, then suggest policy that
varies according to the risk category to which a particular
technical system has been assigned. Assessment of risk is
fundamental to policy development, but policy advocates err
in suggesting policy based on definitions of risk derived from
technology alone (Freudenburg, 1988). Clearly, a technical explanation is insufficient to explain the Challenger tragedy. The
existence of organizational patterns that contribute to failures
of foresight increases risk. Moreover, any system runs a risk
of failure when human actors are involved. Policy makers and
advocates need to take into account the organizational contribution to technical system accidents when defining technical
systems as more or less risky for the purpose of selecting
strategies of social control.
This case study does not generate the sort of comparative information on which definitive policy statements can be
made, however. While autonomy and interdependence between regulatory and regulated organizations predictably will
mitigate social control efforts, we do not know the dynamics
of arrangements other than those observed here, so we do
not know which arrangements offer the greatest or least potential for reducing organizational-technical system accidents.
Until we systematically assemble data on the relationship between autonomy, interdependence, and social control in diverse types of regulatory settings, we have no basis for
distinguishing regulatory systems by their potential for failure
or success or for assigning them to categories according to
risk potential, as Morone and Woodhouse (1986) and Perrow
(1984) have done with technical systems. Furthermore, even
when comparative data are available, difficulties in measuring
variation in autonomy and interdependence may mean our
assessments necessarily will be imprecise. Finally, both preventive strategies and post-accident attempts to correct the
organizational contribution to technical system accidents are
handicapped by our lack of skill at converting research
findings into diagnosticrecommendationsfor organizations.
255/ASQ, June 1990
REFERENCES
Aerospace Safety Advisory Panel
(ASAP)
1973 "Responsibilityin the Space
ShuttleProgram."Internal
mimeo. Washington,DC:
Aerospace Safety Advisory
Panel.
1984 AnnualReportCoveringCalendarYear1983. Washington,
DC:Aerospace Safety Advisory Panel.
1985 AnnualReportCoveringCalendarYear1984. Washington,
DC:Aerospace Safety Advisory Panel.
1986 AnnualReportCoveringCalendarYear1985. Washington,
DC:Aerospace Safety Advisory Panel.
Aviation Weekand Space
Technology
1987 "MortonThiokolwill forfeit
$10 millionin lieu of contract
penalty."2 March:28.
Bardach,Eugene, and RobertA.
Kagan
1982 Goingby the Book:The
Problemof RegulatoryUnreasonableness. Philadelphia:
Temple UniversityPress.
Blau, Peter M.
1964 Exchangeand Power in Social
Life.New York:Wiley.
Boisjoly, Roger
1986 Interviewtranscript,2 April.
MortonThiokol,Inc.files, NationalArchives.
Braithwaite,John, and Brent Fisse
1987 "Self-regulation
and the control
of corporatecrime."InClifford
D. Shearingand PhillipC.
Stenning(eds.), PrivatePolicing:221-246. Newbury
Park,CA:Sage.
Bunn, Wiley
1986 Interviewtranscript,17 April.
MarshallSpace FlightCenter
files, NationalArchives.
Clarke,Lee
1988 "Explaining
choices among
technologicalrisks."Social
Problems,35:22-35.
While we cannot make precise recommendations from this
research, we safely can conclude that intra- and interorganizational relations are characterized by structurally engendered
weaknesses that contribute to technical system accidents.
Because the sophisticated formulas used to estimate risk in
technical systems do not acknowledge the possible organizational contribution to technical failures, risk is always underestimated, creating unwarranted confidence in all risky
technological systems. Decisions to design, manufacture, and
use sophisticated technological products should be guided by
this knowledge.
Johnson Space Center
Congressional Budget Office
1974 Space Shuttle Program Direc1988 The NASAProgramin the
tive 4A, 14 April. National Ar1990's and Beyond.Washchives.
ington,DC: Congressional
1983 Space Shuttle Program ReBudget Office.
quirements Control Board DiCullen, FrancisT., WilliamJ.
rective, PRCBD S21701 R2, 7
Maakestad,and Gray Cavender
March. National Archives.
1987 CorporateCrimeunderAttack:
Johnsrud, Cristy S.
The FordPintoCase and
Beyond.Cincinnati:Anderson. 1988 "Conflict, complementarity and
congruence: The administraDiamond, Stuart
tion of cross-sector organiza1986 "NASAcut or delayed safety
tional linkages." Paper
spending."New YorkTimes,
presented at the 1988 Amer24 April:A-1, B-4.
ican Anthropological AssociaEgan, Daniel F.
tion Annual Meeting, Phoenix.
1988 "Theoriginsof the Aerospace Katz, Jack
Safety AdvisoryPanel."Un1977 "Cover-up and collective integpublishedmanuscript,Departrity: On the natural antagoment of Sociology,Boston
nisms of authority internal and
College.
external to organizations." SoFreudenburg,William R.
cial Problems, 25: 3-17.
1988 "Perceivedrisk,realrisk:so- Levine, Arthur L.
cial science and the artof pro- 1986 "Commentary: Space techbabilisticriskassessment."
nology and societal regulaScience, 242 (7 October):
tion." Science, Technology,
44-49.
and Human Values, 2: 27-39.
Hall, RichardH.
Magnuson, Ed
1982 Organizations:Structureand 1986 "Fixing NASA." Time, 9 June:
Process, 3d ed. Englewood
14ff.
Cliffs,NJ: Prentice-Hall.
Maley, Patrick James
Hammack,J. B.
1986 Memorandum to Alton G. Keel,
1986 "Space ShuttleCrew Safety
Jr., Executive Director, PresiPanel history."Internalmimeo
dential Commission on the
for PresidentialCommissionon
Space Shuttle Challenger Accithe Space ShuttleChallenger
dent, 18 April. National ArAccident,NationalArchives.
chives.
Hawkins,Keith
Manning, Peter K.
1983 "Bargainand bluff:Compliance1989 "Managing uncertainty in the
strategyand deterrencein the
British nuclear installations inenforcementof regulation."
spectorate." Law and Policy,
Lawand Policy,5: 35-73.
11: 350-369.
1984 Environmentand Enforcement: Regulationand the So- Marshall Space Flight Center
1982 "SRB Critical Items List," 17
cial Definitionof Pollution.
December. National Archives.
Oxford:OxfordUniversity
1988 Press release 88-58, 12 May.
Press.
McConnell, Malcolm
Heimer, CarolA.
1985 ReactiveRiskand RationalAc- 1987 Challenger: A Major Malfunction. New York: Doubleday.
tion: ManagingMoralHazard
in InsuranceContracts.
McDougall, Walter A.
Berkeley:Universityof Cali- 1985 The Heavens and the Earth: A
forniaPress.
Political History of the Space
Age. New York: Basic Books.
256/ASQ,June 1990
NASA and the Challenger
Morone, Joseph G., and EdwardJ.
Woodhouse
1986 AvertingCatastrophe:Strategies for RegulatingRisky
Technology,Berkeley:University of CaliforniaPress.
National Aeronautics and Space
Administration(NASA)
1967 EighteenthSemiannualReport
to Congress:July 1-December 31, 1967. Washington,
DC: NASA.
1968 NineteenthSemiannualReport
to Congress: January1-June
30, 1968. Washington,DC:
NASA.
1986 Reliabilityand QualityAssurance Publications,NHB5300.4
(1D-2).Washington,DC:
NASA.
Perrow, Charles B.
1984 NormalAccidents: Livingwith
High-RiskTechnologies.New
York:Basic Books.
Pfeffer, Jeffrey, and Gerald R.
Salancik
1978 The ExternalControlof Organizations:A Resource Dependence Perspective.New York:
Harperand Row.
Presidential Commission on the
Space Shuttle ChallengerAccident
1986 Reportof the Presidential
Commissionon the Space
ShuttleAccident,5 vols.
Washington,DC: U.S. Government PrintingOffice.
Punch, Maurice
1985 ConductUnbecoming:The
SocialConstructionof Police
Devianceand Control.London:
Tavistock.
Quong, Harry
1986 Interviewtranscript,11 April.
NASAHeadquartersfiles, NationalArchives.
Reiss, Albert J., Jr.
1984 "Selectingstrategies of social
controlover organizational
life." In KeithHawkinsand
John M. Thomas(eds.), EnforcingRegulation:23-35.
Boston: Kluwer-Nijhoff.
Roethlisberger, F. J., and William
J. Dickson
1947 Managementand the Worker.
Cambridge,MA: HarvardUniversity Press.
Roland,Alex
1985 "Theshuttle: Triumphor
turkey."Discover,6: 35-48.
Rumsfeld, Donald, and William E.
Kriegsman
1967 "A proposalfor an aerospace
advisorypanel:A way to close
the hazardevaluationgap."
NationalSafety News, October: 44-47.
Selznick, Phillip
1966 TVAand the Grass Roots: A
Study in the Sociologyof
FormalOrganization.New
York:Harperand Row.
Shapiro, Susan P.
1987 "Thesocial controlof impersonal trust."AmericanJournal
of Sociology,93: 623-658.
Sherman, LawrenceW.
1978 Scandaland Reform:ControllingPolice Corruption.Los Angeles and Berkeley:University
of CaliforniaPress.
Stinchcombe, ArthurL.
1985 "Contractsas hierarchical
documents." InArthurL. Stinchcombe and CarolA. Heimer
(eds.), Organization
Theoryand
ProjectManagement:AdministeringUncertaintyin Norwegian OffshoreOil: 121-171.
Oslo: NorwegianUniversity
Press.
1986 "Normsof exchange." InArthur L. Stinchcombe,Stratificationand Organization:
Selected Papers:231-267.
Cambridge:CambridgeUniversity Press.
Stone, ChristopherD.
1975 Where the Law Ends:The Social Controlof CorporateBehavior.New York:Harperand
Row.
Turner,BarryM.
1976 "TheOrganizational
and interorganizational
developmentof
disasters."Administrative
Science Quarterly,21:
378-397.
1978 Man-MadeDisasters. London:
Wykeham.
U.S. Congress
1959 NationalAeronauticsand
Space Act of 1958. (P.L.
85-568 72 Stat. 426, July
1958). U.S. Statutes at Large.
85th Congress, 2nd Session.
Vol. 72. Washington,DC: U.S.
GovernmentPrintingOffice.
1968 NationalAeronauticsand
AuthoriSpace Administration
zationAct of 1968. (P.L.90-67
81 Stat. 168, August 1967).
U.S. Statutes at Large.90th
Congress, 1st Session. Vol. 81.
Washington,DC: U.S. Government PrintingOffice.
U.S. House of Representatives
1967a Hearingsbefore the House,
Committeeon Science and
Astronauticson H.R.4450,
H.R.6470 (Supersededby
H.R.10340). 90th Congress,
1st Session. Washington,DC:
U.S. GovernmentPrintingOffice.
257/ASQ, June 1990
1967b House, Congressional
Record.90th Congress, 1st
Session. Vol. 113. Washington,DC: U.S. Government
PrintingOffice.
U.S. House of Representatives,
Committee on Science and
Technology
1986a Investigationof the ChallengerAccident.Report.
Washington,DC: U.S. Government PrintingOffice.
1986b Investigationof the ChallengerAccident.Hearings,2
vols. Washington,DC: U.S.
GovernmentPrintingOffice.
Vaughan, Diane
1983 ControllingUnlawfulOrganizationalBehavior:SocialStructure and Corporate
Misconduct.Chicago:University of ChicagoPress.
1990 "Organization
theory:A
method of elaboration."Paper
presented at "A Symposium
on Basic Social Science Precepts: What is a Case?,"
NorthwesternUniversity,
March2-3.
WallStreet Journal
1986 "Shuttledisaster puts spotlight
on safety: Trade-offfor performance is a criticalquestion."
4 February:A-2,A-26.
Wiley, MaryG., and Mayer N. Zald
1968 "Thegrowthand transformation of educationalaccrediting
agencies: An exploratorystudy
of the social controlof institutions." Sociologyof Education,
41: 36-56.
Williams, KirkR., and Richard
Hawkins
1986 "Perceptualresearchon generaldeterrence:A criticalreview." Lawand Society, 20:
545-572.
Wilson, James Q., and Patricia
Rachal
1977 "Canthe governmentregulate
itself?"PublicInterest,46:
3-14.
Yuchtman, Ephraim,and Stanley
Seashore
1967 "A system resourceapproach
to organizational
effectiveness." AmericanSociological
Review, 32: 891-903.
Zald, Mayer N.
1978 "Onthe social controlof industries."Social Forces, 57:
79-102.