1.1 Launching Shuttles and Airplanes: Analogies

Both NASA and the National Airspace System are government agencies responsible for moving objects and people through space. Monopolies in the USA, their respective systems and their successes or failures have symbolic meaning and practical implications for the leadership of the nation at home and globally. Also in common, both work on technologies that have “interpretive flexibility,” (Pinch & Bijker, 1984) so decisions about the safety and movement through space are made by highly skilled technical professionals. For both, all operations — organizational and technological — are driven by time, schedule, and deadlines. Moreover, historically their ability to achieve their goals has consistently been constrained by decisions by Congress and/or the Administration in power that have limited essential funding and other resources, thus changing the operations of these two organizations, their technologies, the workplace and work, increasing risk. I begin with NASA.

During the Apollo program (1961–1975) NASA was fully supported by Congress. The standards for engineering excellence behind the Apollo successes manifested in a NASA technical culture that relied on deference to in-house professional expertise, based on experiential knowledge gained by working closely on the technology. As the Apollo program neared completion, changes in US domestic and international affairs took priority over the Space Shuttle Program funding. NASA top administrators made a political bargain: they were only able to get the program approved by convincing Congress that the shuttle would essentially pay its own way, carrying “payloads” — scientific experiments for other programs and corporations — that would produce income because the shuttle would operate like a bus, transporting people and objects back and forth in space. At the predicted launch rate, the program would survive as a business, essentially becoming self-supporting. Thus, cost effectiveness became part of operations. Meeting the schedule was essential. For the middle managers and engineers assigned to the hardware, performance pressures and political accountability invaded the original technical culture (Vaughan, 1997).

The system effects of the political bargain on the organization was that the space agency became “bureaupathological,” with bureaucratic accountability becoming part of the cultural mix. NASA expanded its hierarchical structure by, for the first time, “contracting out:” rather than producing all component shuttle parts in-house, the agency would rely on contractors. Many engineers were assigned to coordinate and keep records with contractors, doing deskwork. Huge amounts of paperwork had to be turned around in order to qualify each of 9 shuttle components prior to each launch. The schedule was the problem, not money for hardware redesign. The budget was based on a launch rate that was never achieved. Unless data clearly indicated a component was a serious threat to flight safety, delay was out of the question. From the first shuttle launch through Challenger, the original technical culture, bureaucratic accountability, and political accountability coexisted.

Whereas the NASA system preexisted the shuttle program, the development of the airplane preceded the inception of a National Airspace System. As planes began to fly higher, pilots could no longer see the runways, so airport owners began using airport workers to signal pilots from the ground: their first technologies were signaling flags, binoculars, a wheel barrow, and an umbrella — the purpose of the wheelbarrow being to move everything from one end of the runway to the other when the wind changed. As planes began to fly even higher and greater distances and speeds, the sky became airspace, marked by artificial lines — boundaries — to keep planes from colliding. The system on the ground developed boundaries, too. Responding to the increasing capabilities of the airplane, air traffic controllers moved into Towers, then to high altitude Centers.

In order to move airplanes across the boundaries in the sky, controllers had to pass them across the boundaries on the ground to controllers in other locations — initially communicating via telephone connections; then, by airline telephone operators; then aided by blackboards listing planes and routes with controllers relying on compasses and maps, marking progress and direction. Radar was imported from Europe by the end of WW II. By then the system on the ground was divided into regions, establishing the formal structure of the air traffic control system both on the ground and in the sky. The legitimacy and technological development of the airplane resulted from the intertwined interests and resources of the airline, the military, and government, leading to interdependence of all three. The nascent air traffic control system became dependent upon them, reactive rather than proactive.

The contrast between the uneven development of the aviation system on the ground and the rapid development of airplane capabilities was stark (Vaughan, 2021). The military needed planes for war; the airline industry’s problem was competition with rail travel for passengers. The airlines used military innovations to develop a larger, faster commercial airplane that would beat the competition — not only with rail traffic, but within the airline industry in this country and internationally. With increased size, speed, and height, time, timing, and deadlines were driving movement of traffic in the sky. But the system on the ground, dependent upon the government for money, lagged behind in ability to handle the changes. Some technological innovations were ongoing that would soon transform control of an aircraft from the pilot in the sky to the controller and devices on the ground. Pilots flying by Instrument Flight Rule became fully dependent on controllers who worked in organizations that were “centers of coordination” (Suchman, 1997).

Rather than telephones, controllers relied on devices to engage in dead reckoning: from early marine navigation, dead reckoning refers to the prediction of the position of objects in space and time by deduction, without benefit of direct observation or direct evidence. Coordination of movement across the boundaries of the sky and the system on the ground was tightly regulated by rules and procedures. The mandate of the system was “The Safe, Orderly, and Expeditious (read: speedy, cost effective, and on time) Delivery of Air Traffic.” Government funded, the system routinely lacked resources. By the late 1970s, Controllers were working overtime on old and flawed equipment, with inadequate personal benefits, in the midst of a staffing shortage. In 1981, members of the Professional Air Traffic Controllers Organization (PATCO) went on strike. Then-President Ronald Reagan, fired over 14,000 striking controllers — coincidentally, the year of the first Space Shuttle Flight — leaving the system in crisis.

1.2 Organizational Structures and Processes: Differences

The organization structures and processes of getting Space Shuttles and airplanes off the ground varied, shaped by the vastly different technologies and consequently, the work required. At NASA, the shuttle design was an experimental vehicle; for Air Traffic Control, the technology — airplanes — was standardized.

The Space Shuttle has four component parts: the Orbiter, Main Engine, External Fuel Tank, and the Solid Rocket Boosters. The physical location, technical production, and decision making actors for each part was different. For the Solid Rocket Boosters (SRBs), the part of the shuttle that failed during the Challenger launch, the locations were Marshall Space Flight Center, Huntsville, Alabama, and Morton Thiokol, the contractor constructing the SRBs, in Wasatch, Utah. NASA was a “matrix” organization. It has a chain of command that is hierarchical, but differs from a classic hierarchical structure, where each level reports to the one above, with a CEO at the top. A NASA Project Manager had authority over a component’s Work Group, reporting to the director of the larger component of which the project was a part, not to a CEO. NASA’s matrix structure was duplicated by the contractor, the parallel structures making daily engineering discussions between Morton Thiokol and NASA easy.

All NASA Work Groups were comprised of engineers and technical people drawn from different parts of the system in order to bring together different engineering specializations and perspectives to create contradictory points of view and dissonance (Stark, 2011). Comprised of NASA and Thiokol engineers, the SRB work group explored the unprecedented technology, doing lab tests, technical analysis, and revising risk assessments, but the sky was the laboratory: the anomalies discovered after a mission were crucial. Differences of opinion were routine. When the inevitable controversies about risk occurred, scientific positivism reigned; it was dispute resolution by the numbers. The schedule was always important, but the entire operation was rule bound: do not launch unless all tests verify that all Launch Commit Criteria have been met. Consensus required.

A hierarchical pre-launch decision-making structure, Flight Readiness Review (FRR) began about a month or two before the launch date to bring together all shuttle components. FRR had four reporting levels that moved launch decision making up the FRR hierarchy. Each stage of the review was adversarial, with people with different expertise present to critique the engineering analysis. At Level 1, Thiokol engineers and technical people brought their risk assessment to Marshall, meeting with the SRB Project Manager and NASA engineers, all reviewing their test data, airing their concerns and differences of opinions, doing more tests and fixes to come to agreement about “Acceptable Risk,” meaning that after all tests and evidence had been done, it was safe to fly. At each level, more people, with different expertise from different parts of the system, participated in the review. The Level IV review was at Marshall Space Flight Center, headed by the Center Director. 150 people participated. Ironically, and contradicting the dissonance designed into the FRR structure, at each level a found technical problem was fixed before moving up, so the original assessment of the work group incorporated more supportive data, confirming the original risk assessment to “Accept Risk and Fly.” “Action Items” to fix things often extended FRR, but rarely was a launch delayed because of a technical problem found in FRR.

In contrast, the National Airspace System’s multiple locations were designed to be standardized, alike in task, physically located to cover the movement of air traffic in the US within and between the nine regions of the system on the ground. Overseeing all Air Traffic Operations was the Command Center in Virginia, with a Director, Regional Representatives, and Weather Specialists to coordinate weather changes, traffic movement or incidents throughout the larger system, receiving input from all, and making decisions that affected all. Air traffic control was hierarchical on paper but in practice was a heterarchy — a collaborative organizational form that spawned dissonance and open discussion at each level (Stark, 1999; Beunza & Stark, 2004): within and between each facility, between facilities and region, within and between regions. Moreover, dissonance and collaboration were ongoing between controllers and FAA management at all levels because, unlike NASA engineers, controllers are unionized, belonging to the National Air Traffic Controllers Association (NATCA), born in the years after the Reagan firings.

Also in contrast to NASA, all controllers had the same task. In Towers, high altitude Radar Centers, and Terminal Radar Approach Control (TRACONs), they work in teams of 3–8 with a supervisor in small, intimate spaces, elbow to elbow, so they can hear each other and coordinate traffic movement. Although the work is standardized, no two facilities are alike because as the complexity of the airspace varies, (volume, types of aircraft, crossing or single direction air patterns) the architecture, technology, and task of a facility vary. As the work varies, so does the culture of a place: the ways of doing and being. As one controller said, “You move to a different place, you have to become a different person.” Consequently, the system is only allegedly standardized: it is riddled with variation. Necessarily, the work they do combines standardization and improvision. Heterarchy and negotiation of differences within and between the parts is built into the system, as follows.

In contrast to the Shuttle Program, the time and timing of identifying anomalies is not pre-flight, but when planes are put in motion. Quick decision-making is essential. Controllers interpretive work consists of ethnocognition and boundary work. Ethnocognition (Geertz, 1983) includes a shared cultural system of knowledge as well as a fine-tuned local knowledge. Cognition is not only distributed between people and technologies in the room (Hutchins, 1995), it is distributed beyond the room to controllers in other facilities, making coordination possible across the system. Controllers do two kinds of boundary work: they move airplanes across the boundaries of the sky, and in doing so, they also must move planes to other controllers across the boundaries of the other facilities on the ground. Because of airspace variation throughout the system, boundary work is not easy. One controller may not always be able to accept an airplane from another into their airspace (“unable”), causing the sender to hold the plane, crowding their own airspace and backing up the next neighboring airspace. Thus, boundary work is a major source of stress on the job, producing dissonance, competition and shout-outs between controllers in the same facility and across facilities. Because planes have to keep moving, boundary disputes compelled negotiation of differences between controllers and improvisation within their own facility and between other facilities in order to keep the system working safely.

2.1 System Effects and Failure: How the Past Affected the Present

The launch decision was the outcome of a two-hour teleconference between 34 people in three locations: Morton Thiokol in Utah, Kennedy Space Center in Florida, and Marshall Space Flight Center in Alabama. This decision scenario was unprecedented in three ways: the predicted cold temperature was below that of any previous launch; launch decisions always were discussed face-to-face in Flight Readiness Review, held two weeks before a launch; and Thiokol had never before come forward with a no-launch recommendation (Vaughan, 1997).

Concern about temperature came up early in the day. Thiokol needed to prepare, so chose a time for the three-location teleconference to begin, setting it at 8:15 pm. Accustomed to working in a dead-line oriented culture concerned about cost and schedule, they knew if they could reach a decision before 12:30 AM EST, when the ground crew at Kennedy would begin putting fuel into the External Tank, they could avoid the costly de-tanking if the decision was “No-Go.” Production pressure drove the proceedings. The engineers collectively decided their position, then hurried to put together the engineering charts containing their analysis. They divided up the work. However, some people were putting together the final recommendation chart without seeing the data analysis charts other engineers were still creating. In the press for time, the group never collectively discussed all the charts prior to faxing them to people in the other two locations. As it turned out, the engineering charts contained inconsistencies that did not live up to the standards of NASA’s original technical culture: quantitative, scientific data for every engineering launch recommendation. Moreover, the final launch recommendation chart stated, “Do not launch unless the temperature is equal to or greater than 53 degrees,” reflecting the temperature of the coldest launch, which had experienced the most O-ring damage. However, data on some of the Thiokol charts contradicted the 53 degree limit they proposed.

Recognizing their own political and bureaucratic accountability, angry Marshall managers challenged Thiokol’s data analysis and conclusions. Marshall managers would be the ones who would have to carry forward the no-launch recommendation. They had done so before, but this time it was with flawed data. Moreover, the 53 degree launch limit set a new decision criterion for all launches, which would delay many launches. The effects of hierarchy and organization structure on the discussion were equally devastating. People were in three locations and could not see each other. Moreover, midway in the teleconference, the people at Thiokol held an off-line caucus. A Thiokol administrator who knew little about the technology took charge. Without any new data to support their arguments, the engineers could not build a stronger data analysis.

Then at Thiokol, bureaucratic accountability came into play. A “management decision” was made: excluding engineers, four managers reversed the no-launch decision, went back on-line saying they had re-examined their data, and recommended launch. When Marshall managers asked, “Does anyone have anything more to say?” No one spoke up. In three locations with no visuals, the silence of the off-line caucus created structural secrecy (Vaughan, 1983 & 1996). People at Marshall and Kennedy did not know that Thiokol engineers still objected. And Thiokol engineers did not know that many people in the other locations supported them and were preparing to cancel the launch. This was a “no-launch” recommendation. In an unprecedented situation, all participants invoked the usual rules about how decisions are made, when (hindsight shows) the usual rules were inappropriate. Perhaps in a situation of uncertainty, a cooperative, democratic heterarchical decision-making session that brought the dissonance and diversity of all points of view into play would have produced a different outcome (see, e.g., Beunza & Stark, 2003). Not only did the silent Thiokol engineers abide by the norms of the hierarchical system, but people in other locations had potentially useful information they did not enter into the conversation because they, too, were subordinates. The result was that conforming to all the rules, on the eve of the launch they normalized the technical deviance once again.

Many changes to increase safety followed. However, in 2003, 17 years after Challenger, NASA’s Space Shuttle Columbia disintegrated upon reentry into the earth’s atmosphere. The official accident investigation concluded that the causes of Challenger had not been fixed (Columbia Accident Investigation Board Report, 2003). Cameras at the launch pad showed that a large piece of foam insulation flew off the External Tank, hitting the leading edge of the shuttle wing, then the heat at reentry caused fire and disintegration. Foam had been a recurring problem, hitting protective tiles on the wings, but the damage was minimal, so tiles were replaced. The anomalies had been normalized — treated as a maintenance problem, not a risk. Further, engineers’ several requests for close up satellite photos of the damage were dismissed by the Mission Manager, some for not following the mandated reporting hierarchy, others because satellite photos would take time and delay the next launch, and “there is nothing we can do anyway.” Engineers were excluded from the decision. Consequently, no collaborative discussion of possibilities occurred.

3.1 System Effects and Repair: How the Past Affects the Present

The Boston TRACON bore the official responsibility for integrating the airspace and training the Manchester controllers. However, Boston controllers also felt a moral responsibility to join the two facilities by reproducing the unique culture of collective responsibility that had typified their own workplace prior to relocating: pride in the accomplishment of group over the individual; looking out for one another. That was not only what they wanted for themselves and for Manchester but for the safe operation of the facility. Drawing on the expertise acquired since legally empowered by Clinton to have input into all organizational and technological innovations, they improvised, engaging in new forms of boundary work to repair the physical, social, technological, status, and cultural boundaries in the facility. Their primary goal was to rectify the inequalities in the facility.

The resulting effort reveals heterarchy in action, demonstrating the benefits of disruptive dissonance for discovery and change (Beunza & Stark, 2011). Collectively, facility managers, NATCA representatives, and several controllers from both Manchester and Boston — all with different points of view — formed a “Cooperative Work Group.” Not so cooperative at the start, they worked through differences to develop a general plan. They began with the physical and technological fixes, implemented with the help of FAA architects and technical people. First, the Work Group redesigned the Inner Circle, keeping its position in the center of the Control Room, but splitting it into two smaller circles, each with four exits so people could get to all parts of the Control Room quickly.

To rectify inequalities and status dynamics, the group divided the Outer Circle airspace into two parts, “Boston North” and “Boston South.” Some airspace sectors would be co-owned (jointly worked by controllers from both facilities) while other sectors would belong to each. Salary would match the complexity skill level attained, so Manchester controllers could opt to stay at their original airspace or work up. Finally, to “fully integrate” the separate cultures of the two facilities called for a common cultural system of knowledge and material practices acquired only by being there. Transforming culture was a long-term project, involving daily training and retraining of both former and new generations of controllers by those senior controllers already there. It was in the form of ongoing talking and teaching both while working traffic and off position, often corrective and dissonant, demonstrating “This is the way we do it here.” The effort was formalized: the Collaborative Work Group wrote and everyone approved and engaged in “The Five Core Values of PULSE: A Unifying Code of Moral Conduct.” Originally an experiment, the Boston Consolidated TRACON became a prototype for other planned consolidated facilities that combined small and large TRACONs.