Your job isn't to make management comfortable with every decision. It's to make sure they understand the risks before they make it.
On 16 January 2003, 81 seconds after the Space Shuttle Columbia launched, a piece of foam insulation broke away from the external fuel tank. It was large — somewhere in the region of 20 inches by 16 inches by 6 inches, roughly the size of a suitcase — and it struck the leading edge of the left wing, in the area where the reinforced heat-shielding of the wing's leading edge meets the main structure.
Rodney Rocha's Debris Assessment Team looked at the strike and didn't like what they saw. They classified it as “out-of-family” — engineering language for something outside previous experience, and therefore of greater concern than a routine foam loss. Boeing and United Space Alliance engineers gave up part of their holiday weekend to work the analysis. At their first meeting, the team agreed that imagery of the wing area was essential to refine what they could tell mission management.
Rocha asked for it. He wanted outside imaging — spy satellites or ground-based telescopes capable of resolving the strike zone well enough to assess the damage properly.
The request went nowhere. Mission management decided the Orbiter wasn't requesting outside imaging help, and when flight director Linda Ham terminated the Department of Defense imaging actions already in motion, she effectively closed down every channel pursuing it.
On 23 January, after informal conversations about the issue, mission manager Leroy Cain wrote: “I consider it to be a dead issue.”
On 1 February, Columbia disintegrated over Texas during re-entry. All seven astronauts aboard died.
This isn't a story about a safety professional who failed to speak up. Rocha's team spoke up immediately, assessed the strike as more serious than usual, and asked for exactly the information that would have let everyone make an informed decision. It's a story about what happens when that isn't enough — and about the moment afterward when Rocha had one more move available, and didn't take it.
The classification that closed the question
The Debris Assessment Team's own initial read was clear: out-of-family, greater concern, needs imagery.
Mission management reached a different conclusion, and reached for a different comparison. Internal logs from the Mission Evaluation Room began describing the Columbia strike as “almost an ‘in-family’ event,” then simply an “in-family’ event — the language of a known, previously accepted problem rather than something new.
The comparison they were leaning on was an earlier foam loss on STS-112. The Columbia Accident Investigation Board later found that comparison didn't hold up on close inspection: on STS-112, the foam had struck the Solid Rocket Booster, not the orbiter's wing, and the resulting debris spray pattern was, in the Board's words, “a lot smaller than that of STS-107.” Different location. Different scale. The Board called it “a distinction not examined by mission managers.”
Once a strike the engineers themselves had flagged as unusual got relabelled as familiar, it stopped looking urgent. The classification became the argument against further investigation — not because anyone had shown the comparison held up, but because treating it as routine made the awkward, resource-intensive follow-up unnecessary.
Ham's own notes recorded the practical reasoning behind declining the imaging request: the Program didn't want to spend the resources.
The email that was never sent
Rocha didn't just raise his concern once and let it drop.
He drafted an email, addressed up the chain, setting out in plain terms why he thought the decision not to pursue imaging was wrong. In his own words, it was “the wrong (and bordering on irresponsible) answer.”
He never sent it.
When the Accident Investigation Board later asked him why, Rocha said he didn't want to jump the chain of command.
That answer deserves more attention than it usually gets. Rocha wasn't unaware of the risk. He wasn't confused about the engineering, and his own team had already done the harder analytical work of flagging the strike as out-of-family before anyone talked them out of it. He had, in writing, a clear and correct assessment of what needed to happen next. What stopped him wasn't a lack of conviction. It was a professional norm — respect the hierarchy, work through your line management, don't go over anyone's head — that, in this one specific moment, was exactly the wrong instinct to follow.
This is the real dilemma safety professionals face, and it isn't simply “should I speak up?” Most competent professionals already know the answer to that one. The harder question is what you do when you've spoken up, through every proper channel, and the organisation has quietly closed the file anyway.
Three tensions worth naming
Trusted adviser versus agreeable employee. Building credibility with management matters. But credibility should rest on the honesty of your advice, not on how comfortable it makes people feel to hear it. An adviser who is always easy to agree with has usually stopped being useful. Rocha's team never lost credibility by raising the alarm — they lost the argument once the alarm was quietly reclassified by people who hadn't examined the comparison they were relying on.
Commercial reality versus unacceptable risk. Understanding schedule pressure, cost constraints and operational realities is part of the job. Letting those pressures quietly decide whether a risk is acceptable is not. Ham's notes about resources weren't a safety judgement. They were a cost judgement wearing a safety decision's clothes. This is precisely the distinction engineering ethics has tried to formalise for over a century. The ASCE Code of Ethics states plainly that engineers “shall hold paramount the safety, health and welfare of the public” in the performance of their professional duties — ranking that obligation above duties to an employer or client, not alongside them. When a professional's judgement is overridden and the public remains at risk, the same code requires them to make the possible consequences known. The requirement isn't a courtesy. It's the job.
Raising a concern versus making sure it's resolved. Rocha's team raised their concern immediately and asked for exactly what they needed to resolve it properly. Nobody formally closed it out, tested the comparison it rested on, or documented why the risk was being accepted instead. It simply stopped being discussed. A concern that fades from the agenda isn't the same as a concern that's been properly answered.
Five questions worth asking yourself
- Have I ever softened a recommendation because I already knew management wouldn't like the answer?
- Do I distinguish between a risk being genuinely controlled and management simply choosing to accept it?
- When my advice is rejected or quietly dropped, do I have a clear route to escalate it further?
- Am I measuring my own effectiveness by the quality of my advice, or by how readily it gets accepted?
- If there were a serious incident tomorrow, would I be comfortable explaining the judgement calls I made today?
Respected matters more than liked
None of this is an argument for safety professionals to treat every management decision as a fight. Challenging everything, refusing to engage with commercial reality, or treating disagreement as a personal test of integrity is not effective safety leadership either. It just produces a different kind of ineffective adviser — one nobody wants in the room.
The skill that actually matters is knowing the difference between a decision you can support because the risk is genuinely controlled, and a decision you're being asked to go quiet on because raising it again would be inconvenient.
Rocha's team had that judgement. They made the right call about the engineering, immediately, before anyone had reason to doubt them. Where the system failed them — and where it fails safety professionals in plants and sites everywhere — was in offering no clear, sanctioned way to make that judgement heard once the normal channel had quietly closed.
If your organisation only works when every safety concern gets resolved on the first attempt, it doesn't have an escalation route. It has a hope.
Your job isn't to make management comfortable with every decision. It's to make sure they understand the risks before they make it.
Sources
- Columbia Accident Investigation Board, Report, Volume I (2003), including the inflight decision-making timeline and findings on the Debris Assessment Team's imaging requests and the STS-112 comparison.
- NASA, internal communications and mission logs cited within the CAIB report, including Rodney Rocha's 21 January 2003 e-mail and unsent follow-up draft.
- American Society of Civil Engineers, Code of Ethics (Canon 1).