What Normalization of Deviance Means, With Examples From Challenger and Hospitals

STS 51-C went up on January 24, 1985, with the coldest booster joints the shuttle program had yet flown. The Rogers Commission put the O-ring temperature at launch at 53 degrees Fahrenheit. Both boosters came back with O-ring damage, and the Commission records it as the first flight on which a secondary O-ring showed the effect of heat. The mission itself finished without incident.

Normalization of deviance is the process by which a departure from a standard, repeated without a bad outcome, comes to be treated as the standard. The sociologist Diane Vaughan developed the idea in The Challenger Launch Decision (University of Chicago Press, 1996), and Banja carried it into medicine in 2010. In both settings the people involved are hiding nothing. They have stopped seeing the departure as one.

How did O-ring damage become an acceptable risk?

The Rogers Commission says the problem grew as NASA and its contractor “first failed to recognize it as a problem, then failed to fix it and finally treated it as an acceptable flight risk.” Thiokol’s stated position, quoted by the Commission, was that “the condition is not desirable but is acceptable.” The first in-flight erosion of a primary O-ring had come on STS-2 in November 1981; by STS 41-B in February 1984 the Commission describes erosion as a recurring problem, and it found that Level III project managers at Marshall believed there was ample margin to fly with erosion, provided the leak check ran at 200 psi.

Each safe return read as evidence about the joint. The anomaly moved from the column marked “warning” to the column marked “known and bounded.”

What did Vaughan actually argue?

She started from the popular account, in which managers knowingly overrode engineers to keep a schedule, and came to reject it. As summarized by the publisher’s reviewers and a secondary summary (I could not get the book’s text), she found that no rules were broken and that those involved did not believe they were gambling with lives. Schedule pressure, scarce funds and competition made trade-offs routine, information was split across units, and each time erosion exceeded what the design expected while the mission succeeded, the anomaly was reinterpreted as tolerable.

The claim worth defending is that this is not a failure of paperwork. The erosion was reported, reviewed and waived, and the reviews are how it became normal. A secret problem can be exposed; one that has been formally accepted has nobody left to expose it.

The Commission read the final night differently, concluding that Thiokol’s management reversed its position at Marshall’s urging and contrary to its engineers’ views. I have not tried to settle the two readings.

What did the argument sound like the night before launch?

A teleconference began at 5:45 p.m. Eastern time on January 27, 1986. Thiokol engineers presented their worries about cold and an opinion that launch should be delayed. A Thiokol manager testified that he heard of forecasts as low as 18 degrees overnight, and another witness relayed 26 degrees at the planned launch time (air temperatures, not O-ring temperatures). The Commission’s analysis found that all four earlier flights with O-ring temperatures of 63 degrees or below showed thermal distress, against three of twenty at 66 or above.

Lawrence Mulloy, who ran the booster project at Marshall, told the Commission that the thought behind a remark attributed to him (“My God, Thiokol, when do you want me to launch, next April?”) was that a new temperature criterion was being proposed on the eve of launch “after we have successfully flown with the existing Launch Commit Criteria 24 previous times.” Twenty-four flights had become the baseline, and four cold-weather data points had to overturn it. About 11 p.m. Thiokol called its data “admittedly inconclusive” and recommended launch. Challenger lifted off at 11:38 a.m. on January 28 and broke up 73 seconds later.

Does it happen in hospitals?

Banja’s article (Business Horizons, 2010, volume 53, issue 2) lists the reasons staff give for bending rules: they seem stupid or inefficient, knowledge of their purpose is uneven, they are meant for other people, speaking up feels unsafe, and managers dilute what they hear. I read it on PubMed Central through a summarizing tool, so I quote only what I could check twice.

His examples are ordinary. Neonatal nurses shared passwords for a drug cabinet to get around a witness requirement for discarding medication. In a case from his expert-witness work, a ventilator alarm had been deliberately set to “suspend indefinite.” On most days the shortcut saved time and harmed no one, until it did. The dulled response to such alarms has its own name, desensitization to repeated alarm signals, but here the habit is taught to newcomers.

A hypothetical: the alarm that drifted ten minutes

What follows is an invented illustration, not a case or a finding. Suppose a 6:30 alarm gets moved to 6:40 one Sunday because the week looks light. Nothing bad happens. The next Sunday it moves to 6:50, judged against 6:40 and not against 6:30. After four such weeks it sits at 7:10, a 40-minute change (4 steps × 10 minutes), and 6:30 is remembered as the old setting. No step exceeded ten minutes, so none ever looked like a decision.

That matches Vaughan’s pattern: small increments, each judged against the last, and silence read as confirmation. A second ingredient is that nobody is placed to say stop, which the hospital checklist trials treat as the line between a list that works and one that decorates. Reason’s Swiss cheese model describes the other side of the same problem, a lapse that matters only when several defences have holes at once, which a 4-slice morning example walks through.

It breaks in three places. A missed morning has no cost on the scale of a lost orbiter, and often none at all. The “no bad outcome” signal is weaker and noisier, since a late start can carry a cost that arrives days later and gets blamed on something else. And a changed alarm is not automatically a deviation: 6:30 may have been wrong for that person, which is Banja’s “rules seem stupid” reason, and sometimes it is right. An organization can tell a drifted standard from a revised one by whether anyone reviewed it. One person alone has no reviewer.

Four follow-up questions

Who extended the term beyond NASA?

Banja’s 2010 article in Business Horizons applied it to hospitals and cites Vaughan’s later work (2004, and Vaughan, Gleave and Welser, 2005) for its definition. The publisher’s later edition of Vaughan’s book also ties the pattern to the 2003 Columbia loss.

Is it the same as alarm fatigue?

No. Alarm fatigue is one person’s response dulling with repetition. Normalization of deviance is a group revising its standard, usually with reviews and sign-offs, so a nurse who silences a monitor from weariness is fatigued, while a unit that sets monitors to suspend-indefinite and teaches newcomers to do likewise has normalized something.

How could the alarm-drift analogy be tested?

Log the alarm time set each night for two months and compare every night with both the previous week and the original setting. A moving reference would show as a gap to last week near ten minutes while the gap to the original keeps growing. A self-kept log is a diary, so it could show the pattern without showing the cause.

Does the concept explain why Challenger launched?

It explains how the joint problem came to look acceptable, not every decision on the last night. The Rogers Commission concluded that Thiokol’s management reversed its recommendation contrary to its engineers’ views, while Vaughan stresses conformity to existing norms.