A. Responsibility¶
Duties toward people, the environment and the work itself.
Take the Responsibility quiz when you have read the examples.
P1. Public safety first¶
The rule: put public safety above cost, schedule and convenience
Illustrative, not evidence.
Scenario. A payments team plans to release on Friday. A late test shows that a rare timeout exposes one customer's card details to another customer.
Applying the rule. The release checklist has a safety and security sign-off item. The security reviewer marks it open, and the gate stays shut until the leak is fixed. The date moves.
Violating the rule. The team knows about the leak and ships on Friday anyway, because the launch date was promised to a client. They plan to patch it next week.
Management variant.
Scenario. A product manager learns that a new feature would process personal data without a legal basis. The launch is due in two days.
Applying the rule. The manager stops the launch and puts the legal basis review on the launch plan. People's rights rank above the date.
Violating the rule. The manager lets the launch go ahead and plans to sort out the legal basis later, because the campaign budget is already spent.
Real case: Space Shuttle Challenger O-ring joint and launch decision (1986).
The Space Shuttle Challenger was lost when the seals in a joint of the right Solid Rocket Motor failed. The joint's O-rings had shown erosion and blow-by on earlier flights, and NASA and its contractor, Morton Thiokol, came to accept this as an acceptable flight risk instead of solving it. For this launch, the contractor's engineers had first recommended against launch below 53 degrees Fahrenheit. Their management reversed that position at the urging of NASA's Marshall Space Flight Center. The Rogers Commission found the decision to launch flawed, and found that it was based on incomplete and sometimes misleading information.
What it shows for P1. Safety must outrank the customer and the launch schedule. Here the contractor's management reversed its engineers' no-launch advice to accommodate a major customer. The Commission found that waiving launch constraints came at the expense of flight safety. A release gate needs a safety sign-off that customer or schedule pressure cannot waive.
the loss of the Space Shuttle Challenger was caused by a failure in the joint between the two lower segments of the right Solid Rocket Motor.
The decision to launch the Challenger was flawed.
the initial written recommendation of the contractor advising against the launch at temperatures below 53 degrees Fahrenheit
a decision to launch 51-L based on incomplete and sometimes misleading information
The waiving of launch constraints appears to have been at the expense of flight safety.
the Thiokol Management reversed its position and recommended the launch of 51-L, at the urging of Marshall and contrary to the views of its engineers in order to accommodate a major customer.
we were being put in a position to prove that we should not launch rather than being put in the position and prove that we had enough data to launch.
The genesis of the Challenger accident-the failure of the joint of the right Solid Rocket Motor-began with decisions made in the design of the joint
Morton Thiokol, Inc., the contractor
as tests and then flights confirmed damage to the sealing rings, the reaction by both NASA and Thiokol was to increase the amount of damage considered “acceptable.”
Neither organization developed a solution to the unexpected occurrences of O-ring erosion and blow-by even though this problem was experienced frequently during the Shuttle flight history. Instead, Thiokol and NASA management came to accept erosion and blow-by as unavoidable and an acceptable flight risk.
NASA and Thiokol accepted escalating risk apparently because they “got away with it last time.”
Tracking and continuing only anomalies that are “outside the data base” of prior flight allowed major problems to be removed from, and lost by, the reporting system.
P2. Work within competence¶
The rule: work only within your competence, and involve an expert outside it
Illustrative, not evidence.
Scenario. A backend team designs the access rules for a cloud account. Nobody on the team has deep identity and access management (IAM) experience.
Applying the rule. Each design names a checker with IAM expertise. The team asks a security engineer from another group, and she reviews the design before it is approved.
Violating the rule. A senior developer approves the IAM design alone. He has never worked with IAM, but he is the most senior person in the room.
Management variant.
Scenario. A team lead wants to change the on-call rules. She has no knowledge of labour law.
Applying the rule. She asks HR before the change. HR points out rest-time limits, and she adjusts the rota to fit them.
Violating the rule. She changes the on-call rules on her own and assigns weekend shifts back to back. Nobody with the knowledge sees the change.
P3. Sustainability¶
The rule: reduce environmental impact and resource use across the whole lifecycle
Illustrative, not evidence.
Scenario. A team runs a test environment for every feature branch. Most of them sit unused for weeks.
Applying the rule. The team measures the resource use of each environment and reviews it monthly. Idle environments scale to zero and are deleted after the branch merges.
Violating the rule. The environments run all day and all night. Nobody measures their use, so nobody sees the waste.
Management variant.
Scenario. A department buys cloud services and pays the bills each month.
Applying the rule. Cloud cost and energy reports are reviewed together with the budget. Procurement asks suppliers for their environmental impact.
Violating the rule. The department reviews only the price. Nobody asks about energy use or supplier practices before signing.
P4. Stop authority¶
The rule: let that person stop the work without needing permission and without being blamed; the stop must always be available, must override all other functions, and resetting it must not restart the system
Illustrative, not evidence.
Scenario. A release pipeline deploys to production through automatic sync. An engineer sees error rates rise on the first canary.
Applying the rule. A deploy freeze overrides the auto-sync in every mode, and the engineer sets it without asking anyone. Lifting it needs an explicit sync, and a reset does not restart the rollout. The use is reviewed without blame.
Violating the rule. The engineer raises the problem in the channel while the release continues. Management asks the team to discuss it first, and the rollout reaches all users.
Management variant.
Scenario. A company has an anonymous channel for legal and ethical concerns. An engineer sees an unsafe shortcut in a release.
Applying the rule. Any engineer may pause the release without permission. The company follows up on the report and does not retaliate.
Violating the rule. Only a director can pause a release. An engineer who stops work on their own is warned for missing the deadline.
Real case: Space Shuttle Columbia foam strike and its organizational causes (2003).
A piece of insulating foam from the External Tank struck Columbia's left wing after launch. During re-entry, the breach it made in the Thermal Protection System let superheated air in, and the orbiter and its crew were lost. During the flight, engineers assessed the strike with Crater, a model calibrated on far smaller debris. Program management cancelled a request for images of the wing. The Columbia Accident Investigation Board did not stop at the part that broke or the people closest to it, and looked for causes in the organization as a whole. It found that the causes of the institutional failure behind Challenger, 17 years earlier, had not been fixed.
What it shows for P4. A stop authority must work in practice, not only on paper. NASA told the Board that any employee could stop an operation at the first sign of a problem. The Board found that this view of its safety culture did not reflect reality.
The physical cause of the loss of Columbia and its crew was a breach in the Thermal Protection System on the leading edge of the left wing.
Source: Columbia Accident Investigation Board: Report, Volume I, Chapter 3, Accident Analysis (2003)
The breach was initiated by a piece of insulating foam that separated from the left bipod ramp of the External Tank and struck the wing in the vicinity of the lower half of Reinforced Carbon-Carbon panel 8 at 81.9 seconds after launch.
Source: Columbia Accident Investigation Board: Report, Volume I, Chapter 3, Accident Analysis (2003)
During re-entry, this breach in the Thermal Protection System allowed superheated air to penetrate the leading-edge insulation
Source: Columbia Accident Investigation Board: Report, Volume I, Chapter 3, Accident Analysis (2003)
When used within its validated limits, Crater provides conservative predictions
Source: Columbia Accident Investigation Board: Report, Volume I, Chapter 6, Decision Making at NASA (2003)
engineers used Crater during STS-107 to analyze a piece of debris that was at maximum 640 times larger in volume than the pieces of debris used to calibrate and validate the Crater model
Source: Columbia Accident Investigation Board: Report, Volume I, Chapter 6, Decision Making at NASA (2003)
When asked why he did not send this e-mail, Rocha replied that he did not want to jump the chain of command.
Source: Columbia Accident Investigation Board: Report, Volume I, Chapter 6, Decision Making at NASA (2003)
this is the wrong (and bordering on irresponsible) answer from the SSP and Orbiter not to request additional imaging help from any outside source.
Source: Columbia Accident Investigation Board: Report, Volume I, Chapter 6, Decision Making at NASA (2003)
Even after the imagery request had been cancelled by Program management
Source: Columbia Accident Investigation Board: Report, Volume I, Chapter 6, Decision Making at NASA (2003)
empowered any employee to stop an operation at the mere glimmer of a problem.
Unfortunately, NASAʼs views of its safety culture in those briefings did not reflect reality.
Even after it was clear from the launch videos that foam had struck the Orbiter in a manner never before seen
were largely silent during the events leading up to the loss of Columbia.
Many accident investigations make the same mistake in defining causes. They identify the widget that broke or malfunctioned, then locate the person most closely connected with the technical failure
Such corrections lead to a misguided and potentially disastrous belief that the underlying problem has been solved.
A central piece of our expanded cause model involves NASA as an organizational whole.
That silence was not merely a failure of safety, but a failure of the entire organization.
the causes of the institutional failure responsible for Challenger have not been fixed.
Seventeen years separated the two accidents.
problems cannot be solved simply by retirements, resignations, or transferring personnel.
The Board had a hard time understanding how, after the bitter lessons of Challenger, NASA could have failed to identify a similar trend.
P5. Psychological safety¶
The rule: make it safe to report errors, ask questions and disagree: leaders ask for input, thank people for bad news, and never punish an honest report
Illustrative, not evidence.
Scenario. A pipeline breaks in the middle of the night. A junior engineer reports that she caused it by merging a bad config.
Applying the rule. Her team lead thanks her for the quick report. In the retrospective he names his own mistake from last month. A regular anonymous survey asks about safety to speak up, and near-miss reports do not fall after the incident.
Violating the rule. The team lead blames her in front of the group and puts the incident in her review. Reports of near misses stop within a month.
Real case: Space Shuttle Columbia foam strike and its organizational causes (2003). Read the full case above.
What it shows for P5. An engineer drafted an e-mail calling the decision not to seek images of the wing wrong, then did not send it. He did not want to jump the chain of command. When people hold back bad news, leaders lose the warning they need.
P6. Conflict-of-interest disclosure¶
The rule: disclose the interest and step out of the decision or review
Illustrative, not evidence.
Scenario. A company picks a monitoring vendor. One reviewer on the panel holds shares in one of the bidders.
Applying the rule. The reviewer's interest is in the register of declared interests. The register is checked before vendor selection, and she leaves the evaluation.
Violating the rule. She keeps the interest to herself and scores the bidders. Her favourite wins, and nobody learns about the shares.
P7. Commander's intent¶
The rule: state the purpose, the desired end state and the constraints, and leave the method to the people who do the work (mission orders)
Illustrative, not evidence.
Scenario. A platform lead delegates a migration of the logging stack to a team.
Applying the rule. The epic states why (cut cost and risk), when it is done (all services log to the new stack) and what must not happen (no gaps in audit logs). The team picks the steps.
Violating the rule. The epic is a list of commands with no purpose. When one step fails, the work stops because nobody knows what the plan was for.
P8. Fair process¶
The rule: engage them (ask for input and challenge), explain the final decision and its reasons, and state the new expectations clearly; this is not consensus
Illustrative, not evidence.
Scenario. A department head plans to change the on-call model from one fixed team to a rotation across teams.
Applying the rule. She asks the teams for input and for challenges before deciding. Then she announces the decision with the reasons and writes down the new rules. The decision is hers; it is not a vote.
Violating the rule. She announces the new rotation by email on Friday. It contains no reasons and no input round, and the new rules are unclear.