In March 2010, a 29-year-old shift nurse left her job in Atlanta, Georgia and headed to her boyfriend’s house. She was driving her 2005 Chevy Cobalt on a two-lane road as she approached a half-mile downhill straightaway. As the road leveled after the straightaway, she approached an area where some rainwater had accumulated. Shortly after encountering this section of roadway, she apparently lost control of her Cobalt as it hydroplaned across the center line. The rear passenger side of her car was struck by an oncoming Ford Focus, causing the Cobalt to spin off the road and fall 15 feet before landing in a large creek around 7:30 p.m. The impact of the crash broke the nurse’s neck, an injury that led to her death shortly after she arrived at the hospital.
Figure 1: Chevy Cobalt after accident caused by defective ignition switch (Source: Cooper Firm).
While this tragedy might sound like a typical crash scenario, it was particularly puzzling to the victim’s parents. Why? According to Atlanta magazine, she always wore her seat belt and never had a speeding ticket. So how did she suddenly lose control of her car on that fateful evening? Sadly, this unsettling question remained unanswered until several years later—after many more drivers suffered similar fates.
In March 2014, law firm Jenner & Block LLP was commissioned by GM to investigate over a decade of operational issues with an ignition switch used in several GM vehicles, including the Chevy Cobalt. According to the firm’s Valukas report, drivers had problems with the ignition switch slipping out of position, stalling engines and cutting power to vehicle systems. In many cases, the stalling would disable the vehicle’s airbags just as the car was about to crash. In April 2017, Forbes reported that the ignition switch had been associated with 124 deaths and 275 injuries. Since the initial product recall in February 2014, GM has recalled 30 million vehicles and paid over $2 billion in fines, penalties and settlements.
Aside from the ignition switch’s technical problems, the Valukas report identified several social (organizational) issues involving the relationship between GM’s management and its engineering teams. These fundamental problems are not unique to GM. Any large, complex organization—including NASA—is vulnerable to poor communication and oversight. Consider these similar underlying issues identified by experts who investigated the flawed Hubble Space Telescope (HST):
Figure 2: HST clears the cargo bay during its deployment on April 25, 1990 (Source: NASA Image and Video Library).
Communication Issues: Investigators discovered that a significant communication breakdown occurred when a technician (employed by contractor Perkin-Elmer) rigged the equipment used to test the mirror’s surface to provide a desired result, hiding its actual flaws from discovery until the telescope was in orbit. The technician failed to notify others of the modification. In addition, the contractor allowed critical components of the telescope to be fabricated in a closed-door environment, which restricted communication and prevented problems from being reviewed by third-party inspectors.
Management problems: Financial problems as well as political and schedule pressures distracted managers at NASA and at Perkin-Elmer. Supervisors neglected to oversee the work on the primary HST mirror. Distractions overwhelmed managers to the point that they failed to identify and mitigate risk, enforce quality assurance procedures and maintain good communication within the project.
This case study goes beyond the technical factors to focus on the impact of relevant social issues, including inadequate communication and oversight, on the manufacturing, investigation and recall of the faulty GM ignition switch.
The ignition switch did not meet the mechanical specifications for torque and required less force to turn the key than its designers originally ordered. If the driver’s knee hit the key fob, the car would often turn off, causing stalling at highway speeds and disabling the airbags.
Several social issues, including structural secrecy, a lack of urgency, inadequate oversight and a company culture characterized by low accountability, contributed to the ignition switch problems.
GM’s top leaders have been proactive in handling safety-related social issues, focusing on honesty and transparency. The company reorganized and restructured its engineering operations to improve quality and safety. While GM has been working to recover financially, its appeal to block several lawsuits related to faulty ignition switches was rejected by the Supreme Court in April 2017.
GM is one of the world’s largest engineering and manufacturing enterprises. The company has 210,000 employees working in 396 facilities across 30 countries. At the management level, most senior GM executives have tens of thousands of employees reporting to them. To support its product line of over 100 vehicles, GM uses tens of thousands of parts, which are either manufactured in-house or sourced from outside companies.
In the early 2000s, GM developed what it called the Delta Vehicle Platform, which was an architecture designed to support compact cars. It was used in the Chevy Cobalt and HHR, Saturn Ion and Pontiac G5.
GM Financial Issues and Cost-Cutting Strategies
GM experienced several financial problems in the early 2000s that led the company to take action regarding its production, parts procurement and personnel. For example, GM lost an average of $729 on each vehicle sold in 2007. According to the Valukas report, the company pressured suppliers to lower costs, setting cost-cutting targets for individual parts. To help reduce its workforce, GM streamlined its U.S. engineering organization from 11 engineering centers to just one.
Cobalt Safety Concerns
The Valukas report provided additional details on the historical safety ratings of the Cobalt. Prior to the vehicle’s release, positive safety ratings (based on crash testing) were reported in 2005. By 2011, however, the Insurance Institute for Highway Safety revealed that the Cobalt’s driver death rate was higher than any other four-door vehicle in its class. According to the Valukas report, multiple witnesses characterized the Cobalt as a “cost-conscious vehicle” made on “slim margins.”
Ignition Switch Positions and Components
As part of GM’s cost-reducing strategy, Delta platform-based vehicles, including the Cobalt, were built with an ignition switch that was developed as a “corporate common” part for multiple vehicle platforms. According to the Valukas report, it was considered a new generation of switch that was “developed to be less prone to failure, less expensive and less likely to catch fire than existing ignition switches.”
The switch operates in the following positions:
Start: The driver starts the car by turning the switch from Off to Start. The engine starts, allowing the switch to automatically rotate back to Run.
Run: The switch stays in the Run position while the engine runs, which is required for driving or remaining idle.
Accessory: Placing the ignition switch in the Accessory position sends a signal to the body control module (BCM), which sends a signal to turn off the engine. This signal causes the airbag’s crash sensing system to turn off, which prevents the airbags from deploying. The signal also results in a loss of power steering and a loss of power brakes.
Off: When set to Off, the switch sends a signal to the BCM, which sends a signal to disable power to all ignition-powered systems in the vehicle, including the airbags. In some cases, the airbag system could maintain an energy reserve to deploy the bags for a short period if vehicle power is lost during a car crash.
Two components inside the switch assembly control the amount of effort needed to change the position of the switch. The plunger cap and coiled spring (Figure 3) sit in a small groove (detent). While turning the key, the driver applies torque to the key to overcome the detent and rotate the switch to the desired position.
Sensing Diagnostic Module (SDM) and Airbag System
The SDM is an onboard electric module that tracks real-time vehicle status data (e.g., acceleration, speed and impact). Initially, the SDM determines if and when the airbags should deploy. Then, if needed, it triggers deployment. SDM data inform forensic analysts about the causes of accidents and car component failures. The Valukas report noted that GM relied on the SDM supplier to obtain analyses of some SDM data, including information about the position of the ignition switch during crashes.
When the Cobalt’s ignition switch is turned to Off or Accessory, SDM power is lost and the module powers down unless or until the switch is returned to Run. This safety feature helps to minimize unintended airbag deployments when the driver is not sitting in a proper, restrained position. However, when the switch is turned to Run after being in Accessory or Off (e.g., when the driver’s knee bumps the key fob or keychain), the SDM “reboots,” turning itself Off and then On. During the reboot process, which takes a few seconds, the vehicle’s airbags will not deploy. In the event of a crash and vehicle power loss, the SDM crash sensing will continue for about 150 milliseconds after the power loss. The Valukas report concluded that if power was lost before the SDM started to sense the crash, the airbags wouldn’t deploy.
Figure 3: Ignition switch; plunger cap and spring (Source: Valukas report).
2002 — Ion production begins; ignition switch issues also begin.
2003–2004 — Customers complain to GM about no crank/no start issues during cold weather. According to the Valukas report, the large volume of starter issue complaints caused GM to focus on fixing the switch’s starting issues instead of addressing the stalling issues. The report revealed that GM engineers considered the stalling problem to be a version of the starting problem. However, the stalling issue involved a completely different problem with the switch.
- The Cobalt goes into production with the same ignition switch used in the Ion.
- GM classifies the moving stall as a nonsafety issue.
March — Various GM committees considered possible fixes for the ignition switch problem. However, they rejected them as “too costly,” since the switch issue was not deemed a safety concern. GM closes the initial safety investigation regarding the stalling issue without taking action. According to the Valukas report, this is “a direct consequence of the decision to classify the problem as one of ‘convenience’ rather than ‘safety.’”
July — The first fatality involving the stalling issue occurs when Amber Marie Rose crashes her 2005 Cobalt into a tree.
December — GM sent out a dealer notice about possible customer complaints of ignition cut-offs, instructing dealers to tell customers to remove heavy items from keychains and offering an insert for the key that would reduce the likelihood of the switch rotating unintentionally. Only customers who complained to the dealers received these instructions.
Ray DeGiorgio, the engineer who approved the ignition switch to enter production, authorized a change in the ignition switch to increase the amount of torque needed to turn the key. While GM had a policy in place to require a part number update for a significant change, DeGiorgio did not change the part number to reflect the design update. According to the Valukas report, no one at GM verified his decision to change the part.
- Litigation into fatalities from ignition switch-related accidents began.
The following outside individuals/organizations correctly diagnosed the problem with the ignition switch design flaw:
- Wisconsin Safety Patrol trooper
- Indiana University’s Transportation Research Center
- Two plaintiffs’ experts
In support of GM’s products liability defense team, a Field Performance Assessment (FPA) engineer was tasked with tracking incidents of Cobalt airbag failures in a spreadsheet.
- The engineer was given no deliverable or timeframe.
- The engineer was unaware of the prior problems with the ignition switch, including the 2005 dealer bulletin.
- The engineer eventually recognized a pattern connecting the airbags with the ignition switch.
2009 — When questioned by John Sprague, an FPA airbag engineer at GM, DeGiorgio said that “there had been no change to the switch that would have affected the power mode shutting off,” according to the Valukas report. In addition, DeGiorgio did not discuss any changes to the detent plunger “that would have affected the torque required to turn the key.”
Armed with the knowledge of the FPA engineer’s data, outside legal counsel warned GM’s in-house counsel that it could be accused of “egregious conduct” for failure to address the airbag problem.
GM’s lawyers requested that the investigation be reassigned to GM’s Product Investigations unit. It was assigned to investigator Brian Stouffer.
While Stouffer gained access to Indiana University’s report and a report from a plaintiff’s
expert, he discounted their findings, concluding that they were inaccurate.
April — GM engineers finally understood that Cobalt ignition switches had changed and realized that earlier models had the torque problem.
December — A proposed recall reached the Executive Field Action Decision Committee (EFADC), which included three GM vice presidents and its chief engineer. The chief engineer questioned the data. Since EFADC members lacked the accident fatality information, they did not act with a sense of urgency.
February — GM issued the first recall, making it the second-largest recall since 2000. The initial recall was deemed incomplete because EFADC decision-makers lacked all pertinent information needed, according to the Valukas report.
While the Wisconsin Safety Patrol trooper’s accident reconstruction report was added to GM’s files in 2007, the GM engineers responsible for investigating the switch problem did not report seeing it until 2014.
Figure 4: Chain of events leading to airbag failure during a car crash (Source: NASA Safety Center).
According to the Valukas report, the ignition switch did not meet the mechanical specifications for torque. The switch required less force to turn the key than its designers originally ordered.
The investigators concluded that if a driver hit the key fob or keychain with his or her knee, the car would often turn off, causing stalling at highway speeds and disabling the vehicle’s airbags.
In addition to the technical problem with the ignition switch, the Valukas report identified the following social issues:
On two occasions, DeGiorgio’s actions were obscured by significant communication problems. First, he approved the ignition switch to enter production even though it fell well below GM’s specifications for torque. GM had no organizational arrangement in place to question or validate DeGiorgio’s decision. Second, DeGiorgio signed off on a redesigned switch without documenting it or changing the switch’s part number. Because he told his colleagues that there was no change, this created confusion throughout much of the investigation. The Valukas report revealed that this concealed information delayed investigators for years from learning what had actually taken place. Once again, no organizational check was in place to verify DeGiorgio’s actions or inactions.
The bottom line is that a significant communication breakdown allowed the core technical issue involving the ignition switch and airbags to be concealed from anyone with technical oversight until 2013. Poor communication was responsible for partially blocking the flow of information throughout GM, affecting management’s interpretation of the information.
Lack of Understanding of the Problem
For many years, GM personnel did not fully understand the primary safety issue related to the ignition switch. GM engineers on committees did not associate turning the key to Accessory or Off with disabling the airbags.
Further, the individuals involved in the initial investigation did not know the appropriate questions to ask to understand the technical problem. The information that was available regarding complaints, negative reviews and fatalities was not readily shared with all levels of the company, as shown in the following examples from the Valukas report:
- GM employees, customers and members of the automotive press voiced complaints early on. GM personnel even called the Cobalt switch the “switch from hell” to reflect its significant problems. Customer complaints were documented in GM electronic forms.
- Outside organizations discovered the core problem with the ignition switch and airbags years before GM did.
Lack of Urgency
The Valukas report revealed a lack of urgency at many stages of the evolution and investigation of the ignition switch problem. For example, GM engineers initially thought that consumers could safely maneuver their vehicles after they stalled. Because of this, GM personnel classified the problem as a customer convenience issue rather than a safety issue. GM failed to reclassify the ignition switch problem as a safety issue from 2004 to 2006.
In addition, the GM Recall Committee lacked a sense of urgency during the recall process. For example, in December 2013, the committee held a discussion to decide on the recall that included the Cobalt. According to the Valukas report, they delayed making the final decision for six additional weeks to gather more information on the switch. Importantly, they were not made aware of the fatalities associated with the ignition switch. This knowledge might have elevated their sense of urgency during the investigation and recall.
Lack of Oversight
According to the Valukas report, GM had no oversight system in place to ensure that decisions regarding the approval of the switch for production and redesign were documented and evaluated by other GM personnel.
At the board level, GM didn’t have a single committee organized to address vehicle safety issues. While the board received a wide variety of reports, most of them were in aggregate form. Only in rare circumstances did these reports highlight individual safety issues or recalls. The board was not informed of the ignition switch safety issue until February 2014.
Throughout the time period of the ignition switch safety issues, the technical problems were not raised to management-level decision-makers at GM. They were only shared with engineers, investigators and lawyers, according to the Valukas report. For example, senior leaders, including the CEO, executive VP/Global Product Development/Purchasing/Supply Chain and general counsel, didn’t learn about the ignition switch safety issue (or the delay in addressing it) until the EFADC decided to issue the recall on Jan. 31, 2014. (The Valukas report revealed that the EFADC may have learned about the issue in December 2013 at the earliest.)
When questioned about safety, GM employees reported conflicting messages, as described in the Valukas report. For example, some employees said that “when safety is at issue, cost is irrelevant.” Others said that “cost is everything.” The extraordinary cost-cutting measures that took place in the 2000s reflected the budget-conscious climate at the company.
The Valukas report also indicated that employees may have been resistant to raise issues with management. For example, the National Highway Traffic Safety Administration (NHTSA) reviewed GM’s safety processes in May 2014. During this review, the organization found a 2008 presentation that encouraged GM employees to be factual but “not fantastic” in writing about safety issues. Employees were discouraged from using words such as “problem,” “safety” or “defect” in these safety-related communications.
Some comments by GM employees revealed an overall lack of accountability that contributed to the company’s slow response to safety issues. For example, the “GM salute” involved crossing the arms and pointing toward other people, indicating a shifting of personal responsibility. Also, the “GM nod” was an empty gesture used to signify that the employees agreed on a plan of action but had no intentions of following through on the plan.
Since becoming the CEO of GM in January 2014, Mary Barra has been proactive in handling safety-related social issues at GM, focusing on honesty and transparency. She told GM employees, “I never want to put this behind us. I want to put this painful experience permanently in our collective memories.” In terms of the company’s response following the investigations, she believes that it “has been unprecedented in terms of candor, cooperation, transparency and compassion.”
Under Barra’s guidance, the company has reorganized and restructured its engineering operations to improve quality and safety. For example, GM’s engineering operations changed in the following ways:
- Advanced analysis tools and processes were put in place to catch and prevent issues during vehicle development.
- Weekly safety meetings were established for those responsible for vehicle safety.
- A group of executives provides monthly safety reports to GM’s board.
GM also has restructured its safety organization by appointing Jeff Boyer as the new global vehicle safety chief. This new safety leader reports to Ken Morris, the new vice president of the global product integrity business.
GM has been working to recover financially as litigation from the switch-related accidents continues. In April 2017, the Supreme Court rejected GM’s appeal to block several lawsuits related to faulty ignition switches. In spite of GM’s 2009 bankruptcy filing, the Supreme Court determined that GM is still financially responsible for ignition switch-related injuries and deaths that occurred prior to the filing.
Applying Lessons Learned to Current and Future NASA Missions
Unintended barriers to effective communication have contributed to several major NASA mishaps, including the following:
Apollo 1: The acceptance of “quality escapes” (nonconformance to specifications) and a lack of use of Systems Engineering and Integration (SE&I) principles prevented effective hazard communication. The organizational structure had no formal integrative roles and responsibilities that could have identified the hazards of 100 percent O2 testing at sea level pressure or daily wear and tear to electrical wiring in the spacecraft.
HST: The test equipment for mirror surface finish was rigged by a technician to provide a desired result, hiding the actual flaws from discovery until the telescope was in orbit.
Challenger: A “prove it’s unsafe” organizational climate stifled a hazard discussion about cold prelaunch conditions on the pad on the night before the launch. Unknown to other NASA decision-makers, this discussion involved 34 people in three locations and occurred for several hours.
Columbia: NASA personnel failed to coordinate a complete prelaunch countdown test with spacecraft-confined space entry by technicians, resulting in three deaths. The organizational structure prior to STS-1 drove those in charge of the countdown exercise and ongoing industrial work to focus on the exercise and lose track of how changing the schedule would affect the workers. During STS-107, a post-launch discussion involving isolated groups of engineers and managers stifled a recommendation to obtain on-orbit imagery that could identify potential orbiter damage.
Lack of effective communication has been found by investigators to contribute to other well-known mishaps, including the following:
SpaceShipTwo: The hazards of unlocking the vehicle’s pivoting booms in the transonic region were not communicated to the crew in relation to changing flight test requirements.
Three Mile Island (TMI): A close-call shutdown at a plant in Toledo, Ohio, over 18 months earlier generated a key recommendation for plant operators to follow. However, the TMI reactor design and construction company did not decide to act upon this recommendation until after the TMI accident occurred.
Conditions exist today where the potential for unintentional barriers to communication to block the timely exchange of safety-critical information is very real. Consider the following examples:
- Competing providers of commercial launch services are given federal regulatory and contractual latitude to substitute corporate efficiencies in place of formal SE&I principles. Yet, NASA looks for evidence of engineering discipline and control via requirements verification and the examination of deliverable documents.
- NASA Space Launch System, Orion and Ground Systems Development and Operations milestones and schedules are complex and spread out geographically and chronologically in such a way that successful integration requires the unprecedented use of tools and constancy of purpose over decades. Even if the organization is configured to effectively communicate in real time, decisions and systems knowledge that exist now may not transfer effectively—or at all—to new deciders and actors in the future.
- The incremental budgeting of facilities and projects can limit planning and the communication about planning to near-term activities that are capable of fiscal control. As a result, communication about long-term strategies can be limited or even ignored because the strategies are considered unrealistic or premature.
To ensure effective risk communication, the following questions must be answered: How much do risk owners need to know? And when do they need to know it? Unless those possessing the capability, responsibility and accountability to mitigate risks to acceptable levels set the stage for timely, effective communication vertically and horizontally within their organizations, barriers to effective communication can proliferate and obscure safety-critical data or information until it’s too late. To set the stage, it’s not enough to encourage employees to speak up with dissenting opinions. Exercising a formal dissent process in the open will help generate trust and confidence across peer groups and throughout the management chain.
Questions for Discussion
- Are there any projects or processes within your organization where only one person is in charge of testing and approving a final component/design?
- Are you encouraged to notify upper management about potential safety issues? If not, are there other channels for you to use to report safety concerns?
- In general, how quickly are potential safety issues handled within your organization? How are safety issues prioritized?
- When safety is at stake, how important is cost?
- Blau, Max: No Accident: Inside GM’s Deadly Ignition Switch Scandal. Atlanta. Jan. 2016.
- Vlasic, Bill: GM Settles Switch Suit, Avoiding Depositions. NY Times. March 13, 2015.
- Valukas, Anton: Report to Board of Directors of General Motors Company Regarding Ignition Switch Recalls. Jenner & Block. May 29, 2014. (redacted).
- Boudette, Neal: Supreme Court Rebuffs GM’s Bid to Limit Ignition-Switch Lawsuits. New York Times. April 24, 2017.
- Muller, Joan: Supreme Court Allows Ignition-Switch Lawsuits To Proceed Against GM In Pre-Bankruptcy Crashes. Forbes. April 24, 2017.
- Consumer Safety.org: GM Ignition Switches. https://www.consumersafety.org/products/gm-ignition-switches/ Accessed July 17, 2017.
- Klayman, Ben: GM Restructures Engineering to Improve Vehicle Quality, Safety. Fox Business. April 22, 2014.
- Basu, Tanya: Timeline: A History of GM’s Ignition Switch Defect. NPR. March 31, 2014.
- Ecclestone, Chris: NHTSA Chief Rosekind Pleased with GM’s Safety Process Improvements. GM Authority. May 24, 2015.
- Colvin, Geoff: How CEO Mary Barra Is Using the Ignition-Switch Scandal to Change GM’s Culture. Fortune. Sept. 18, 2015.
- Associated Press: Supreme Court Rejects Appeal from GM on Faulty Ignition Switches. Los Angeles Times. April 24, 2017.
Responsible NASA Official: Steve Lilley
This is an internal NASA safety awareness training document based on information available in the public domain. The findings, proximate causes and contributing factors identified in this case study do not necessarily represent those of the Agency. Sections of this case study were derived from multiple sources listed under References. Any misrepresentation or improper use of source material is unintentional.