How Rodney Rocha Thinks About Uncertainty Before Safety Can Be Proven

F8 episode companion for EHS managers, safety leaders, and operations executives

Episode 7 of Headline Podcast, published on October 9, 2025, featured Rodney Rocha, a retired NASA chief engineer who served on the Columbia debris assessment team.

Rodney Rocha's central argument changes the safety question because leaders should not demand proof that a condition is unsafe before they act when the available information is incomplete.

Uncertainty is a risk signal, not a reason to wait

Uncertainty becomes a safety signal when the organization cannot explain what it knows, what it does not know, and which decision protects people while the gap remains open.

Many operational decisions begin with a quiet shift in the burden of proof. Instead of asking whether the available evidence is strong enough to continue, the team is asked to prove that the task is unsafe. That sounds cautious, but it can make action impossible when the evidence is partial, technical, or still being gathered.

Rodney Rocha described this pattern through the Columbia conversation. The lesson is not limited to aerospace. A maintenance team that sees an unfamiliar crack, an abnormal vibration, or a changed isolation condition faces the same leadership problem. The absence of certainty does not mean the absence of exposure.

A director can make the uncertainty visible by asking three questions before approving continuation. What evidence supports the current decision? Which assumption carries the greatest consequence if it is wrong? What temporary protection will remain in place until the assumption is tested?

The burden of proof can move risk upward

When workers must prove that a task is unsafe before leaders will pause it, the organization transfers the cost of uncertainty to the people closest to the hazard.

That transfer is easy to miss because the formal decision still appears reasonable. The supervisor has a permit, the engineering note has been circulated, and the work has a production purpose. Yet the person who sees the weak signal may have only five minutes, two photographs, and a memory of what the equipment looked like yesterday.

Rodney Rocha said on Headline Podcast, “Our profession's culture is to show it's safe enough to operate.” The short quotation captures a powerful default. A team can begin treating safe enough as a conclusion rather than as a claim that must remain open to challenge.

For an EHS manager, the practical response is to define a stop threshold before the work starts. The threshold can be a missing inspection record, a control that cannot be independently verified, or a condition that differs from the approved plan. The exact trigger depends on the task, but the rule should be known before production pressure arrives.

Reasonable assumptions still need owners

A reasonable assumption is not a verified control, and every assumption that affects a high-consequence decision needs an owner, a test, and a time limit.

Teams make assumptions because work cannot pause for perfect knowledge. They assume a sensor is reading correctly, a seal has not degraded, a contractor understood the change, or a previous inspection still represents the current condition. Most assumptions are ordinary. The danger begins when nobody records which assumptions matter most.

Use a three-column review for each uncertain decision. Write the assumption, the consequence if it is wrong, and the evidence that would change the decision. This small record is more useful than a long narrative because it tells the next reviewer exactly where to look.

The owner should be a person with authority to obtain evidence or stop the work, not a generic department. If the assumption remains untested after 24 hours, the owner should escalate it. If it remains open after seven days, the responsible director should decide whether the exposure is accepted, controlled, or removed.

Warnings lose force as they travel

A warning becomes weaker when each handoff removes context, softens the language, or turns a specific concern into a general request for reassurance.

Technical concerns rarely arrive at senior leadership in their original form. The operator describes an unusual condition, the supervisor summarizes it, engineering translates it into a calculation, and the manager turns the result into a decision memo. Each step can improve understanding, yet each can also reduce urgency.

Rodney Rocha said on Headline Podcast, “Tell the truth, and empower others to tell the truth too.” That is a leadership instruction with an operational test. Does the system preserve the original observation, the uncertainty attached to it, and the name of the person who can challenge the conclusion?

A useful review asks the sender to retain four elements. Keep the original observation, the strongest interpretation, the weakest interpretation, and the action that protects people under the weakest interpretation. The fourth element prevents the discussion from becoming a contest over who sounds most confident.

Confidence is not the same as evidence

A confident technical answer can still be fragile when it depends on one model, one inspection, or one interpretation of an incomplete record.

Leaders often reward certainty because certainty makes meetings move. The problem is that a polished explanation can hide the boundary between measured evidence and professional judgment. When those two are mixed together, later reviewers cannot tell whether a failed decision came from bad data, an invalid assumption, or an acceptable risk choice that was never documented.

Separate the decision record into three layers. The first layer contains facts that were observed or measured. The second contains assumptions that connect those facts to a conclusion. The third contains the decision and the protection that follows. This structure can fit on one page and still preserve the reasoning that a future investigation will need.

Ask two people to read the record independently, then compare their understanding. If one reader believes the task is approved and the other believes it is conditional, the document has already exposed a control weakness. The disagreement is useful because it arrives before the work creates a consequence.

Before and after the burden-of-proof shift

A safer decision system does not require perfect evidence; it requires a clear response to uncertainty before the work reaches the point of no return.

The difference is not a preference for caution over production. It is a choice about who carries the consequence when knowledge is incomplete. In the first model, the person with the least authority carries it. In the second, the person with decision authority must make the uncertainty visible and provide a defensible temporary barrier.

What safety leaders can change this week

Leaders can improve decisions about uncertainty by changing the questions, records, and escalation timing that surround ordinary work.

Start with one high-consequence task scheduled in the next 30 days. Ask the supervisor to identify three assumptions before the pre-job review. Ask engineering to name the evidence that would invalidate each assumption. Ask the operations manager to define the person who can stop the work without seeking permission from the same chain that approved it.

Then run a short test with six recent concerns. For each one, record when the concern was first raised, who received it, how long the response took, whether the work changed, and whether the person who raised it could see the reasoning. A response time below 24 hours is not automatically good, but the comparison will show whether concerns disappear in the handoff.

After 30 days, review the patterns with the site director. Look for repeated assumptions, recurring missing evidence, and decisions that depend on one individual being confident. The goal is not to create a new scorecard. The goal is to identify where the organization asks people to carry uncertainty without giving them authority or protection.

Recommendation

Treat uncertainty as an owned operating condition, not as a temporary inconvenience that workers must overcome before leaders will act.

For the next seven days, select one decision involving incomplete information and write down its facts, assumptions, consequence, owner, temporary control, and review date. Give the person closest to the work a direct route to challenge the conclusion. If the evidence changes, change the decision without framing the challenge as failure.

Rodney Rocha's contribution to the Headline conversation is a disciplined way to think about silence. The most dangerous warning is not always the one that is ignored. Sometimes it is the one that is repeatedly softened until the organization can no longer recognize the decision it is making.

Safety leaders who want to explore this argument further can listen to Episode 7 with Rodney Rocha, review more Headline Podcast safety conversations, and connect the episode's questions with Andreza Araujo's broader work on safety leadership and risk decisions.